openmeld 0.3.222 → 0.3.224

package/dist/auth-session-uEk_Tx6T.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-session-uEk_Tx6T.js","names":["delay","toErrorMessage","toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/computer-connection-progress.js","../../../packages/schemas/dist/schemas/start/device-projection.js","../../../packages/schemas/dist/schemas/prepare/session.js","../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/config/auth-session-expiry.ts","../src/config/auth-session-transition-lock.ts","../src/config/service-account-admission.ts","../src/config/development-credential-store.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import * as z$1 from \"zod/v4\";\n//#region src/computer-connection-progress.ts\nconst computerConnectionProgressPhaseSchema = z$1.enum([\n\t\"checking\",\n\t\"downloading\",\n\t\"verifying\",\n\t\"installing\",\n\t\"waiting_for_confirmation\",\n\t\"switching_account\",\n\t\"finishing_previous_connection\",\n\t\"waiting_for_current_work\",\n\t\"connecting_service\",\n\t\"confirming\",\n\t\"connected\",\n\t\"restoring\",\n\t\"needs_attention\"\n]);\nconst computerConnectionProgressMeasurementSchema = z$1.strictObject({\n\tunit: z$1.literal(\"bytes\"),\n\tvalue: z$1.number().int().nonnegative(),\n\ttotal: z$1.number().int().positive(),\n\ttransferAttempt: z$1.number().int().positive()\n});\nconst computerConnectionProgressObservationSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(1),\n\toperationId: z$1.string().min(1).max(128),\n\tattemptId: z$1.string().min(1).max(128),\n\tprepareSessionId: z$1.string().min(1).max(256).nullable(),\n\tsequence: z$1.number().int().nonnegative(),\n\tstartedAt: z$1.string().datetime(),\n\tobservedAt: z$1.string().datetime(),\n\tphase: computerConnectionProgressPhaseSchema,\n\tstate: z$1.enum([\n\t\t\"active\",\n\t\t\"completed\",\n\t\t\"failed\"\n\t]),\n\tcode: z$1.string().min(1).max(256),\n\tmeasurement: computerConnectionProgressMeasurementSchema.optional(),\n\tdetail: z$1.string().min(1).max(512).optional()\n});\n//#endregion\nexport { computerConnectionProgressMeasurementSchema, computerConnectionProgressObservationSchema, computerConnectionProgressPhaseSchema };\n\n//# sourceMappingURL=computer-connection-progress.js.map","import { localAgentCatalogSchema, localAgentCatalogSelectableReasonSchema } from \"../runtime/local-agent-catalog.js\";\nimport { daemonServiceLaneSchema } from \"../daemon/service-contract.js\";\nimport { START_BOUNDED_ID_SCHEMA, START_BOUNDED_VERSION_SCHEMA, START_ISO_DATE_TIME_SCHEMA, startReplyReadinessSummarySchema } from \"./shared.js\";\nimport * as z$1 from \"zod/v4\";\n//#region src/schemas/start/device-projection.ts\nconst startBackgroundHelperInstallStatusSchema = z$1.enum([\n\t\"not_installed\",\n\t\"installed_current\",\n\t\"installed_outdated\",\n\t\"unknown\"\n]);\nconst startBackgroundHelperRuntimeStatusSchema = z$1.enum([\n\t\"running\",\n\t\"stale\",\n\t\"not_running\",\n\t\"unknown\"\n]);\nconst startBackgroundHelperExecutionCompatibilityStatusSchema = z$1.enum([\"compatible\", \"update_required\"]);\nconst startBackgroundHelperExecutionCompatibilityReasonCodeSchema = z$1.enum([\n\t\"daemon.runtime_contract.compatible\",\n\t\"daemon.runtime_contract.missing\",\n\t\"daemon.runtime_contract.mismatch\",\n\t\"daemon.runtime_contract.unavailable\",\n\t\"daemon.runtime_contract.not_observed\"\n]);\nconst startBackgroundHelperExecutionCompatibilitySchema = z$1.strictObject({\n\tstatus: startBackgroundHelperExecutionCompatibilityStatusSchema,\n\treasonCode: startBackgroundHelperExecutionCompatibilityReasonCodeSchema,\n\texpectedEpoch: START_BOUNDED_ID_SCHEMA,\n\tobservedEpoch: z$1.union([START_BOUNDED_ID_SCHEMA, z$1.null()]),\n\tupdatedAt: z$1.union([START_ISO_DATE_TIME_SCHEMA, z$1.null()])\n});\nconst startSkillsReadinessStatusSchema = z$1.enum([\n\t\"up_to_date\",\n\t\"action_required\",\n\t\"no_targets\",\n\t\"unknown\"\n]);\nconst startDeviceAgentSelectableReasonSchema = localAgentCatalogSelectableReasonSchema;\nconst startBackgroundHelperProjectionSchema = z$1.strictObject({\n\tinstallStatus: startBackgroundHelperInstallStatusSchema,\n\truntimeStatus: startBackgroundHelperRuntimeStatusSchema,\n\tinstalledVersion: z$1.union([START_BOUNDED_VERSION_SCHEMA, z$1.null()]),\n\texpectedVersion: START_BOUNDED_VERSION_SCHEMA,\n\texecutionCompatibility: startBackgroundHelperExecutionCompatibilitySchema.optional()\n});\nconst startSkillsReadinessSummarySchema = z$1.strictObject({\n\tupToDate: z$1.number().int().min(0),\n\toutdated: z$1.number().int().min(0),\n\tmissing: z$1.number().int().min(0),\n\texternalConflict: z$1.number().int().min(0)\n});\nconst startSkillsReadinessProjectionSchema = z$1.strictObject({\n\tstatus: startSkillsReadinessStatusSchema,\n\ttargetCount: z$1.number().int().min(0),\n\tsummary: startSkillsReadinessSummarySchema\n}).superRefine((value, ctx) => {\n\tif (value.summary.upToDate + value.summary.outdated + value.summary.missing + value.summary.externalConflict !== value.targetCount) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"skills readiness summary counts must add up to targetCount\",\n\t\tpath: [\"summary\"]\n\t});\n});\nconst startDeviceAgentCatalogSchema = localAgentCatalogSchema;\nconst startDeviceProjectionSchema = z$1.strictObject({\n\tdeviceId: START_BOUNDED_ID_SCHEMA,\n\truntimeLane: daemonServiceLaneSchema,\n\tobservedAt: START_ISO_DATE_TIME_SCHEMA,\n\tbackgroundHelper: startBackgroundHelperProjectionSchema,\n\tskillsReadiness: startSkillsReadinessProjectionSchema,\n\tdeviceAgentCatalog: startDeviceAgentCatalogSchema,\n\tdeviceReplyReadiness: startReplyReadinessSummarySchema\n});\n//#endregion\nexport { startBackgroundHelperExecutionCompatibilityReasonCodeSchema, startBackgroundHelperExecutionCompatibilitySchema, startBackgroundHelperExecutionCompatibilityStatusSchema, startBackgroundHelperInstallStatusSchema, startBackgroundHelperProjectionSchema, startBackgroundHelperRuntimeStatusSchema, startDeviceAgentCatalogSchema, startDeviceAgentSelectableReasonSchema, startDeviceProjectionSchema, startSkillsReadinessProjectionSchema, startSkillsReadinessStatusSchema, startSkillsReadinessSummarySchema };\n\n//# sourceMappingURL=device-projection.js.map","import { computerConnectionProgressObservationSchema } from \"../../computer-connection-progress.js\";\nimport { array, boolean, discriminatedUnion, enum as enumFactory, int, iso, literal, null as nullFactory, object, record, strictObject, string, union, unknown } from \"../../lazy-zod.js\";\nimport { openMeldProfileIdSchema } from \"../daemon/profile-identity.js\";\nimport { authProfileKindSchema, authProfileManagedRoleSchema } from \"../http/profiles.js\";\nimport { localAgentCatalogSchema } from \"../runtime/local-agent-catalog.js\";\nimport { startBackgroundHelperProjectionSchema, startSkillsReadinessProjectionSchema } from \"../start/device-projection.js\";\n//#region src/schemas/prepare/session.ts\nconst PREPARE_BOUNDED_ID_SCHEMA = string().trim().min(1).max(256);\nconst prepareSessionContinuationSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\tlocalAgentSelection: discriminatedUnion(\"mode\", [\n\t\tstrictObject({ mode: literal(\"all\") }),\n\t\tstrictObject({ mode: literal(\"none\") }),\n\t\tstrictObject({\n\t\t\tmode: literal(\"specific\"),\n\t\t\tlocalAgentIds: array(PREPARE_BOUNDED_ID_SCHEMA).max(64)\n\t\t})\n\t]).optional()\n});\nconst PREPARE_REASON_CODE_SCHEMA = string().trim().min(1).max(256);\nconst PREPARE_USER_MESSAGE_SCHEMA = string().trim().min(1).max(512);\nconst PREPARE_LONG_TEXT_SCHEMA = string().trim().min(1).max(4096);\nconst PREPARE_STEP_DIAGNOSTICS_MAX_CHARS = 16384;\nconst PREPARE_STEP_DIAGNOSTICS_SCHEMA = string().trim().min(1).max(PREPARE_STEP_DIAGNOSTICS_MAX_CHARS);\nconst PREPARE_ISO_DATE_TIME_SCHEMA = iso.datetime({ offset: true }).max(64);\nconst PREPARE_NULLABLE_DATE_TIME_SCHEMA = union([PREPARE_ISO_DATE_TIME_SCHEMA, nullFactory()]);\nconst PREPARE_STEP_DIAGNOSTICS_SHORT_TEXT_SCHEMA = string().trim().min(1).max(256);\nconst PREPARE_STEP_DIAGNOSTICS_LOG_LINE_MAX_CHARS = 321;\nconst PREPARE_STEP_DIAGNOSTICS_LIFECYCLE_ENTRY_MAX_CHARS = 700;\nconst PREPARE_STEP_DIAGNOSTICS_COLLECTION_ERROR_MAX_CHARS = 64;\nconst PREPARE_STEP_DIAGNOSTICS_CLI_VERSION_MAX_CHARS = 64;\nconst PREPARE_STEP_DIAGNOSTICS_OS_PLATFORM_MAX_CHARS = 64;\nconst PREPARE_STEP_DIAGNOSTICS_OS_RELEASE_MAX_CHARS = 128;\nconst PREPARE_STEP_DIAGNOSTICS_SERVICE_JOB_TEXT_MAX_CHARS = 128;\nconst prepareStepDiagnosticsServiceJobSchema = object({\n\tcontroller: enumFactory([\n\t\t\"launchd\",\n\t\t\"systemd\",\n\t\t\"windows-service\",\n\t\t\"legacy-detached\",\n\t\t\"unknown\"\n\t]),\n\tloaded: boolean(),\n\truns: union([int().nonnegative(), nullFactory()]),\n\tstate: union([string().trim().max(PREPARE_STEP_DIAGNOSTICS_SERVICE_JOB_TEXT_MAX_CHARS), nullFactory()]),\n\tlastExitCodeText: union([string().trim().max(PREPARE_STEP_DIAGNOSTICS_SERVICE_JOB_TEXT_MAX_CHARS), nullFactory()]),\n\tlastExitCode: union([int(), nullFactory()]),\n\tpendedNondemandSpawn: union([string().trim().max(PREPARE_STEP_DIAGNOSTICS_SERVICE_JOB_TEXT_MAX_CHARS), nullFactory()]),\n\tkeepaliveRunAtLoad: boolean()\n});\nconst prepareStepDiagnosticsLifecycleEventTypeSchema = enumFactory([\n\t\"connection.state\",\n\t\"daemon.crash\",\n\t\"lifecycle.command.begin\",\n\t\"lifecycle.command.end\",\n\t\"owner.snapshot\",\n\t\"route_catalog.initial_load\",\n\t\"runtime_state.takeover\",\n\t\"stop.controlled_drain\",\n\t\"stop.strategy.selected\",\n\t\"stop.signal.observed\",\n\t\"service_manager.action\",\n\t\"service_manager.registration_reconcile\",\n\t\"process_stop.action\",\n\t\"service_contract.write\"\n]);\nconst prepareStepDiagnosticsLifecycleJournalEntrySchema = object({\n\tschema: literal(\"openmeld-daemon-lifecycle-event-v1\"),\n\tv: literal(1),\n\ttype: prepareStepDiagnosticsLifecycleEventTypeSchema,\n\ttimestamp: PREPARE_ISO_DATE_TIME_SCHEMA,\n\tlane: string().trim().min(1).max(64),\n\tintent: string().trim().min(1).max(64),\n\tcommand: string().trim().min(1).max(256),\n\tpid: int().nonnegative(),\n\tsessionId: union([PREPARE_STEP_DIAGNOSTICS_SHORT_TEXT_SCHEMA, nullFactory()]),\n\tresult: string().trim().min(1).max(64),\n\tmetadata: record(string().trim().min(1).max(64), unknown()).optional()\n}).superRefine((value, ctx) => {\n\tif (JSON.stringify(value).length > PREPARE_STEP_DIAGNOSTICS_LIFECYCLE_ENTRY_MAX_CHARS) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"lifecycle journal entry exceeds diagnostics size budget\"\n\t});\n});\nconst prepareStepDiagnosticsBundleSchema = object({\n\tbundleVersion: int().positive(),\n\tcollectedAt: PREPARE_ISO_DATE_TIME_SCHEMA,\n\tsupportCode: PREPARE_STEP_DIAGNOSTICS_SHORT_TEXT_SCHEMA,\n\tnativeFailure: object({ osStatus: int() }).optional(),\n\toperationFailure: object({\n\t\tcode: string().regex(/^E[A-Z]+$/u).max(32),\n\t\terrno: int().optional(),\n\t\tsyscall: string().regex(/^[a-z]+$/u).max(32).optional(),\n\t\tpathCategory: enumFactory([\n\t\t\t\"app_bundle\",\n\t\t\t\"absolute_other\",\n\t\t\t\"relative\",\n\t\t\t\"unknown\"\n\t\t]),\n\t\tdestinationCategory: enumFactory([\n\t\t\t\"app_bundle\",\n\t\t\t\"absolute_other\",\n\t\t\t\"relative\",\n\t\t\t\"unknown\"\n\t\t]).optional()\n\t}).optional(),\n\tevidenceWindow: object({\n\t\tstartedAt: PREPARE_ISO_DATE_TIME_SCHEMA,\n\t\tendedAt: PREPARE_ISO_DATE_TIME_SCHEMA\n\t}).optional(),\n\tserviceLogWindow: object({\n\t\texcludedUndatedLines: int().nonnegative(),\n\t\texcludedOutsideWindowLines: int().nonnegative(),\n\t\tsourceTruncated: boolean()\n\t}).optional(),\n\tstepId: PREPARE_STEP_DIAGNOSTICS_SHORT_TEXT_SCHEMA,\n\tdeviceId: PREPARE_STEP_DIAGNOSTICS_SHORT_TEXT_SCHEMA.optional(),\n\tcliVersion: string().trim().min(1).max(PREPARE_STEP_DIAGNOSTICS_CLI_VERSION_MAX_CHARS),\n\tos: object({\n\t\tproductVersion: string().regex(/^[0-9]+(?:\\.[0-9]+){1,3}$/u).max(64).optional(),\n\t\tbuildVersion: string().regex(/^[A-Za-z0-9.]+$/u).max(64).optional(),\n\t\tplatform: string().trim().min(1).max(PREPARE_STEP_DIAGNOSTICS_OS_PLATFORM_MAX_CHARS),\n\t\trelease: string().trim().max(PREPARE_STEP_DIAGNOSTICS_OS_RELEASE_MAX_CHARS)\n\t}),\n\tinventoryAnomalies: union([array(PREPARE_STEP_DIAGNOSTICS_SHORT_TEXT_SCHEMA).max(32), nullFactory()]),\n\tserviceJob: union([prepareStepDiagnosticsServiceJobSchema, nullFactory()]),\n\tlifecycleJournalTail: union([array(prepareStepDiagnosticsLifecycleJournalEntrySchema).max(10), nullFactory()]),\n\tserviceLogTail: union([array(string().trim().max(PREPARE_STEP_DIAGNOSTICS_LOG_LINE_MAX_CHARS)).max(30), nullFactory()]),\n\tserviceLogNote: enumFactory([\"file_missing\", \"file_empty\"]).optional(),\n\tcollectionErrors: array(string().trim().min(1).max(PREPARE_STEP_DIAGNOSTICS_COLLECTION_ERROR_MAX_CHARS)).max(8),\n\ttruncated: boolean()\n});\nconst PREPARE_STEP_DIAGNOSTICS_REDACTION_REPLACEMENTS = [\n\t[/\\b(authorization\\s*:\\s*(?:bearer|basic)\\s+)[^\\s,;]+/gi, \"$1[redacted]\"],\n\t[/\\b(x-openmeld-prepare-token\\s*[:=]\\s*[\"']?)[^\"',;\\s]+/gi, \"$1[redacted]\"],\n\t[/\\b((?:set-cookie|cookie)\\s*:\\s*)[^\\r\\n]+/gi, \"$1[redacted]\"],\n\t[/\\bopenMeldDaemon_[A-Za-z0-9._~:/+=-]+/g, \"[redacted]\"],\n\t[/\\b[A-Fa-f0-9]{40,}\\b/g, \"[redacted]\"],\n\t[/\\b[A-Za-z0-9+/]{40,}={0,2}/g, \"[redacted]\"]\n];\nfunction redactPrepareStepDiagnosticsText(value) {\n\tlet redacted = value;\n\tfor (const [pattern, replacement] of PREPARE_STEP_DIAGNOSTICS_REDACTION_REPLACEMENTS) redacted = redacted.replace(pattern, replacement);\n\treturn redacted;\n}\nfunction redactPrepareStepDiagnosticsValue(value) {\n\tif (typeof value === \"string\") return redactPrepareStepDiagnosticsText(value);\n\tif (Array.isArray(value)) return value.map((entry) => redactPrepareStepDiagnosticsValue(entry));\n\tif (value && typeof value === \"object\") return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, redactPrepareStepDiagnosticsValue(entry)]));\n\treturn value;\n}\nfunction redactPrepareStepDiagnosticsBundle(bundle) {\n\treturn redactPrepareStepDiagnosticsValue(bundle);\n}\nconst PREPARE_URL_SCHEMA = string().trim().min(1).max(2048).refine((value) => {\n\ttry {\n\t\tnew URL(value);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}, { message: \"expected a valid URL\" });\nconst PREPARE_SESSION_STREAM_PROTOCOL_VERSION = 1;\nconst prepareOpaqueTokenSchema = string().trim().min(1).max(2048);\nconst prepareSessionLifecycleStatusSchema = enumFactory([\n\t\"active\",\n\t\"completed\",\n\t\"failed\",\n\t\"cancelled\",\n\t\"expired\"\n]);\nconst prepareSessionPhaseSchema = enumFactory([\n\t\"waiting_for_terminal\",\n\t\"terminal_connected\",\n\t\"checking_computer\",\n\t\"waiting_for_agent_selection\",\n\t\"preparing_local_agents\",\n\t\"starting_service\",\n\t\"reporting_runtime\",\n\t\"verifying_readiness\",\n\t\"ready\",\n\t\"blocked\",\n\t\"terminal_disconnected\",\n\t\"failed\",\n\t\"expired\"\n]);\nconst prepareStepIdSchema = enumFactory([\n\t\"computer\",\n\t\"connect_terminal\",\n\t\"choose_local_agents\",\n\t\"prepare_selected_agents\",\n\t\"refresh_service\",\n\t\"report_runtime\",\n\t\"verify_setup\",\n\t\"ready\"\n]);\nconst prepareStepStateSchema = enumFactory([\n\t\"pending\",\n\t\"active\",\n\t\"waiting_for_user\",\n\t\"complete\",\n\t\"blocked\",\n\t\"terminal_disconnected\"\n]);\nconst prepareStepSchema = strictObject({\n\tid: prepareStepIdSchema,\n\tstate: prepareStepStateSchema,\n\ttitle: PREPARE_USER_MESSAGE_SCHEMA,\n\tsummary: union([PREPARE_USER_MESSAGE_SCHEMA, nullFactory()]),\n\tblockerReasonCode: union([PREPARE_REASON_CODE_SCHEMA, nullFactory()]),\n\tstartedAt: PREPARE_NULLABLE_DATE_TIME_SCHEMA,\n\tcompletedAt: PREPARE_NULLABLE_DATE_TIME_SCHEMA,\n\tupdatedAt: PREPARE_ISO_DATE_TIME_SCHEMA\n}).superRefine((value, ctx) => {\n\tif (value.state === \"blocked\" && value.blockerReasonCode === null) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"blocked prepare steps must include blockerReasonCode\",\n\t\tpath: [\"blockerReasonCode\"]\n\t});\n\tif (value.state !== \"blocked\" && value.blockerReasonCode !== null) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"non-blocked prepare steps must use a null blockerReasonCode\",\n\t\tpath: [\"blockerReasonCode\"]\n\t});\n\tif (value.state === \"complete\" && value.completedAt === null) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"complete prepare steps must include completedAt\",\n\t\tpath: [\"completedAt\"]\n\t});\n});\nconst prepareTerminalConnectionStatusSchema = enumFactory([\n\t\"never_connected\",\n\t\"connected\",\n\t\"disconnected\",\n\t\"replaced\"\n]);\nconst prepareTerminalConnectionSchema = strictObject({\n\tstatus: prepareTerminalConnectionStatusSchema,\n\tconnectionId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]),\n\tconnectionEpoch: union([int().positive(), nullFactory()]),\n\tconnectedAt: PREPARE_NULLABLE_DATE_TIME_SCHEMA,\n\tlastSeenAt: PREPARE_NULLABLE_DATE_TIME_SCHEMA,\n\tdisconnectedAt: PREPARE_NULLABLE_DATE_TIME_SCHEMA,\n\tdisconnectReason: union([PREPARE_REASON_CODE_SCHEMA, nullFactory()])\n}).superRefine((value, ctx) => {\n\tif (value.status === \"connected\") {\n\t\tif (value.connectionId === null) ctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"connected terminal must include connectionId\",\n\t\t\tpath: [\"connectionId\"]\n\t\t});\n\t\tif (value.connectionEpoch === null) ctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"connected terminal must include connectionEpoch\",\n\t\t\tpath: [\"connectionEpoch\"]\n\t\t});\n\t\tif (value.connectedAt === null) ctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tmessage: \"connected terminal must include connectedAt\",\n\t\t\tpath: [\"connectedAt\"]\n\t\t});\n\t}\n});\nconst prepareBlockerSeveritySchema = enumFactory([\"user_action_required\", \"system_blocked\"]);\nconst prepareBlockerRetryActionSchema = enumFactory([\n\t\"run_prepare_command\",\n\t\"copy_fresh_command\",\n\t\"choose_agents\",\n\t\"refresh\",\n\t\"contact_support\"\n]);\nconst prepareBlockerSchema = strictObject({\n\tblockerId: PREPARE_BOUNDED_ID_SCHEMA,\n\tstepId: prepareStepIdSchema,\n\treasonCode: PREPARE_REASON_CODE_SCHEMA,\n\tmessage: PREPARE_USER_MESSAGE_SCHEMA,\n\tseverity: prepareBlockerSeveritySchema,\n\tretryAction: prepareBlockerRetryActionSchema,\n\tcreatedAt: PREPARE_ISO_DATE_TIME_SCHEMA\n});\nconst prepareLocalAgentIdsSchema = array(PREPARE_BOUNDED_ID_SCHEMA).superRefine((value, ctx) => {\n\tif (new Set(value).size !== value.length) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"localAgentIds must not contain duplicates\"\n\t});\n});\nconst prepareLocalAgentCatalogSchema = localAgentCatalogSchema;\nconst prepareLocalReadinessSnapshotSchema = strictObject({\n\tobservedAt: PREPARE_ISO_DATE_TIME_SCHEMA,\n\tservice: startBackgroundHelperProjectionSchema,\n\tskills: startSkillsReadinessProjectionSchema\n});\nconst prepareSetupBootstrapStepSchema = enumFactory([\n\t\"human_profile\",\n\t\"assistant_profile\",\n\t\"account_space_index\",\n\t\"space_create\",\n\t\"space_membership\",\n\t\"binding\",\n\t\"welcome_message\",\n\t\"unknown\"\n]);\nconst prepareSetupBootstrapProfileSummarySchema = strictObject({\n\topenMeldProfileId: PREPARE_BOUNDED_ID_SCHEMA,\n\tprofileKind: authProfileKindSchema,\n\tprofileName: PREPARE_USER_MESSAGE_SCHEMA\n});\nconst prepareSetupBootstrapFactsSchema = strictObject({\n\townerUserId: PREPARE_BOUNDED_ID_SCHEMA,\n\tassistantProfileId: PREPARE_BOUNDED_ID_SCHEMA,\n\tspaceId: PREPARE_BOUNDED_ID_SCHEMA,\n\tspaceUrl: PREPARE_URL_SCHEMA,\n\tcreatedAt: PREPARE_ISO_DATE_TIME_SCHEMA\n});\nconst legacyPrepareSetupBootstrapAssistantProfileSchema = prepareSetupBootstrapProfileSummarySchema.extend({\n\tmanagedRole: authProfileManagedRoleSchema.extract([\"openmeld_assistant\"]),\n\tprofileKind: literal(\"agent\")\n});\nconst legacyPrepareSetupBootstrapMembershipSchema = strictObject({\n\taddedMemberIds: array(PREPARE_BOUNDED_ID_SCHEMA),\n\talreadyMemberIds: array(PREPARE_BOUNDED_ID_SCHEMA),\n\tassistantProfileId: PREPARE_BOUNDED_ID_SCHEMA,\n\thumanProfileId: PREPARE_BOUNDED_ID_SCHEMA\n});\nconst legacyPrepareSetupBootstrapWelcomingSpaceSchema = strictObject({\n\tcreatedAt: PREPARE_ISO_DATE_TIME_SCHEMA,\n\tname: PREPARE_USER_MESSAGE_SCHEMA,\n\toutcome: enumFactory([\"created\", \"reused\"]).optional(),\n\tspaceId: PREPARE_BOUNDED_ID_SCHEMA,\n\turl: PREPARE_URL_SCHEMA\n});\nconst prepareSetupBootstrapResultSchema = discriminatedUnion(\"status\", [strictObject({\n\tstatus: literal(\"completed\"),\n\tassistantProfile: union([legacyPrepareSetupBootstrapAssistantProfileSchema, nullFactory()]),\n\tbinding: union([strictObject({\n\t\tagentControllerRef: PREPARE_BOUNDED_ID_SCHEMA,\n\t\topenMeldServiceRuntimeId: PREPARE_BOUNDED_ID_SCHEMA,\n\t\toutcome: enumFactory([\n\t\t\t\"created\",\n\t\t\t\"reused\",\n\t\t\t\"reconnected\"\n\t\t]),\n\t\treason: union([PREPARE_REASON_CODE_SCHEMA, nullFactory()]).optional(),\n\t\treasonCodes: array(PREPARE_REASON_CODE_SCHEMA),\n\t\troutable: literal(true),\n\t\tsource: literal(\"agent_profile_binding_api\"),\n\t\tstatus: literal(\"accepted\")\n\t}), nullFactory()]),\n\tbindingWarning: union([strictObject({\n\t\tcode: PREPARE_REASON_CODE_SCHEMA,\n\t\tmessage: PREPARE_USER_MESSAGE_SCHEMA,\n\t\tretryCommand: PREPARE_LONG_TEXT_SCHEMA\n\t}), nullFactory()]).optional(),\n\thumanProfile: prepareSetupBootstrapProfileSummarySchema.extend({ profileKind: literal(\"human\") }),\n\tfacts: union([prepareSetupBootstrapFactsSchema, nullFactory()]),\n\tmembership: union([legacyPrepareSetupBootstrapMembershipSchema, nullFactory()]),\n\tretryCommand: nullFactory(),\n\twarnings: array(strictObject({\n\t\tcode: PREPARE_REASON_CODE_SCHEMA,\n\t\tmessage: PREPARE_USER_MESSAGE_SCHEMA,\n\t\tprofileId: PREPARE_BOUNDED_ID_SCHEMA\n\t})),\n\twelcomeMessage: union([strictObject({\n\t\tsignalId: PREPARE_BOUNDED_ID_SCHEMA,\n\t\ttext: PREPARE_LONG_TEXT_SCHEMA\n\t}), nullFactory()]),\n\twelcomingSpace: union([legacyPrepareSetupBootstrapWelcomingSpaceSchema, nullFactory()])\n}), strictObject({\n\tstatus: literal(\"failed\"),\n\tdiagnostics: strictObject({\n\t\terrorName: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]),\n\t\tselectedAgentIds: prepareLocalAgentIdsSchema\n\t}),\n\tfailedStep: prepareSetupBootstrapStepSchema,\n\tmessage: PREPARE_LONG_TEXT_SCHEMA,\n\treason: literal(\"bootstrap_failed\"),\n\tretryCommand: PREPARE_LONG_TEXT_SCHEMA\n})]);\nconst prepareSetupBootstrapWriteSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\tsetupBootstrap: prepareSetupBootstrapResultSchema\n});\nconst prepareSessionSnapshotSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\townerUserId: PREPARE_BOUNDED_ID_SCHEMA,\n\tconnectedComputerId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\thumanProfileId: union([openMeldProfileIdSchema, nullFactory()]),\n\tdeviceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]),\n\truntimeLane: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]),\n\ttargetSpaceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]),\n\tsessionRevision: int().nonnegative(),\n\tlifecycleStatus: prepareSessionLifecycleStatusSchema,\n\tphase: prepareSessionPhaseSchema,\n\tsteps: array(prepareStepSchema),\n\tlocalAgentCatalog: union([prepareLocalAgentCatalogSchema, nullFactory()]).default(null),\n\tlocalReadinessSnapshot: union([prepareLocalReadinessSnapshotSchema, nullFactory()]).default(null),\n\tsetupBootstrap: prepareSetupBootstrapResultSchema.optional(),\n\tselectedLocalAgentIds: prepareLocalAgentIdsSchema,\n\tterminalConnection: prepareTerminalConnectionSchema,\n\tblockers: array(prepareBlockerSchema),\n\tdiagnosticCorrelationId: PREPARE_BOUNDED_ID_SCHEMA,\n\tcreatedAt: PREPARE_ISO_DATE_TIME_SCHEMA,\n\tupdatedAt: PREPARE_ISO_DATE_TIME_SCHEMA,\n\tcompletedAt: PREPARE_NULLABLE_DATE_TIME_SCHEMA,\n\texpiresAt: PREPARE_ISO_DATE_TIME_SCHEMA\n}).superRefine((value, ctx) => {\n\tconst terminalLifecycle = value.lifecycleStatus === \"completed\" || value.lifecycleStatus === \"failed\" || value.lifecycleStatus === \"cancelled\" || value.lifecycleStatus === \"expired\";\n\tif (terminalLifecycle && value.completedAt === null) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"terminal prepare sessions must include completedAt\",\n\t\tpath: [\"completedAt\"]\n\t});\n\tif (!terminalLifecycle && value.completedAt !== null) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"active prepare sessions must use a null completedAt\",\n\t\tpath: [\"completedAt\"]\n\t});\n\tif (value.phase === \"blocked\" && value.blockers.length === 0) ctx.addIssue({\n\t\tcode: \"custom\",\n\t\tmessage: \"blocked prepare sessions must include at least one blocker\",\n\t\tpath: [\"blockers\"]\n\t});\n});\nconst prepareSessionEventTypeSchema = enumFactory([\n\t\"session.created\",\n\t\"session.snapshot_updated\",\n\t\"session.completed\",\n\t\"session.failed\",\n\t\"session.cancelled\",\n\t\"session.expired\",\n\t\"token.minted\",\n\t\"token.revoked\",\n\t\"terminal.connected\",\n\t\"terminal.disconnected\",\n\t\"terminal.connection_replaced\",\n\t\"terminal.local_agent_catalog_reported\",\n\t\"terminal.agent_selection_saved\",\n\t\"terminal.setup_bootstrap_recorded\",\n\t\"terminal.step_started\",\n\t\"terminal.step_completed\",\n\t\"terminal.step_failed\",\n\t\"web.agent_selection_saved\",\n\t\"blocker.added\",\n\t\"blocker.cleared\"\n]);\nconst prepareSessionEventActorSchema = enumFactory([\n\t\"web\",\n\t\"terminal\",\n\t\"system\"\n]);\nconst prepareSessionEventSchema = strictObject({\n\teventId: PREPARE_BOUNDED_ID_SCHEMA,\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\tsessionRevision: int().nonnegative(),\n\teventType: prepareSessionEventTypeSchema,\n\tactor: prepareSessionEventActorSchema,\n\tstepId: union([prepareStepIdSchema, nullFactory()]),\n\tconnectionEpoch: union([int().positive(), nullFactory()]),\n\treasonCode: union([PREPARE_REASON_CODE_SCHEMA, nullFactory()]),\n\tmessage: union([PREPARE_USER_MESSAGE_SCHEMA, nullFactory()]),\n\tlocalAgentIds: prepareLocalAgentIdsSchema,\n\tcreatedAt: PREPARE_ISO_DATE_TIME_SCHEMA\n});\nconst createPrepareSessionRequestSchema = strictObject({\n\tconnectedComputerId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\thumanProfileId: union([openMeldProfileIdSchema, nullFactory()]).optional(),\n\tdeviceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\truntimeLane: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\ttargetSpaceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\tselectedLocalAgentIds: prepareLocalAgentIdsSchema.optional(),\n\tsourceNavigationAction: strictObject({\n\t\tsignalId: PREPARE_BOUNDED_ID_SCHEMA,\n\t\tspaceId: PREPARE_BOUNDED_ID_SCHEMA\n\t}).optional()\n});\nconst prepareSessionWithTokenResponseSchema = strictObject({\n\tsnapshot: prepareSessionSnapshotSchema,\n\topaqueToken: prepareOpaqueTokenSchema,\n\topaqueTokenExpiresAt: PREPARE_ISO_DATE_TIME_SCHEMA\n});\nconst createPrepareSessionResponseSchema = prepareSessionWithTokenResponseSchema;\nconst prepareSessionResponseSchema = strictObject({ snapshot: prepareSessionSnapshotSchema });\nconst terminalStepWriteStatusSchema = enumFactory([\n\t\"started\",\n\t\"completed\",\n\t\"failed\"\n]);\nconst terminalStepWriteSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\tconnectionEpoch: int().positive(),\n\texpectedRevision: int().nonnegative(),\n\tdeviceId: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\truntimeLane: union([PREPARE_BOUNDED_ID_SCHEMA, nullFactory()]).optional(),\n\tstepAttemptId: PREPARE_BOUNDED_ID_SCHEMA,\n\tstepId: prepareStepIdSchema,\n\tstatus: terminalStepWriteStatusSchema,\n\tlocalReadinessSnapshot: union([prepareLocalReadinessSnapshotSchema, nullFactory()]).optional(),\n\treasonCode: union([PREPARE_REASON_CODE_SCHEMA, nullFactory()]).optional(),\n\tmessage: union([PREPARE_USER_MESSAGE_SCHEMA, nullFactory()]).optional(),\n\tdiagnostics: PREPARE_STEP_DIAGNOSTICS_SCHEMA.optional()\n});\nconst terminalLocalAgentCatalogWriteSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\tconnectionEpoch: int().positive(),\n\tlocalAgentCatalog: prepareLocalAgentCatalogSchema\n});\nconst terminalAgentSelectionWriteSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\tconnectionEpoch: int().positive(),\n\texpectedRevision: int().nonnegative(),\n\tlocalAgentIds: prepareLocalAgentIdsSchema\n});\nconst webAgentSelectionWriteSchema = strictObject({\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA,\n\texpectedRevision: int().nonnegative(),\n\tlocalAgentIds: prepareLocalAgentIdsSchema\n});\nconst prepareDiagnosticResponseSchema = strictObject({\n\tsnapshot: prepareSessionSnapshotSchema,\n\tevents: array(prepareSessionEventSchema)\n});\nconst prepareSessionStreamRoleSchema = enumFactory([\"web\", \"terminal\"]);\nconst prepareConnectionProgressWriteSchema = computerConnectionProgressObservationSchema.extend({\n\tconnectionEpoch: int().positive(),\n\tprepareSessionId: PREPARE_BOUNDED_ID_SCHEMA\n});\nconst prepareSessionStreamClientFrameSchema = discriminatedUnion(\"type\", [\n\tstrictObject({\n\t\ttype: literal(\"client.ping\"),\n\t\tpayload: strictObject({ sentAt: PREPARE_ISO_DATE_TIME_SCHEMA })\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"client.hello\"),\n\t\tpayload: strictObject({\n\t\t\tcliVersion: PREPARE_BOUNDED_ID_SCHEMA,\n\t\t\tprotocolVersion: int().positive()\n\t\t})\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"terminal.step.write\"),\n\t\tpayload: terminalStepWriteSchema\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"terminal.connection_progress.write\"),\n\t\tpayload: prepareConnectionProgressWriteSchema\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"terminal.local_agent_catalog.write\"),\n\t\tpayload: terminalLocalAgentCatalogWriteSchema\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"terminal.agent_selection.write\"),\n\t\tpayload: terminalAgentSelectionWriteSchema\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"web.agent_selection.write\"),\n\t\tpayload: webAgentSelectionWriteSchema\n\t})\n]);\nconst prepareSessionStreamServerFrameSchema = discriminatedUnion(\"type\", [\n\tstrictObject({\n\t\ttype: literal(\"server.pong\"),\n\t\tpayload: strictObject({ sentAt: PREPARE_ISO_DATE_TIME_SCHEMA })\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"server.capabilities\"),\n\t\tpayload: strictObject({ connectionProgress: literal(1) })\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"snapshot\"),\n\t\tpayload: strictObject({ snapshot: prepareSessionSnapshotSchema })\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"snapshot_changed\"),\n\t\tpayload: strictObject({ snapshot: prepareSessionSnapshotSchema })\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"connection_progress\"),\n\t\tpayload: prepareConnectionProgressWriteSchema\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"terminal.replaced\"),\n\t\tpayload: strictObject({\n\t\t\treasonCode: PREPARE_REASON_CODE_SCHEMA,\n\t\t\tmessage: PREPARE_USER_MESSAGE_SCHEMA\n\t\t})\n\t}),\n\tstrictObject({\n\t\ttype: literal(\"server.error\"),\n\t\tpayload: strictObject({\n\t\t\tcode: PREPARE_REASON_CODE_SCHEMA,\n\t\t\tmessage: PREPARE_USER_MESSAGE_SCHEMA\n\t\t})\n\t})\n]);\n//#endregion\nexport { PREPARE_SESSION_STREAM_PROTOCOL_VERSION, PREPARE_STEP_DIAGNOSTICS_MAX_CHARS, createPrepareSessionRequestSchema, createPrepareSessionResponseSchema, prepareBlockerRetryActionSchema, prepareBlockerSchema, prepareBlockerSeveritySchema, prepareConnectionProgressWriteSchema, prepareDiagnosticResponseSchema, prepareLocalAgentCatalogSchema, prepareLocalAgentIdsSchema, prepareLocalReadinessSnapshotSchema, prepareOpaqueTokenSchema, prepareSessionContinuationSchema, prepareSessionEventActorSchema, prepareSessionEventSchema, prepareSessionEventTypeSchema, prepareSessionLifecycleStatusSchema, prepareSessionPhaseSchema, prepareSessionResponseSchema, prepareSessionSnapshotSchema, prepareSessionStreamClientFrameSchema, prepareSessionStreamRoleSchema, prepareSessionStreamServerFrameSchema, prepareSessionWithTokenResponseSchema, prepareSetupBootstrapFactsSchema, prepareSetupBootstrapProfileSummarySchema, prepareSetupBootstrapResultSchema, prepareSetupBootstrapStepSchema, prepareSetupBootstrapWriteSchema, prepareStepDiagnosticsBundleSchema, prepareStepDiagnosticsLifecycleEventTypeSchema, prepareStepDiagnosticsLifecycleJournalEntrySchema, prepareStepDiagnosticsServiceJobSchema, prepareStepIdSchema, prepareStepSchema, prepareStepStateSchema, prepareTerminalConnectionSchema, prepareTerminalConnectionStatusSchema, redactPrepareStepDiagnosticsBundle, redactPrepareStepDiagnosticsText, redactPrepareStepDiagnosticsValue, terminalAgentSelectionWriteSchema, terminalLocalAgentCatalogWriteSchema, terminalStepWriteSchema, terminalStepWriteStatusSchema, webAgentSelectionWriteSchema };\n\n//# sourceMappingURL=session.js.map","import * as z$1 from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z$1.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z$1.discriminatedUnion(\"operation\", [\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.literal(\"read\"),\n\taccessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])\n});\nconst macOsKeychainHelperErrorSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z$1.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z$1.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","export type AuthSessionExpiryEligibility =\n  | { status: \"no_expiry\" }\n  | { expiresAtMs: number; status: \"valid\" }\n  | { expiresAtMs: number; status: \"expired\" }\n  | { status: \"invalid\" };\n\nexport function resolveAuthSessionExpiryEligibility(\n  expiresAt: string | undefined,\n  nowMs = Date.now()\n): AuthSessionExpiryEligibility {\n  const normalized = String(expiresAt ?? \"\").trim();\n  if (!normalized) {\n    return { status: \"no_expiry\" };\n  }\n\n  const expiresAtMs = Date.parse(normalized);\n  if (Number.isNaN(expiresAtMs)) {\n    return { status: \"invalid\" };\n  }\n  return expiresAtMs <= nowMs\n    ? { expiresAtMs, status: \"expired\" }\n    : { expiresAtMs, status: \"valid\" };\n}\n","import { setTimeout as delay } from \"node:timers/promises\";\nimport { acquireLock, isOpenMeldLockError, runWithHeldLock } from \"./lock\";\n\nconst AUTH_SESSION_LOCK_KEY = \"session-transition-mutation\";\nconst AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY = \"candidate-session-refresh\";\nconst AUTH_SESSION_LOCK_PROFILE = \"auth-session\";\nconst AUTH_SESSION_LOCK_RETRY_DELAY_MS = 20;\nconst AUTH_SESSION_LOCK_WAIT_MS = 10_000;\n\nexport async function withAuthSessionTransitionMutationLock<T>(\n  operation: () => Promise<T>\n): Promise<T> {\n  return await withAuthSessionLock({\n    component: \"auth_session_transition\",\n    key: AUTH_SESSION_LOCK_KEY,\n    operation,\n  });\n}\n\nexport async function withAuthSessionCandidateRefreshLock<T>(\n  operation: () => Promise<T>\n): Promise<T> {\n  return await withAuthSessionLock({\n    component: \"auth_session_candidate_refresh\",\n    key: AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY,\n    operation,\n  });\n}\n\nasync function withAuthSessionLock<T>(input: {\n  component: string;\n  key: string;\n  operation: () => Promise<T>;\n}): Promise<T> {\n  const lock = await acquireAuthSessionLock(input);\n  return await runWithHeldLock({\n    lock,\n    run: input.operation,\n    releaseContext: {\n      component: input.component,\n      lockKey: input.key,\n    },\n  });\n}\n\nasync function acquireAuthSessionLock(input: {\n  component: string;\n  key: string;\n}) {\n  const deadline = Date.now() + AUTH_SESSION_LOCK_WAIT_MS;\n  while (true) {\n    try {\n      return await acquireLock({\n        key: input.key,\n        meta: { component: input.component },\n        openMeldProfileId: AUTH_SESSION_LOCK_PROFILE,\n      });\n    } catch (error) {\n      if (!(isOpenMeldLockError(error) && Date.now() < deadline)) {\n        throw error;\n      }\n      await delay(AUTH_SESSION_LOCK_RETRY_DELAY_MS);\n    }\n  }\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  type ServiceAccountAdmission,\n  type ServiceAccountAdmissionIdentity,\n  serviceAccountAdmissionSchema,\n} from \"@openmeld/schemas\";\nimport {\n  CURRENT_PROCESS_START_IDENTITY,\n  isPreciseProcessStartIdentity,\n  isProcessIdentityAlive,\n  readProcessStartIdentity,\n} from \"../system/process-identity\";\nimport { withAuthSessionTransitionMutationLock } from \"./auth-session-transition-lock\";\nimport { writeDaemonLocalStateFile } from \"./daemon-local-state-file\";\nimport { openMeldRootDir } from \"./paths\";\n\nexport class ServiceAccountAdmissionError extends Error {\n  readonly code: string;\n\n  constructor(reason: string, message: string) {\n    super(message);\n    this.name = \"ServiceAccountAdmissionError\";\n    this.code = `service.account_admission.${reason}`;\n  }\n}\n\nfunction admissionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"service-account-admission.json\");\n}\n\nexport async function readServiceAccountAdmission(): Promise<ServiceAccountAdmission | null> {\n  let raw: string;\n  try {\n    raw = await readFile(admissionPath(), \"utf8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return null;\n    }\n    throw error;\n  }\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch {\n    value = null;\n  }\n  const parsed = serviceAccountAdmissionSchema.safeParse(value);\n  if (!parsed.success) {\n    throw new ServiceAccountAdmissionError(\n      \"unknown\",\n      \"OpenMeld could not verify the pending Service action. Run `openmeld service status --json` for diagnostics.\"\n    );\n  }\n  return parsed.data;\n}\n\nasync function writeAdmission(value: ServiceAccountAdmission): Promise<void> {\n  await writeDaemonLocalStateFile({\n    path: admissionPath(),\n    schema: serviceAccountAdmissionSchema,\n    value,\n    mode: 0o600,\n  });\n}\n\n// Caller owns the auth mutation mutex. Cancellation is a durable generation\n// fence, not removal: a delayed carrier must still be refused after recovery.\nexport async function assertServiceAccountAdmissionMutationAvailable(): Promise<void> {\n  const current = await readServiceAccountAdmission();\n  if (current?.state !== \"pending\") {\n    return;\n  }\n  if (isProcessIdentityAlive(current.requester)) {\n    throw new ServiceAccountAdmissionError(\n      \"busy\",\n      \"OpenMeld is starting or stopping this Service. Try the account change again when that action is accepted.\"\n    );\n  }\n  await writeAdmission({ ...current, state: \"cancelled\" });\n}\n\n// The caller must hold the auth mutation mutex and validate local credentials\n// and the service contract in that same critical section.\nexport async function reserveServiceAccountAdmission(input: {\n  operation: ServiceAccountAdmission[\"operation\"];\n  identity: ServiceAccountAdmissionIdentity;\n  target?: ServiceAccountAdmission[\"target\"];\n}): Promise<ServiceAccountAdmission> {\n  await assertServiceAccountAdmissionMutationAvailable();\n  const previous = await readServiceAccountAdmission();\n  if (!isPreciseProcessStartIdentity(CURRENT_PROCESS_START_IDENTITY)) {\n    throw new ServiceAccountAdmissionError(\n      \"unknown\",\n      \"OpenMeld could not verify this command's process identity. Try again from a supported local CLI.\"\n    );\n  }\n  const reservation: ServiceAccountAdmission = {\n    version: 1,\n    id: randomUUID(),\n    operation: input.operation,\n    state: \"pending\",\n    identity: input.identity,\n    ...(input.target ? { target: input.target } : {}),\n    requester: {\n      ownerPid: process.pid,\n      ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n    },\n    ...(previous?.startupReceipt\n      ? { startupReceipt: previous.startupReceipt }\n      : {}),\n  };\n  await writeAdmission(reservation);\n  return reservation;\n}\n\nexport async function cancelServiceAccountAdmission(id: string): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const current = await readServiceAccountAdmission();\n    if (current?.id === id && current.state === \"pending\") {\n      await writeAdmission({ ...current, state: \"cancelled\" });\n    }\n  });\n}\n\n// Caller holds the auth mutex and has bound its actual local identity first.\nexport async function admitServiceAccountOperation(input: {\n  id: string;\n  operation: ServiceAccountAdmission[\"operation\"];\n  identity: ServiceAccountAdmissionIdentity;\n  commit?: () => void;\n}): Promise<void> {\n  const current = await readServiceAccountAdmission();\n  const contractBinding = bindServiceAccountIdentity(input.identity);\n  if (\n    input.operation === \"start\" &&\n    current?.startupReceipt?.id === input.id &&\n    current.startupReceipt.contractBinding === contractBinding\n  ) {\n    // A receipt never changes the latest command or its auth reservation.\n    // Current contract identity is checked by the carrier before this call;\n    // ordinary runtime ownership still prevents two active Service instances.\n    return;\n  }\n  if (\n    !current ||\n    current.id !== input.id ||\n    current.operation !== input.operation ||\n    current.state !== \"pending\" ||\n    readProcessStartIdentity(current.requester.ownerPid) !==\n      current.requester.ownerProcessStartedAt ||\n    (current.target !== undefined &&\n      (current.target.ownerPid !== process.pid ||\n        current.target.ownerProcessStartedAt !==\n          CURRENT_PROCESS_START_IDENTITY)) ||\n    JSON.stringify(current.identity) !== JSON.stringify(input.identity)\n  ) {\n    throw new ServiceAccountAdmissionError(\n      \"cancelled\",\n      \"This Service action is no longer authorized. Check the signed-in account and try again.\"\n    );\n  }\n  input.commit?.();\n  await writeAdmission({\n    ...current,\n    state: \"admitted\",\n    carrier: {\n      ownerPid: process.pid,\n      ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n    },\n    ...(input.operation === \"start\"\n      ? { startupReceipt: { id: input.id, contractBinding } }\n      : {}),\n  });\n}\n\nfunction bindServiceAccountIdentity(\n  identity: ServiceAccountAdmissionIdentity\n): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify([\n        identity.accountId,\n        identity.authBaseUrl,\n        identity.clientId,\n        identity.gatewayUrl,\n        identity.lane,\n        identity.deviceId,\n        identity.contractGeneration,\n      ])\n    )\n    .digest(\"hex\");\n}\n","import { realpath } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { basename, dirname, isAbsolute, join, resolve, sep } from \"node:path\";\nimport { isLoopbackHostname } from \"./loopback-hostname\";\nimport { resolveOpenMeldEnvPreset } from \"./paths\";\n\n/** Select only newly issued localhost credentials; never migrate saved tokens. */\nexport async function shouldUseDevelopmentCredentialFile(\n  authBaseUrl: string\n): Promise<boolean> {\n  if (\n    process.platform !== \"darwin\" ||\n    resolveOpenMeldEnvPreset() !== \"dev-local\"\n  ) {\n    return false;\n  }\n  const mode = process.env.OPENMELD_DEV_CREDENTIAL_STORE;\n  if (mode === \"system\") {\n    return false;\n  }\n  if (mode && mode !== \"file\") {\n    throw new Error(\"OPENMELD_DEV_CREDENTIAL_STORE must be file or system.\");\n  }\n  const root = process.env.OPENMELD_HOME?.trim();\n  if (!(root && isAbsolute(root))) {\n    return false;\n  }\n  if (\n    !(\n      isLocalEndpoint(authBaseUrl) &&\n      isLocalEndpoint(process.env.OPENMELD_GATEWAY_URL)\n    )\n  ) {\n    return false;\n  }\n  const canonicalRoot = await canonicalPath(root);\n  const userHome = await canonicalPath(homedir());\n  if (canonicalRoot === userHome || canonicalRoot === dirname(canonicalRoot)) {\n    return false;\n  }\n  for (const directory of [\".openmeld\", \".openmeld-dev\", \".openmeld-canary\"]) {\n    const protectedRoot = await canonicalPath(join(userHome, directory));\n    if (\n      canonicalRoot === protectedRoot ||\n      canonicalRoot.startsWith(protectedRoot + sep)\n    ) {\n      return false;\n    }\n  }\n  return true;\n}\n\nfunction isLocalEndpoint(value: string | undefined): boolean {\n  try {\n    const url = new URL(value ?? \"\");\n    return (\n      (url.protocol === \"http:\" || url.protocol === \"https:\") &&\n      !url.username &&\n      !url.password &&\n      (isLoopbackHostname(url.hostname) || url.hostname.endsWith(\".localhost\"))\n    );\n  } catch {\n    return false;\n  }\n}\n\nasync function canonicalPath(path: string): Promise<string> {\n  try {\n    return await realpath(path);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw error;\n    }\n    const absolute = resolve(path);\n    const parent = dirname(absolute);\n    if (parent === absolute) {\n      throw error;\n    }\n    return join(await canonicalPath(parent), basename(absolute));\n  }\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nconst OS_STATUS_PATTERN = /OSStatus (-?\\d+)/u;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\nlet keychainRetryAt = 0;\nlet lastKeychainFailureCode: string | null = null;\nexport const MAC_OS_KEYCHAIN_RETRY_DELAY_MS = 30_000;\n\nexport function getMacOsKeychainRetryAfterMs(): number {\n  return Math.max(0, keychainRetryAt - Date.now());\n}\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError && Date.now() < keychainRetryAt) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      const result = await runMacOsNativeKeychainRequestInChild(input);\n      noteKeychainRecovery();\n      return result;\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n    noteKeychainRecovery();\n  } catch (error) {\n    const timedOut = error instanceof MacOsNativeKeychainTimeoutError;\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n      keychainRetryAt = Date.now() + MAC_OS_KEYCHAIN_RETRY_DELAY_MS;\n    }\n    const osStatus = OS_STATUS_PATTERN.exec(toErrorMessage(error))?.[1];\n    let reasonCode = osStatus ? \"keychain_os_error\" : \"keychain_helper_failed\";\n    if (timedOut) {\n      reasonCode = \"keychain_helper_timeout\";\n    }\n    const failureCode = `${reasonCode}:${osStatus ?? \"none\"}`;\n    if (lastKeychainFailureCode !== failureCode) {\n      lastKeychainFailureCode = failureCode;\n      console.warn(\n        JSON.stringify({\n          event: \"cli.keychain.readiness_failed\",\n          observedAt: new Date().toISOString(),\n          reasonCode,\n          ...(osStatus ? { osStatus: Number(osStatus) } : {}),\n          operation: input.operation,\n          timeoutMs: MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS,\n          ...(timedOut ? { retryAfterMs: MAC_OS_KEYCHAIN_RETRY_DELAY_MS } : {}),\n        })\n      );\n    }\n    throw error;\n  }\n}\n\nfunction noteKeychainRecovery(): void {\n  if (lastKeychainFailureCode) {\n    console.warn(\n      JSON.stringify({\n        event: \"cli.keychain.readiness_recovered\",\n        observedAt: new Date().toISOString(),\n      })\n    );\n  }\n  unresponsiveKeychainError = null;\n  keychainRetryAt = 0;\n  lastKeychainFailureCode = null;\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (process.platform === \"darwin\" && isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport { shouldUseDevelopmentCredentialFile } from \"./development-credential-store\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  getMacOsKeychainRetryAfterMs,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst COMMAND_ERROR_CODE_PATTERN = /^E[A-Z0-9_]{1,63}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      retryAfterMs?: number;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n  unique?: boolean;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n  const storageKey = input.unique ? buildUniqueTokenFileKey(key) : key;\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key: storageKey,\n    };\n  }\n\n  if (await shouldUseDevelopmentCredentialFile(input.authBaseUrl)) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    console.warn(\n      \"[openmeld auth] Local development sign-in uses an unencrypted file restricted to your OS user in OPENMELD_HOME. Use test accounts only. Rebuilds keep this sign-in; use OPENMELD_DEV_CREDENTIAL_STORE=system and a separate home for system Keychain acceptance.\"\n    );\n    return { provider: \"insecure-file\", key: storageKey };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key: storageKey,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key: storageKey,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key: storageKey,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key: storageKey,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key: storageKey,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key: storageKey,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`,\n        { cause: error }\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key: storageKey,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      ...(ref.provider === \"macos-keychain\"\n        ? { retryAfterMs: getMacOsKeychainRetryAfterMs() }\n        : {}),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(error);\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject({ code, stderr });\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code: number | string | null } {\n  const details =\n    error && typeof error === \"object\"\n      ? (error as { code?: unknown; stderr?: unknown })\n      : {};\n  let code: number | string | null = null;\n  if (typeof details.code === \"number\" && Number.isInteger(details.code)) {\n    code = details.code;\n  } else if (\n    typeof details.code === \"string\" &&\n    COMMAND_ERROR_CODE_PATTERN.test(details.code)\n  ) {\n    code = details.code;\n  }\n  // Only fixed script markers may become diagnostics. stdout is a decrypted\n  // token, and PowerShell/Node error messages can include input or command text.\n  const marker =\n    typeof details.stderr === \"string\" ? details.stderr.trim() : \"\";\n  let reason = \"PowerShell did not complete the credential operation\";\n  if (typeof code === \"string\") {\n    reason = \"PowerShell could not be started or executed\";\n  } else if (marker === \"OPENMELD_DPAPI_ASSEMBLY_LOAD_FAILED\") {\n    reason = \"Windows credential encryption could not be initialized\";\n  } else if (marker === \"OPENMELD_DPAPI_OPERATION_FAILED\") {\n    reason = \"Windows could not encrypt or decrypt the stored credential\";\n  }\n  return Object.assign(\n    new Error(\n      `command failed (${command}); ${reason}; ${code === null ? \"no exit code\" : `code: ${code}`}`\n    ),\n    { code }\n  );\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"try { Add-Type -AssemblyName System.Security -ErrorAction Stop } catch { [Console]::Error.WriteLine('OPENMELD_DPAPI_ASSEMBLY_LOAD_FAILED'); exit 1 }\",\n  \"try {\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n  \"} catch { [Console]::Error.WriteLine('OPENMELD_DPAPI_OPERATION_FAILED'); exit 1 }\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"try { Add-Type -AssemblyName System.Security -ErrorAction Stop } catch { [Console]::Error.WriteLine('OPENMELD_DPAPI_ASSEMBLY_LOAD_FAILED'); exit 1 }\",\n  \"try {\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n  \"} catch { [Console]::Error.WriteLine('OPENMELD_DPAPI_OPERATION_FAILED'); exit 1 }\",\n].join(\";\");\n","import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { link, mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { prepareSessionContinuationSchema } from \"@openmeld/schemas\";\nimport type { PrepareSessionContinuation } from \"@openmeld/schemas/types\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport {\n  CURRENT_PROCESS_START_IDENTITY,\n  isProcessIdentityAlive,\n} from \"../system/process-identity\";\nimport { resolveAuthSessionExpiryEligibility } from \"./auth-session-expiry\";\nimport {\n  withAuthSessionCandidateRefreshLock,\n  withAuthSessionTransitionMutationLock,\n} from \"./auth-session-transition-lock\";\nimport { isLoopbackHostname } from \"./loopback-hostname\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  assertServiceAccountAdmissionMutationAvailable,\n  ServiceAccountAdmissionError,\n} from \"./service-account-admission\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\ntype AuthSessionTransitionJournalV1 = {\n  v: 1;\n  id: string;\n  state: \"pending\" | \"recovery_required\" | \"committed\";\n  ownerPid: number;\n  ownerProcessStartedAt: string;\n  previousPayload: AuthSessionV1 | null;\n  candidatePayload: AuthSessionV1;\n  candidateCredentialRefreshVersion?: 1;\n  candidateTokenRefs?: StoredTokenRef[];\n  candidateServiceProcesses?: ProcessIdentity[];\n  /** @deprecated Read and write until in-flight v1 journals from older builds expire. */\n  candidateServiceProcess?: ProcessIdentity;\n  computerHandoff?: {\n    gatewayUrl: string;\n    prepareContinuation?: PrepareSessionContinuation;\n    serviceReconciledAt?: string;\n    remoteSessionRevokedAt?: string;\n    lastRecoveryFailure?: {\n      at: string;\n      message: string;\n      phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n      endpoint?: string;\n      status?: number | null;\n    };\n  };\n};\n\ntype ProcessIdentity = {\n  ownerPid: number;\n  ownerProcessStartedAt: string;\n};\n\nconst MAX_CANDIDATE_SERVICE_PROCESSES = 16;\nconst MAX_CANDIDATE_TOKEN_REFS = 64;\n\nclass AuthSessionStorageError extends Error {\n  readonly reason: \"corrupt\" | \"unreadable\";\n\n  constructor(input: {\n    message: string;\n    reason: \"corrupt\" | \"unreadable\";\n    cause?: unknown;\n  }) {\n    super(\n      input.message,\n      input.cause === undefined ? undefined : { cause: input.cause }\n    );\n    this.name = \"AuthSessionStorageError\";\n    this.reason = input.reason;\n  }\n}\n\nexport class AuthSessionRecoveryInProgressError extends Error {\n  constructor() {\n    super(\n      \"OpenMeld is still finishing an interrupted Computer sign-in recovery. The current sign-in was not changed; retry after the recovery cleanup succeeds.\"\n    );\n    this.name = \"AuthSessionRecoveryInProgressError\";\n  }\n}\n\nexport class AuthSessionChangedBeforeTransitionError extends Error {\n  readonly reason = \"previous_session_changed\" as const;\n\n  constructor() {\n    super(\n      \"The current Computer sign-in changed while OpenMeld was waiting to start this account switch. Run the setup command again to review the current account before switching. No local sign-in state was changed.\"\n    );\n    this.name = \"AuthSessionChangedBeforeTransitionError\";\n  }\n}\n\nexport class AuthSessionTransitionConflictError extends Error {\n  readonly previousOwnerRestored: boolean;\n  readonly reason:\n    | \"journal_missing\"\n    | \"journal_not_pending\"\n    | \"journal_replaced\";\n\n  constructor(input: {\n    previousOwnerRestored: boolean;\n    reason: \"journal_missing\" | \"journal_not_pending\" | \"journal_replaced\";\n  }) {\n    const conflict = {\n      journal_missing: \"missing\",\n      journal_not_pending: \"no longer pending\",\n      journal_replaced: \"owned by another sign-in\",\n    }[input.reason];\n    const outcome = input.previousOwnerRestored\n      ? \"The previous sign-in was restored.\"\n      : \"No local sign-in state was changed.\";\n    super(`The auth session transition journal is ${conflict}. ${outcome}`);\n    this.name = \"AuthSessionTransitionConflictError\";\n    this.reason = input.reason;\n    this.previousOwnerRestored = input.previousOwnerRestored;\n  }\n}\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n  preservedSessionPath?: string;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionInput = {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n};\n\nexport type AuthSessionTransition = {\n  previousSession: StoredAuthSession | null;\n  commit: () => Promise<void>;\n  rollback: () => Promise<void>;\n};\n\nexport type AuthSessionTransitionContext = {\n  computerHandoff?: {\n    gatewayUrl: string;\n    prepareContinuation?: PrepareSessionContinuation;\n  };\n  expectedPreviousSession?: AuthSessionMetadata | null;\n};\n\nexport type InterruptedComputerAuthSessionRecovery = {\n  gatewayUrl: string;\n  id: string;\n  previousSession: StoredAuthSession | null;\n  serviceReconciled: boolean;\n} & (\n  | { remoteSessionRevoked: true; candidateSession: null }\n  | {\n      remoteSessionRevoked: false;\n      candidateSession: StoredAuthSession & {\n        user: NonNullable<StoredAuthSession[\"user\"]> & { id: string };\n      };\n    }\n);\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_expiry_invalid\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  retryAfterMs?: number;\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  // Keep normal requests local-first, but let the server recover a stale local\n  // expiry before callers stop attaching an otherwise usable credential.\n  refreshExpired?: boolean;\n  // Ask the server to validate even a locally current session.\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      retryAfterMs?: number;\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      payloadKey: string;\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      payloadKey: string;\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation =\n  | {\n      accessToken?: string;\n      expiresAt?: string;\n      state: \"valid\";\n    }\n  | {\n      state: Exclude<RemoteAuthSessionState, \"valid\">;\n    };\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  credentialKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\nconst pendingCredentialReads = new Map<\n  string,\n  ReturnType<typeof readAccessToken>\n>();\nconst credentialAvailabilityListeners = new Set<{\n  path: string;\n  notify: () => void;\n}>();\n\nexport function onAuthSessionCredentialAvailable(\n  notify: () => void\n): () => void {\n  const listener = { path: authSessionPath(), notify };\n  credentialAvailabilityListeners.add(listener);\n  return () => {\n    credentialAvailabilityListeners.delete(listener);\n  };\n}\nconst activeAuthSessionTransitionIds = new Set<string>();\n\nconst admittedServiceSession = new AsyncLocalStorage<StoredAuthSession>();\nconst boundSessionPayloadKeys = new WeakMap<StoredAuthSession, string | null>();\n\nexport function withAdmittedServiceSession<T>(\n  session: StoredAuthSession,\n  run: () => Promise<T>\n): Promise<T> {\n  return admittedServiceSession.run(structuredClone(session), run);\n}\n\n// Admission validates remotely before acquiring the mutex, then rechecks this\n// local snapshot under it. It never refreshes credentials or recovers a journal\n// while recursively holding the auth lock.\nexport async function readServiceAdmissionSessionWithOwnership(): Promise<StoredAuthSession> {\n  if (await readAuthSessionTransitionJournal()) {\n    throw new AuthSessionRecoveryInProgressError();\n  }\n  const state = await getLocalAuthSessionState({ recover: false });\n  if (state.state !== \"valid\" || !state.session?.user?.id) {\n    throw new Error(\n      \"Service control requires a valid CLI sign-in. Sign in with the matching account and try again.\"\n    );\n  }\n  return state.session;\n}\n\ntype CredentialObservation =\n  | \"context_changed\"\n  | \"credential_changed\"\n  | \"account_changed\"\n  | \"metadata_unavailable\"\n  | \"credential_available\";\nconst credentialObservationListeners = new Set<{\n  path: string;\n  notify: (reason: CredentialObservation) => void;\n}>();\n\nexport function onAuthSessionCredentialObservation(\n  notify: (reason: CredentialObservation) => void\n): () => void {\n  const listener = { path: authSessionPath(), notify };\n  credentialObservationListeners.add(listener);\n  return () => {\n    credentialObservationListeners.delete(listener);\n  };\n}\n\nfunction observeCredential(reason: CredentialObservation): void {\n  const path = authSessionPath();\n  for (const listener of credentialObservationListeners) {\n    if (listener.path === path) {\n      try {\n        listener.notify(reason);\n      } catch {\n        /* Observations never control authentication. */\n      }\n    }\n  }\n}\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const bound = admittedServiceSession.getStore();\n  if (bound) {\n    return await getBoundServiceSessionState(bound, options);\n  }\n  const result = await getAuthSessionStateWithCandidateRefreshFence(\n    options,\n    false\n  );\n  // Exact-payload fences are private to the auth owner, not diagnostic payloads.\n  if (result.reasonCode === \"session_metadata_invalid\") {\n    observeCredential(\"metadata_unavailable\");\n  }\n  return {\n    state: result.state,\n    session: result.session,\n    ...(result.reasonCode ? { reasonCode: result.reasonCode } : {}),\n    ...(result.errorMessage ? { errorMessage: result.errorMessage } : {}),\n    ...(result.retryAfterMs !== undefined\n      ? { retryAfterMs: result.retryAfterMs }\n      : {}),\n  };\n}\n\nasync function syncBoundServiceCredentials(\n  bound: StoredAuthSession\n): Promise<string | null> {\n  const local = await getLocalAuthSessionState({\n    recover: false,\n    boundSessionIdentity: buildStoredAuthSessionIdentity(bound),\n  });\n  const samePrincipal = isSameAuthPrincipal(local.session, bound);\n  const localPayloadKey =\n    samePrincipal && \"payloadKey\" in local ? local.payloadKey : null;\n  if (\n    samePrincipal &&\n    local.session &&\n    boundSessionPayloadKeys.get(bound) !== localPayloadKey\n  ) {\n    Object.assign(bound, local.session, {\n      activeOrganization: local.session.activeOrganization,\n    });\n    boundSessionPayloadKeys.set(bound, localPayloadKey);\n  }\n  if (\n    samePrincipal &&\n    local.session &&\n    bound.expiresAt &&\n    (bound.accessToken !== local.session.accessToken ||\n      bound.expiresAt !== local.session.expiresAt)\n  ) {\n    await persistBoundServiceRefresh(\n      bound,\n      {\n        state: \"valid\",\n        accessToken: bound.accessToken,\n        expiresAt: bound.expiresAt,\n      },\n      localPayloadKey,\n      local.session.accessToken\n    );\n  }\n  return samePrincipal ? (boundSessionPayloadKeys.get(bound) ?? null) : null;\n}\n\nasync function getBoundServiceSessionState(\n  bound: StoredAuthSession,\n  options: GetAuthSessionStateOptions\n): Promise<AuthSessionStateResult> {\n  const localPayloadKey = await syncBoundServiceCredentials(bound);\n  if (\n    options.validateRemote ||\n    (options.refreshExpired && isExpired(bound.expiresAt))\n  ) {\n    const remote = await getRemoteAuthSessionState(bound);\n    if (remote.state === \"revoked\" || remote.state === \"invalid\") {\n      return {\n        state: remote.state,\n        session: null,\n        reasonCode: resolveRemoteAuthSessionReasonCode(remote.state),\n      };\n    }\n    if (remote.state === \"valid\") {\n      await persistBoundServiceRefresh(bound, remote, localPayloadKey);\n      if (remote.accessToken) {\n        bound.accessToken = remote.accessToken;\n      }\n      if (remote.expiresAt) {\n        bound.expiresAt = remote.expiresAt;\n      }\n    }\n  }\n  const expiry = resolveAuthSessionExpiryEligibility(bound.expiresAt);\n  if (expiry.status === \"expired\") {\n    return {\n      session: bound,\n      state: \"expired\",\n      reasonCode: \"session_expired\",\n    };\n  }\n  if (expiry.status === \"invalid\") {\n    return {\n      session: null,\n      state: \"invalid\",\n      reasonCode: \"session_expiry_invalid\",\n    };\n  }\n  return { session: bound, state: \"valid\" };\n}\n\nasync function persistBoundServiceRefresh(\n  bound: StoredAuthSession,\n  remote: Extract<RemoteAuthSessionValidation, { state: \"valid\" }>,\n  localPayloadKey: string | null,\n  previousAccessToken = bound.accessToken\n): Promise<void> {\n  if (!(localPayloadKey && remote.expiresAt) || isExpired(remote.expiresAt)) {\n    return;\n  }\n  try {\n    const persisted = await persistRemoteSessionRefresh({\n      accessToken: remote.accessToken ?? bound.accessToken,\n      previousAccessToken,\n      expectedPayloadKey: localPayloadKey,\n      expiresAt: remote.expiresAt,\n    });\n    if (persisted) {\n      const current = await getLocalAuthSessionState({\n        recover: false,\n        boundSessionIdentity: buildStoredAuthSessionIdentity(bound),\n      });\n      boundSessionPayloadKeys.set(\n        bound,\n        isSameAuthPrincipal(current.session, bound) && \"payloadKey\" in current\n          ? current.payloadKey\n          : null\n      );\n    }\n  } catch (error) {\n    if (\n      !(\n        error instanceof ServiceAccountAdmissionError &&\n        error.code === \"service.account_admission.busy\"\n      )\n    ) {\n      throw error;\n    }\n    // Keep the remotely validated A session in memory during admission; the\n    // canonical writer remains deferred until that short reservation settles.\n  }\n}\n\nfunction isSameAuthPrincipal(\n  current: Pick<\n    Partial<StoredAuthSession>,\n    \"user\" | \"authBaseUrl\" | \"clientId\"\n  > | null,\n  expected: StoredAuthSession\n): boolean {\n  return Boolean(\n    expected.user?.id &&\n      current?.user?.id === expected.user.id &&\n      current.authBaseUrl === expected.authBaseUrl &&\n      current.clientId === expected.clientId\n  );\n}\n\nasync function getAuthSessionStateWithCandidateRefreshFence(\n  options: GetAuthSessionStateOptions,\n  candidateRefreshFenceHeld: boolean\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  const localPayloadKey =\n    \"payloadKey\" in localState ? localState.payloadKey : null;\n  const shouldValidateRemote =\n    options.validateRemote === true ||\n    (options.refreshExpired === true && localState.state === \"expired\");\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n      return localState;\n    case \"expired\":\n      if (!shouldValidateRemote) {\n        return localState;\n      }\n      break;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!shouldValidateRemote) {\n    return localState;\n  }\n  if (\n    !candidateRefreshFenceHeld &&\n    (await shouldFencePendingCandidateRemoteValidation())\n  ) {\n    return await withAuthSessionCandidateRefreshLock(\n      async () =>\n        await getAuthSessionStateWithCandidateRefreshFence(options, true)\n    );\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return await resolveRemotelyValidatedAuthSession({\n      localPayloadKey,\n      localState,\n      remoteValidation,\n    });\n  }\n  if (remoteValidation.state === \"unknown\") {\n    if (localState.state === \"expired\" && options.refreshExpired === true) {\n      // A stale local timestamp is not authorization truth. Preserve the\n      // session so the shared request-attachment owner can reject the known\n      // expiry without discarding credentials that a later refresh may renew.\n      return {\n        state: \"valid\",\n        session: localState.session,\n      };\n    }\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\nasync function shouldFencePendingCandidateRemoteValidation(): Promise<boolean> {\n  const journal = await readAuthSessionTransitionJournal();\n  return Boolean(\n    journal?.state === \"pending\" &&\n      journal.candidateCredentialRefreshVersion === 1 &&\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal)\n  );\n}\n\nasync function resolveRemotelyValidatedAuthSession(input: {\n  localPayloadKey: string | null;\n  localState: Extract<LocalAuthSessionState, { state: \"expired\" | \"valid\" }>;\n  remoteValidation: Extract<RemoteAuthSessionValidation, { state: \"valid\" }>;\n}): Promise<AuthSessionStateResult> {\n  if (\n    !input.remoteValidation.expiresAt ||\n    isExpired(input.remoteValidation.expiresAt)\n  ) {\n    return input.localState;\n  }\n\n  let refreshedSession: StoredAuthSession | null;\n  try {\n    refreshedSession = await persistRemoteSessionRefresh({\n      accessToken:\n        input.remoteValidation.accessToken ??\n        input.localState.session.accessToken,\n      expectedPayloadKey: input.localPayloadKey,\n      expiresAt: input.remoteValidation.expiresAt,\n      previousAccessToken: input.localState.session.accessToken,\n    });\n  } catch (error) {\n    if (!(error instanceof AuthSessionRecoveryInProgressError)) {\n      throw error;\n    }\n    // Remote validation already proved this exact in-memory session is valid.\n    // Another process may still own the Computer handoff transaction, so this\n    // reader cannot persist the refreshed token or expiry yet. Keep using the\n    // validated session in memory instead of falling back to the committed\n    // session file, which is intentionally absent on a fresh Computer.\n    return {\n      state: \"valid\",\n      session: {\n        ...input.localState.session,\n        accessToken:\n          input.remoteValidation.accessToken ??\n          input.localState.session.accessToken,\n        expiresAt: input.remoteValidation.expiresAt,\n      },\n    };\n  }\n\n  if (!refreshedSession) {\n    return await getLocalAuthSessionState();\n  }\n  return {\n    state: \"valid\",\n    session: refreshedSession,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: AuthSessionInput): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    await retryPendingTokenCleanup();\n\n    const previousPayload = await readSessionPayloadFile();\n    const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n    const tokenRef = await storeAccessToken({\n      accessToken,\n      authBaseUrl,\n      clientId,\n    });\n\n    const payload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n      authBaseUrl,\n      clientId,\n      createdAt: new Date().toISOString(),\n      ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n      ...(input.scope ? { scope: input.scope } : {}),\n      ...buildAuthUserPayload(input.user),\n      ...buildActiveOrganizationPayload(input.activeOrganization),\n    };\n\n    const path = authSessionPath();\n    await ensureAuthSessionDirectory();\n\n    try {\n      await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n      await writeSessionPayloadAtomically(path, payload);\n    } catch (error) {\n      await deleteAccessTokenOrRetainForCleanup(tokenRef);\n      throw error;\n    }\n\n    cacheAuthSession({\n      payload,\n      session: buildStoredAuthSession({ accessToken, payload }),\n    });\n    if (\n      previousTokenRef &&\n      !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n    ) {\n      await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n    }\n  });\n}\n\nexport async function beginAuthSessionTransition(\n  input: AuthSessionInput,\n  context: AuthSessionTransitionContext = {}\n): Promise<AuthSessionTransition> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n  const continuation = context.computerHandoff?.prepareContinuation;\n  const prepareContinuation = continuation\n    ? prepareSessionContinuationSchema.parse(continuation)\n    : undefined;\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    await retryPendingTokenCleanup();\n    await ensureAuthSessionDirectory();\n    const previousPayload = await readSessionPayloadFile();\n    const previousState = await getLocalAuthSessionState({ recover: false });\n    const previousSession =\n      previousState.state === \"valid\" || previousState.state === \"expired\"\n        ? previousState.session\n        : null;\n    assertExpectedPreviousSession({\n      current: buildAuthSessionMetadata(previousPayload),\n      expected: context.expectedPreviousSession,\n    });\n    const tokenRef = await storeAccessToken({\n      accessToken,\n      authBaseUrl,\n      clientId,\n      unique: true,\n    });\n    const nextPayload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n      authBaseUrl,\n      clientId,\n      createdAt: new Date().toISOString(),\n      ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n      ...(input.scope ? { scope: input.scope } : {}),\n      ...buildAuthUserPayload(input.user),\n      ...buildActiveOrganizationPayload(input.activeOrganization),\n    };\n    const journal: AuthSessionTransitionJournalV1 = {\n      v: 1,\n      id: randomUUID(),\n      state: \"pending\",\n      ownerPid: process.pid,\n      ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n      previousPayload:\n        previousPayload?.v === 1 ? (previousPayload as AuthSessionV1) : null,\n      candidatePayload: nextPayload,\n      candidateCredentialRefreshVersion: 1,\n      candidateTokenRefs: [tokenRef],\n      ...(context.computerHandoff\n        ? {\n            computerHandoff: {\n              gatewayUrl: context.computerHandoff.gatewayUrl,\n              prepareContinuation,\n            },\n          }\n        : {}),\n    };\n    let journalClaimed = false;\n    try {\n      await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n      await claimAuthSessionTransitionJournal(journal);\n      journalClaimed = true;\n      activeAuthSessionTransitionIds.add(journal.id);\n    } catch (error) {\n      activeAuthSessionTransitionIds.delete(journal.id);\n      if (journalClaimed) {\n        await restoreTransitionPreviousPayload(journal).catch(() => undefined);\n        await removeAuthSessionTransitionJournalIfOwned(journal).catch(\n          () => undefined\n        );\n      }\n      await deleteAccessTokenOrRetainForCleanup(tokenRef);\n      throw error;\n    }\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({ accessToken, payload: nextPayload }),\n    });\n\n    let settlement: \"committed\" | \"pending\" | \"rolled_back\" = \"pending\";\n    const assertTransitionPending = () => {\n      if (settlement !== \"pending\") {\n        throw new Error(\"auth session transition is already settled\");\n      }\n    };\n    const isPreviousSessionCurrent = (\n      currentPayload: Partial<AuthSessionV1> | null\n    ) => {\n      if (!journal.previousPayload) {\n        return currentPayload === null;\n      }\n      return (\n        currentPayload?.v === 1 &&\n        buildAuthSessionPayloadKey(currentPayload) ===\n          buildAuthSessionPayloadKey(journal.previousPayload)\n      );\n    };\n    const isCandidateSessionCurrent = (\n      currentPayload: Partial<AuthSessionV1> | null,\n      candidatePayload: Partial<AuthSessionV1> = nextPayload\n    ) =>\n      currentPayload?.v === 1 &&\n      buildAuthSessionPayloadKey(currentPayload) ===\n        buildAuthSessionPayloadKey(candidatePayload);\n    const assertTransitionSessionCurrent = async (\n      candidatePayload: Partial<AuthSessionV1> = nextPayload\n    ) => {\n      const currentPayload = await readSessionPayloadFile();\n      if (\n        !(\n          isPreviousSessionCurrent(currentPayload) ||\n          isCandidateSessionCurrent(currentPayload, candidatePayload)\n        )\n      ) {\n        throw new Error(\n          \"auth session changed before the setup transition completed\"\n        );\n      }\n    };\n    const restoreMissingJournalTransition = async () => {\n      const currentPayload = await readSessionPayloadFile();\n      if (\n        !(\n          isPreviousSessionCurrent(currentPayload) ||\n          isCandidateSessionCurrent(currentPayload)\n        )\n      ) {\n        try {\n          await cleanupTransitionTokensNotReferencedByCurrentSession({\n            currentPayload,\n            journal,\n          });\n        } finally {\n          activeAuthSessionTransitionIds.delete(journal.id);\n        }\n        throw new AuthSessionTransitionConflictError({\n          previousOwnerRestored: false,\n          reason: \"journal_missing\",\n        });\n      }\n\n      await claimAuthSessionTransitionJournal(journal);\n      try {\n        await restoreTransitionPreviousPayload(journal, previousSession);\n        settlement = \"rolled_back\";\n        await deleteAccessTokenOrRetainForCleanup(tokenRef).catch(\n          (error: unknown) => {\n            logDeferredAuthSessionTransitionCleanup({\n              error,\n              transitionId: journal.id,\n            });\n          }\n        );\n      } finally {\n        activeAuthSessionTransitionIds.delete(journal.id);\n        await removeAuthSessionTransitionJournalIfOwned(journal);\n      }\n    };\n\n    return {\n      previousSession,\n      commit: async () =>\n        await withAuthSessionTransitionMutationLock(async () => {\n          assertTransitionPending();\n          const currentJournal =\n            await readOwnedPendingAuthSessionTransition(journal);\n          if (currentJournal.status === \"missing\") {\n            await restoreMissingJournalTransition();\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: true,\n              reason: \"journal_missing\",\n            });\n          }\n          if (currentJournal.status !== \"current\") {\n            activeAuthSessionTransitionIds.delete(journal.id);\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: false,\n              reason: currentJournal.status,\n            });\n          }\n          await commitAuthSessionTransitionJournal(currentJournal.journal);\n          settlement = \"committed\";\n        }),\n      rollback: async () =>\n        await withAuthSessionTransitionMutationLock(async () => {\n          if (settlement === \"rolled_back\") {\n            return;\n          }\n          assertTransitionPending();\n          const currentJournal =\n            await readOwnedPendingAuthSessionTransition(journal);\n          if (currentJournal.status === \"missing\") {\n            await restoreMissingJournalTransition();\n            return;\n          }\n          if (currentJournal.status !== \"current\") {\n            activeAuthSessionTransitionIds.delete(journal.id);\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: false,\n              reason: currentJournal.status,\n            });\n          }\n          await assertTransitionSessionCurrent(\n            currentJournal.journal.candidatePayload\n          );\n          await restoreTransitionPreviousPayload(\n            currentJournal.journal,\n            previousSession\n          );\n          settlement = \"rolled_back\";\n          activeAuthSessionTransitionIds.delete(journal.id);\n          stopRegisteredCandidateService(currentJournal.journal);\n          if (currentJournal.journal.computerHandoff) {\n            await writeAuthSessionTransitionJournalIfOwned(\n              currentJournal.journal,\n              {\n                ...currentJournal.journal,\n                state: \"recovery_required\",\n                computerHandoff: {\n                  ...currentJournal.journal.computerHandoff,\n                  prepareContinuation: undefined,\n                },\n              }\n            );\n            return;\n          }\n          await cleanupCandidateTokenRefs(currentJournal.journal);\n          await removeAuthSessionTransitionJournalIfOwned(\n            currentJournal.journal\n          );\n        }),\n    };\n  });\n}\n\nasync function commitAuthSessionTransitionJournal(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const currentPayload = await readSessionPayloadFile();\n  const previousIsCurrent = journal.previousPayload\n    ? currentPayload?.v === 1 &&\n      buildAuthSessionPayloadKey(currentPayload) ===\n        buildAuthSessionPayloadKey(journal.previousPayload)\n    : currentPayload === null;\n  const candidateIsCurrent =\n    currentPayload?.v === 1 &&\n    buildAuthSessionPayloadKey(currentPayload) ===\n      buildAuthSessionPayloadKey(journal.candidatePayload);\n  if (!(previousIsCurrent || candidateIsCurrent)) {\n    throw new Error(\n      \"auth session changed before the setup transition completed\"\n    );\n  }\n  const payload = journal.candidatePayload;\n  const session = await readStoredAuthSessionFromPayload(payload);\n  await writeSessionPayloadAtomically(authSessionPath(), payload);\n  cacheAuthSession({ payload, session });\n  const committed: AuthSessionTransitionJournalV1 = {\n    ...journal,\n    state: \"committed\",\n  };\n  await writeAuthSessionTransitionJournalIfOwned(journal, committed);\n  activeAuthSessionTransitionIds.delete(journal.id);\n  await finalizeCommittedAuthSessionTransition(committed).catch(\n    (error: unknown) => {\n      logDeferredAuthSessionTransitionCleanup({\n        error,\n        transitionId: journal.id,\n      });\n    }\n  );\n}\n\nexport async function hasPendingComputerSetupContinuation(): Promise<boolean> {\n  const journal = await readAuthSessionTransitionJournal();\n  return (\n    (journal?.state === \"pending\" || journal?.state === \"recovery_required\") &&\n    Boolean(journal.computerHandoff?.prepareContinuation)\n  );\n}\n\n// The OS worker may adopt the existing journal only after its exact owner\n// process exits. Its id, account and Prepare session remain unchanged.\nexport async function resumeInterruptedComputerSetup(\n  run: (\n    input: PrepareSessionContinuation & { gatewayUrl: string }\n  ) => Promise<\"completed\" | \"not_completed\">\n): Promise<boolean> {\n  const claimed = await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readAuthSessionTransitionJournal();\n    if (\n      !(\n        (journal?.state === \"pending\" ||\n          journal?.state === \"recovery_required\") &&\n        journal.computerHandoff?.prepareContinuation\n      ) ||\n      isProcessIdentityAlive({\n        ownerPid: journal.ownerPid,\n        ownerProcessStartedAt: journal.ownerProcessStartedAt,\n      })\n    ) {\n      return null;\n    }\n    const next = {\n      ...journal,\n      // Older auth readers roll a dead Terminal back without understanding its\n      // continuation. Keep that original intent until Core confirms completion\n      // or cancellation; current cancellation writers explicitly remove it.\n      state: \"pending\" as const,\n      ownerPid: process.pid,\n      ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n    };\n    // Ownership transfer is performed only here, under the existing mutation\n    // lock, after proving the old owner is dead. Ordinary writes remain fenced.\n    await writeJsonAtomically(authSessionTransitionPath(), next);\n    activeAuthSessionTransitionIds.add(next.id);\n    return {\n      journal: next,\n      continuation: journal.computerHandoff.prepareContinuation,\n      gatewayUrl: journal.computerHandoff.gatewayUrl,\n    };\n  });\n  if (!claimed) {\n    return false;\n  }\n  try {\n    const outcome = await run({\n      ...claimed.continuation,\n      gatewayUrl: claimed.gatewayUrl,\n    });\n    await withAuthSessionTransitionMutationLock(async () => {\n      const current = await readOwnedPendingAuthSessionTransition(\n        claimed.journal\n      );\n      if (current.status !== \"current\") {\n        throw new AuthSessionTransitionConflictError({\n          previousOwnerRestored: false,\n          reason:\n            current.status === \"missing\" ? \"journal_missing\" : current.status,\n        });\n      }\n      if (outcome === \"completed\") {\n        await commitAuthSessionTransitionJournal(current.journal);\n      } else {\n        await restoreTransitionPreviousPayload(current.journal);\n        stopRegisteredCandidateService(current.journal);\n        await writeAuthSessionTransitionJournalIfOwned(current.journal, {\n          ...current.journal,\n          state: \"recovery_required\",\n          computerHandoff: {\n            ...current.journal.computerHandoff,\n            gatewayUrl: claimed.gatewayUrl,\n            prepareContinuation: undefined,\n          },\n        });\n      }\n    });\n    return true;\n  } finally {\n    activeAuthSessionTransitionIds.delete(claimed.journal.id);\n    cachedAuthSession = null;\n  }\n}\n\ntype OwnedPendingAuthSessionTransition =\n  | { status: \"current\"; journal: AuthSessionTransitionJournalV1 }\n  | { status: \"missing\" }\n  | { status: \"journal_not_pending\"; journal: AuthSessionTransitionJournalV1 }\n  | { status: \"journal_replaced\"; journal: AuthSessionTransitionJournalV1 };\n\nasync function readOwnedPendingAuthSessionTransition(\n  expected: AuthSessionTransitionJournalV1\n): Promise<OwnedPendingAuthSessionTransition> {\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (!currentJournal) {\n    return { status: \"missing\" };\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) {\n    return { status: \"journal_replaced\", journal: currentJournal };\n  }\n  if (currentJournal.state !== \"pending\") {\n    return { status: \"journal_not_pending\", journal: currentJournal };\n  }\n  return { status: \"current\", journal: currentJournal };\n}\n\nexport async function getInterruptedComputerAuthSessionRecovery(): Promise<InterruptedComputerAuthSessionRecovery | null> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await recoverInterruptedAuthSessionTransitionWithOwnership();\n    let journal = await readAuthSessionTransitionJournal();\n    // Explicit handoff recovery runs only after joining outstanding updates.\n    // A Terminal may have exited before publishing any durable update, or an\n    // explicit Service stop may have removed its executor. Do not let that\n    // abandoned intent permanently prevent the next user-initiated setup.\n    if (\n      (journal?.state === \"pending\" ||\n        journal?.state === \"recovery_required\") &&\n      journal.computerHandoff?.prepareContinuation &&\n      !isProcessIdentityAlive({\n        ownerPid: journal.ownerPid,\n        ownerProcessStartedAt: journal.ownerProcessStartedAt,\n      })\n    ) {\n      await restoreTransitionPreviousPayload(journal);\n      stopRegisteredCandidateService(journal);\n      const recovery = {\n        ...journal,\n        state: \"recovery_required\" as const,\n        computerHandoff: {\n          ...journal.computerHandoff,\n          prepareContinuation: undefined,\n        },\n      };\n      await writeAuthSessionTransitionJournalIfOwned(journal, recovery);\n      journal = recovery;\n    }\n    if (!(journal?.state === \"recovery_required\" && journal.computerHandoff)) {\n      return null;\n    }\n\n    // Revocation is durable. Finishing local cleanup must not require reading\n    // a credential that has already been revoked (and may already be deleted).\n    if (journal.computerHandoff.remoteSessionRevokedAt) {\n      if (journal.computerHandoff.serviceReconciledAt) {\n        await cleanupCandidateTokenRefs(journal);\n        await removeAuthSessionTransitionJournalIfOwned(journal);\n        return null;\n      }\n      return {\n        candidateSession: null,\n        gatewayUrl: journal.computerHandoff.gatewayUrl,\n        id: journal.id,\n        previousSession: await readRecoverablePreviousSession(\n          journal.previousPayload\n        ),\n        remoteSessionRevoked: true,\n        serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt),\n      };\n    }\n\n    const candidateSession = await readStoredAuthSessionFromPayloadIfPresent(\n      journal.candidatePayload\n    );\n    if (!candidateSession) {\n      throw new AuthSessionStorageError({\n        message: \"auth session recovery token is missing\",\n        reason: \"corrupt\",\n      });\n    }\n    const candidateOwnerUserId = normalizeOptionalString(\n      candidateSession.user?.id\n    );\n    if (!candidateOwnerUserId) {\n      throw new AuthSessionStorageError({\n        message:\n          \"computer auth recovery candidate is missing its owner user id\",\n        reason: \"corrupt\",\n      });\n    }\n\n    return {\n      candidateSession: {\n        ...candidateSession,\n        user: { ...candidateSession.user, id: candidateOwnerUserId },\n      },\n      gatewayUrl: journal.computerHandoff.gatewayUrl,\n      id: journal.id,\n      previousSession: await readRecoverablePreviousSession(\n        journal.previousPayload\n      ),\n      remoteSessionRevoked: false,\n      serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt),\n    };\n  });\n}\n\nexport async function markInterruptedComputerAuthSessionRecovery(input: {\n  id: string;\n  phase: \"service\" | \"remote_session\";\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readRequiredComputerAuthRecoveryJournal(input.id);\n    await writeAuthSessionTransitionJournalIfOwned(journal, {\n      ...journal,\n      computerHandoff: {\n        ...journal.computerHandoff,\n        ...(input.phase === \"service\"\n          ? { serviceReconciledAt: new Date().toISOString() }\n          : { remoteSessionRevokedAt: new Date().toISOString() }),\n        lastRecoveryFailure: undefined,\n      },\n    });\n  });\n}\n\nexport async function recordInterruptedComputerAuthSessionRecoveryFailure(input: {\n  endpoint?: string;\n  id: string;\n  message: string;\n  phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n  status?: number | null;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(\n      input\n    );\n  });\n}\n\nasync function recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(input: {\n  endpoint?: string;\n  id: string;\n  message: string;\n  phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n  status?: number | null;\n}): Promise<void> {\n  const journal = await readRequiredComputerAuthRecoveryJournal(input.id);\n  await writeAuthSessionTransitionJournalIfOwned(journal, {\n    ...journal,\n    computerHandoff: {\n      ...journal.computerHandoff,\n      lastRecoveryFailure: {\n        at: new Date().toISOString(),\n        message: input.message,\n        phase: input.phase,\n        ...(input.endpoint ? { endpoint: input.endpoint } : {}),\n        ...(input.status === undefined ? {} : { status: input.status }),\n      },\n    },\n  });\n}\n\nexport async function completeInterruptedComputerAuthSessionRecovery(\n  id: string\n): Promise<boolean> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readRequiredComputerAuthRecoveryJournal(id);\n    if (\n      !(\n        journal.computerHandoff.serviceReconciledAt &&\n        journal.computerHandoff.remoteSessionRevokedAt\n      )\n    ) {\n      throw new Error(\n        \"computer auth recovery cannot complete before service and remote-session cleanup\"\n      );\n    }\n    try {\n      await cleanupCandidateTokenRefs(journal);\n      await removeAuthSessionTransitionJournalIfOwned(journal);\n      return true;\n    } catch (error) {\n      await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership({\n        id,\n        message: toErrorMessage(error),\n        phase: \"local_cleanup\",\n      }).catch(() => undefined);\n      logDeferredAuthSessionTransitionCleanup({ error, transitionId: id });\n      return false;\n    }\n  });\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const bound = admittedServiceSession.getStore();\n  if (bound) {\n    return (await getBoundServiceSessionState(bound, {})).session;\n  }\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const bound = admittedServiceSession.getStore();\n  if (bound) {\n    await getBoundServiceSessionState(bound, {});\n    return buildAuthSessionMetadata(bound);\n  }\n  const payload = await readSessionPayload();\n  return buildAuthSessionMetadata(payload);\n}\n\nfunction buildAuthSessionMetadata(\n  payload: Partial<AuthSessionV1> | null\n): AuthSessionMetadata | null {\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    const payload = await readSessionPayloadFile();\n    if (payload?.v !== 1) {\n      throw new Error(\"cannot update active organization without auth session\");\n    }\n\n    const tokenRef = normalizeTokenRef(payload.tokenRef);\n    const tokenType = normalizeOptionalString(payload.tokenType);\n    const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n    const clientId = normalizeOptionalString(payload.clientId);\n    const createdAt = normalizeOptionalString(payload.createdAt);\n    if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n      throw new Error(\n        \"cannot update active organization for invalid auth session\"\n      );\n    }\n\n    const nextPayload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType,\n      authBaseUrl,\n      clientId,\n      createdAt,\n      ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n        ? { expiresAt: payload.expiresAt.trim() }\n        : {}),\n      ...(typeof payload.scope === \"string\" && payload.scope.trim()\n        ? { scope: payload.scope.trim() }\n        : {}),\n      ...buildAuthUserPayload(payload.user),\n      ...buildActiveOrganizationPayload(activeOrganization),\n    };\n\n    await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n    const currentCachedSession = readCachedAuthSession(payload);\n    if (currentCachedSession) {\n      cacheAuthSession({\n        payload: nextPayload,\n        session: buildStoredAuthSession({\n          accessToken: currentCachedSession.accessToken,\n          payload: nextPayload,\n        }),\n      });\n    }\n  });\n}\n\nexport async function clearAuthSession(\n  expectedSession?: AuthSessionMetadata\n): Promise<ClearAuthSessionResult> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    cachedAuthSession = null;\n    await retryPendingTokenCleanup();\n    const hadLocalSession = await authSessionFileExists();\n    let payload: Partial<AuthSessionV1> | null;\n    try {\n      payload = await readSessionPayloadFile();\n    } catch (error) {\n      if (expectedSession) {\n        throw error;\n      }\n      if (\n        !(\n          error instanceof AuthSessionStorageError && error.reason === \"corrupt\"\n        )\n      ) {\n        throw error;\n      }\n      // Explicit logout may recover malformed metadata, but must preserve the\n      // original evidence and never guess which Keychain item it referred to.\n      const preservedSessionPath = join(\n        openMeldRootDir(),\n        \"auth\",\n        `session-corrupt-${randomUUID()}.json`\n      );\n      await rename(authSessionPath(), preservedSessionPath);\n      return { hadLocalSession, preservedSessionPath };\n    }\n    assertExpectedPreviousSession({\n      current: buildAuthSessionMetadata(payload),\n      expected: expectedSession,\n    });\n    if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n      await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n    }\n    await removeSessionFile();\n    return { hadLocalSession };\n  });\n}\n\nexport async function assertAuthSessionMutationAvailable(): Promise<void> {\n  await withAuthSessionTransitionMutationLock(\n    assertAuthSessionMutationAvailableWithOwnership\n  );\n}\n\nasync function assertAuthSessionMutationAvailableWithOwnership(): Promise<void> {\n  await assertServiceAccountAdmissionMutationAvailable();\n  const bound = admittedServiceSession.getStore();\n  if (bound) {\n    const current = await readSessionPayloadFile();\n    if (\n      current?.user?.id !== bound.user?.id ||\n      current?.authBaseUrl !== bound.authBaseUrl ||\n      current?.clientId !== bound.clientId\n    ) {\n      throw new AuthSessionChangedBeforeTransitionError();\n    }\n  }\n  await recoverInterruptedAuthSessionTransitionWithOwnership();\n  if (await readAuthSessionTransitionJournal()) {\n    throw new AuthSessionRecoveryInProgressError();\n  }\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(\n  options: {\n    recover?: boolean;\n    reloadCount?: number;\n    boundSessionIdentity?: string;\n  } = {}\n): Promise<LocalAuthSessionState> {\n  let payload: Partial<AuthSessionV1> | null;\n  try {\n    payload =\n      options.recover === false\n        ? await readBoundOrCommittedSessionPayload(options.boundSessionIdentity)\n        : await readSessionPayload();\n  } catch (error) {\n    if (error instanceof AuthSessionStorageError) {\n      cachedAuthSession = null;\n      return {\n        errorMessage: error.message,\n        reasonCode: \"session_metadata_invalid\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    throw error;\n  }\n  if (payload?.v !== 1) {\n    cachedAuthSession = null;\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    cachedAuthSession = null;\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    cachedAuthSession = null;\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const session = readCachedAuthSession(payload);\n  if (!session) {\n    return await loadCurrentSessionCredential(\n      {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n      options\n    );\n  }\n  return resolveLocalStoredSessionState(\n    session,\n    buildAuthSessionPayloadKey(payload)\n  );\n}\n\nfunction resolveLocalStoredSessionState(\n  session: StoredAuthSession,\n  payloadKey: string\n): LocalAuthSessionState {\n  const expiryEligibility = resolveAuthSessionExpiryEligibility(\n    session.expiresAt\n  );\n  if (expiryEligibility.status === \"invalid\") {\n    return {\n      reasonCode: \"session_expiry_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n  if (expiryEligibility.status === \"expired\") {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      payloadKey,\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    payloadKey,\n    session,\n  };\n}\n\nasync function loadCurrentSessionCredential(\n  payload: AuthSessionV1,\n  options: { recover?: boolean; reloadCount?: number }\n): Promise<LocalAuthSessionState> {\n  const credentialKey = buildAuthSessionCredentialCacheKey(payload);\n  const accessToken = await readSessionCredential(\n    credentialKey,\n    payload.tokenRef\n  );\n  // Secret-store reads can outlive logout. Recheck the owner before accepting a result.\n  let currentPayload: Partial<AuthSessionV1> | null;\n  try {\n    currentPayload =\n      options.recover === false\n        ? await readSessionPayloadFile()\n        : await readSessionPayload();\n  } catch (error) {\n    if (!(error instanceof AuthSessionStorageError)) {\n      throw error;\n    }\n    cachedAuthSession = null;\n    return {\n      state: \"invalid\",\n      session: null,\n      reasonCode: \"session_metadata_invalid\",\n      errorMessage: error.message,\n    };\n  }\n  if (\n    !currentPayload ||\n    buildAuthSessionCredentialCacheKey(currentPayload) !== credentialKey\n  ) {\n    if ((options.reloadCount ?? 0) >= 2) {\n      cachedAuthSession = null;\n      return {\n        state: \"invalid\",\n        session: null,\n        reasonCode: \"session_metadata_invalid\",\n        errorMessage:\n          \"The local login changed while reading its credentials. Try again.\",\n      };\n    }\n    return await getLocalAuthSessionState({\n      ...options,\n      reloadCount: (options.reloadCount ?? 0) + 1,\n    });\n  }\n  if (accessToken.status === \"missing\") {\n    return {\n      reasonCode: \"session_token_missing\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n  if (accessToken.status === \"unavailable\") {\n    return {\n      errorMessage: accessToken.errorMessage,\n      retryAfterMs: accessToken.retryAfterMs,\n      reasonCode: \"session_token_unavailable\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n  // Credential-key equality preserves all required fields validated by the caller.\n  const session = buildStoredAuthSession({\n    accessToken: accessToken.accessToken,\n    payload: currentPayload as AuthSessionV1,\n  });\n  cacheAuthSession({ payload: currentPayload, session });\n  return resolveLocalStoredSessionState(\n    session,\n    buildAuthSessionPayloadKey(currentPayload)\n  );\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction assertExpectedPreviousSession(input: {\n  current: AuthSessionMetadata | null;\n  expected: AuthSessionMetadata | null | undefined;\n}): void {\n  if (input.expected === undefined) {\n    return;\n  }\n  if (\n    buildStoredAuthSessionIdentity(input.current) !==\n    buildStoredAuthSessionIdentity(input.expected)\n  ) {\n    throw new AuthSessionChangedBeforeTransitionError();\n  }\n}\n\nexport function buildStoredAuthSessionIdentity(\n  session: AuthSessionMetadata | null\n): string {\n  if (!session) {\n    return \"missing\";\n  }\n  // Token rotation, expiry refresh, display metadata, and Organization\n  // selection do not change the signed-in Computer session the user reviewed.\n  // createdAt changes on every committed login, while user.id catches a real\n  // cross-account replacement even if two sessions are created together.\n  const identitySource = JSON.stringify([\n    session.authBaseUrl,\n    session.clientId,\n    session.createdAt,\n    session.user?.id ?? null,\n  ]);\n  return createHash(\"sha256\").update(identitySource).digest(\"base64url\");\n}\n\nasync function cleanupTransitionTokensNotReferencedByCurrentSession(input: {\n  currentPayload: Partial<AuthSessionV1> | null;\n  journal: AuthSessionTransitionJournalV1;\n}): Promise<void> {\n  const currentTokenRef = normalizeTokenRef(input.currentPayload?.tokenRef);\n  const previousTokenRef = normalizeTokenRef(\n    input.journal.previousPayload?.tokenRef\n  );\n  const transitionTokenRefs = [\n    ...(previousTokenRef ? [previousTokenRef] : []),\n    ...getCandidateTokenRefs(input.journal),\n  ];\n\n  for (const [index, tokenRef] of transitionTokenRefs.entries()) {\n    const alreadyHandled = transitionTokenRefs\n      .slice(0, index)\n      .some((previousRef) => areStoredTokenRefsEqual(previousRef, tokenRef));\n    if (\n      alreadyHandled ||\n      (currentTokenRef && areStoredTokenRefsEqual(currentTokenRef, tokenRef))\n    ) {\n      continue;\n    }\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n  }\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  const credentialKey = buildAuthSessionCredentialCacheKey(input.payload);\n  const becameAvailable = cachedAuthSession?.credentialKey !== credentialKey;\n  const previous = cachedAuthSession;\n  cachedAuthSession = {\n    credentialKey,\n    session: input.session,\n  };\n  if (!previous) {\n    observeCredential(\"credential_available\");\n  } else if (previous.session.user?.id !== input.session.user?.id) {\n    observeCredential(\"account_changed\");\n  } else if (becameAvailable) {\n    observeCredential(\"credential_changed\");\n  } else if (\n    JSON.stringify([\n      previous.session.activeOrganization,\n      previous.session.user,\n    ]) !==\n    JSON.stringify([input.session.activeOrganization, input.session.user])\n  ) {\n    observeCredential(\"context_changed\");\n  }\n  if (becameAvailable) {\n    const path = authSessionPath();\n    for (const listener of credentialAvailabilityListeners) {\n      if (listener.path === path) {\n        listener.notify();\n      }\n    }\n  }\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  if (\n    cachedAuthSession?.credentialKey !==\n    buildAuthSessionCredentialCacheKey(payload)\n  ) {\n    return null;\n  }\n  const session = buildStoredAuthSession({\n    accessToken: cachedAuthSession.session.accessToken,\n    payload: payload as AuthSessionV1,\n  });\n  // Context is freshly read; the exact payload still fences remote refreshes.\n  cacheAuthSession({ payload, session });\n  return session;\n}\n\nfunction buildAuthSessionCredentialCacheKey(\n  payload: Partial<AuthSessionV1>\n): string {\n  return `${authSessionPath()}\\n${JSON.stringify({\n    v: payload.v,\n    tokenRef: payload.tokenRef,\n    tokenType: payload.tokenType,\n    authBaseUrl: payload.authBaseUrl,\n    clientId: payload.clientId,\n    createdAt: payload.createdAt,\n    expiresAt: payload.expiresAt,\n    scope: payload.scope,\n    ownerUserId: payload.user?.id,\n  })}`;\n}\n\nasync function readSessionCredential(\n  key: string,\n  ref: StoredTokenRef\n): ReturnType<typeof readAccessToken> {\n  const pending = pendingCredentialReads.get(key);\n  if (pending) {\n    return await pending;\n  }\n  const read = readAccessToken(ref).finally(() => {\n    if (pendingCredentialReads.get(key) === read) {\n      pendingCredentialReads.delete(key);\n    }\n  });\n  pendingCredentialReads.set(key, read);\n  return await read;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction getUniqueTokenRefs(tokenRefs: StoredTokenRef[]): StoredTokenRef[] {\n  const uniqueTokenRefs: StoredTokenRef[] = [];\n  for (const tokenRef of tokenRefs) {\n    if (\n      !uniqueTokenRefs.some((existing) =>\n        areStoredTokenRefsEqual(existing, tokenRef)\n      )\n    ) {\n      uniqueTokenRefs.push(tokenRef);\n    }\n  }\n  return uniqueTokenRefs;\n}\n\nfunction getCandidateTokenRefs(\n  journal: AuthSessionTransitionJournalV1\n): StoredTokenRef[] {\n  return getUniqueTokenRefs([\n    ...(journal.candidateTokenRefs ?? []),\n    journal.candidatePayload.tokenRef,\n  ]);\n}\n\nasync function cleanupCandidateTokenRefs(\n  journal: AuthSessionTransitionJournalV1,\n  keepTokenRef?: StoredTokenRef\n): Promise<void> {\n  for (const tokenRef of getCandidateTokenRefs(journal)) {\n    if (keepTokenRef && areStoredTokenRefsEqual(keepTokenRef, tokenRef)) {\n      continue;\n    }\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n  }\n}\n\nasync function persistRemoteSessionRefresh(input: {\n  accessToken: string;\n  expectedPayloadKey: string | null;\n  expiresAt: string;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    const bound = admittedServiceSession.getStore();\n    if (bound) {\n      const current = await getLocalAuthSessionState({\n        recover: false,\n        boundSessionIdentity: buildStoredAuthSessionIdentity(bound),\n      });\n      if (!isSameAuthPrincipal(current.session, bound)) {\n        return null;\n      }\n    }\n    await assertServiceAccountAdmissionMutationAvailable();\n    await recoverInterruptedAuthSessionTransitionWithOwnership();\n    const transitionJournal = await readAuthSessionTransitionJournal();\n    if (transitionJournal) {\n      if (\n        transitionJournal.state === \"pending\" &&\n        transitionJournal.candidateCredentialRefreshVersion === 1 &&\n        isAuthSessionTransitionCandidateVisibleToCurrentProcess(\n          transitionJournal\n        ) &&\n        input.expectedPayloadKey !== null &&\n        buildAuthSessionPayloadKey(transitionJournal.candidatePayload) ===\n          input.expectedPayloadKey\n      ) {\n        return await persistPendingCandidateRemoteSessionRefresh({\n          ...input,\n          journal: transitionJournal,\n        });\n      }\n      throw new AuthSessionRecoveryInProgressError();\n    }\n    return await persistCommittedRemoteSessionRefresh(input);\n  });\n}\n\nasync function persistCommittedRemoteSessionRefresh(input: {\n  accessToken: string;\n  expectedPayloadKey: string | null;\n  expiresAt: string;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  const payload = await readSessionPayloadFile();\n  if (\n    payload?.v !== 1 ||\n    input.expectedPayloadKey === null ||\n    buildAuthSessionPayloadKey(payload) !== input.expectedPayloadKey\n  ) {\n    return null;\n  }\n  const refresh = await prepareRemoteSessionRefresh({\n    ...input,\n    payload,\n    uniqueTokenRef: true,\n  });\n  if (!refresh) {\n    return null;\n  }\n\n  try {\n    await assertStoredAccessTokenReloads({\n      accessToken: refresh.nextSession.accessToken,\n      tokenRef: refresh.nextTokenRef,\n    });\n    await writeSessionPayloadAtomically(authSessionPath(), refresh.nextPayload);\n  } catch (error) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload: refresh.nextPayload,\n    session: refresh.nextSession,\n  });\n  if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(refresh.currentTokenRef);\n  }\n  return refresh.nextSession;\n}\n\nasync function persistPendingCandidateRemoteSessionRefresh(input: {\n  accessToken: string;\n  expiresAt: string;\n  journal: AuthSessionTransitionJournalV1;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  const refresh = await prepareRemoteSessionRefresh({\n    ...input,\n    payload: input.journal.candidatePayload,\n    uniqueTokenRef: true,\n  });\n  if (!refresh) {\n    return null;\n  }\n  const candidateTokenRefs = getUniqueTokenRefs([\n    ...getCandidateTokenRefs(input.journal),\n    refresh.nextTokenRef,\n  ]);\n  if (candidateTokenRefs.length > MAX_CANDIDATE_TOKEN_REFS) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw new AuthSessionStorageError({\n      message: `auth session transition has more than ${String(MAX_CANDIDATE_TOKEN_REFS)} candidate token rotations`,\n      reason: \"unreadable\",\n    });\n  }\n  const nextJournal: AuthSessionTransitionJournalV1 = {\n    ...input.journal,\n    candidatePayload: refresh.nextPayload,\n    candidateTokenRefs,\n  };\n\n  try {\n    await assertStoredAccessTokenReloads({\n      accessToken: refresh.nextSession.accessToken,\n      tokenRef: refresh.nextTokenRef,\n    });\n    await writeAuthSessionTransitionJournalIfOwned(input.journal, nextJournal);\n  } catch (error) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload: refresh.nextPayload,\n    session: refresh.nextSession,\n  });\n  return refresh.nextSession;\n}\n\ntype PreparedRemoteSessionRefresh = {\n  currentTokenRef: StoredTokenRef;\n  nextPayload: AuthSessionV1;\n  nextSession: StoredAuthSession;\n  nextTokenRef: StoredTokenRef;\n};\n\nasync function prepareRemoteSessionRefresh(input: {\n  accessToken: string;\n  expiresAt: string;\n  payload: Partial<AuthSessionV1>;\n  previousAccessToken: string;\n  uniqueTokenRef: boolean;\n}): Promise<PreparedRemoteSessionRefresh | null> {\n  const currentTokenRef = normalizeTokenRef(input.payload.tokenRef);\n  const tokenType = normalizeOptionalString(input.payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(input.payload.authBaseUrl);\n  const clientId = normalizeOptionalString(input.payload.clientId);\n  const createdAt = normalizeOptionalString(input.payload.createdAt);\n  const nextAccessToken = normalizeOptionalString(input.accessToken);\n  if (\n    !(\n      currentTokenRef &&\n      tokenType &&\n      authBaseUrl &&\n      clientId &&\n      createdAt &&\n      nextAccessToken\n    )\n  ) {\n    return null;\n  }\n\n  const nextTokenRef =\n    nextAccessToken === input.previousAccessToken\n      ? currentTokenRef\n      : await storeAccessToken({\n          accessToken: nextAccessToken,\n          authBaseUrl,\n          clientId,\n          unique: input.uniqueTokenRef,\n        });\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef: nextTokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    expiresAt: input.expiresAt,\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n  return {\n    currentTokenRef,\n    nextPayload,\n    nextSession: buildStoredAuthSession({\n      accessToken: nextAccessToken,\n      payload: nextPayload,\n    }),\n    nextTokenRef,\n  };\n}\n\nasync function cleanupFailedRemoteSessionRefresh(\n  refresh: PreparedRemoteSessionRefresh\n): Promise<void> {\n  if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(refresh.nextTokenRef);\n  }\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return {\n      state: \"valid\",\n      ...readRemoteAccessToken(response),\n      ...readRemoteSessionExpiration(payload),\n    };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction readRemoteAccessToken(response: Response): {\n  accessToken?: string;\n} {\n  const accessToken = normalizeOptionalString(\n    response.headers.get(\"set-auth-token\")\n  );\n  return accessToken ? { accessToken } : {};\n}\n\nfunction readRemoteSessionExpiration(payload: unknown): {\n  expiresAt?: string;\n} {\n  if (!isRecord(payload)) {\n    return {};\n  }\n  const session = payload.session;\n  if (!isRecord(session)) {\n    return {};\n  }\n  const expiresAt = normalizeOptionalString(session.expiresAt);\n  if (!expiresAt) {\n    return {};\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return {};\n  }\n  return { expiresAt: new Date(expiresAtMs).toISOString() };\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  return resolveAuthSessionExpiryEligibility(expiresAt).status === \"expired\";\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  await recoverInterruptedAuthSessionTransition();\n  const journal = await readAuthSessionTransitionJournal();\n  if (journal?.state === \"pending\") {\n    const candidateVisible =\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal);\n    if (candidateVisible) {\n      return journal.candidatePayload;\n    }\n  }\n  return await readSessionPayloadFile();\n}\n\nfunction isAuthSessionTransitionCandidateVisibleToCurrentProcess(\n  journal: AuthSessionTransitionJournalV1\n): boolean {\n  if (activeAuthSessionTransitionIds.has(journal.id)) {\n    return true;\n  }\n  return getRegisteredCandidateServiceProcesses(journal).some(\n    (candidateServiceProcess) =>\n      isSameProcessIdentity(candidateServiceProcess, {\n        ownerPid: process.pid,\n        ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n      })\n  );\n}\n\nasync function readBoundOrCommittedSessionPayload(\n  boundSessionIdentity: string | undefined\n): Promise<Partial<AuthSessionV1> | null> {\n  if (boundSessionIdentity) {\n    const journal = await readAuthSessionTransitionJournal();\n    if (\n      journal?.state === \"pending\" &&\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal) &&\n      buildStoredAuthSessionIdentity(journal.candidatePayload) ===\n        boundSessionIdentity\n    ) {\n      // Reconnect can stage a new login for the same principal. Its admitted\n      // Service must follow that candidate's credential writer, not adopt the\n      // previous committed login while the Host verifies the new identity.\n      return journal.candidatePayload;\n    }\n  }\n  return await readSessionPayloadFile();\n}\n\nasync function readSessionPayloadFile(): Promise<Partial<AuthSessionV1> | null> {\n  const path = authSessionPath();\n  const raw = await readFile(path, \"utf8\").catch((error: unknown) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw new AuthSessionStorageError({\n      message: `current auth session metadata could not be read at ${path}: ${toErrorMessage(error)}`,\n      reason: \"unreadable\",\n      cause: error,\n    });\n  });\n  if (raw === null) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch (error) {\n    throw new AuthSessionStorageError({\n      message: `current auth session metadata is corrupt at ${path}`,\n      reason: \"corrupt\",\n      cause: error,\n    });\n  }\n}\n\nasync function recoverInterruptedAuthSessionTransition(): Promise<void> {\n  // Committed session reads do not mutate state. Only enter the recovery\n  // critical section when a durable transition actually needs inspection.\n  // The locked operation rereads the journal before making any changes.\n  if (!(await readAuthSessionTransitionJournal())) {\n    return;\n  }\n  await withAuthSessionTransitionMutationLock(\n    recoverInterruptedAuthSessionTransitionWithOwnership\n  );\n}\n\nasync function recoverInterruptedAuthSessionTransitionWithOwnership(): Promise<void> {\n  let journal = await readAuthSessionTransitionJournal();\n  if (!journal) {\n    return;\n  }\n  await assertServiceAccountAdmissionMutationAvailable();\n  if (activeAuthSessionTransitionIds.has(journal.id)) {\n    return;\n  }\n  if (\n    journal.state === \"pending\" &&\n    isProcessIdentityAlive({\n      ownerPid: journal.ownerPid,\n      ownerProcessStartedAt: journal.ownerProcessStartedAt,\n    })\n  ) {\n    journal = await registerCurrentCandidateServiceProcess(journal);\n    return;\n  }\n\n  if (journal.state === \"pending\") {\n    // A durable setup is still intended after its Terminal exits. The existing\n    // maintenance worker resumes this Prepare session; reads must not roll back\n    // its account or kill the Service that is completing the update.\n    if (journal.computerHandoff?.prepareContinuation) {\n      await registerCurrentCandidateServiceProcess(journal);\n      return;\n    }\n    await restoreTransitionPreviousPayload(journal);\n    stopRegisteredCandidateService(journal);\n    if (journal.computerHandoff) {\n      await writeAuthSessionTransitionJournalIfOwned(journal, {\n        ...journal,\n        state: \"recovery_required\",\n      });\n      return;\n    }\n    await cleanupCandidateTokenRefs(journal);\n    await removeAuthSessionTransitionJournalIfOwned(journal);\n    return;\n  }\n  if (journal.state === \"recovery_required\") {\n    if (journal.computerHandoff?.prepareContinuation) {\n      return;\n    }\n    stopRegisteredCandidateService(journal);\n    return;\n  }\n\n  if (journal.state === \"committed\") {\n    const currentPayload = await readSessionPayloadFile();\n    if (\n      currentPayload?.v !== 1 ||\n      buildAuthSessionPayloadKey(currentPayload) !==\n        buildAuthSessionPayloadKey(journal.candidatePayload)\n    ) {\n      throw new AuthSessionStorageError({\n        message:\n          \"committed auth session transition does not match current session metadata\",\n        reason: \"corrupt\",\n      });\n    }\n    await finalizeCommittedAuthSessionTransition(journal).catch(\n      (error: unknown) => {\n        logDeferredAuthSessionTransitionCleanup({\n          error,\n          transitionId: journal.id,\n        });\n      }\n    );\n  }\n}\n\nasync function finalizeCommittedAuthSessionTransition(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const previousTokenRef = normalizeTokenRef(journal.previousPayload?.tokenRef);\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(\n      previousTokenRef,\n      journal.candidatePayload.tokenRef\n    )\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n  await cleanupCandidateTokenRefs(journal, journal.candidatePayload.tokenRef);\n  await removeAuthSessionTransitionJournalIfOwned(journal);\n}\n\nasync function registerCurrentCandidateServiceProcess(\n  journal: AuthSessionTransitionJournalV1\n): Promise<AuthSessionTransitionJournalV1> {\n  if (!isCurrentProcessCandidateService()) {\n    return journal;\n  }\n  const currentProcess: ProcessIdentity = {\n    ownerPid: process.pid,\n    ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n  };\n  if (\n    getRegisteredCandidateServiceProcesses(journal).some(\n      (candidateServiceProcess) =>\n        isSameProcessIdentity(candidateServiceProcess, currentProcess)\n    )\n  ) {\n    return journal;\n  }\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (currentJournal?.id !== journal.id || currentJournal.state !== \"pending\") {\n    return currentJournal ?? journal;\n  }\n  const candidateServiceProcesses = getRegisteredCandidateServiceProcesses(\n    currentJournal\n  ).filter((candidate) => isProcessIdentityAlive(candidate));\n  candidateServiceProcesses.push(currentProcess);\n  if (candidateServiceProcesses.length > MAX_CANDIDATE_SERVICE_PROCESSES) {\n    throw new Error(\n      `auth session transition has more than ${String(MAX_CANDIDATE_SERVICE_PROCESSES)} live candidate OpenMeld Service processes`\n    );\n  }\n  const updatedJournal = {\n    ...currentJournal,\n    candidateServiceProcesses,\n    candidateServiceProcess: currentProcess,\n  };\n  await writeAuthSessionTransitionJournalIfOwned(\n    currentJournal,\n    updatedJournal\n  );\n  return updatedJournal;\n}\n\nfunction stopRegisteredCandidateService(\n  journal: AuthSessionTransitionJournalV1\n): void {\n  for (const candidateServiceProcess of getRegisteredCandidateServiceProcesses(\n    journal\n  )) {\n    if (!isProcessIdentityAlive(candidateServiceProcess)) {\n      continue;\n    }\n    try {\n      process.kill(candidateServiceProcess.ownerPid, \"SIGTERM\");\n    } catch (error) {\n      if (!isFileNotFoundErrorCode(error, \"ESRCH\")) {\n        throw new AuthSessionStorageError({\n          message: `candidate OpenMeld Service process ${String(candidateServiceProcess.ownerPid)} could not be stopped: ${toErrorMessage(error)}`,\n          reason: \"unreadable\",\n          cause: error,\n        });\n      }\n    }\n  }\n}\n\nfunction getRegisteredCandidateServiceProcesses(\n  journal: AuthSessionTransitionJournalV1\n): ProcessIdentity[] {\n  const candidates = [\n    ...(journal.candidateServiceProcesses ?? []),\n    ...(journal.candidateServiceProcess\n      ? [journal.candidateServiceProcess]\n      : []),\n  ];\n  const uniqueCandidates: ProcessIdentity[] = [];\n  for (const candidate of candidates) {\n    if (\n      !uniqueCandidates.some((existing) =>\n        isSameProcessIdentity(existing, candidate)\n      )\n    ) {\n      uniqueCandidates.push(candidate);\n    }\n  }\n  return uniqueCandidates;\n}\n\nfunction isSameProcessIdentity(\n  left: ProcessIdentity,\n  right: ProcessIdentity\n): boolean {\n  return (\n    left.ownerPid === right.ownerPid &&\n    left.ownerProcessStartedAt === right.ownerProcessStartedAt\n  );\n}\n\nfunction isCurrentProcessCandidateService(): boolean {\n  const runtimeMode = String(\n    process.env.OPENMELD_DAEMON_RUNTIME_MODE ?? \"\"\n  ).trim();\n  return runtimeMode === \"background\" || runtimeMode === \"foreground\";\n}\n\nasync function readStoredAuthSessionFromPayload(\n  payload: AuthSessionV1\n): Promise<StoredAuthSession> {\n  const session = await readStoredAuthSessionFromPayloadIfPresent(payload);\n  if (!session) {\n    throw new AuthSessionStorageError({\n      message: \"auth session recovery token is missing\",\n      reason: \"corrupt\",\n    });\n  }\n  return session;\n}\n\nasync function readStoredAuthSessionFromPayloadIfPresent(\n  payload: AuthSessionV1\n): Promise<StoredAuthSession | null> {\n  const accessToken = await readAccessToken(payload.tokenRef);\n  if (accessToken.status === \"missing\") {\n    return null;\n  }\n  if (accessToken.status === \"unavailable\") {\n    throw new AuthSessionStorageError({\n      message: accessToken.errorMessage,\n      reason: \"unreadable\",\n    });\n  }\n  return buildStoredAuthSession({\n    accessToken: accessToken.accessToken,\n    payload,\n  });\n}\n\nasync function readRecoverablePreviousSession(\n  payload: AuthSessionV1 | null\n): Promise<StoredAuthSession | null> {\n  if (!payload) {\n    return null;\n  }\n  const token = await readAccessToken(payload.tokenRef);\n  // The rollback has already restored the original payload. An unreadable\n  // credential cannot restart a Service, but must not prevent cleanup of the\n  // failed candidate or permanently block a fresh authorization attempt.\n  return token.status === \"found\"\n    ? buildStoredAuthSession({ accessToken: token.accessToken, payload })\n    : null;\n}\n\nasync function readRequiredComputerAuthRecoveryJournal(id: string): Promise<\n  AuthSessionTransitionJournalV1 & {\n    computerHandoff: NonNullable<\n      AuthSessionTransitionJournalV1[\"computerHandoff\"]\n    >;\n  }\n> {\n  const journal = await readAuthSessionTransitionJournal();\n  if (\n    journal?.id !== id ||\n    journal.state !== \"recovery_required\" ||\n    !journal.computerHandoff\n  ) {\n    throw new Error(\"computer auth recovery is no longer current\");\n  }\n  return journal as AuthSessionTransitionJournalV1 & {\n    computerHandoff: NonNullable<\n      AuthSessionTransitionJournalV1[\"computerHandoff\"]\n    >;\n  };\n}\n\nfunction logDeferredAuthSessionTransitionCleanup(input: {\n  error: unknown;\n  transitionId: string;\n}): void {\n  console.warn(\"[openmeld.auth.session_transition_cleanup_deferred]\", {\n    error: toErrorMessage(input.error),\n    transitionId: input.transitionId,\n  });\n}\n\nasync function restoreTransitionPreviousPayload(\n  journal: AuthSessionTransitionJournalV1,\n  previousSession?: StoredAuthSession | null\n): Promise<void> {\n  cachedAuthSession = null;\n  if (!journal.previousPayload) {\n    await removeSessionFile();\n    return;\n  }\n  await writeSessionPayloadAtomically(\n    authSessionPath(),\n    journal.previousPayload\n  );\n  if (previousSession) {\n    cacheAuthSession({\n      payload: journal.previousPayload,\n      session: previousSession,\n    });\n  }\n}\n\nasync function readAuthSessionTransitionJournal(): Promise<AuthSessionTransitionJournalV1 | null> {\n  const path = authSessionTransitionPath();\n  const raw = await readFile(path, \"utf8\").catch((error: unknown) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw new AuthSessionStorageError({\n      message: `auth session transition state could not be read at ${path}: ${toErrorMessage(error)}`,\n      reason: \"unreadable\",\n      cause: error,\n    });\n  });\n  if (raw === null) {\n    return null;\n  }\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new AuthSessionStorageError({\n      message: `auth session transition state is corrupt at ${path}`,\n      reason: \"corrupt\",\n      cause: error,\n    });\n  }\n  if (!isAuthSessionTransitionJournal(value)) {\n    throw new AuthSessionStorageError({\n      message: `auth session transition state is corrupt at ${path}`,\n      reason: \"corrupt\",\n    });\n  }\n  return value;\n}\n\nfunction isAuthSessionTransitionJournal(\n  value: unknown\n): value is AuthSessionTransitionJournalV1 {\n  if (!isRecord(value)) {\n    return false;\n  }\n  return (\n    value.v === 1 &&\n    typeof value.id === \"string\" &&\n    value.id.length > 0 &&\n    (value.state === \"pending\" ||\n      value.state === \"recovery_required\" ||\n      value.state === \"committed\") &&\n    Number.isSafeInteger(value.ownerPid) &&\n    Number(value.ownerPid) > 0 &&\n    typeof value.ownerProcessStartedAt === \"string\" &&\n    value.ownerProcessStartedAt.length > 0 &&\n    (value.previousPayload === null ||\n      isAuthSessionPayload(value.previousPayload)) &&\n    isAuthSessionPayload(value.candidatePayload) &&\n    (value.candidateCredentialRefreshVersion === undefined ||\n      value.candidateCredentialRefreshVersion === 1) &&\n    isOptionalStoredTokenRefList(value.candidateTokenRefs) &&\n    isOptionalProcessIdentityList(value.candidateServiceProcesses) &&\n    isOptionalProcessIdentity(value.candidateServiceProcess) &&\n    isOptionalComputerHandoffRecovery(value.computerHandoff)\n  );\n}\n\nfunction isOptionalStoredTokenRefList(value: unknown): boolean {\n  return (\n    value === undefined ||\n    (Array.isArray(value) &&\n      value.length <= MAX_CANDIDATE_TOKEN_REFS &&\n      value.every((tokenRef) => isStoredTokenRef(tokenRef)))\n  );\n}\n\nfunction isOptionalProcessIdentityList(value: unknown): boolean {\n  return (\n    value === undefined ||\n    (Array.isArray(value) &&\n      value.length <= MAX_CANDIDATE_SERVICE_PROCESSES &&\n      value.every((candidate) => isProcessIdentity(candidate)))\n  );\n}\n\nfunction isOptionalProcessIdentity(value: unknown): boolean {\n  return value === undefined || isProcessIdentity(value);\n}\n\nfunction isProcessIdentity(value: unknown): value is ProcessIdentity {\n  return (\n    isRecord(value) &&\n    Number.isSafeInteger(value.ownerPid) &&\n    Number(value.ownerPid) > 0 &&\n    typeof value.ownerProcessStartedAt === \"string\" &&\n    value.ownerProcessStartedAt.length > 0\n  );\n}\n\nfunction isOptionalComputerHandoffRecovery(value: unknown): boolean {\n  if (value === undefined) {\n    return true;\n  }\n  if (!(isRecord(value) && typeof value.gatewayUrl === \"string\")) {\n    return false;\n  }\n  return (\n    (value.prepareContinuation === undefined ||\n      prepareSessionContinuationSchema.safeParse(value.prepareContinuation)\n        .success) &&\n    (value.serviceReconciledAt === undefined ||\n      typeof value.serviceReconciledAt === \"string\") &&\n    (value.remoteSessionRevokedAt === undefined ||\n      typeof value.remoteSessionRevokedAt === \"string\") &&\n    (value.lastRecoveryFailure === undefined ||\n      isComputerHandoffRecoveryFailure(value.lastRecoveryFailure))\n  );\n}\n\nfunction isComputerHandoffRecoveryFailure(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    typeof value.at === \"string\" &&\n    typeof value.message === \"string\" &&\n    (value.phase === \"service\" ||\n      value.phase === \"remote_session\" ||\n      value.phase === \"local_cleanup\") &&\n    (value.endpoint === undefined || typeof value.endpoint === \"string\") &&\n    (value.status === undefined ||\n      value.status === null ||\n      typeof value.status === \"number\")\n  );\n}\n\nfunction isAuthSessionPayload(value: unknown): value is AuthSessionV1 {\n  return isRecord(value) && value.v === 1 && isStoredTokenRef(value.tokenRef);\n}\n\nasync function writeAuthSessionTransitionJournalIfOwned(\n  expected: AuthSessionTransitionJournalV1,\n  next: AuthSessionTransitionJournalV1\n): Promise<void> {\n  if (!hasSameAuthSessionTransitionIdentity(expected, next)) {\n    throw new Error(\"auth session transition identity cannot change\");\n  }\n  const current = await readAuthSessionTransitionJournal();\n  if (!current) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_missing\",\n    });\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, current)) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_replaced\",\n    });\n  }\n  await writeJsonAtomically(authSessionTransitionPath(), next);\n}\n\nasync function claimAuthSessionTransitionJournal(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const path = authSessionTransitionPath();\n  const claimPath = `${path}.claim-${process.pid}-${Date.now()}-${randomUUID()}`;\n  const file = await open(claimPath, \"wx\", 0o600);\n  let failure: unknown;\n  try {\n    await file.writeFile(`${JSON.stringify(journal, null, 2)}\\n`, \"utf8\");\n    await file.sync();\n  } catch (error) {\n    failure = error;\n  }\n  try {\n    await file.close();\n  } catch (error) {\n    failure ??= error;\n  }\n  if (failure !== undefined) {\n    await rm(claimPath, { force: true }).catch(() => undefined);\n    throw failure;\n  }\n\n  try {\n    await link(claimPath, path);\n  } catch (error) {\n    if (isFileNotFoundErrorCode(error, \"EEXIST\")) {\n      throw new AuthSessionRecoveryInProgressError();\n    }\n    throw error;\n  } finally {\n    await rm(claimPath, { force: true }).catch(() => undefined);\n  }\n}\n\nasync function removeAuthSessionTransitionJournalIfOwned(\n  expected: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (!currentJournal) {\n    return;\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_replaced\",\n    });\n  }\n  await rm(authSessionTransitionPath(), { force: true });\n}\n\nfunction hasSameAuthSessionTransitionIdentity(\n  left: AuthSessionTransitionJournalV1,\n  right: AuthSessionTransitionJournalV1\n): boolean {\n  return (\n    left.id === right.id &&\n    left.ownerPid === right.ownerPid &&\n    left.ownerProcessStartedAt === right.ownerProcessStartedAt\n  );\n}\n\nfunction authSessionTransitionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session-transition.json\");\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function ensureAuthSessionDirectory(): Promise<void> {\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction isFileNotFoundErrorCode(error: unknown, code: string): boolean {\n  return Boolean(\n    error && typeof error === \"object\" && \"code\" in error && error.code === code\n  );\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error && error.message.trim()\n    ? error.message.trim()\n    : String(error ?? \"unknown error\");\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAEA,MAAM,wCAAwC,IAAI,KAAK;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,8CAA8C,IAAI,aAAa;CACpE,MAAM,IAAI,QAAQ,OAAO;CACzB,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACtC,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACnC,iBAAiB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AAC9C,CAAC;AACD,MAAM,8CAA8C,IAAI,aAAa;CACpE,eAAe,IAAI,QAAQ,CAAC;CAC5B,aAAa,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACxC,WAAW,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACtC,kBAAkB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CACxD,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACzC,WAAW,IAAI,OAAO,CAAC,CAAC,SAAS;CACjC,YAAY,IAAI,OAAO,CAAC,CAAC,SAAS;CAClC,OAAO;CACP,OAAO,IAAI,KAAK;EACf;EACA;EACA;CACD,CAAC;CACD,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACjC,aAAa,4CAA4C,SAAS;CAClE,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;AAC/C,CAAC;;;ACnCD,MAAM,2CAA2C,IAAI,KAAK;CACzD;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,2CAA2C,IAAI,KAAK;CACzD;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,0DAA0D,IAAI,KAAK,CAAC,cAAc,iBAAiB,CAAC;AAC1G,MAAM,8DAA8D,IAAI,KAAK;CAC5E;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,oDAAoD,IAAI,aAAa;CAC1E,QAAQ;CACR,YAAY;CACZ,eAAe;CACf,eAAe,IAAI,MAAM,CAAC,yBAAyB,IAAI,KAAK,CAAC,CAAC;CAC9D,WAAW,IAAI,MAAM,CAAC,4BAA4B,IAAI,KAAK,CAAC,CAAC;AAC9D,CAAC;AACD,MAAM,mCAAmC,IAAI,KAAK;CACjD;CACA;CACA;CACA;AACD,CAAC;AAED,MAAM,wCAAwC,IAAI,aAAa;CAC9D,eAAe;CACf,eAAe;CACf,kBAAkB,IAAI,MAAM,CAAC,8BAA8B,IAAI,KAAK,CAAC,CAAC;CACtE,iBAAiB;CACjB,wBAAwB,kDAAkD,SAAS;AACpF,CAAC;AACD,MAAM,oCAAoC,IAAI,aAAa;CAC1D,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CAClC,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CAClC,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACjC,kBAAkB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AACD,MAAM,uCAAuC,IAAI,aAAa;CAC7D,QAAQ;CACR,aAAa,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;CACrC,SAAS;AACV,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC9B,IAAI,MAAM,QAAQ,WAAW,MAAM,QAAQ,WAAW,MAAM,QAAQ,UAAU,MAAM,QAAQ,qBAAqB,MAAM,aAAa,IAAI,SAAS;EAChJ,MAAM;EACN,SAAS;EACT,MAAM,CAAC,SAAS;CACjB,CAAC;AACF,CAAC;AACD,MAAM,gCAAgC;AACF,IAAI,aAAa;CACpD,UAAU;CACV,aAAa;CACb,YAAY;CACZ,kBAAkB;CAClB,iBAAiB;CACjB,oBAAoB;CACpB,sBAAsB;AACvB,CAAC;;;ACjED,MAAM,4BAA4B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAChE,MAAM,mCAAmC,aAAa;CACrD,kBAAkB;CAClB,qBAAqB,mBAAmB,QAAQ;EAC/C,aAAa,EAAE,MAAM,QAAQ,KAAK,EAAE,CAAC;EACrC,aAAa,EAAE,MAAM,QAAQ,MAAM,EAAE,CAAC;EACtC,aAAa;GACZ,MAAM,QAAQ,UAAU;GACxB,eAAe,MAAM,yBAAyB,CAAC,CAAC,IAAI,EAAE;EACvD,CAAC;CACF,CAAC,CAAC,CAAC,SAAS;AACb,CAAC;AACD,MAAM,6BAA6B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACjE,MAAM,8BAA8B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAClE,MAAM,2BAA2B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAChE,MAAM,qCAAqC;AAC3C,MAAM,kCAAkC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,kCAAkC;AACrG,MAAM,+BAA+B,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;AAC1E,MAAM,oCAAoC,MAAM,CAAC,8BAA8B,YAAY,CAAC,CAAC;AAC7F,MAAM,6CAA6C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACjF,MAAM,8CAA8C;AACpD,MAAM,qDAAqD;AAC3D,MAAM,sDAAsD;AAC5D,MAAM,iDAAiD;AACvD,MAAM,iDAAiD;AACvD,MAAM,gDAAgD;AACtD,MAAM,sDAAsD;AAC5D,MAAM,yCAAyC,OAAO;CACrD,YAAY,YAAY;EACvB;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,QAAQ,QAAQ;CAChB,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC,CAAC;CAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,mDAAmD,GAAG,YAAY,CAAC,CAAC;CACtG,kBAAkB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,mDAAmD,GAAG,YAAY,CAAC,CAAC;CACjH,cAAc,MAAM,CAAC,IAAI,GAAG,YAAY,CAAC,CAAC;CAC1C,sBAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,mDAAmD,GAAG,YAAY,CAAC,CAAC;CACrH,oBAAoB,QAAQ;AAC7B,CAAC;AACD,MAAM,iDAAiD,YAAY;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,oDAAoD,OAAO;CAChE,QAAQ,QAAQ,oCAAoC;CACpD,GAAG,QAAQ,CAAC;CACZ,MAAM;CACN,WAAW;CACX,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;CACnC,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;CACrC,SAAS,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACvC,KAAK,IAAI,CAAC,CAAC,YAAY;CACvB,WAAW,MAAM,CAAC,4CAA4C,YAAY,CAAC,CAAC;CAC5E,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;CACrC,UAAU,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS;AACtE,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC9B,IAAI,KAAK,UAAU,KAAK,CAAC,CAAC,SAAS,oDAAoD,IAAI,SAAS;EACnG,MAAM;EACN,SAAS;CACV,CAAC;AACF,CAAC;AACD,MAAM,qCAAqC,OAAO;CACjD,eAAe,IAAI,CAAC,CAAC,SAAS;CAC9B,aAAa;CACb,aAAa;CACb,eAAe,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;CACpD,kBAAkB,OAAO;EACxB,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,IAAI,EAAE;EACzC,OAAO,IAAI,CAAC,CAAC,SAAS;EACtB,SAAS,OAAO,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;EACtD,cAAc,YAAY;GACzB;GACA;GACA;GACA;EACD,CAAC;EACD,qBAAqB,YAAY;GAChC;GACA;GACA;GACA;EACD,CAAC,CAAC,CAAC,SAAS;CACb,CAAC,CAAC,CAAC,SAAS;CACZ,gBAAgB,OAAO;EACtB,WAAW;EACX,SAAS;CACV,CAAC,CAAC,CAAC,SAAS;CACZ,kBAAkB,OAAO;EACxB,sBAAsB,IAAI,CAAC,CAAC,YAAY;EACxC,4BAA4B,IAAI,CAAC,CAAC,YAAY;EAC9C,iBAAiB,QAAQ;CAC1B,CAAC,CAAC,CAAC,SAAS;CACZ,QAAQ;CACR,UAAU,2CAA2C,SAAS;CAC9D,YAAY,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8CAA8C;CACrF,IAAI,OAAO;EACV,gBAAgB,OAAO,CAAC,CAAC,MAAM,4BAA4B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;EAC9E,cAAc,OAAO,CAAC,CAAC,MAAM,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;EAClE,UAAU,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8CAA8C;EACnF,SAAS,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,6CAA6C;CAC3E,CAAC;CACD,oBAAoB,MAAM,CAAC,MAAM,0CAA0C,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;CACpG,YAAY,MAAM,CAAC,wCAAwC,YAAY,CAAC,CAAC;CACzE,sBAAsB,MAAM,CAAC,MAAM,iDAAiD,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;CAC7G,gBAAgB,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC;CACtH,gBAAgB,YAAY,CAAC,gBAAgB,YAAY,CAAC,CAAC,CAAC,SAAS;CACrE,kBAAkB,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,mDAAmD,CAAC,CAAC,CAAC,IAAI,CAAC;CAC9G,WAAW,QAAQ;AACpB,CAAC;AACD,MAAM,kDAAkD;CACvD,CAAC,yDAAyD,cAAc;CACxE,CAAC,2DAA2D,cAAc;CAC1E,CAAC,8CAA8C,cAAc;CAC7D,CAAC,0CAA0C,YAAY;CACvD,CAAC,yBAAyB,YAAY;CACtC,CAAC,+BAA+B,YAAY;AAC7C;AACA,SAAS,iCAAiC,OAAO;CAChD,IAAI,WAAW;CACf,KAAK,MAAM,CAAC,SAAS,gBAAgB,iDAAiD,WAAW,SAAS,QAAQ,SAAS,WAAW;CACtI,OAAO;AACR;AACA,SAAS,kCAAkC,OAAO;CACjD,IAAI,OAAO,UAAU,UAAU,OAAO,iCAAiC,KAAK;CAC5E,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,UAAU,kCAAkC,KAAK,CAAC;CAC9F,IAAI,SAAS,OAAO,UAAU,UAAU,OAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,kCAAkC,KAAK,CAAC,CAAC,CAAC;CAC9J,OAAO;AACR;AACA,SAAS,mCAAmC,QAAQ;CACnD,OAAO,kCAAkC,MAAM;AAChD;AACA,MAAM,qBAAqB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,UAAU;CAC7E,IAAI;EACH,IAAI,IAAI,KAAK;EACb,OAAO;CACR,QAAQ;EACP,OAAO;CACR;AACD,GAAG,EAAE,SAAS,uBAAuB,CAAC;AAEtC,MAAM,2BAA2B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAChE,MAAM,sCAAsC,YAAY;CACvD;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,4BAA4B,YAAY;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,sBAAsB,YAAY;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AASD,MAAM,oBAAoB,aAAa;CACtC,IAAI;CACJ,OAV8B,YAAY;EAC1C;EACA;EACA;EACA;EACA;EACA;CACD,CAGQ;CACP,OAAO;CACP,SAAS,MAAM,CAAC,6BAA6B,YAAY,CAAC,CAAC;CAC3D,mBAAmB,MAAM,CAAC,4BAA4B,YAAY,CAAC,CAAC;CACpE,WAAW;CACX,aAAa;CACb,WAAW;AACZ,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC9B,IAAI,MAAM,UAAU,aAAa,MAAM,sBAAsB,MAAM,IAAI,SAAS;EAC/E,MAAM;EACN,SAAS;EACT,MAAM,CAAC,mBAAmB;CAC3B,CAAC;CACD,IAAI,MAAM,UAAU,aAAa,MAAM,sBAAsB,MAAM,IAAI,SAAS;EAC/E,MAAM;EACN,SAAS;EACT,MAAM,CAAC,mBAAmB;CAC3B,CAAC;CACD,IAAI,MAAM,UAAU,cAAc,MAAM,gBAAgB,MAAM,IAAI,SAAS;EAC1E,MAAM;EACN,SAAS;EACT,MAAM,CAAC,aAAa;CACrB,CAAC;AACF,CAAC;AAOD,MAAM,kCAAkC,aAAa;CACpD,QAP6C,YAAY;EACzD;EACA;EACA;EACA;CACD,CAES;CACR,cAAc,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC;CAC9D,iBAAiB,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC;CACxD,aAAa;CACb,YAAY;CACZ,gBAAgB;CAChB,kBAAkB,MAAM,CAAC,4BAA4B,YAAY,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC9B,IAAI,MAAM,WAAW,aAAa;EACjC,IAAI,MAAM,iBAAiB,MAAM,IAAI,SAAS;GAC7C,MAAM;GACN,SAAS;GACT,MAAM,CAAC,cAAc;EACtB,CAAC;EACD,IAAI,MAAM,oBAAoB,MAAM,IAAI,SAAS;GAChD,MAAM;GACN,SAAS;GACT,MAAM,CAAC,iBAAiB;EACzB,CAAC;EACD,IAAI,MAAM,gBAAgB,MAAM,IAAI,SAAS;GAC5C,MAAM;GACN,SAAS;GACT,MAAM,CAAC,aAAa;EACrB,CAAC;CACF;AACD,CAAC;AASD,MAAM,uBAAuB,aAAa;CACzC,WAAW;CACX,QAAQ;CACR,YAAY;CACZ,SAAS;CACT,UAboC,YAAY,CAAC,wBAAwB,gBAAgB,CAa/E;CACV,aAbuC,YAAY;EACnD;EACA;EACA;EACA;EACA;CACD,CAOc;CACb,WAAW;AACZ,CAAC;AACD,MAAM,6BAA6B,MAAM,yBAAyB,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC/F,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAAQ,IAAI,SAAS;EACtD,MAAM;EACN,SAAS;CACV,CAAC;AACF,CAAC;AACD,MAAM,iCAAiC;AACvC,MAAM,sCAAsC,aAAa;CACxD,YAAY;CACZ,SAAS;CACT,QAAQ;AACT,CAAC;AACD,MAAM,kCAAkC,YAAY;CACnD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,4CAA4C,aAAa;CAC9D,mBAAmB;CACnB,aAAa;CACb,aAAa;AACd,CAAC;AACD,MAAM,mCAAmC,aAAa;CACrD,aAAa;CACb,oBAAoB;CACpB,SAAS;CACT,UAAU;CACV,WAAW;AACZ,CAAC;AACD,MAAM,oDAAoD,0CAA0C,OAAO;CAC1G,aAAa,6BAA6B,QAAQ,CAAC,oBAAoB,CAAC;CACxE,aAAa,QAAQ,OAAO;AAC7B,CAAC;AACD,MAAM,8CAA8C,aAAa;CAChE,gBAAgB,MAAM,yBAAyB;CAC/C,kBAAkB,MAAM,yBAAyB;CACjD,oBAAoB;CACpB,gBAAgB;AACjB,CAAC;AACD,MAAM,kDAAkD,aAAa;CACpE,WAAW;CACX,MAAM;CACN,SAAS,YAAY,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,SAAS;CACrD,SAAS;CACT,KAAK;AACN,CAAC;AACD,MAAM,oCAAoC,mBAAmB,UAAU,CAAC,aAAa;CACpF,QAAQ,QAAQ,WAAW;CAC3B,kBAAkB,MAAM,CAAC,mDAAmD,YAAY,CAAC,CAAC;CAC1F,SAAS,MAAM,CAAC,aAAa;EAC5B,oBAAoB;EACpB,0BAA0B;EAC1B,SAAS,YAAY;GACpB;GACA;GACA;EACD,CAAC;EACD,QAAQ,MAAM,CAAC,4BAA4B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;EACpE,aAAa,MAAM,0BAA0B;EAC7C,UAAU,QAAQ,IAAI;EACtB,QAAQ,QAAQ,2BAA2B;EAC3C,QAAQ,QAAQ,UAAU;CAC3B,CAAC,GAAG,YAAY,CAAC,CAAC;CAClB,gBAAgB,MAAM,CAAC,aAAa;EACnC,MAAM;EACN,SAAS;EACT,cAAc;CACf,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAC7B,cAAc,0CAA0C,OAAO,EAAE,aAAa,QAAQ,OAAO,EAAE,CAAC;CAChG,OAAO,MAAM,CAAC,kCAAkC,YAAY,CAAC,CAAC;CAC9D,YAAY,MAAM,CAAC,6CAA6C,YAAY,CAAC,CAAC;CAC9E,cAAc,YAAY;CAC1B,UAAU,MAAM,aAAa;EAC5B,MAAM;EACN,SAAS;EACT,WAAW;CACZ,CAAC,CAAC;CACF,gBAAgB,MAAM,CAAC,aAAa;EACnC,UAAU;EACV,MAAM;CACP,CAAC,GAAG,YAAY,CAAC,CAAC;CAClB,gBAAgB,MAAM,CAAC,iDAAiD,YAAY,CAAC,CAAC;AACvF,CAAC,GAAG,aAAa;CAChB,QAAQ,QAAQ,QAAQ;CACxB,aAAa,aAAa;EACzB,WAAW,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC;EAC3D,kBAAkB;CACnB,CAAC;CACD,YAAY;CACZ,SAAS;CACT,QAAQ,QAAQ,kBAAkB;CAClC,cAAc;AACf,CAAC,CAAC,CAAC;AACH,MAAM,mCAAmC,aAAa;CACrD,kBAAkB;CAClB,gBAAgB;AACjB,CAAC;AACD,MAAM,+BAA+B,aAAa;CACjD,kBAAkB;CAClB,aAAa;CACb,qBAAqB,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,gBAAgB,MAAM,CAAC,yBAAyB,YAAY,CAAC,CAAC;CAC9D,UAAU,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC;CAC1D,aAAa,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC;CAC7D,eAAe,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC;CAC/D,iBAAiB,IAAI,CAAC,CAAC,YAAY;CACnC,iBAAiB;CACjB,OAAO;CACP,OAAO,MAAM,iBAAiB;CAC9B,mBAAmB,MAAM,CAAC,gCAAgC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI;CACtF,wBAAwB,MAAM,CAAC,qCAAqC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI;CAChG,gBAAgB,kCAAkC,SAAS;CAC3D,uBAAuB;CACvB,oBAAoB;CACpB,UAAU,MAAM,oBAAoB;CACpC,yBAAyB;CACzB,WAAW;CACX,WAAW;CACX,aAAa;CACb,WAAW;AACZ,CAAC,CAAC,CAAC,aAAa,OAAO,QAAQ;CAC9B,MAAM,oBAAoB,MAAM,oBAAoB,eAAe,MAAM,oBAAoB,YAAY,MAAM,oBAAoB,eAAe,MAAM,oBAAoB;CAC5K,IAAI,qBAAqB,MAAM,gBAAgB,MAAM,IAAI,SAAS;EACjE,MAAM;EACN,SAAS;EACT,MAAM,CAAC,aAAa;CACrB,CAAC;CACD,IAAI,CAAC,qBAAqB,MAAM,gBAAgB,MAAM,IAAI,SAAS;EAClE,MAAM;EACN,SAAS;EACT,MAAM,CAAC,aAAa;CACrB,CAAC;CACD,IAAI,MAAM,UAAU,aAAa,MAAM,SAAS,WAAW,GAAG,IAAI,SAAS;EAC1E,MAAM;EACN,SAAS;EACT,MAAM,CAAC,UAAU;CAClB,CAAC;AACF,CAAC;AACD,MAAM,gCAAgC,YAAY;CACjD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;AACD,MAAM,iCAAiC,YAAY;CAClD;CACA;CACA;AACD,CAAC;AACD,MAAM,4BAA4B,aAAa;CAC9C,SAAS;CACT,kBAAkB;CAClB,iBAAiB,IAAI,CAAC,CAAC,YAAY;CACnC,WAAW;CACX,OAAO;CACP,QAAQ,MAAM,CAAC,qBAAqB,YAAY,CAAC,CAAC;CAClD,iBAAiB,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC;CACxD,YAAY,MAAM,CAAC,4BAA4B,YAAY,CAAC,CAAC;CAC7D,SAAS,MAAM,CAAC,6BAA6B,YAAY,CAAC,CAAC;CAC3D,eAAe;CACf,WAAW;AACZ,CAAC;AACD,MAAM,oCAAoC,aAAa;CACtD,qBAAqB,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAChF,gBAAgB,MAAM,CAAC,yBAAyB,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACzE,UAAU,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACrE,aAAa,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACxE,eAAe,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAC1E,uBAAuB,2BAA2B,SAAS;CAC3D,wBAAwB,aAAa;EACpC,UAAU;EACV,SAAS;CACV,CAAC,CAAC,CAAC,SAAS;AACb,CAAC;AACD,MAAM,wCAAwC,aAAa;CAC1D,UAAU;CACV,aAAa;CACb,sBAAsB;AACvB,CAAC;AAED,MAAM,+BAA+B,aAAa,EAAE,UAAU,6BAA6B,CAAC;AAC5F,MAAM,gCAAgC,YAAY;CACjD;CACA;CACA;AACD,CAAC;AACD,MAAM,0BAA0B,aAAa;CAC5C,kBAAkB;CAClB,iBAAiB,IAAI,CAAC,CAAC,SAAS;CAChC,kBAAkB,IAAI,CAAC,CAAC,YAAY;CACpC,UAAU,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACrE,aAAa,MAAM,CAAC,2BAA2B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACxE,eAAe;CACf,QAAQ;CACR,QAAQ;CACR,wBAAwB,MAAM,CAAC,qCAAqC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CAC7F,YAAY,MAAM,CAAC,4BAA4B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACxE,SAAS,MAAM,CAAC,6BAA6B,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;CACtE,aAAa,gCAAgC,SAAS;AACvD,CAAC;AACD,MAAM,uCAAuC,aAAa;CACzD,kBAAkB;CAClB,iBAAiB,IAAI,CAAC,CAAC,SAAS;CAChC,mBAAmB;AACpB,CAAC;AACD,MAAM,oCAAoC,aAAa;CACtD,kBAAkB;CAClB,iBAAiB,IAAI,CAAC,CAAC,SAAS;CAChC,kBAAkB,IAAI,CAAC,CAAC,YAAY;CACpC,eAAe;AAChB,CAAC;AACD,MAAM,+BAA+B,aAAa;CACjD,kBAAkB;CAClB,kBAAkB,IAAI,CAAC,CAAC,YAAY;CACpC,eAAe;AAChB,CAAC;AACuC,aAAa;CACpD,UAAU;CACV,QAAQ,MAAM,yBAAyB;AACxC,CAAC;AACsC,YAAY,CAAC,OAAO,UAAU,CAAC;AACtE,MAAM,uCAAuC,4CAA4C,OAAO;CAC/F,iBAAiB,IAAI,CAAC,CAAC,SAAS;CAChC,kBAAkB;AACnB,CAAC;AAC6C,mBAAmB,QAAQ;CACxE,aAAa;EACZ,MAAM,QAAQ,aAAa;EAC3B,SAAS,aAAa,EAAE,QAAQ,6BAA6B,CAAC;CAC/D,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,cAAc;EAC5B,SAAS,aAAa;GACrB,YAAY;GACZ,iBAAiB,IAAI,CAAC,CAAC,SAAS;EACjC,CAAC;CACF,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,qBAAqB;EACnC,SAAS;CACV,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,oCAAoC;EAClD,SAAS;CACV,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,oCAAoC;EAClD,SAAS;CACV,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,gCAAgC;EAC9C,SAAS;CACV,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,2BAA2B;EACzC,SAAS;CACV,CAAC;AACF,CAAC;AACD,MAAM,wCAAwC,mBAAmB,QAAQ;CACxE,aAAa;EACZ,MAAM,QAAQ,aAAa;EAC3B,SAAS,aAAa,EAAE,QAAQ,6BAA6B,CAAC;CAC/D,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,qBAAqB;EACnC,SAAS,aAAa,EAAE,oBAAoB,QAAQ,CAAC,EAAE,CAAC;CACzD,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,UAAU;EACxB,SAAS,aAAa,EAAE,UAAU,6BAA6B,CAAC;CACjE,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,kBAAkB;EAChC,SAAS,aAAa,EAAE,UAAU,6BAA6B,CAAC;CACjE,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,qBAAqB;EACnC,SAAS;CACV,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,mBAAmB;EACjC,SAAS,aAAa;GACrB,YAAY;GACZ,SAAS;EACV,CAAC;CACF,CAAC;CACD,aAAa;EACZ,MAAM,QAAQ,cAAc;EAC5B,SAAS,aAAa;GACrB,MAAM;GACN,SAAS;EACV,CAAC;CACF,CAAC;AACF,CAAC;;;AC/kBD,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,iCAAiC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AACpE,MAAM,qCAAqC,IAAI,KAAK;CACnD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,IAAI,mBAAmB,aAAa;CAC5E,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,OAAO;EAC9B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,MAAM;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,QAAQ;EAC/B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,IAAI,aAAa;CACjE,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC;AACxC,CAAC;AACD,MAAM,uCAAuC,IAAI,aAAa;CAC7D,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,QAAQ,MAAM;CAC7B,aAAa,IAAI,MAAM,CAAC,gCAAgC,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,KAAK;CACrB,WAAW;CACX,cAAc,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAClD,CAAC;AACD,MAAM,oCAAoC,IAAI,MAAM;CACnD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpCvC,SAAgB,oCACd,WACA,QAAQ,KAAK,IAAI,GACa;CAC9B,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,IAAI,CAAC,YACH,OAAO,EAAE,QAAQ,YAAY;CAG/B,MAAM,cAAc,KAAK,MAAM,UAAU;CACzC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO,eAAe,QAClB;EAAE;EAAa,QAAQ;CAAU,IACjC;EAAE;EAAa,QAAQ;CAAQ;AACrC;;;ACnBA,MAAM,wBAAwB;AAC9B,MAAM,0CAA0C;AAChD,MAAM,4BAA4B;AAClC,MAAM,mCAAmC;AACzC,MAAM,4BAA4B;AAElC,eAAsB,sCACpB,WACY;CACZ,OAAO,MAAM,oBAAoB;EAC/B,WAAW;EACX,KAAK;EACL;CACF,CAAC;AACH;AAEA,eAAsB,oCACpB,WACY;CACZ,OAAO,MAAM,oBAAoB;EAC/B,WAAW;EACX,KAAK;EACL;CACF,CAAC;AACH;AAEA,eAAe,oBAAuB,OAIvB;CAEb,OAAO,MAAM,gBAAgB;EAC3B,MAAA,MAFiB,uBAAuB,KAAK;EAG7C,KAAK,MAAM;EACX,gBAAgB;GACd,WAAW,MAAM;GACjB,SAAS,MAAM;EACjB;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,OAGnC;CACD,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,MACL,IAAI;EACF,OAAO,MAAM,YAAY;GACvB,KAAK,MAAM;GACX,MAAM,EAAE,WAAW,MAAM,UAAU;GACnC,mBAAmB;EACrB,CAAC;CACH,SAAS,OAAO;EACd,IAAI,EAAE,oBAAoB,KAAK,KAAK,KAAK,IAAI,IAAI,WAC/C,MAAM;EAER,MAAMA,aAAM,gCAAgC;CAC9C;AAEJ;;;AC9CA,IAAa,+BAAb,cAAkD,MAAM;CACtD;CAEA,YAAY,QAAgB,SAAiB;EAC3C,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO,6BAA6B;CAC3C;AACF;AAEA,SAAS,gBAAwB;CAC/B,OAAO,KAAK,gBAAgB,GAAG,QAAQ,gCAAgC;AACzE;AAEA,eAAsB,8BAAuE;CAC3F,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,SAAS,cAAc,GAAG,MAAM;CAC9C,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAC5C,OAAO;EAET,MAAM;CACR;CACA,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,GAAG;CACxB,QAAQ;EACN,QAAQ;CACV;CACA,MAAM,SAAS,8BAA8B,UAAU,KAAK;CAC5D,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,6BACR,WACA,6GACF;CAEF,OAAO,OAAO;AAChB;AAEA,eAAe,eAAe,OAA+C;CAC3E,MAAM,0BAA0B;EAC9B,MAAM,cAAc;EACpB,QAAQ;EACR;EACA,MAAM;CACR,CAAC;AACH;AAIA,eAAsB,iDAAgE;CACpF,MAAM,UAAU,MAAM,4BAA4B;CAClD,IAAI,SAAS,UAAU,WACrB;CAEF,IAAI,uBAAuB,QAAQ,SAAS,GAC1C,MAAM,IAAI,6BACR,QACA,2GACF;CAEF,MAAM,eAAe;EAAE,GAAG;EAAS,OAAO;CAAY,CAAC;AACzD;AAIA,eAAsB,+BAA+B,OAIhB;CACnC,MAAM,+CAA+C;CACrD,MAAM,WAAW,MAAM,4BAA4B;CACnD,IAAI,CAAC,8BAA8B,8BAA8B,GAC/D,MAAM,IAAI,6BACR,WACA,kGACF;CAEF,MAAM,cAAuC;EAC3C,SAAS;EACT,IAAI,WAAW;EACf,WAAW,MAAM;EACjB,OAAO;EACP,UAAU,MAAM;EAChB,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,WAAW;GACT,UAAU,QAAQ;GAClB,uBAAuB;EACzB;EACA,GAAI,UAAU,iBACV,EAAE,gBAAgB,SAAS,eAAe,IAC1C,CAAC;CACP;CACA,MAAM,eAAe,WAAW;CAChC,OAAO;AACT;AAEA,eAAsB,8BAA8B,IAA2B;CAC7E,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,4BAA4B;EAClD,IAAI,SAAS,OAAO,MAAM,QAAQ,UAAU,WAC1C,MAAM,eAAe;GAAE,GAAG;GAAS,OAAO;EAAY,CAAC;CAE3D,CAAC;AACH;AAGA,eAAsB,6BAA6B,OAKjC;CAChB,MAAM,UAAU,MAAM,4BAA4B;CAClD,MAAM,kBAAkB,2BAA2B,MAAM,QAAQ;CACjE,IACE,MAAM,cAAc,WACpB,SAAS,gBAAgB,OAAO,MAAM,MACtC,QAAQ,eAAe,oBAAoB,iBAK3C;CAEF,IACE,CAAC,WACD,QAAQ,OAAO,MAAM,MACrB,QAAQ,cAAc,MAAM,aAC5B,QAAQ,UAAU,aAClB,yBAAyB,QAAQ,UAAU,QAAQ,MACjD,QAAQ,UAAU,yBACnB,QAAQ,WAAW,KAAA,MACjB,QAAQ,OAAO,aAAa,QAAQ,OACnC,QAAQ,OAAO,0BACb,mCACN,KAAK,UAAU,QAAQ,QAAQ,MAAM,KAAK,UAAU,MAAM,QAAQ,GAElE,MAAM,IAAI,6BACR,aACA,yFACF;CAEF,MAAM,SAAS;CACf,MAAM,eAAe;EACnB,GAAG;EACH,OAAO;EACP,SAAS;GACP,UAAU,QAAQ;GAClB,uBAAuB;EACzB;EACA,GAAI,MAAM,cAAc,UACpB,EAAE,gBAAgB;GAAE,IAAI,MAAM;GAAI;EAAgB,EAAE,IACpD,CAAC;CACP,CAAC;AACH;AAEA,SAAS,2BACP,UACQ;CACR,OAAO,WAAW,QAAQ,CAAC,CACxB,OACC,KAAK,UAAU;EACb,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;CACX,CAAC,CACH,CAAC,CACA,OAAO,KAAK;AACjB;;;;AC1LA,eAAsB,mCACpB,aACkB;CAClB,IACE,QAAQ,aAAa,YACrB,yBAAyB,MAAM,aAE/B,OAAO;CAET,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,SAAS,UACX,OAAO;CAET,IAAI,QAAQ,SAAS,QACnB,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,OAAO,QAAQ,IAAI,eAAe,KAAK;CAC7C,IAAI,EAAE,QAAQ,WAAW,IAAI,IAC3B,OAAO;CAET,IACE,EACE,gBAAgB,WAAW,KAC3B,gBAAgB,QAAQ,IAAI,oBAAoB,IAGlD,OAAO;CAET,MAAM,gBAAgB,MAAM,cAAc,IAAI;CAC9C,MAAM,WAAW,MAAM,cAAc,QAAQ,CAAC;CAC9C,IAAI,kBAAkB,YAAY,kBAAkB,QAAQ,aAAa,GACvE,OAAO;CAET,KAAK,MAAM,aAAa;EAAC;EAAa;EAAiB;CAAkB,GAAG;EAC1E,MAAM,gBAAgB,MAAM,cAAc,KAAK,UAAU,SAAS,CAAC;EACnE,IACE,kBAAkB,iBAClB,cAAc,WAAW,gBAAgB,GAAG,GAE5C,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAoC;CAC3D,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,SAAS,EAAE;EAC/B,QACG,IAAI,aAAa,WAAW,IAAI,aAAa,aAC9C,CAAC,IAAI,YACL,CAAC,IAAI,aACJ,mBAAmB,IAAI,QAAQ,KAAK,IAAI,SAAS,SAAS,YAAY;CAE3E,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,cAAc,MAA+B;CAC1D,IAAI;EACF,OAAO,MAAM,SAAS,IAAI;CAC5B,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAC5C,MAAM;EAER,MAAM,WAAW,QAAQ,IAAI;EAC7B,MAAM,SAAS,QAAQ,QAAQ;EAC/B,IAAI,WAAW,UACb,MAAM;EAER,OAAO,KAAK,MAAM,cAAc,MAAM,GAAG,SAAS,QAAQ,CAAC;CAC7D;AACF;;;ACpEA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AACtC,MAAM,oBAAoB;AAC1B,MAAa,oCAAoC;AAoCjD,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAC9C,IAAI,kBAAkB;AACtB,IAAI,0BAAyC;AAC7C,MAAa,iCAAiC;AAE9C,SAAgB,+BAAuC;CACrD,OAAO,KAAK,IAAI,GAAG,kBAAkB,KAAK,IAAI,CAAC;AACjD;AAEA,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CC,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,6BAA6B,KAAK,IAAI,IAAI,iBAC5C,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QAAQ;GAC9B,MAAM,SAAS,MAAM,qCAAqC,KAAK;GAC/D,qBAAqB;GACrB,OAAO;EACT;EACA,MAAM,qCAAqC,KAAK;EAChD,qBAAqB;CACvB,SAAS,OAAO;EACd,MAAM,WAAW,iBAAiB;EAClC,IAAI,iBAAiB,iCAAiC;GACpD,4BAA4B;GAC5B,kBAAkB,KAAK,IAAI,IAAI;EACjC;EACA,MAAM,WAAW,kBAAkB,KAAKA,iBAAe,KAAK,CAAC,CAAC,GAAG;EACjE,IAAI,aAAa,WAAW,sBAAsB;EAClD,IAAI,UACF,aAAa;EAEf,MAAM,cAAc,GAAG,WAAW,GAAG,YAAY;EACjD,IAAI,4BAA4B,aAAa;GAC3C,0BAA0B;GAC1B,QAAQ,KACN,KAAK,UAAU;IACb,OAAO;IACP,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;IACnC;IACA,GAAI,WAAW,EAAE,UAAU,OAAO,QAAQ,EAAE,IAAI,CAAC;IACjD,WAAW,MAAM;IACjB,WAAW;IACX,GAAI,WAAW,EAAE,cAAc,+BAA+B,IAAI,CAAC;GACrE,CAAC,CACH;EACF;EACA,MAAM;CACR;AACF;AAEA,SAAS,uBAA6B;CACpC,IAAI,yBACF,QAAQ,KACN,KAAK,UAAU;EACb,OAAO;EACP,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;CACrC,CAAC,CACH;CAEF,4BAA4B;CAC5B,kBAAkB;CAClB,0BAA0B;AAC5B;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,QAAQ,aAAa,YAAY,qBAAqB,GAAG;EAE3D,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACnaA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,6BAA6B;AACnC,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA4CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CACD,MAAM,aAAa,MAAM,SAAS,wBAAwB,GAAG,IAAI;CAEjE,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF;CAEA,IAAI,MAAM,mCAAmC,MAAM,WAAW,GAAG;EAC/D,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,QAAQ,KACN,kQACF;EACA,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB,KAAK;IACL,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV,KAAK;GACP;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB,KAAK;IACL,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV,KAAK;GACP;EACF;EACA,MAAM,IAAI,MACR,mDAAmDC,iBAAe,KAAK,KACvE,EAAE,OAAO,MAAM,CACjB;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAcA,iBAAe,KAAK;GAClC,GAAI,IAAI,aAAa,mBACjB,EAAE,cAAc,6BAA6B,EAAE,IAC/C,CAAC;GACL,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAYD,iBAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAiClC,OAAO,MAhCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,KAAK;GACd,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OAAO;KAAE;KAAM;IAAO,CAAC;GACzB,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SAC0C;CAC1C,MAAM,UACJ,SAAS,OAAO,UAAU,WACrB,QACD,CAAC;CACP,IAAI,OAA+B;CACnC,IAAI,OAAO,QAAQ,SAAS,YAAY,OAAO,UAAU,QAAQ,IAAI,GACnE,OAAO,QAAQ;MACV,IACL,OAAO,QAAQ,SAAS,YACxB,2BAA2B,KAAK,QAAQ,IAAI,GAE5C,OAAO,QAAQ;CAIjB,MAAM,SACJ,OAAO,QAAQ,WAAW,WAAW,QAAQ,OAAO,KAAK,IAAI;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO,SAAS,UAClB,SAAS;MACJ,IAAI,WAAW,uCACpB,SAAS;MACJ,IAAI,WAAW,mCACpB,SAAS;CAEX,OAAO,OAAO,uBACZ,IAAI,MACF,mBAAmB,QAAQ,KAAK,OAAO,IAAI,SAAS,OAAO,iBAAiB,SAAS,QACvF,GACA,EAAE,KAAK,CACT;AACF;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAASA,iBAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASC,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;AC3gBV,MAAM,kCAAkC;AACxC,MAAM,2BAA2B;AAEjC,IAAM,0BAAN,cAAsC,MAAM;CAC1C;CAEA,YAAY,OAIT;EACD,MACE,MAAM,SACN,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,CAC/D;EACA,KAAK,OAAO;EACZ,KAAK,SAAS,MAAM;CACtB;AACF;AAEA,IAAa,qCAAb,cAAwD,MAAM;CAC5D,cAAc;EACZ,MACE,uJACF;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,0CAAb,cAA6D,MAAM;CACjE,SAAkB;CAElB,cAAc;EACZ,MACE,+MACF;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qCAAb,cAAwD,MAAM;CAC5D;CACA;CAKA,YAAY,OAGT;EACD,MAAM,WAAW;GACf,iBAAiB;GACjB,qBAAqB;GACrB,kBAAkB;EACpB,EAAE,MAAM;EACR,MAAM,UAAU,MAAM,wBAClB,uCACA;EACJ,MAAM,0CAA0C,SAAS,IAAI,SAAS;EACtE,KAAK,OAAO;EACZ,KAAK,SAAS,MAAM;EACpB,KAAK,wBAAwB,MAAM;CACrC;AACF;AA6JA,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAClD,MAAM,yCAAyB,IAAI,IAGjC;AACF,MAAM,kDAAkC,IAAI,IAGzC;AAEH,SAAgB,iCACd,QACY;CACZ,MAAM,WAAW;EAAE,MAAM,gBAAgB;EAAG;CAAO;CACnD,gCAAgC,IAAI,QAAQ;CAC5C,aAAa;EACX,gCAAgC,OAAO,QAAQ;CACjD;AACF;AACA,MAAM,iDAAiC,IAAI,IAAY;AAEvD,MAAM,yBAAyB,IAAI,kBAAqC;AACxE,MAAM,0CAA0B,IAAI,QAA0C;AAE9E,SAAgB,2BACd,SACA,KACY;CACZ,OAAO,uBAAuB,IAAI,gBAAgB,OAAO,GAAG,GAAG;AACjE;AAKA,eAAsB,2CAAuE;CAC3F,IAAI,MAAM,iCAAiC,GACzC,MAAM,IAAI,mCAAmC;CAE/C,MAAM,QAAQ,MAAM,yBAAyB,EAAE,SAAS,MAAM,CAAC;CAC/D,IAAI,MAAM,UAAU,WAAW,CAAC,MAAM,SAAS,MAAM,IACnD,MAAM,IAAI,MACR,gGACF;CAEF,OAAO,MAAM;AACf;AAQA,MAAM,iDAAiC,IAAI,IAGxC;AAEH,SAAgB,mCACd,QACY;CACZ,MAAM,WAAW;EAAE,MAAM,gBAAgB;EAAG;CAAO;CACnD,+BAA+B,IAAI,QAAQ;CAC3C,aAAa;EACX,+BAA+B,OAAO,QAAQ;CAChD;AACF;AAEA,SAAS,kBAAkB,QAAqC;CAC9D,MAAM,OAAO,gBAAgB;CAC7B,KAAK,MAAM,YAAY,gCACrB,IAAI,SAAS,SAAS,MACpB,IAAI;EACF,SAAS,OAAO,MAAM;CACxB,QAAQ,CAER;AAGN;AAEA,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,QAAQ,uBAAuB,SAAS;CAC9C,IAAI,OACF,OAAO,MAAM,4BAA4B,OAAO,OAAO;CAEzD,MAAM,SAAS,MAAM,6CACnB,SACA,KACF;CAEA,IAAI,OAAO,eAAe,4BACxB,kBAAkB,sBAAsB;CAE1C,OAAO;EACL,OAAO,OAAO;EACd,SAAS,OAAO;EAChB,GAAI,OAAO,aAAa,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC;EAC7D,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;EACnE,GAAI,OAAO,iBAAiB,KAAA,IACxB,EAAE,cAAc,OAAO,aAAa,IACpC,CAAC;CACP;AACF;AAEA,eAAe,4BACb,OACwB;CACxB,MAAM,QAAQ,MAAM,yBAAyB;EAC3C,SAAS;EACT,sBAAsB,+BAA+B,KAAK;CAC5D,CAAC;CACD,MAAM,gBAAgB,oBAAoB,MAAM,SAAS,KAAK;CAC9D,MAAM,kBACJ,iBAAiB,gBAAgB,QAAQ,MAAM,aAAa;CAC9D,IACE,iBACA,MAAM,WACN,wBAAwB,IAAI,KAAK,MAAM,iBACvC;EACA,OAAO,OAAO,OAAO,MAAM,SAAS,EAClC,oBAAoB,MAAM,QAAQ,mBACpC,CAAC;EACD,wBAAwB,IAAI,OAAO,eAAe;CACpD;CACA,IACE,iBACA,MAAM,WACN,MAAM,cACL,MAAM,gBAAgB,MAAM,QAAQ,eACnC,MAAM,cAAc,MAAM,QAAQ,YAEpC,MAAM,2BACJ,OACA;EACE,OAAO;EACP,aAAa,MAAM;EACnB,WAAW,MAAM;CACnB,GACA,iBACA,MAAM,QAAQ,WAChB;CAEF,OAAO,gBAAiB,wBAAwB,IAAI,KAAK,KAAK,OAAQ;AACxE;AAEA,eAAe,4BACb,OACA,SACiC;CACjC,MAAM,kBAAkB,MAAM,4BAA4B,KAAK;CAC/D,IACE,QAAQ,kBACP,QAAQ,kBAAkB,UAAU,MAAM,SAAS,GACpD;EACA,MAAM,SAAS,MAAM,0BAA0B,KAAK;EACpD,IAAI,OAAO,UAAU,aAAa,OAAO,UAAU,WACjD,OAAO;GACL,OAAO,OAAO;GACd,SAAS;GACT,YAAY,mCAAmC,OAAO,KAAK;EAC7D;EAEF,IAAI,OAAO,UAAU,SAAS;GAC5B,MAAM,2BAA2B,OAAO,QAAQ,eAAe;GAC/D,IAAI,OAAO,aACT,MAAM,cAAc,OAAO;GAE7B,IAAI,OAAO,WACT,MAAM,YAAY,OAAO;EAE7B;CACF;CACA,MAAM,SAAS,oCAAoC,MAAM,SAAS;CAClE,IAAI,OAAO,WAAW,WACpB,OAAO;EACL,SAAS;EACT,OAAO;EACP,YAAY;CACd;CAEF,IAAI,OAAO,WAAW,WACpB,OAAO;EACL,SAAS;EACT,OAAO;EACP,YAAY;CACd;CAEF,OAAO;EAAE,SAAS;EAAO,OAAO;CAAQ;AAC1C;AAEA,eAAe,2BACb,OACA,QACA,iBACA,sBAAsB,MAAM,aACb;CACf,IAAI,EAAE,mBAAmB,OAAO,cAAc,UAAU,OAAO,SAAS,GACtE;CAEF,IAAI;EAOF,IAAI,MANoB,4BAA4B;GAClD,aAAa,OAAO,eAAe,MAAM;GACzC;GACA,oBAAoB;GACpB,WAAW,OAAO;EACpB,CAAC,GACc;GACb,MAAM,UAAU,MAAM,yBAAyB;IAC7C,SAAS;IACT,sBAAsB,+BAA+B,KAAK;GAC5D,CAAC;GACD,wBAAwB,IACtB,OACA,oBAAoB,QAAQ,SAAS,KAAK,KAAK,gBAAgB,UAC3D,QAAQ,aACR,IACN;EACF;CACF,SAAS,OAAO;EACd,IACE,EACE,iBAAiB,gCACjB,MAAM,SAAS,mCAGjB,MAAM;CAIV;AACF;AAEA,SAAS,oBACP,SAIA,UACS;CACT,OAAO,QACL,SAAS,MAAM,MACb,SAAS,MAAM,OAAO,SAAS,KAAK,MACpC,QAAQ,gBAAgB,SAAS,eACjC,QAAQ,aAAa,SAAS,QAClC;AACF;AAEA,eAAe,6CACb,SACA,2BACiC;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,MAAM,kBACJ,gBAAgB,aAAa,WAAW,aAAa;CACvD,MAAM,uBACJ,QAAQ,mBAAmB,QAC1B,QAAQ,mBAAmB,QAAQ,WAAW,UAAU;CAC3D,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK;GACH,IAAI,CAAC,sBACH,OAAO;GAET;EACF,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,sBACH,OAAO;CAET,IACE,CAAC,6BACA,MAAM,4CAA4C,GAEnD,OAAO,MAAM,oCACX,YACE,MAAM,6CAA6C,SAAS,IAAI,CACpE;CAGF,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO,MAAM,oCAAoC;EAC/C;EACA;EACA;CACF,CAAC;CAEH,IAAI,iBAAiB,UAAU,WAAW;EACxC,IAAI,WAAW,UAAU,aAAa,QAAQ,mBAAmB,MAI/D,OAAO;GACL,OAAO;GACP,SAAS,WAAW;EACtB;EAEF,OAAO;CACT;CAEA,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAEA,eAAe,8CAAgE;CAC7E,MAAM,UAAU,MAAM,iCAAiC;CACvD,OAAO,QACL,SAAS,UAAU,aACjB,QAAQ,sCAAsC,KAC9C,wDAAwD,OAAO,CACnE;AACF;AAEA,eAAe,oCAAoC,OAIf;CAClC,IACE,CAAC,MAAM,iBAAiB,aACxB,UAAU,MAAM,iBAAiB,SAAS,GAE1C,OAAO,MAAM;CAGf,IAAI;CACJ,IAAI;EACF,mBAAmB,MAAM,4BAA4B;GACnD,aACE,MAAM,iBAAiB,eACvB,MAAM,WAAW,QAAQ;GAC3B,oBAAoB,MAAM;GAC1B,WAAW,MAAM,iBAAiB;GAClC,qBAAqB,MAAM,WAAW,QAAQ;EAChD,CAAC;CACH,SAAS,OAAO;EACd,IAAI,EAAE,iBAAiB,qCACrB,MAAM;EAOR,OAAO;GACL,OAAO;GACP,SAAS;IACP,GAAG,MAAM,WAAW;IACpB,aACE,MAAM,iBAAiB,eACvB,MAAM,WAAW,QAAQ;IAC3B,WAAW,MAAM,iBAAiB;GACpC;EACF;CACF;CAEA,IAAI,CAAC,kBACH,OAAO,MAAM,yBAAyB;CAExC,OAAO;EACL,OAAO;EACP,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAAwC;CAC3E,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,sCAAsC,YAAY;EACtD,MAAM,gDAAgD;EACtD,MAAM,yBAAyB;EAG/B,MAAM,mBAAmB,mBAAkB,MADb,uBAAuB,EAAA,EACO,QAAQ;EACpE,MAAM,WAAW,MAAM,iBAAiB;GACtC;GACA;GACA;EACF,CAAC;EAED,MAAM,UAAyB;GAC7B,GAAG;GACH;GACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;GACzD;GACA;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC5C,GAAG,qBAAqB,MAAM,IAAI;GAClC,GAAG,+BAA+B,MAAM,kBAAkB;EAC5D;EAEA,MAAM,OAAO,gBAAgB;EAC7B,MAAM,2BAA2B;EAEjC,IAAI;GACF,MAAM,+BAA+B;IAAE;IAAa;GAAS,CAAC;GAC9D,MAAM,8BAA8B,MAAM,OAAO;EACnD,SAAS,OAAO;GACd,MAAM,oCAAoC,QAAQ;GAClD,MAAM;EACR;EAEA,iBAAiB;GACf;GACA,SAAS,uBAAuB;IAAE;IAAa;GAAQ,CAAC;EAC1D,CAAC;EACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;CAE9D,CAAC;AACH;AAEA,eAAsB,2BACpB,OACA,UAAwC,CAAC,GACT;CAChC,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAE5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAE7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAEzC,MAAM,eAAe,QAAQ,iBAAiB;CAC9C,MAAM,sBAAsB,eACxB,iCAAiC,MAAM,YAAY,IACnD,KAAA;CACJ,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,gDAAgD;EACtD,MAAM,yBAAyB;EAC/B,MAAM,2BAA2B;EACjC,MAAM,kBAAkB,MAAM,uBAAuB;EACrD,MAAM,gBAAgB,MAAM,yBAAyB,EAAE,SAAS,MAAM,CAAC;EACvE,MAAM,kBACJ,cAAc,UAAU,WAAW,cAAc,UAAU,YACvD,cAAc,UACd;EACN,8BAA8B;GAC5B,SAAS,yBAAyB,eAAe;GACjD,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,WAAW,MAAM,iBAAiB;GACtC;GACA;GACA;GACA,QAAQ;EACV,CAAC;EACD,MAAM,cAA6B;GACjC,GAAG;GACH;GACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;GACzD;GACA;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC5C,GAAG,qBAAqB,MAAM,IAAI;GAClC,GAAG,+BAA+B,MAAM,kBAAkB;EAC5D;EACA,MAAM,UAA0C;GAC9C,GAAG;GACH,IAAI,WAAW;GACf,OAAO;GACP,UAAU,QAAQ;GAClB,uBAAuB;GACvB,iBACE,iBAAiB,MAAM,IAAK,kBAAoC;GAClE,kBAAkB;GAClB,mCAAmC;GACnC,oBAAoB,CAAC,QAAQ;GAC7B,GAAI,QAAQ,kBACR,EACE,iBAAiB;IACf,YAAY,QAAQ,gBAAgB;IACpC;GACF,EACF,IACA,CAAC;EACP;EACA,IAAI,iBAAiB;EACrB,IAAI;GACF,MAAM,+BAA+B;IAAE;IAAa;GAAS,CAAC;GAC9D,MAAM,kCAAkC,OAAO;GAC/C,iBAAiB;GACjB,+BAA+B,IAAI,QAAQ,EAAE;EAC/C,SAAS,OAAO;GACd,+BAA+B,OAAO,QAAQ,EAAE;GAChD,IAAI,gBAAgB;IAClB,MAAM,iCAAiC,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACrE,MAAM,0CAA0C,OAAO,CAAC,CAAC,YACjD,KAAA,CACR;GACF;GACA,MAAM,oCAAoC,QAAQ;GAClD,MAAM;EACR;EACA,iBAAiB;GACf,SAAS;GACT,SAAS,uBAAuB;IAAE;IAAa,SAAS;GAAY,CAAC;EACvE,CAAC;EAED,IAAI,aAAsD;EAC1D,MAAM,gCAAgC;GACpC,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;EAEhE;EACA,MAAM,4BACJ,mBACG;GACH,IAAI,CAAC,QAAQ,iBACX,OAAO,mBAAmB;GAE5B,OACE,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,eAAe;EAExD;EACA,MAAM,6BACJ,gBACA,mBAA2C,gBAE3C,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,gBAAgB;EAC/C,MAAM,iCAAiC,OACrC,mBAA2C,gBACxC;GACH,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IACE,EACE,yBAAyB,cAAc,KACvC,0BAA0B,gBAAgB,gBAAgB,IAG5D,MAAM,IAAI,MACR,4DACF;EAEJ;EACA,MAAM,kCAAkC,YAAY;GAClD,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IACE,EACE,yBAAyB,cAAc,KACvC,0BAA0B,cAAc,IAE1C;IACA,IAAI;KACF,MAAM,qDAAqD;MACzD;MACA;KACF,CAAC;IACH,UAAU;KACR,+BAA+B,OAAO,QAAQ,EAAE;IAClD;IACA,MAAM,IAAI,mCAAmC;KAC3C,uBAAuB;KACvB,QAAQ;IACV,CAAC;GACH;GAEA,MAAM,kCAAkC,OAAO;GAC/C,IAAI;IACF,MAAM,iCAAiC,SAAS,eAAe;IAC/D,aAAa;IACb,MAAM,oCAAoC,QAAQ,CAAC,CAAC,OACjD,UAAmB;KAClB,wCAAwC;MACtC;MACA,cAAc,QAAQ;KACxB,CAAC;IACH,CACF;GACF,UAAU;IACR,+BAA+B,OAAO,QAAQ,EAAE;IAChD,MAAM,0CAA0C,OAAO;GACzD;EACF;EAEA,OAAO;GACL;GACA,QAAQ,YACN,MAAM,sCAAsC,YAAY;IACtD,wBAAwB;IACxB,MAAM,iBACJ,MAAM,sCAAsC,OAAO;IACrD,IAAI,eAAe,WAAW,WAAW;KACvC,MAAM,gCAAgC;KACtC,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ;KACV,CAAC;IACH;IACA,IAAI,eAAe,WAAW,WAAW;KACvC,+BAA+B,OAAO,QAAQ,EAAE;KAChD,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ,eAAe;KACzB,CAAC;IACH;IACA,MAAM,mCAAmC,eAAe,OAAO;IAC/D,aAAa;GACf,CAAC;GACH,UAAU,YACR,MAAM,sCAAsC,YAAY;IACtD,IAAI,eAAe,eACjB;IAEF,wBAAwB;IACxB,MAAM,iBACJ,MAAM,sCAAsC,OAAO;IACrD,IAAI,eAAe,WAAW,WAAW;KACvC,MAAM,gCAAgC;KACtC;IACF;IACA,IAAI,eAAe,WAAW,WAAW;KACvC,+BAA+B,OAAO,QAAQ,EAAE;KAChD,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ,eAAe;KACzB,CAAC;IACH;IACA,MAAM,+BACJ,eAAe,QAAQ,gBACzB;IACA,MAAM,iCACJ,eAAe,SACf,eACF;IACA,aAAa;IACb,+BAA+B,OAAO,QAAQ,EAAE;IAChD,+BAA+B,eAAe,OAAO;IACrD,IAAI,eAAe,QAAQ,iBAAiB;KAC1C,MAAM,yCACJ,eAAe,SACf;MACE,GAAG,eAAe;MAClB,OAAO;MACP,iBAAiB;OACf,GAAG,eAAe,QAAQ;OAC1B,qBAAqB,KAAA;MACvB;KACF,CACF;KACA;IACF;IACA,MAAM,0BAA0B,eAAe,OAAO;IACtD,MAAM,0CACJ,eAAe,OACjB;GACF,CAAC;EACL;CACF,CAAC;AACH;AAEA,eAAe,mCACb,SACe;CACf,MAAM,iBAAiB,MAAM,uBAAuB;CACpD,MAAM,oBAAoB,QAAQ,kBAC9B,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,eAAe,IACpD,mBAAmB;CACvB,MAAM,qBACJ,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,gBAAgB;CACvD,IAAI,EAAE,qBAAqB,qBACzB,MAAM,IAAI,MACR,4DACF;CAEF,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,MAAM,iCAAiC,OAAO;CAC9D,MAAM,8BAA8B,gBAAgB,GAAG,OAAO;CAC9D,iBAAiB;EAAE;EAAS;CAAQ,CAAC;CACrC,MAAM,YAA4C;EAChD,GAAG;EACH,OAAO;CACT;CACA,MAAM,yCAAyC,SAAS,SAAS;CACjE,+BAA+B,OAAO,QAAQ,EAAE;CAChD,MAAM,uCAAuC,SAAS,CAAC,CAAC,OACrD,UAAmB;EAClB,wCAAwC;GACtC;GACA,cAAc,QAAQ;EACxB,CAAC;CACH,CACF;AACF;AAEA,eAAsB,sCAAwD;CAC5E,MAAM,UAAU,MAAM,iCAAiC;CACvD,QACG,SAAS,UAAU,aAAa,SAAS,UAAU,wBACpD,QAAQ,QAAQ,iBAAiB,mBAAmB;AAExD;AAIA,eAAsB,+BACpB,KAGkB;CAClB,MAAM,UAAU,MAAM,sCAAsC,YAAY;EACtE,MAAM,UAAU,MAAM,iCAAiC;EACvD,IACE,GACG,SAAS,UAAU,aAClB,SAAS,UAAU,wBACrB,QAAQ,iBAAiB,wBAE3B,uBAAuB;GACrB,UAAU,QAAQ;GAClB,uBAAuB,QAAQ;EACjC,CAAC,GAED,OAAO;EAET,MAAM,OAAO;GACX,GAAG;GAIH,OAAO;GACP,UAAU,QAAQ;GAClB,uBAAuB;EACzB;EAGA,MAAM,oBAAoB,0BAA0B,GAAG,IAAI;EAC3D,+BAA+B,IAAI,KAAK,EAAE;EAC1C,OAAO;GACL,SAAS;GACT,cAAc,QAAQ,gBAAgB;GACtC,YAAY,QAAQ,gBAAgB;EACtC;CACF,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAET,IAAI;EACF,MAAM,UAAU,MAAM,IAAI;GACxB,GAAG,QAAQ;GACX,YAAY,QAAQ;EACtB,CAAC;EACD,MAAM,sCAAsC,YAAY;GACtD,MAAM,UAAU,MAAM,sCACpB,QAAQ,OACV;GACA,IAAI,QAAQ,WAAW,WACrB,MAAM,IAAI,mCAAmC;IAC3C,uBAAuB;IACvB,QACE,QAAQ,WAAW,YAAY,oBAAoB,QAAQ;GAC/D,CAAC;GAEH,IAAI,YAAY,aACd,MAAM,mCAAmC,QAAQ,OAAO;QACnD;IACL,MAAM,iCAAiC,QAAQ,OAAO;IACtD,+BAA+B,QAAQ,OAAO;IAC9C,MAAM,yCAAyC,QAAQ,SAAS;KAC9D,GAAG,QAAQ;KACX,OAAO;KACP,iBAAiB;MACf,GAAG,QAAQ,QAAQ;MACnB,YAAY,QAAQ;MACpB,qBAAqB,KAAA;KACvB;IACF,CAAC;GACH;EACF,CAAC;EACD,OAAO;CACT,UAAU;EACR,+BAA+B,OAAO,QAAQ,QAAQ,EAAE;EACxD,oBAAoB;CACtB;AACF;AAQA,eAAe,sCACb,UAC4C;CAC5C,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,CAAC,gBACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,IAAI,CAAC,qCAAqC,UAAU,cAAc,GAChE,OAAO;EAAE,QAAQ;EAAoB,SAAS;CAAe;CAE/D,IAAI,eAAe,UAAU,WAC3B,OAAO;EAAE,QAAQ;EAAuB,SAAS;CAAe;CAElE,OAAO;EAAE,QAAQ;EAAW,SAAS;CAAe;AACtD;AAEA,eAAsB,4CAAoG;CACxH,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,qDAAqD;EAC3D,IAAI,UAAU,MAAM,iCAAiC;EAKrD,KACG,SAAS,UAAU,aAClB,SAAS,UAAU,wBACrB,QAAQ,iBAAiB,uBACzB,CAAC,uBAAuB;GACtB,UAAU,QAAQ;GAClB,uBAAuB,QAAQ;EACjC,CAAC,GACD;GACA,MAAM,iCAAiC,OAAO;GAC9C,+BAA+B,OAAO;GACtC,MAAM,WAAW;IACf,GAAG;IACH,OAAO;IACP,iBAAiB;KACf,GAAG,QAAQ;KACX,qBAAqB,KAAA;IACvB;GACF;GACA,MAAM,yCAAyC,SAAS,QAAQ;GAChE,UAAU;EACZ;EACA,IAAI,EAAE,SAAS,UAAU,uBAAuB,QAAQ,kBACtD,OAAO;EAKT,IAAI,QAAQ,gBAAgB,wBAAwB;GAClD,IAAI,QAAQ,gBAAgB,qBAAqB;IAC/C,MAAM,0BAA0B,OAAO;IACvC,MAAM,0CAA0C,OAAO;IACvD,OAAO;GACT;GACA,OAAO;IACL,kBAAkB;IAClB,YAAY,QAAQ,gBAAgB;IACpC,IAAI,QAAQ;IACZ,iBAAiB,MAAM,+BACrB,QAAQ,eACV;IACA,sBAAsB;IACtB,mBAAmB,QAAQ,QAAQ,gBAAgB,mBAAmB;GACxE;EACF;EAEA,MAAM,mBAAmB,MAAM,0CAC7B,QAAQ,gBACV;EACA,IAAI,CAAC,kBACH,MAAM,IAAI,wBAAwB;GAChC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,MAAM,uBAAuB,wBAC3B,iBAAiB,MAAM,EACzB;EACA,IAAI,CAAC,sBACH,MAAM,IAAI,wBAAwB;GAChC,SACE;GACF,QAAQ;EACV,CAAC;EAGH,OAAO;GACL,kBAAkB;IAChB,GAAG;IACH,MAAM;KAAE,GAAG,iBAAiB;KAAM,IAAI;IAAqB;GAC7D;GACA,YAAY,QAAQ,gBAAgB;GACpC,IAAI,QAAQ;GACZ,iBAAiB,MAAM,+BACrB,QAAQ,eACV;GACA,sBAAsB;GACtB,mBAAmB,QAAQ,QAAQ,gBAAgB,mBAAmB;EACxE;CACF,CAAC;AACH;AAEA,eAAsB,2CAA2C,OAG/C;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,wCAAwC,MAAM,EAAE;EACtE,MAAM,yCAAyC,SAAS;GACtD,GAAG;GACH,iBAAiB;IACf,GAAG,QAAQ;IACX,GAAI,MAAM,UAAU,YAChB,EAAE,sCAAqB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE,IAChD,EAAE,yCAAwB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE;IACvD,qBAAqB,KAAA;GACvB;EACF,CAAC;CACH,CAAC;AACH;AAEA,eAAsB,oDAAoD,OAMxD;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,iEACJ,KACF;CACF,CAAC;AACH;AAEA,eAAe,iEAAiE,OAM9D;CAChB,MAAM,UAAU,MAAM,wCAAwC,MAAM,EAAE;CACtE,MAAM,yCAAyC,SAAS;EACtD,GAAG;EACH,iBAAiB;GACf,GAAG,QAAQ;GACX,qBAAqB;IACnB,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;IAC3B,SAAS,MAAM;IACf,OAAO,MAAM;IACb,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;IACrD,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC/D;EACF;CACF,CAAC;AACH;AAEA,eAAsB,+CACpB,IACkB;CAClB,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,UAAU,MAAM,wCAAwC,EAAE;EAChE,IACE,EACE,QAAQ,gBAAgB,uBACxB,QAAQ,gBAAgB,yBAG1B,MAAM,IAAI,MACR,kFACF;EAEF,IAAI;GACF,MAAM,0BAA0B,OAAO;GACvC,MAAM,0CAA0C,OAAO;GACvD,OAAO;EACT,SAAS,OAAO;GACd,MAAM,iEAAiE;IACrE;IACA,SAAS,eAAe,KAAK;IAC7B,OAAO;GACT,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;GACxB,wCAAwC;IAAE;IAAO,cAAc;GAAG,CAAC;GACnE,OAAO;EACT;CACF,CAAC;AACH;AAEA,eAAsB,iBAAoD;CACxE,MAAM,QAAQ,uBAAuB,SAAS;CAC9C,IAAI,OACF,QAAQ,MAAM,4BAA4B,OAAO,CAAC,CAAC,EAAA,CAAG;CAExD,MAAM,aAAa,MAAM,yBAAyB;CAClD,IAAI,WAAW,UAAU,aAAa,WAAW,UAAU,WACzD,OAAO;CAET,OAAO,WAAW;AACpB;AAEA,eAAsB,yBAA8D;CAClF,MAAM,QAAQ,uBAAuB,SAAS;CAC9C,IAAI,OAAO;EACT,MAAM,4BAA4B,OAAO,CAAC,CAAC;EAC3C,OAAO,yBAAyB,KAAK;CACvC;CAEA,OAAO,yBAAyB,MADV,mBAAmB,CACF;AACzC;AAEA,SAAS,yBACP,SAC4B;CAC5B,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,sCAAsC,YAAY;EACtD,MAAM,gDAAgD;EACtD,MAAM,UAAU,MAAM,uBAAuB;EAC7C,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;EAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;EACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;EAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;EAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;EACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;EAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;EAGF,MAAM,cAA6B;GACjC,GAAG;GACH;GACA;GACA;GACA;GACA;GACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;GACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;GACL,GAAG,qBAAqB,QAAQ,IAAI;GACpC,GAAG,+BAA+B,kBAAkB;EACtD;EAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;EAClE,MAAM,uBAAuB,sBAAsB,OAAO;EAC1D,IAAI,sBACF,iBAAiB;GACf,SAAS;GACT,SAAS,uBAAuB;IAC9B,aAAa,qBAAqB;IAClC,SAAS;GACX,CAAC;EACH,CAAC;CAEL,CAAC;AACH;AAEA,eAAsB,iBACpB,iBACiC;CACjC,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,gDAAgD;EACtD,oBAAoB;EACpB,MAAM,yBAAyB;EAC/B,MAAM,kBAAkB,MAAM,sBAAsB;EACpD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,uBAAuB;EACzC,SAAS,OAAO;GACd,IAAI,iBACF,MAAM;GAER,IACE,EACE,iBAAiB,2BAA2B,MAAM,WAAW,YAG/D,MAAM;GAIR,MAAM,uBAAuB,KAC3B,gBAAgB,GAChB,QACA,mBAAmB,WAAW,EAAE,MAClC;GACA,MAAM,OAAO,gBAAgB,GAAG,oBAAoB;GACpD,OAAO;IAAE;IAAiB;GAAqB;EACjD;EACA,8BAA8B;GAC5B,SAAS,yBAAyB,OAAO;GACzC,UAAU;EACZ,CAAC;EACD,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;EAE5D,MAAM,kBAAkB;EACxB,OAAO,EAAE,gBAAgB;CAC3B,CAAC;AACH;AAEA,eAAsB,qCAAoD;CACxE,MAAM,sCACJ,+CACF;AACF;AAEA,eAAe,kDAAiE;CAC9E,MAAM,+CAA+C;CACrD,MAAM,QAAQ,uBAAuB,SAAS;CAC9C,IAAI,OAAO;EACT,MAAM,UAAU,MAAM,uBAAuB;EAC7C,IACE,SAAS,MAAM,OAAO,MAAM,MAAM,MAClC,SAAS,gBAAgB,MAAM,eAC/B,SAAS,aAAa,MAAM,UAE5B,MAAM,IAAI,wCAAwC;CAEtD;CACA,MAAM,qDAAqD;CAC3D,IAAI,MAAM,iCAAiC,GACzC,MAAM,IAAI,mCAAmC;AAEjD;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,yBACb,UAII,CAAC,GAC2B;CAChC,IAAI;CACJ,IAAI;EACF,UACE,QAAQ,YAAY,QAChB,MAAM,mCAAmC,QAAQ,oBAAoB,IACrE,MAAM,mBAAmB;CACjC,SAAS,OAAO;EACd,IAAI,iBAAiB,yBAAyB;GAC5C,oBAAoB;GACpB,OAAO;IACL,cAAc,MAAM;IACpB,YAAY;IACZ,OAAO;IACP,SAAS;GACX;EACF;EACA,MAAM;CACR;CACA,IAAI,SAAS,MAAM,GAAG;EACpB,oBAAoB;EACpB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;CACF;CAEA,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UAAU;EACb,oBAAoB;EACpB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;CACF;CAEA,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAAY;EACxD,oBAAoB;EACpB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;CACF;CAEA,MAAM,UAAU,sBAAsB,OAAO;CAC7C,IAAI,CAAC,SACH,OAAO,MAAM,6BACX;EACE,GAAG;EACH,GAAG;EACH;EACA;EACA;EACA;EACA;CACF,GACA,OACF;CAEF,OAAO,+BACL,SACA,2BAA2B,OAAO,CACpC;AACF;AAEA,SAAS,+BACP,SACA,YACuB;CACvB,MAAM,oBAAoB,oCACxB,QAAQ,SACV;CACA,IAAI,kBAAkB,WAAW,WAC/B,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAEF,IAAI,kBAAkB,WAAW,WAC/B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;EACA;CACF;CAGF,OAAO;EACL,OAAO;EACP;EACA;CACF;AACF;AAEA,eAAe,6BACb,SACA,SACgC;CAChC,MAAM,gBAAgB,mCAAmC,OAAO;CAChE,MAAM,cAAc,MAAM,sBACxB,eACA,QAAQ,QACV;CAEA,IAAI;CACJ,IAAI;EACF,iBACE,QAAQ,YAAY,QAChB,MAAM,uBAAuB,IAC7B,MAAM,mBAAmB;CACjC,SAAS,OAAO;EACd,IAAI,EAAE,iBAAiB,0BACrB,MAAM;EAER,oBAAoB;EACpB,OAAO;GACL,OAAO;GACP,SAAS;GACT,YAAY;GACZ,cAAc,MAAM;EACtB;CACF;CACA,IACE,CAAC,kBACD,mCAAmC,cAAc,MAAM,eACvD;EACA,KAAK,QAAQ,eAAe,MAAM,GAAG;GACnC,oBAAoB;GACpB,OAAO;IACL,OAAO;IACP,SAAS;IACT,YAAY;IACZ,cACE;GACJ;EACF;EACA,OAAO,MAAM,yBAAyB;GACpC,GAAG;GACH,cAAc,QAAQ,eAAe,KAAK;EAC5C,CAAC;CACH;CACA,IAAI,YAAY,WAAW,WACzB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAEF,IAAI,YAAY,WAAW,eACzB,OAAO;EACL,cAAc,YAAY;EAC1B,cAAc,YAAY;EAC1B,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,UAAU,uBAAuB;EACrC,aAAa,YAAY;EACzB,SAAS;CACX,CAAC;CACD,iBAAiB;EAAE,SAAS;EAAgB;CAAQ,CAAC;CACrD,OAAO,+BACL,SACA,2BAA2B,cAAc,CAC3C;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,8BAA8B,OAG9B;CACP,IAAI,MAAM,aAAa,KAAA,GACrB;CAEF,IACE,+BAA+B,MAAM,OAAO,MAC5C,+BAA+B,MAAM,QAAQ,GAE7C,MAAM,IAAI,wCAAwC;AAEtD;AAEA,SAAgB,+BACd,SACQ;CACR,IAAI,CAAC,SACH,OAAO;CAMT,MAAM,iBAAiB,KAAK,UAAU;EACpC,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ,MAAM,MAAM;CACtB,CAAC;CACD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,OAAO,WAAW;AACvE;AAEA,eAAe,qDAAqD,OAGlD;CAChB,MAAM,kBAAkB,kBAAkB,MAAM,gBAAgB,QAAQ;CACxE,MAAM,mBAAmB,kBACvB,MAAM,QAAQ,iBAAiB,QACjC;CACA,MAAM,sBAAsB,CAC1B,GAAI,mBAAmB,CAAC,gBAAgB,IAAI,CAAC,GAC7C,GAAG,sBAAsB,MAAM,OAAO,CACxC;CAEA,KAAK,MAAM,CAAC,OAAO,aAAa,oBAAoB,QAAQ,GAAG;EAI7D,IAHuB,oBACpB,MAAM,GAAG,KAAK,CAAC,CACf,MAAM,gBAAgB,wBAAwB,aAAa,QAAQ,CAEvD,KACZ,mBAAmB,wBAAwB,iBAAiB,QAAQ,GAErE;EAEF,MAAM,oCAAoC,QAAQ;CACpD;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,MAAM,gBAAgB,mCAAmC,MAAM,OAAO;CACtE,MAAM,kBAAkB,mBAAmB,kBAAkB;CAC7D,MAAM,WAAW;CACjB,oBAAoB;EAClB;EACA,SAAS,MAAM;CACjB;CACA,IAAI,CAAC,UACH,kBAAkB,sBAAsB;MACnC,IAAI,SAAS,QAAQ,MAAM,OAAO,MAAM,QAAQ,MAAM,IAC3D,kBAAkB,iBAAiB;MAC9B,IAAI,iBACT,kBAAkB,oBAAoB;MACjC,IACL,KAAK,UAAU,CACb,SAAS,QAAQ,oBACjB,SAAS,QAAQ,IACnB,CAAC,MACD,KAAK,UAAU,CAAC,MAAM,QAAQ,oBAAoB,MAAM,QAAQ,IAAI,CAAC,GAErE,kBAAkB,iBAAiB;CAErC,IAAI,iBAAiB;EACnB,MAAM,OAAO,gBAAgB;EAC7B,KAAK,MAAM,YAAY,iCACrB,IAAI,SAAS,SAAS,MACpB,SAAS,OAAO;CAGtB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,IACE,mBAAmB,kBACnB,mCAAmC,OAAO,GAE1C,OAAO;CAET,MAAM,UAAU,uBAAuB;EACrC,aAAa,kBAAkB,QAAQ;EAC9B;CACX,CAAC;CAED,iBAAiB;EAAE;EAAS;CAAQ,CAAC;CACrC,OAAO;AACT;AAEA,SAAS,mCACP,SACQ;CACR,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU;EAC7C,GAAG,QAAQ;EACX,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,aAAa,QAAQ;EACrB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,WAAW,QAAQ;EACnB,OAAO,QAAQ;EACf,aAAa,QAAQ,MAAM;CAC7B,CAAC;AACH;AAEA,eAAe,sBACb,KACA,KACoC;CACpC,MAAM,UAAU,uBAAuB,IAAI,GAAG;CAC9C,IAAI,SACF,OAAO,MAAM;CAEf,MAAM,OAAO,gBAAgB,GAAG,CAAC,CAAC,cAAc;EAC9C,IAAI,uBAAuB,IAAI,GAAG,MAAM,MACtC,uBAAuB,OAAO,GAAG;CAErC,CAAC;CACD,uBAAuB,IAAI,KAAK,IAAI;CACpC,OAAO,MAAM;AACf;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,mBAAmB,WAA+C;CACzE,MAAM,kBAAoC,CAAC;CAC3C,KAAK,MAAM,YAAY,WACrB,IACE,CAAC,gBAAgB,MAAM,aACrB,wBAAwB,UAAU,QAAQ,CAC5C,GAEA,gBAAgB,KAAK,QAAQ;CAGjC,OAAO;AACT;AAEA,SAAS,sBACP,SACkB;CAClB,OAAO,mBAAmB,CACxB,GAAI,QAAQ,sBAAsB,CAAC,GACnC,QAAQ,iBAAiB,QAC3B,CAAC;AACH;AAEA,eAAe,0BACb,SACA,cACe;CACf,KAAK,MAAM,YAAY,sBAAsB,OAAO,GAAG;EACrD,IAAI,gBAAgB,wBAAwB,cAAc,QAAQ,GAChE;EAEF,MAAM,oCAAoC,QAAQ;CACpD;AACF;AAEA,eAAe,4BAA4B,OAKL;CACpC,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,QAAQ,uBAAuB,SAAS;EAC9C,IAAI;OAKE,CAAC,qBAAoB,MAJH,yBAAyB;IAC7C,SAAS;IACT,sBAAsB,+BAA+B,KAAK;GAC5D,CAAC,EAAA,CACgC,SAAS,KAAK,GAC7C,OAAO;EAAA;EAGX,MAAM,+CAA+C;EACrD,MAAM,qDAAqD;EAC3D,MAAM,oBAAoB,MAAM,iCAAiC;EACjE,IAAI,mBAAmB;GACrB,IACE,kBAAkB,UAAU,aAC5B,kBAAkB,sCAAsC,KACxD,wDACE,iBACF,KACA,MAAM,uBAAuB,QAC7B,2BAA2B,kBAAkB,gBAAgB,MAC3D,MAAM,oBAER,OAAO,MAAM,4CAA4C;IACvD,GAAG;IACH,SAAS;GACX,CAAC;GAEH,MAAM,IAAI,mCAAmC;EAC/C;EACA,OAAO,MAAM,qCAAqC,KAAK;CACzD,CAAC;AACH;AAEA,eAAe,qCAAqC,OAKd;CACpC,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IACE,SAAS,MAAM,KACf,MAAM,uBAAuB,QAC7B,2BAA2B,OAAO,MAAM,MAAM,oBAE9C,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B;EAChD,GAAG;EACH;EACA,gBAAgB;CAClB,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAGT,IAAI;EACF,MAAM,+BAA+B;GACnC,aAAa,QAAQ,YAAY;GACjC,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,8BAA8B,gBAAgB,GAAG,QAAQ,WAAW;CAC5E,SAAS,OAAO;EACd,MAAM,kCAAkC,OAAO;EAC/C,MAAM;CACR;CAEA,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS,QAAQ;CACnB,CAAC;CACD,IAAI,CAAC,wBAAwB,QAAQ,iBAAiB,QAAQ,YAAY,GACxE,MAAM,oCAAoC,QAAQ,eAAe;CAEnE,OAAO,QAAQ;AACjB;AAEA,eAAe,4CAA4C,OAKrB;CACpC,MAAM,UAAU,MAAM,4BAA4B;EAChD,GAAG;EACH,SAAS,MAAM,QAAQ;EACvB,gBAAgB;CAClB,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAET,MAAM,qBAAqB,mBAAmB,CAC5C,GAAG,sBAAsB,MAAM,OAAO,GACtC,QAAQ,YACV,CAAC;CACD,IAAI,mBAAmB,SAAS,0BAA0B;EACxD,MAAM,kCAAkC,OAAO;EAC/C,MAAM,IAAI,wBAAwB;GAChC,SAAS,yCAAyC,OAAO,wBAAwB,EAAE;GACnF,QAAQ;EACV,CAAC;CACH;CACA,MAAM,cAA8C;EAClD,GAAG,MAAM;EACT,kBAAkB,QAAQ;EAC1B;CACF;CAEA,IAAI;EACF,MAAM,+BAA+B;GACnC,aAAa,QAAQ,YAAY;GACjC,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,yCAAyC,MAAM,SAAS,WAAW;CAC3E,SAAS,OAAO;EACd,MAAM,kCAAkC,OAAO;EAC/C,MAAM;CACR;CAEA,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS,QAAQ;CACnB,CAAC;CACD,OAAO,QAAQ;AACjB;AASA,eAAe,4BAA4B,OAMM;CAC/C,MAAM,kBAAkB,kBAAkB,MAAM,QAAQ,QAAQ;CAChE,MAAM,YAAY,wBAAwB,MAAM,QAAQ,SAAS;CACjE,MAAM,cAAc,wBAAwB,MAAM,QAAQ,WAAW;CACrE,MAAM,WAAW,wBAAwB,MAAM,QAAQ,QAAQ;CAC/D,MAAM,YAAY,wBAAwB,MAAM,QAAQ,SAAS;CACjE,MAAM,kBAAkB,wBAAwB,MAAM,WAAW;CACjE,IACE,EACE,mBACA,aACA,eACA,YACA,aACA,kBAGF,OAAO;CAGT,MAAM,eACJ,oBAAoB,MAAM,sBACtB,kBACA,MAAM,iBAAiB;EACrB,aAAa;EACb;EACA;EACA,QAAQ,MAAM;CAChB,CAAC;CACP,MAAM,cAA6B;EACjC,GAAG;EACH,UAAU;EACV;EACA;EACA;EACA;EACA,WAAW,MAAM;EACjB,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;CACA,OAAO;EACL;EACA;EACA,aAAa,uBAAuB;GAClC,aAAa;GACb,SAAS;EACX,CAAC;EACD;CACF;AACF;AAEA,eAAe,kCACb,SACe;CACf,IAAI,CAAC,wBAAwB,QAAQ,iBAAiB,QAAQ,YAAY,GACxE,MAAM,oCAAoC,QAAQ,YAAY;AAElE;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAG5B,MAAM,UAAU,MAAM,kBAAkB,QAAQ;EAChD,IAAI,CAAC,wBAAwB,OAAO,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO;GACL,OAAO;GACP,GAAG,sBAAsB,QAAQ;GACjC,GAAG,4BAA4B,OAAO;EACxC;CACF,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,sBAAsB,UAE7B;CACA,MAAM,cAAc,wBAClB,SAAS,QAAQ,IAAI,gBAAgB,CACvC;CACA,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAC1C;AAEA,SAAS,4BAA4B,SAEnC;CACA,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,CAAC;CAEV,MAAM,UAAU,QAAQ;CACxB,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,CAAC;CAEV,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,CAAC,WACH,OAAO,CAAC;CAEV,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO,CAAC;CAEV,OAAO,EAAE,WAAW,IAAI,KAAK,WAAW,CAAC,CAAC,YAAY,EAAE;AAC1D;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,OAAO,oCAAoC,SAAS,CAAC,CAAC,WAAW;AACnE;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,wCAAwC;CAC9C,MAAM,UAAU,MAAM,iCAAiC;CACvD,IAAI,SAAS,UAAU;MAEnB,wDAAwD,OACvC,GACjB,OAAO,QAAQ;CAAA;CAGnB,OAAO,MAAM,uBAAuB;AACtC;AAEA,SAAS,wDACP,SACS;CACT,IAAI,+BAA+B,IAAI,QAAQ,EAAE,GAC/C,OAAO;CAET,OAAO,uCAAuC,OAAO,CAAC,CAAC,MACpD,4BACC,sBAAsB,yBAAyB;EAC7C,UAAU,QAAQ;EAClB,uBAAuB;CACzB,CAAC,CACL;AACF;AAEA,eAAe,mCACb,sBACwC;CACxC,IAAI,sBAAsB;EACxB,MAAM,UAAU,MAAM,iCAAiC;EACvD,IACE,SAAS,UAAU,aACnB,wDAAwD,OAAO,KAC/D,+BAA+B,QAAQ,gBAAgB,MACrD,sBAKF,OAAO,QAAQ;CAEnB;CACA,OAAO,MAAM,uBAAuB;AACtC;AAEA,eAAe,yBAAiE;CAC9E,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACjE,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM,IAAI,wBAAwB;GAChC,SAAS,sDAAsD,KAAK,IAAI,eAAe,KAAK;GAC5F,QAAQ;GACR,OAAO;EACT,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,MACV,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,SAAS,OAAO;EACd,MAAM,IAAI,wBAAwB;GAChC,SAAS,+CAA+C;GACxD,QAAQ;GACR,OAAO;EACT,CAAC;CACH;AACF;AAEA,eAAe,0CAAyD;CAItE,IAAI,CAAE,MAAM,iCAAiC,GAC3C;CAEF,MAAM,sCACJ,oDACF;AACF;AAEA,eAAe,uDAAsE;CACnF,IAAI,UAAU,MAAM,iCAAiC;CACrD,IAAI,CAAC,SACH;CAEF,MAAM,+CAA+C;CACrD,IAAI,+BAA+B,IAAI,QAAQ,EAAE,GAC/C;CAEF,IACE,QAAQ,UAAU,aAClB,uBAAuB;EACrB,UAAU,QAAQ;EAClB,uBAAuB,QAAQ;CACjC,CAAC,GACD;EACA,UAAU,MAAM,uCAAuC,OAAO;EAC9D;CACF;CAEA,IAAI,QAAQ,UAAU,WAAW;EAI/B,IAAI,QAAQ,iBAAiB,qBAAqB;GAChD,MAAM,uCAAuC,OAAO;GACpD;EACF;EACA,MAAM,iCAAiC,OAAO;EAC9C,+BAA+B,OAAO;EACtC,IAAI,QAAQ,iBAAiB;GAC3B,MAAM,yCAAyC,SAAS;IACtD,GAAG;IACH,OAAO;GACT,CAAC;GACD;EACF;EACA,MAAM,0BAA0B,OAAO;EACvC,MAAM,0CAA0C,OAAO;EACvD;CACF;CACA,IAAI,QAAQ,UAAU,qBAAqB;EACzC,IAAI,QAAQ,iBAAiB,qBAC3B;EAEF,+BAA+B,OAAO;EACtC;CACF;CAEA,IAAI,QAAQ,UAAU,aAAa;EACjC,MAAM,iBAAiB,MAAM,uBAAuB;EACpD,IACE,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,gBAAgB,GAErD,MAAM,IAAI,wBAAwB;GAChC,SACE;GACF,QAAQ;EACV,CAAC;EAEH,MAAM,uCAAuC,OAAO,CAAC,CAAC,OACnD,UAAmB;GAClB,wCAAwC;IACtC;IACA,cAAc,QAAQ;GACxB,CAAC;EACH,CACF;CACF;AACF;AAEA,eAAe,uCACb,SACe;CACf,MAAM,mBAAmB,kBAAkB,QAAQ,iBAAiB,QAAQ;CAC5E,IACE,oBACA,CAAC,wBACC,kBACA,QAAQ,iBAAiB,QAC3B,GAEA,MAAM,oCAAoC,gBAAgB;CAE5D,MAAM,0BAA0B,SAAS,QAAQ,iBAAiB,QAAQ;CAC1E,MAAM,0CAA0C,OAAO;AACzD;AAEA,eAAe,uCACb,SACyC;CACzC,IAAI,CAAC,iCAAiC,GACpC,OAAO;CAET,MAAM,iBAAkC;EACtC,UAAU,QAAQ;EAClB,uBAAuB;CACzB;CACA,IACE,uCAAuC,OAAO,CAAC,CAAC,MAC7C,4BACC,sBAAsB,yBAAyB,cAAc,CACjE,GAEA,OAAO;CAET,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,gBAAgB,OAAO,QAAQ,MAAM,eAAe,UAAU,WAChE,OAAO,kBAAkB;CAE3B,MAAM,4BAA4B,uCAChC,cACF,CAAC,CAAC,QAAQ,cAAc,uBAAuB,SAAS,CAAC;CACzD,0BAA0B,KAAK,cAAc;CAC7C,IAAI,0BAA0B,SAAS,iCACrC,MAAM,IAAI,MACR,yCAAyC,OAAO,+BAA+B,EAAE,2CACnF;CAEF,MAAM,iBAAiB;EACrB,GAAG;EACH;EACA,yBAAyB;CAC3B;CACA,MAAM,yCACJ,gBACA,cACF;CACA,OAAO;AACT;AAEA,SAAS,+BACP,SACM;CACN,KAAK,MAAM,2BAA2B,uCACpC,OACF,GAAG;EACD,IAAI,CAAC,uBAAuB,uBAAuB,GACjD;EAEF,IAAI;GACF,QAAQ,KAAK,wBAAwB,UAAU,SAAS;EAC1D,SAAS,OAAO;GACd,IAAI,CAAC,wBAAwB,OAAO,OAAO,GACzC,MAAM,IAAI,wBAAwB;IAChC,SAAS,sCAAsC,OAAO,wBAAwB,QAAQ,EAAE,yBAAyB,eAAe,KAAK;IACrI,QAAQ;IACR,OAAO;GACT,CAAC;EAEL;CACF;AACF;AAEA,SAAS,uCACP,SACmB;CACnB,MAAM,aAAa,CACjB,GAAI,QAAQ,6BAA6B,CAAC,GAC1C,GAAI,QAAQ,0BACR,CAAC,QAAQ,uBAAuB,IAChC,CAAC,CACP;CACA,MAAM,mBAAsC,CAAC;CAC7C,KAAK,MAAM,aAAa,YACtB,IACE,CAAC,iBAAiB,MAAM,aACtB,sBAAsB,UAAU,SAAS,CAC3C,GAEA,iBAAiB,KAAK,SAAS;CAGnC,OAAO;AACT;AAEA,SAAS,sBACP,MACA,OACS;CACT,OACE,KAAK,aAAa,MAAM,YACxB,KAAK,0BAA0B,MAAM;AAEzC;AAEA,SAAS,mCAA4C;CACnD,MAAM,cAAc,OAClB,QAAQ,IAAI,gCAAgC,EAC9C,CAAC,CAAC,KAAK;CACP,OAAO,gBAAgB,gBAAgB,gBAAgB;AACzD;AAEA,eAAe,iCACb,SAC4B;CAC5B,MAAM,UAAU,MAAM,0CAA0C,OAAO;CACvE,IAAI,CAAC,SACH,MAAM,IAAI,wBAAwB;EAChC,SAAS;EACT,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;AAEA,eAAe,0CACb,SACmC;CACnC,MAAM,cAAc,MAAM,gBAAgB,QAAQ,QAAQ;CAC1D,IAAI,YAAY,WAAW,WACzB,OAAO;CAET,IAAI,YAAY,WAAW,eACzB,MAAM,IAAI,wBAAwB;EAChC,SAAS,YAAY;EACrB,QAAQ;CACV,CAAC;CAEH,OAAO,uBAAuB;EAC5B,aAAa,YAAY;EACzB;CACF,CAAC;AACH;AAEA,eAAe,+BACb,SACmC;CACnC,IAAI,CAAC,SACH,OAAO;CAET,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,QAAQ;CAIpD,OAAO,MAAM,WAAW,UACpB,uBAAuB;EAAE,aAAa,MAAM;EAAa;CAAQ,CAAC,IAClE;AACN;AAEA,eAAe,wCAAwC,IAMrD;CACA,MAAM,UAAU,MAAM,iCAAiC;CACvD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,uBAClB,CAAC,QAAQ,iBAET,MAAM,IAAI,MAAM,6CAA6C;CAE/D,OAAO;AAKT;AAEA,SAAS,wCAAwC,OAGxC;CACP,QAAQ,KAAK,uDAAuD;EAClE,OAAO,eAAe,MAAM,KAAK;EACjC,cAAc,MAAM;CACtB,CAAC;AACH;AAEA,eAAe,iCACb,SACA,iBACe;CACf,oBAAoB;CACpB,IAAI,CAAC,QAAQ,iBAAiB;EAC5B,MAAM,kBAAkB;EACxB;CACF;CACA,MAAM,8BACJ,gBAAgB,GAChB,QAAQ,eACV;CACA,IAAI,iBACF,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS;CACX,CAAC;AAEL;AAEA,eAAe,mCAAmF;CAChG,MAAM,OAAO,0BAA0B;CACvC,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACjE,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM,IAAI,wBAAwB;GAChC,SAAS,sDAAsD,KAAK,IAAI,eAAe,KAAK;GAC5F,QAAQ;GACR,OAAO;EACT,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,MACV,OAAO;CAET,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,GAAG;CACxB,SAAS,OAAO;EACd,MAAM,IAAI,wBAAwB;GAChC,SAAS,+CAA+C;GACxD,QAAQ;GACR,OAAO;EACT,CAAC;CACH;CACA,IAAI,CAAC,+BAA+B,KAAK,GACvC,MAAM,IAAI,wBAAwB;EAChC,SAAS,+CAA+C;EACxD,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;AAEA,SAAS,+BACP,OACyC;CACzC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,OACE,MAAM,MAAM,KACZ,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,SAAS,MACjB,MAAM,UAAU,aACf,MAAM,UAAU,uBAChB,MAAM,UAAU,gBAClB,OAAO,cAAc,MAAM,QAAQ,KACnC,OAAO,MAAM,QAAQ,IAAI,KACzB,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS,MACpC,MAAM,oBAAoB,QACzB,qBAAqB,MAAM,eAAe,MAC5C,qBAAqB,MAAM,gBAAgB,MAC1C,MAAM,sCAAsC,KAAA,KAC3C,MAAM,sCAAsC,MAC9C,6BAA6B,MAAM,kBAAkB,KACrD,8BAA8B,MAAM,yBAAyB,KAC7D,0BAA0B,MAAM,uBAAuB,KACvD,kCAAkC,MAAM,eAAe;AAE3D;AAEA,SAAS,6BAA6B,OAAyB;CAC7D,OACE,UAAU,KAAA,KACT,MAAM,QAAQ,KAAK,KAClB,MAAM,UAAU,4BAChB,MAAM,OAAO,aAAa,iBAAiB,QAAQ,CAAC;AAE1D;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,OACE,UAAU,KAAA,KACT,MAAM,QAAQ,KAAK,KAClB,MAAM,UAAU,mCAChB,MAAM,OAAO,cAAc,kBAAkB,SAAS,CAAC;AAE7D;AAEA,SAAS,0BAA0B,OAAyB;CAC1D,OAAO,UAAU,KAAA,KAAa,kBAAkB,KAAK;AACvD;AAEA,SAAS,kBAAkB,OAA0C;CACnE,OACE,SAAS,KAAK,KACd,OAAO,cAAc,MAAM,QAAQ,KACnC,OAAO,MAAM,QAAQ,IAAI,KACzB,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS;AAEzC;AAEA,SAAS,kCAAkC,OAAyB;CAClE,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,IAAI,EAAE,SAAS,KAAK,KAAK,OAAO,MAAM,eAAe,WACnD,OAAO;CAET,QACG,MAAM,wBAAwB,KAAA,KAC7B,iCAAiC,UAAU,MAAM,mBAAmB,CAAC,CAClE,aACJ,MAAM,wBAAwB,KAAA,KAC7B,OAAO,MAAM,wBAAwB,cACtC,MAAM,2BAA2B,KAAA,KAChC,OAAO,MAAM,2BAA2B,cACzC,MAAM,wBAAwB,KAAA,KAC7B,iCAAiC,MAAM,mBAAmB;AAEhE;AAEA,SAAS,iCAAiC,OAAyB;CACjE,OACE,SAAS,KAAK,KACd,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,YAAY,aACxB,MAAM,UAAU,aACf,MAAM,UAAU,oBAChB,MAAM,UAAU,qBACjB,MAAM,aAAa,KAAA,KAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,WAAW,KAAA,KAChB,MAAM,WAAW,QACjB,OAAO,MAAM,WAAW;AAE9B;AAEA,SAAS,qBAAqB,OAAwC;CACpE,OAAO,SAAS,KAAK,KAAK,MAAM,MAAM,KAAK,iBAAiB,MAAM,QAAQ;AAC5E;AAEA,eAAe,yCACb,UACA,MACe;CACf,IAAI,CAAC,qCAAqC,UAAU,IAAI,GACtD,MAAM,IAAI,MAAM,gDAAgD;CAElE,MAAM,UAAU,MAAM,iCAAiC;CACvD,IAAI,CAAC,SACH,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,IAAI,CAAC,qCAAqC,UAAU,OAAO,GACzD,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,MAAM,oBAAoB,0BAA0B,GAAG,IAAI;AAC7D;AAEA,eAAe,kCACb,SACe;CACf,MAAM,OAAO,0BAA0B;CACvC,MAAM,YAAY,GAAG,KAAK,SAAS,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CAC3E,MAAM,OAAO,MAAM,KAAK,WAAW,MAAM,GAAK;CAC9C,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;EACpE,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EACd,UAAU;CACZ;CACA,IAAI;EACF,MAAM,KAAK,MAAM;CACnB,SAAS,OAAO;EACd,YAAY;CACd;CACA,IAAI,YAAY,KAAA,GAAW;EACzB,MAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1D,MAAM;CACR;CAEA,IAAI;EACF,MAAM,KAAK,WAAW,IAAI;CAC5B,SAAS,OAAO;EACd,IAAI,wBAAwB,OAAO,QAAQ,GACzC,MAAM,IAAI,mCAAmC;EAE/C,MAAM;CACR,UAAU;EACR,MAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5D;AACF;AAEA,eAAe,0CACb,UACe;CACf,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,CAAC,gBACH;CAEF,IAAI,CAAC,qCAAqC,UAAU,cAAc,GAChE,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,MAAM,GAAG,0BAA0B,GAAG,EAAE,OAAO,KAAK,CAAC;AACvD;AAEA,SAAS,qCACP,MACA,OACS;CACT,OACE,KAAK,OAAO,MAAM,MAClB,KAAK,aAAa,MAAM,YACxB,KAAK,0BAA0B,MAAM;AAEzC;AAEA,SAAS,4BAAoC;CAC3C,OAAO,KAAK,gBAAgB,GAAG,QAAQ,yBAAyB;AAClE;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,6BAA4C;CACzD,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAClE;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,wBAAwB,OAAgB,MAAuB;CACtE,OAAO,QACL,SAAS,OAAO,UAAU,YAAY,UAAU,SAAS,MAAM,SAAS,IAC1E;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,OAAO,iBAAiB,SAAS,MAAM,QAAQ,KAAK,IAChD,MAAM,QAAQ,KAAK,IACnB,OAAO,SAAS,eAAe;AACrC;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}