{"version":3,"file":"codex-auth-B4Xtqggt.mjs","names":[],"sources":["../src/core/codex-auth.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { closeSync, fstatSync, openSync, readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { AuthError } from \"./errors.ts\";\nimport type { CodexAuthSource, CodexCredentials, CodexCredentialProvider } from \"./types.ts\";\n\nconst hostCredentials = new AsyncLocalStorage<CodexCredentialProvider>();\nconst SOURCE_NAMES = [\"auto\", \"codex\", \"pi\", \"omp\", \"opencode\", \"none\"] as const;\nconst MAX_AUTH_FILE_BYTES = 1024 * 1024;\n\ntype NativeSource = Exclude<CodexAuthSource, \"auto\" | \"none\">;\ntype LoginStore = { readonly source: NativeSource; readonly path: string; readonly sqlite?: true };\n\n/** A validated bearer and its account identity, ready for request headers. */\nexport interface ResolvedCodexCredentials {\n  readonly accessToken: string;\n  readonly accountId: string;\n}\n\n/** Minimal native Pi/OMP auth interface; refresh tokens never cross it. */\nexport interface CodexHostAuth {\n  readonly getProviderAuthStatus?: (provider: string) => { readonly configured: boolean };\n  /** Pi resolves current auth but exposes no forced renewal through this API. */\n  readonly getProviderAuth?: (\n    provider: string,\n  ) => Promise<{ readonly auth: { readonly apiKey?: string } } | undefined>;\n  readonly hasOAuth?: (provider: string) => boolean;\n  readonly get?: (provider: string) => unknown;\n  readonly reload?: () => void;\n  readonly getApiKey?: (provider: string) => Promise<string | undefined>;\n  readonly getOAuthAccess?: (\n    provider: string,\n    sessionId?: string,\n    options?: { readonly forceRefresh?: boolean; readonly signal?: Readonly<AbortSignal> },\n  ) => Promise<CodexCredentials | undefined>;\n}\n\n/**\n * Reuse the invoking Pi/OMP login for this operation without global credential registration.\n * @param host - Pi model registry or OMP auth storage from the extension context.\n * @param run - Search or discovery operation.\n * @param sessionId - OMP account affinity for this session.\n * @returns {T} The operation's result, with scoped host auth.\n */\nexport function withCodexHostAuth<T>(\n  host: CodexHostAuth | undefined,\n  run: () => T,\n  sessionId?: string,\n): T {\n  if (!host || !hasHostAuth(host)) return run();\n  return hostCredentials.run(async ({ refresh, signal }) => {\n    signal.throwIfAborted();\n    if (host.getOAuthAccess) {\n      const credentials = await host.getOAuthAccess(\"openai-codex\", sessionId, {\n        forceRefresh: refresh,\n        signal,\n      });\n      if (!credentials) throw missingLogin();\n      return credentials;\n    }\n    const credentials = await resolvePiHostCredentials(host);\n    signal.throwIfAborted();\n    return credentials;\n  }, run);\n}\n\nasync function resolvePiHostCredentials(host: CodexHostAuth): Promise<CodexCredentials> {\n  if (host.getProviderAuth) {\n    const resolved = await host.getProviderAuth(\"openai-codex\");\n    const accessToken = resolved?.auth.apiKey;\n    if (!accessToken) throw missingLogin();\n    return { accessToken };\n  }\n  host.reload?.();\n  const accessToken = await host.getApiKey?.(\"openai-codex\");\n  const credential = record(host.get?.(\"openai-codex\"));\n  if (!accessToken) throw missingLogin();\n  return { accessToken, accountId: stringValue(credential?.accountId) };\n}\n\nfunction hasHostAuth(host: CodexHostAuth): boolean {\n  if (host.getProviderAuth && host.getProviderAuthStatus)\n    return host.getProviderAuthStatus(\"openai-codex\").configured;\n  if (host.hasOAuth) return host.hasOAuth(\"openai-codex\");\n  return record(host.get?.(\"openai-codex\"))?.type === \"oauth\";\n}\n\n/**\n * Read the bearer and account the environment carries, an explicit token taking precedence.\n * @param accessToken - Token from provider configuration, when the caller passed one.\n * @returns {CodexCredentials} Environment credentials, empty when nothing is set.\n */\nexport function environmentCodexCredentials(\n  accessToken = process.env.OPENAI_CODEX_ACCESS_TOKEN,\n): CodexCredentials {\n  return {\n    accessToken: accessToken ?? \"\",\n    accountId: process.env.OPENAI_CODEX_ACCOUNT_ID || undefined,\n  };\n}\n\n/**\n * Whether the environment names a Codex token or account at all.\n * @returns {boolean} Whether either variable is set.\n */\nexport function hasEnvironmentCodexCredentials(): boolean {\n  return Boolean(process.env.OPENAI_CODEX_ACCESS_TOKEN || process.env.OPENAI_CODEX_ACCOUNT_ID);\n}\n\n/**\n * The provider's local configuration check: valid environment credentials or a native login.\n * Never fetches or refreshes a token, so discovery can call it for every listing.\n * @returns {boolean} Whether `create(\"openai-codex\")` has credentials to start from.\n */\nexport function hasCodexCredentials(): boolean {\n  try {\n    if (hasEnvironmentCodexCredentials()) {\n      resolveCodexCredentials(environmentCodexCredentials());\n      return true;\n    }\n    return hasCodexLogin(codexAuthSource());\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Resolve an explicit source or the environment's source selector.\n * @param source - Optional instance override.\n * @returns {CodexAuthSource} Validated login selection.\n */\nexport function codexAuthSource(source?: CodexAuthSource): CodexAuthSource {\n  const selected = source ?? (process.env.OPENAI_CODEX_AUTH_SOURCE || \"auto\");\n  const known = SOURCE_NAMES.find((name) => name === selected);\n  if (!known)\n    throw new AuthError(\n      \"Invalid OPENAI_CODEX_AUTH_SOURCE; use auto, codex, pi, omp, opencode, or none\",\n      \"openai-codex\",\n    );\n  return known;\n}\n\n/**\n * Inspect native logins without refreshing credentials, creating files, or opening a database for write.\n * @param source - Login selection.\n * @returns {boolean} Whether a usable login or a host refresh authority exists.\n */\nexport function hasCodexLogin(source: CodexAuthSource): boolean {\n  if (source === \"none\") return false;\n  if (source === \"auto\" && hostCredentials.getStore()) return true;\n  return findLogin(source) !== undefined;\n}\n\n/**\n * Pin the selected native store; subsequent calls reread it without changing accounts on failure.\n * @param source - Login selection.\n * @returns {CodexCredentialProvider} A native host callback or a read-only saved-login resolver.\n */\nexport function nativeCodexCredentials(source: CodexAuthSource): CodexCredentialProvider {\n  if (source === \"auto\") {\n    const host = hostCredentials.getStore();\n    if (host) return host;\n  }\n  const login = findLogin(source);\n  if (!login) throw missingLogin();\n  return ({ signal }) => {\n    signal.throwIfAborted();\n    const current = readStore(login.store).find(\n      (credentials) => credentials.accountId === login.credentials.accountId,\n    );\n    if (!current) throw missingLogin();\n    return current;\n  };\n}\n\n/**\n * Resolve account identity from an explicit value or the JWT claim, never from an API key.\n * @param credentials - Caller, environment, or native credentials.\n * @returns {ResolvedCodexCredentials} Header-safe bearer and account identity.\n */\nexport function resolveCodexCredentials(credentials: CodexCredentials): ResolvedCodexCredentials {\n  const claims = tokenClaims(credentials.accessToken);\n  const auth = record(claims?.[\"https://api.openai.com/auth\"]);\n  const accountId = credentials.accountId ?? stringValue(auth?.chatgpt_account_id);\n  if (!validHeaderValue(credentials.accessToken) || !validHeaderValue(accountId))\n    throw missingLogin();\n  return { accessToken: credentials.accessToken, accountId };\n}\n\nfunction findLogin(\n  source: CodexAuthSource,\n): { store: LoginStore; credentials: ResolvedCodexCredentials } | undefined {\n  if (source === \"none\") return undefined;\n  for (const store of loginStores()) {\n    if (source !== \"auto\" && store.source !== source) continue;\n    const credentials = readStore(store)[0];\n    if (credentials) return { store, credentials };\n  }\n  return undefined;\n}\n\nfunction loginStores(): readonly LoginStore[] {\n  const home = homedir();\n  const agentOverride = absoluteEnv(\"PI_CODING_AGENT_DIR\");\n  const piDir = agentOverride ?? join(home, \".pi\", \"agent\");\n  const ompDir = ompAgentDir(home, agentOverride);\n  return [\n    { source: \"codex\", path: join(absoluteEnv(\"CODEX_HOME\") ?? join(home, \".codex\"), \"auth.json\") },\n    { source: \"pi\", path: join(piDir, \"auth.json\") },\n    ...ompStores(ompDir),\n    {\n      source: \"opencode\",\n      path: join(\n        absoluteEnv(\"XDG_DATA_HOME\") ?? join(home, \".local\", \"share\"),\n        \"opencode\",\n        \"auth.json\",\n      ),\n    },\n  ];\n}\n\nfunction ompAgentDir(home: string, override?: string): string | undefined {\n  const profile = (process.env.OMP_PROFILE ?? process.env.PI_PROFILE)?.trim();\n  if (!profile || profile === \"default\") return override ?? join(home, \".omp\", \"agent\");\n  if (!validOmpProfile(profile)) return undefined;\n  return join(home, \".omp\", \"profiles\", profile, \"agent\");\n}\n\nfunction validOmpProfile(profile: string): boolean {\n  return (\n    /^[a-z0-9][a-z0-9._-]{0,63}$/u.test(profile) &&\n    !profile.endsWith(\".\") &&\n    !/^(?:CON|PRN|AUX|NUL|COM[0-9]|LPT[0-9])(?:\\..*)?$/iu.test(profile)\n  );\n}\n\nfunction ompStores(dir?: string): readonly LoginStore[] {\n  return dir\n    ? [\n        { source: \"omp\", path: join(dir, \"agent.db\"), sqlite: true },\n        { source: \"omp\", path: join(dir, \"auth.json\") },\n      ]\n    : [];\n}\n\nfunction absoluteEnv(name: string): string | undefined {\n  const value = process.env[name];\n  if (!value) return undefined;\n  if (value === \"~\") return homedir();\n  return value.startsWith(\"~/\") ? join(homedir(), value.slice(2)) : resolve(value);\n}\n\nfunction readStore(store: LoginStore): ResolvedCodexCredentials[] {\n  try {\n    const candidates = store.sqlite ? readOmpDatabase(store.path) : readJsonLogin(store);\n    return candidates.flatMap((candidate) => {\n      const credentials = savedCredentials(candidate, store.source);\n      return credentials ? [credentials] : [];\n    });\n  } catch {\n    return [];\n  }\n}\n\nfunction readJsonLogin(store: LoginStore): readonly unknown[] {\n  const fd = openSync(store.path, \"r\");\n  try {\n    const stat = fstatSync(fd);\n    if (!stat.isFile() || stat.size > MAX_AUTH_FILE_BYTES) return [];\n    const root = record(JSON.parse(readFileSync(fd, \"utf8\")));\n    const key =\n      store.source === \"codex\" ? \"tokens\" : store.source === \"opencode\" ? \"openai\" : \"openai-codex\";\n    const credential: unknown = root?.[key];\n    return Array.isArray(credential) ? credential : [credential];\n  } finally {\n    closeSync(fd);\n  }\n}\n\nfunction readOmpDatabase(path: string): readonly unknown[] {\n  const sqlite = process.getBuiltinModule?.(\"node:sqlite\");\n  if (!sqlite) return [];\n  const db = new sqlite.DatabaseSync(path, { readOnly: true, allowExtension: false });\n  try {\n    const rows = db\n      .prepare(\n        \"SELECT data FROM auth_credentials WHERE provider = ? AND credential_type = 'oauth' AND disabled_cause IS NULL ORDER BY id LIMIT 64\",\n      )\n      .all(\"openai-codex\");\n    return rows.flatMap((row) => {\n      if (typeof row.data !== \"string\" || row.data.length > MAX_AUTH_FILE_BYTES) return [];\n      try {\n        const value: unknown = JSON.parse(row.data);\n        return [value];\n      } catch {\n        return [];\n      }\n    });\n  } finally {\n    db.close();\n  }\n}\n\nfunction savedCredentials(\n  value: unknown,\n  source: NativeSource,\n): ResolvedCodexCredentials | undefined {\n  const data = record(value);\n  if (!data) return undefined;\n  if (source !== \"codex\" && data.type !== undefined && data.type !== \"oauth\") return undefined;\n  const fields =\n    source === \"codex\"\n      ? { access: \"access_token\", account: \"account_id\" }\n      : { access: \"access\", account: \"accountId\" };\n  const accessToken = stringValue(data[fields.access]);\n  if (!accessToken || expired(data, accessToken)) return undefined;\n  try {\n    return resolveCodexCredentials({\n      accessToken,\n      accountId: stringValue(data[fields.account]),\n    });\n  } catch {\n    return undefined;\n  }\n}\n\nfunction expired(data: Readonly<Record<string, unknown>>, accessToken: string): boolean {\n  if (typeof data.expires === \"number\" && data.expires <= Date.now()) return true;\n  const exp = tokenClaims(accessToken)?.exp;\n  return typeof exp === \"number\" && exp * 1000 <= Date.now();\n}\n\nfunction tokenClaims(token: string): Readonly<Record<string, unknown>> | undefined {\n  try {\n    const payload = token.split(\".\")[1];\n    if (!payload) return undefined;\n    return record(JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\")));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction record(value: unknown): Readonly<Record<string, unknown>> | undefined {\n  return isRecord(value) ? value : undefined;\n}\n\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction stringValue(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value : undefined;\n}\nfunction validHeaderValue(value: unknown): value is string {\n  return typeof value === \"string\" && /^[!-~]+$/u.test(value);\n}\nfunction missingLogin(): AuthError {\n  return new AuthError(\n    \"No usable Codex login. Sign in with Pi, OMP, Codex, or OpenCode; let that client refresh an expired login. Explicit overrides: OPENAI_CODEX_ACCESS_TOKEN and OPENAI_CODEX_ACCOUNT_ID, or codex.credentials\",\n    \"openai-codex\",\n  );\n}\n"],"mappings":";;;;;;AAOA,MAAM,kBAAkB,IAAI,kBAA2C;AACvE,MAAM,eAAe;CAAC;CAAQ;CAAS;CAAM;CAAO;CAAY;AAAM;AACtE,MAAM,sBAAsB;;;;;;;;AAoC5B,SAAgB,kBACd,MACA,KACA,WACG;CACH,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,GAAG,OAAO,IAAI;CAC5C,OAAO,gBAAgB,IAAI,OAAO,EAAE,SAAS,aAAa;EACxD,OAAO,eAAe;EACtB,IAAI,KAAK,gBAAgB;GACvB,MAAM,cAAc,MAAM,KAAK,eAAe,gBAAgB,WAAW;IACvE,cAAc;IACd;GACF,CAAC;GACD,IAAI,CAAC,aAAa,MAAM,aAAa;GACrC,OAAO;EACT;EACA,MAAM,cAAc,MAAM,yBAAyB,IAAI;EACvD,OAAO,eAAe;EACtB,OAAO;CACT,GAAG,GAAG;AACR;AAEA,eAAe,yBAAyB,MAAgD;CACtF,IAAI,KAAK,iBAAiB;EAExB,MAAM,eAAc,MADG,KAAK,gBAAgB,cAAc,EAAA,EAC5B,KAAK;EACnC,IAAI,CAAC,aAAa,MAAM,aAAa;EACrC,OAAO,EAAE,YAAY;CACvB;CACA,KAAK,SAAS;CACd,MAAM,cAAc,MAAM,KAAK,YAAY,cAAc;CACzD,MAAM,aAAa,OAAO,KAAK,MAAM,cAAc,CAAC;CACpD,IAAI,CAAC,aAAa,MAAM,aAAa;CACrC,OAAO;EAAE;EAAa,WAAW,YAAY,YAAY,SAAS;CAAE;AACtE;AAEA,SAAS,YAAY,MAA8B;CACjD,IAAI,KAAK,mBAAmB,KAAK,uBAC/B,OAAO,KAAK,sBAAsB,cAAc,CAAC,CAAC;CACpD,IAAI,KAAK,UAAU,OAAO,KAAK,SAAS,cAAc;CACtD,OAAO,OAAO,KAAK,MAAM,cAAc,CAAC,CAAC,EAAE,SAAS;AACtD;;;;;;AAOA,SAAgB,4BACd,cAAc,QAAQ,IAAI,2BACR;CAClB,OAAO;EACL,aAAa,eAAe;EAC5B,WAAW,QAAQ,IAAI,2BAA2B,KAAA;CACpD;AACF;;;;;AAMA,SAAgB,iCAA0C;CACxD,OAAO,QAAQ,QAAQ,IAAI,6BAA6B,QAAQ,IAAI,uBAAuB;AAC7F;;;;;;AAOA,SAAgB,sBAA+B;CAC7C,IAAI;EACF,IAAI,+BAA+B,GAAG;GACpC,wBAAwB,4BAA4B,CAAC;GACrD,OAAO;EACT;EACA,OAAO,cAAc,gBAAgB,CAAC;CACxC,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,gBAAgB,QAA2C;CACzE,MAAM,WAAW,WAAW,QAAQ,IAAI,4BAA4B;CACpE,MAAM,QAAQ,aAAa,MAAM,SAAS,SAAS,QAAQ;CAC3D,IAAI,CAAC,OACH,MAAM,IAAI,UACR,iFACA,cACF;CACF,OAAO;AACT;;;;;;AAOA,SAAgB,cAAc,QAAkC;CAC9D,IAAI,WAAW,QAAQ,OAAO;CAC9B,IAAI,WAAW,UAAU,gBAAgB,SAAS,GAAG,OAAO;CAC5D,OAAO,UAAU,MAAM,MAAM,KAAA;AAC/B;;;;;;AAOA,SAAgB,uBAAuB,QAAkD;CACvF,IAAI,WAAW,QAAQ;EACrB,MAAM,OAAO,gBAAgB,SAAS;EACtC,IAAI,MAAM,OAAO;CACnB;CACA,MAAM,QAAQ,UAAU,MAAM;CAC9B,IAAI,CAAC,OAAO,MAAM,aAAa;CAC/B,QAAQ,EAAE,aAAa;EACrB,OAAO,eAAe;EACtB,MAAM,UAAU,UAAU,MAAM,KAAK,CAAC,CAAC,MACpC,gBAAgB,YAAY,cAAc,MAAM,YAAY,SAC/D;EACA,IAAI,CAAC,SAAS,MAAM,aAAa;EACjC,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,wBAAwB,aAAyD;CAE/F,MAAM,OAAO,OADE,YAAY,YAAY,WACd,CAAC,GAAG,8BAA8B;CAC3D,MAAM,YAAY,YAAY,aAAa,YAAY,MAAM,kBAAkB;CAC/E,IAAI,CAAC,iBAAiB,YAAY,WAAW,KAAK,CAAC,iBAAiB,SAAS,GAC3E,MAAM,aAAa;CACrB,OAAO;EAAE,aAAa,YAAY;EAAa;CAAU;AAC3D;AAEA,SAAS,UACP,QAC0E;CAC1E,IAAI,WAAW,QAAQ,OAAO,KAAA;CAC9B,KAAK,MAAM,SAAS,YAAY,GAAG;EACjC,IAAI,WAAW,UAAU,MAAM,WAAW,QAAQ;EAClD,MAAM,cAAc,UAAU,KAAK,CAAC,CAAC;EACrC,IAAI,aAAa,OAAO;GAAE;GAAO;EAAY;CAC/C;AAEF;AAEA,SAAS,cAAqC;CAC5C,MAAM,OAAO,QAAQ;CACrB,MAAM,gBAAgB,YAAY,qBAAqB;CACvD,MAAM,QAAQ,iBAAiB,KAAK,MAAM,OAAO,OAAO;CACxD,MAAM,SAAS,YAAY,MAAM,aAAa;CAC9C,OAAO;EACL;GAAE,QAAQ;GAAS,MAAM,KAAK,YAAY,YAAY,KAAK,KAAK,MAAM,QAAQ,GAAG,WAAW;EAAE;EAC9F;GAAE,QAAQ;GAAM,MAAM,KAAK,OAAO,WAAW;EAAE;EAC/C,GAAG,UAAU,MAAM;EACnB;GACE,QAAQ;GACR,MAAM,KACJ,YAAY,eAAe,KAAK,KAAK,MAAM,UAAU,OAAO,GAC5D,YACA,WACF;EACF;CACF;AACF;AAEA,SAAS,YAAY,MAAc,UAAuC;CACxE,MAAM,WAAW,QAAQ,IAAI,eAAe,QAAQ,IAAI,WAAA,EAAa,KAAK;CAC1E,IAAI,CAAC,WAAW,YAAY,WAAW,OAAO,YAAY,KAAK,MAAM,QAAQ,OAAO;CACpF,IAAI,CAAC,gBAAgB,OAAO,GAAG,OAAO,KAAA;CACtC,OAAO,KAAK,MAAM,QAAQ,YAAY,SAAS,OAAO;AACxD;AAEA,SAAS,gBAAgB,SAA0B;CACjD,OACE,+BAA+B,KAAK,OAAO,KAC3C,CAAC,QAAQ,SAAS,GAAG,KACrB,CAAC,qDAAqD,KAAK,OAAO;AAEtE;AAEA,SAAS,UAAU,KAAqC;CACtD,OAAO,MACH,CACE;EAAE,QAAQ;EAAO,MAAM,KAAK,KAAK,UAAU;EAAG,QAAQ;CAAK,GAC3D;EAAE,QAAQ;EAAO,MAAM,KAAK,KAAK,WAAW;CAAE,CAChD,IACA,CAAC;AACP;AAEA,SAAS,YAAY,MAAkC;CACrD,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI,UAAU,KAAK,OAAO,QAAQ;CAClC,OAAO,MAAM,WAAW,IAAI,IAAI,KAAK,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,IAAI,QAAQ,KAAK;AACjF;AAEA,SAAS,UAAU,OAA+C;CAChE,IAAI;EAEF,QADmB,MAAM,SAAS,gBAAgB,MAAM,IAAI,IAAI,cAAc,KAAK,EAAA,CACjE,SAAS,cAAc;GACvC,MAAM,cAAc,iBAAiB,WAAW,MAAM,MAAM;GAC5D,OAAO,cAAc,CAAC,WAAW,IAAI,CAAC;EACxC,CAAC;CACH,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,cAAc,OAAuC;CAC5D,MAAM,KAAK,SAAS,MAAM,MAAM,GAAG;CACnC,IAAI;EACF,MAAM,OAAO,UAAU,EAAE;EACzB,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,OAAO,qBAAqB,OAAO,CAAC;EAC/D,MAAM,OAAO,OAAO,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,CAAC;EACxD,MAAM,MACJ,MAAM,WAAW,UAAU,WAAW,MAAM,WAAW,aAAa,WAAW;EACjF,MAAM,aAAsB,OAAO;EACnC,OAAO,MAAM,QAAQ,UAAU,IAAI,aAAa,CAAC,UAAU;CAC7D,UAAU;EACR,UAAU,EAAE;CACd;AACF;AAEA,SAAS,gBAAgB,MAAkC;CACzD,MAAM,SAAS,QAAQ,mBAAmB,aAAa;CACvD,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,KAAK,IAAI,OAAO,aAAa,MAAM;EAAE,UAAU;EAAM,gBAAgB;CAAM,CAAC;CAClF,IAAI;EAMF,OALa,GACV,QACC,oIACF,CAAC,CACA,IAAI,cACG,CAAC,CAAC,SAAS,QAAQ;GAC3B,IAAI,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,qBAAqB,OAAO,CAAC;GACnF,IAAI;IAEF,OAAO,CADgB,KAAK,MAAM,IAAI,IAC1B,CAAC;GACf,QAAQ;IACN,OAAO,CAAC;GACV;EACF,CAAC;CACH,UAAU;EACR,GAAG,MAAM;CACX;AACF;AAEA,SAAS,iBACP,OACA,QACsC;CACtC,MAAM,OAAO,OAAO,KAAK;CACzB,IAAI,CAAC,MAAM,OAAO,KAAA;CAClB,IAAI,WAAW,WAAW,KAAK,SAAS,KAAA,KAAa,KAAK,SAAS,SAAS,OAAO,KAAA;CACnF,MAAM,SACJ,WAAW,UACP;EAAE,QAAQ;EAAgB,SAAS;CAAa,IAChD;EAAE,QAAQ;EAAU,SAAS;CAAY;CAC/C,MAAM,cAAc,YAAY,KAAK,OAAO,OAAO;CACnD,IAAI,CAAC,eAAe,QAAQ,MAAM,WAAW,GAAG,OAAO,KAAA;CACvD,IAAI;EACF,OAAO,wBAAwB;GAC7B;GACA,WAAW,YAAY,KAAK,OAAO,QAAQ;EAC7C,CAAC;CACH,QAAQ;EACN;CACF;AACF;AAEA,SAAS,QAAQ,MAAyC,aAA8B;CACtF,IAAI,OAAO,KAAK,YAAY,YAAY,KAAK,WAAW,KAAK,IAAI,GAAG,OAAO;CAC3E,MAAM,MAAM,YAAY,WAAW,CAAC,EAAE;CACtC,OAAO,OAAO,QAAQ,YAAY,MAAM,OAAQ,KAAK,IAAI;AAC3D;AAEA,SAAS,YAAY,OAA8D;CACjF,IAAI;EACF,MAAM,UAAU,MAAM,MAAM,GAAG,CAAC,CAAC;EACjC,IAAI,CAAC,SAAS,OAAO,KAAA;EACrB,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC;CAC9E,QAAQ;EACN;CACF;AACF;AAEA,SAAS,OAAO,OAA+D;CAC7E,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACnC;AAEA,SAAS,SAAS,OAA4D;CAC5E,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,OAAoC;CACvD,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;AACA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,YAAY,KAAK,KAAK;AAC5D;AACA,SAAS,eAA0B;CACjC,OAAO,IAAI,UACT,8MACA,cACF;AACF"}