🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →

@stll/cli

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

@stll/cli - npm Package Compare versions

Comparing version

0.0.1-placeholder.0

0.1.0

+6

dist/annotations.d.ts

		import type { ToolAnnotation } from "./route-types.js";
		/** Reserved top-level command names a generated domain may never take (spec S1). */
		export declare const RESERVED_TOP_LEVEL_NAMES: ReadonlySet<string>;
		/** Reserved global flags a generated per-tool flag may never collide with (spec S1). */
		export declare const RESERVED_FLAGS: ReadonlySet<string>;
		export declare const TOOL_ANNOTATIONS: Readonly<Record<string, ToolAnnotation>>;

+210

dist/annotations.js

		// The baked-in Annotation Table (spec 051 S1), keyed by tool name. Everything
		// the CLI needs beyond the four `tools/list` wire fields lives here: the
		// command path, the client-side scope for the precheck, the list `itemsKey`,
		// single-read flip props, windowed-text/paginationless markers, and the
		// `manage_organization` discriminator split. Encoded as plain data so both the
		// build-time codegen and (later) a runtime path can import it.
		//
		// `scope` is the UNPREFIXED form from `route-types.ts`; the scope precheck
		// prefixes it with `stella:` before comparing against the decoded token.
		/** Reserved top-level command names a generated domain may never take (spec S1). */
		export const RESERVED_TOP_LEVEL_NAMES = new Set([
		"auth",
		"tools",
		"reference",
		"help",
		"version",
		"completion",
		"config",
		]);
		/** Reserved global flags a generated per-tool flag may never collide with (spec S1). */
		export const RESERVED_FLAGS = new Set([
		"--output",
		"--json",
		"--table",
		"--input",
		"--yes",
		"-y",
		"--all",
		"--cursor",
		"--limit",
		"--org",
		"--no-keychain",
		"--server",
		"--help",
		"-h",
		"--version",
		]);
		export const TOOL_ANNOTATIONS = {
		// --- compat shims: excluded from the tree entirely (spec S1) ---
		search: { command: ["search"], excluded: true, scope: "search" },
		fetch: { command: ["fetch"], excluded: true, scope: "read" },
		// --- matter domain ---
		save_matter: { command: ["matter", "save"], scope: "matters_write" },
		delete_matter: { command: ["matter", "delete"], scope: "matters_write" },
		list_matters: {
		command: ["matter", "list"],
		scope: "read",
		itemsKey: "matters",
		singleReadWhen: "matter_id",
		},
		link_matter_contact: {
		command: ["matter", "link-contact"],
		scope: "matters_write",
		},
		// --- contact domain ---
		save_contact: { command: ["contact", "save"], scope: "matters_write" },
		delete_contact: { command: ["contact", "delete"], scope: "matters_write" },
		read_contact: { command: ["contact", "read"], scope: "read" },
		lookup_business_registry: {
		command: ["contact", "lookup-registry"],
		scope: "read",
		},
		// --- task domain ---
		list_tasks: {
		command: ["task", "list"],
		scope: "read",
		itemsKey: "tasks",
		singleReadWhen: "task_id",
		},
		save_task: { command: ["task", "save"], scope: "matters_write" },
		// --- document domain ---
		list_documents: {
		command: ["document", "list"],
		scope: "read",
		itemsKey: "documents",
		},
		read_document: { command: ["document", "read"], scope: "read" },
		save_document: { command: ["document", "save"], scope: "documents_write" },
		delete_document: {
		command: ["document", "delete"],
		scope: "documents_write",
		},
		list_properties: {
		command: ["document", "properties", "list"],
		scope: "read",
		itemsKey: "properties",
		},
		set_field_value: {
		command: ["document", "field", "set"],
		scope: "documents_write",
		},
		// --- knowledge domain ---
		list_clauses: {
		command: ["clause", "list"],
		scope: "read",
		// Registry payload key is `clauses` (spec table says `items`; registry wins).
		itemsKey: "clauses",
		singleReadWhen: "clause_id",
		},
		save_clause: { command: ["clause", "save"], scope: "knowledge_write" },
		delete_clause: { command: ["clause", "delete"], scope: "knowledge_write" },
		list_playbooks: {
		command: ["playbook", "list"],
		scope: "read",
		itemsKey: "items",
		singleReadWhen: "playbook_id",
		},
		run_playbook: { command: ["playbook", "run"], scope: "knowledge_write" },
		// --- cross-matter search / read ---
		search_across_matters: {
		command: ["search", "matters"],
		scope: "search",
		itemsKey: "hits",
		},
		read_content_across_matters: {
		command: ["search", "read"],
		scope: "read",
		windowedText: true,
		},
		search_case_law: {
		command: ["case-law", "search"],
		scope: "search",
		itemsKey: "results",
		},
		read_case_law_decision: {
		command: ["case-law", "read"],
		scope: "read",
		windowedText: true,
		},
		// --- organization onboarding ---
		set_practice_jurisdictions: {
		command: ["organization", "set-jurisdictions"],
		scope: "onboarding",
		},
		// --- templates ---
		list_templates: {
		command: ["template", "list"],
		scope: "templates",
		itemsKey: "templates",
		paginationless: true,
		singleReadWhen: "template_id",
		},
		fill_template: { command: ["template", "fill"], scope: "templates" },
		save_template: { command: ["template", "save"], scope: "templates" },
		// --- billing ---
		list_time_entries: {
		command: ["time-entry", "list"],
		scope: "read",
		itemsKey: "entries",
		singleReadWhen: "time_entry_id",
		},
		save_time_entry: {
		command: ["time-entry", "save"],
		scope: "billing_write",
		},
		delete_time_entry: {
		command: ["time-entry", "delete"],
		scope: "billing_write",
		},
		resolve_rate: { command: ["rate", "resolve"], scope: "read" },
		list_invoices: {
		command: ["invoice", "list"],
		scope: "read",
		itemsKey: "invoices",
		singleReadWhen: "invoice_id",
		},
		get_usage: { command: ["usage", "get"], scope: "read" },
		// --- research / admin ---
		search_legislation: {
		command: ["legislation", "search"],
		scope: "read",
		// Multi-shape payload (list vs single block vs related); the search-mode
		// list array key is `items`. Read-mode responses render as single objects.
		itemsKey: "items",
		},
		list_audit_log: {
		command: ["audit-log", "list"],
		scope: "admin_read",
		itemsKey: "items",
		},
		manage_organization: {
		command: ["organization"],
		scope: "admin_write",
		discriminator: {
		prop: "action",
		subcommands: {
		add_member: {
		command: "add-member",
		include: ["matter_id", "user_id"],
		required: ["matter_id", "user_id"],
		},
		remove_member: {
		command: "remove-member",
		include: ["matter_id", "user_id"],
		required: ["matter_id", "user_id"],
		destructive: true,
		},
		update_org_settings: {
		command: "update-settings",
		include: [
		"matter_number_pattern",
		"matter_number_padding",
		"prompt_caching_enabled",
		],
		},
		},
		},
		},
		};
		//# sourceMappingURL=annotations.js.map

+1

dist/annotations.js.map

+1

dist/auth/browser-open.d.ts

export declare const openInBrowser: (url: string) => Promise<boolean>;

+47

dist/auth/browser-open.js

		// Best-effort system-browser launch. Never throws: the printed URL is always
		// the fallback (see `login.ts`), so a failure here is not fatal. Uses
		// `node:child_process` `spawn` so the published CLI runs under plain Node.
		import { spawn } from "node:child_process";
		const OPEN_TIMEOUT_MS = 5000;
		const openCommandFor = (platform) => {
		if (platform === "darwin") {
		return ["open"];
		}
		if (platform === "win32") {
		return ["cmd", "/c", "start", ""];
		}
		return ["xdg-open"];
		};
		export const openInBrowser = async (url) => {
		const command = openCommandFor(process.platform);
		if (!command) {
		return false;
		}
		// `command` always has at least one element (see `openCommandFor`); append
		// the URL as the final argument, matching the old `[...command, url]` spawn.
		const [file, ...args] = [...command, url];
		// Detached + `stdio: "ignore"` decouples the launched browser from the CLI
		// (the old `Bun.spawn` ignored all three streams too); a bound `error`
		// handler keeps an async spawn failure (ENOENT) from throwing on the emitter.
		const child = spawn(file, args, { detached: true, stdio: "ignore" });
		// Mirror the old logic: succeed on a zero exit code, fail on a spawn error,
		// and bound the wait so a hung opener can never stall the CLI. Each executor
		// resolves exactly once; `Promise.race` takes whichever settles first.
		let timer;
		const exited = new Promise((resolve) => {
		child.on("exit", (code) => resolve(code === 0));
		});
		const errored = new Promise((resolve) => {
		child.on("error", () => resolve(false));
		});
		const timedOut = new Promise((resolve) => {
		timer = setTimeout(() => resolve(false), OPEN_TIMEOUT_MS);
		});
		try {
		return await Promise.race([exited, errored, timedOut]);
		}
		finally {
		clearTimeout(timer);
		}
		};
		//# sourceMappingURL=browser-open.js.map

+1

dist/auth/browser-open.js.map

{"version":3,"file":"browser-open.js","sourceRoot":"","sources":["../../src/auth/browser-open.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,sEAAsE;AACtE,2EAA2E;AAE3E,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,MAAM,cAAc,GAAG,CACrB,QAAyB,EACM,EAAE;IACjC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;IAE1C,2EAA2E;IAC3E,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAErE,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,KAAgD,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC9C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC"}

+18

dist/auth/cli-config.d.ts

		import { defaultConfigDir, resolveConfigDir } from "./config-dir.js";
		import type { ConfigPathOverrides } from "./config-dir.js";
		export { defaultConfigDir, resolveConfigDir };
		export type { ConfigPathOverrides };
		export type CliConfig = {
		readonly version: 1;
		readonly defaultServerUrl?: string \| undefined;
		readonly oauthClients: Readonly<Record<string, {
		readonly clientId: string;
		readonly registeredAt: number;
		}>>;
		};
		export declare const configFilePath: (configDir: string) => string;
		export declare const readCliConfig: (configDir: string) => Promise<CliConfig>;
		export declare const writeCliConfig: (configDir: string, config: CliConfig) => Promise<void>;
		export declare const setDefaultServerUrl: (configDir: string, serverUrl: string) => Promise<void>;
		export declare const getRegisteredClientId: (configDir: string, serverUrl: string) => Promise<string \| undefined>;
		export declare const setRegisteredClientId: (configDir: string, serverUrl: string, clientId: string) => Promise<void>;

+62

dist/auth/cli-config.js

		// Non-secret CLI configuration: the default server origin and, per server,
		// the dynamically-registered OAuth client id (a public client id is not a
		// secret; there is no client_secret for `token_endpoint_auth_method: "none"`
		// clients). Stored separately from `credential-store.ts`'s file, which holds
		// tokens and is mode 0600.
		import { Result } from "better-result";
		import { mkdir, readFile, writeFile } from "node:fs/promises";
		import path from "node:path";
		import * as v from "valibot";
		import { defaultConfigDir, resolveConfigDir } from "./config-dir.js";
		export { defaultConfigDir, resolveConfigDir };
		const oauthClientEntrySchema = v.strictObject({
		clientId: v.string(),
		registeredAt: v.number(),
		});
		const cliConfigSchema = v.strictObject({
		version: v.literal(1),
		defaultServerUrl: v.optional(v.string()),
		oauthClients: v.record(v.string(), oauthClientEntrySchema),
		});
		const EMPTY_CONFIG = { oauthClients: {}, version: 1 };
		export const configFilePath = (configDir) => path.join(configDir, "config.json");
		export const readCliConfig = async (configDir) => {
		// A missing, corrupt, or empty config file must degrade to defaults, not
		// crash every CLI invocation at context construction.
		const raw = await Result.tryPromise(async () => await readFile(configFilePath(configDir), "utf-8"));
		if (Result.isError(raw)) {
		return EMPTY_CONFIG;
		}
		const parsedJson = Result.try(() => JSON.parse(raw.value));
		if (Result.isError(parsedJson)) {
		return EMPTY_CONFIG;
		}
		const parsed = v.safeParse(cliConfigSchema, parsedJson.value);
		return parsed.success ? parsed.output : EMPTY_CONFIG;
		};
		export const writeCliConfig = async (configDir, config) => {
		// `Bun.write` created the parent directory implicitly; `node:fs` `writeFile`
		// does not. Mirror `credential-store.ts`'s 0700 config dir (both files live
		// in the same `~/.config/stella` directory).
		await mkdir(configDir, { mode: 0o700, recursive: true });
		await writeFile(configFilePath(configDir), `${JSON.stringify(config, null, 2)}\n`);
		};
		export const setDefaultServerUrl = async (configDir, serverUrl) => {
		const config = await readCliConfig(configDir);
		await writeCliConfig(configDir, { ...config, defaultServerUrl: serverUrl });
		};
		export const getRegisteredClientId = async (configDir, serverUrl) => {
		const config = await readCliConfig(configDir);
		return config.oauthClients[serverUrl]?.clientId;
		};
		export const setRegisteredClientId = async (configDir, serverUrl, clientId) => {
		const config = await readCliConfig(configDir);
		await writeCliConfig(configDir, {
		...config,
		oauthClients: {
		...config.oauthClients,
		[serverUrl]: { clientId, registeredAt: Date.now() },
		},
		});
		};
		//# sourceMappingURL=cli-config.js.map

+1

dist/auth/cli-config.js.map

{"version":3,"file":"cli-config.js","sourceRoot":"","sources":["../../src/auth/cli-config.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2BAA2B;AAE3B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGrE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;AAiB9C,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC;CAC3D,CAAC,CAAC;AAEH,MAAM,YAAY,GAAc,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,SAAiB,EAAsB,EAAE;IAC3E,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CACjC,KAAK,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAC/D,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,GAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,SAAiB,EACjB,MAAiB,EACF,EAAE;IACjB,6EAA6E;IAC7E,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,CACb,cAAc,CAAC,SAAS,CAAC,EACzB,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,SAAiB,EACjB,SAAiB,EACF,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,SAAiB,EACjB,SAAiB,EACY,EAAE;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,SAAiB,EACjB,SAAiB,EACjB,QAAgB,EACD,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,cAAc,CAAC,SAAS,EAAE;QAC9B,GAAG,MAAM;QACT,YAAY,EAAE;YACZ,GAAG,MAAM,CAAC,YAAY;YACtB,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;SACpD;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

+7

dist/auth/config-dir.d.ts

		export type ConfigPathOverrides = {
		readonly xdgConfigHome?: string \| undefined;
		readonly homeDir: string;
		};
		/** `$XDG_CONFIG_HOME/stella` or `~/.config/stella`, per the XDG base dir spec. */
		export declare const resolveConfigDir: (overrides: ConfigPathOverrides) => string;
		export declare const defaultConfigDir: () => string;

+17

dist/auth/config-dir.js

		// Shared `~/.config/stella` (XDG) directory resolution, used by both
		// `cli-config.ts` (non-secret config) and `credential-store.ts` (secrets).
		import os from "node:os";
		import path from "node:path";
		import { XDG_CONFIG_HOME } from "../env.js";
		/** `$XDG_CONFIG_HOME/stella` or `~/.config/stella`, per the XDG base dir spec. */
		export const resolveConfigDir = (overrides) => {
		const base = overrides.xdgConfigHome && overrides.xdgConfigHome.length > 0
		? overrides.xdgConfigHome
		: path.join(overrides.homeDir, ".config");
		return path.join(base, "stella");
		};
		export const defaultConfigDir = () => resolveConfigDir({
		homeDir: os.homedir(),
		xdgConfigHome: XDG_CONFIG_HOME,
		});
		//# sourceMappingURL=config-dir.js.map

+1

dist/auth/config-dir.js.map

{"version":3,"file":"config-dir.js","sourceRoot":"","sources":["../../src/auth/config-dir.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,2EAA2E;AAE3E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAO5C,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,SAA8B,EAAU,EAAE;IACzE,MAAM,IAAI,GACR,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAC3D,CAAC,CAAC,SAAS,CAAC,aAAa;QACzB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAC3C,gBAAgB,CAAC;IACf,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE;IACrB,aAAa,EAAE,eAAe;CAC/B,CAAC,CAAC"}

+38

dist/auth/constants.d.ts

		/**
		* The OAuth resource (`RFC 8707`) the CLI requests. Passing `resource` at the
		* token endpoint is what makes better-auth's oauth-provider mint a JWT-format
		* access token (see `checkResource`/`isJwtAccessToken` in
		* `@better-auth/oauth-provider`); without it the server returns an opaque
		* token that the CLI cannot decode for `stella auth whoami`.
		*/
		export declare const getMcpResourceUrl: (serverUrl: string) => string;
		/**
		* Candidate RFC 8414 authorization-server-metadata paths, tried in order.
		* The first is the spec's root-issuer convention; the second matches
		* better-auth's actual (default `/api/auth`) mount point, which is what
		* stella's own server uses today. Self-hosted forks that change
		* `advanced.basePath` are covered as long as they keep one of these two
		* shapes; forks using a third convention are a follow-up, not a Phase 2 gap.
		*/
		export declare const AUTHORIZATION_SERVER_METADATA_PATHS: readonly ["/.well-known/oauth-authorization-server", "/api/auth/.well-known/oauth-authorization-server"];
		/**
		* Loopback redirect URI registered with the OAuth client. Deliberately has no
		* port: better-auth's redirect-uri matcher (`isLoopbackIP` in
		* `@better-auth/core/utils/host`) only compares hostname/pathname/protocol/
		* search for loopback hosts, never the port (RFC 8252 S7.3). Registering a
		* portless URI once lets every login reuse the same client registration with
		* a fresh ephemeral port each run.
		*/
		export declare const LOOPBACK_REDIRECT_PATH = "/callback";
		export declare const LOOPBACK_REDIRECT_URI: string;
		/** Default scopes requested when `stella auth login` is run without `--scopes`. */
		export declare const CLI_DEFAULT_SCOPES: readonly ["openid", "profile", "email", "stella:read", "stella:search"];
		/** Every OAuth scope `stella auth login --scopes` is documented to accept. */
		export declare const CLI_KNOWN_SCOPES: readonly ["openid", "profile", "email", "stella:search", "stella:read", "stella:templates", "stella:documents_write", "stella:matters_write", "stella:knowledge_write", "stella:billing_write", "stella:admin_read", "stella:admin_write", "stella:onboarding", "stella:skills", "stella:external_mcps"];
		export declare const CLIENT_NAME = "stella-cli";
		/** `--server` resolution: env var name, checked between the flag and the config file. */
		export declare const SERVER_URL_ENV_VAR = "STELLA_SERVER_URL";
		/** How long the CLI waits for the browser round-trip before giving up. */
		export declare const LOGIN_TIMEOUT_MS: number;
		/** Network timeout for every discovery/registration/token request the CLI makes. */
		export declare const AUTH_FETCH_TIMEOUT_MS = 10000;

+75

dist/auth/constants.js

		// Shared literal constants for the `stella auth` flow (spec 051 Phase 2).
		//
		// Several of these intentionally duplicate values owned by `apps/api`
		// (`apps/api/src/mcp/constants.ts`, `apps/api/src/lib/auth.ts`). `packages/cli`
		// cannot import from `apps/api` (apps depend on packages, never the reverse),
		// and the MCP tool registry does not yet expose these as data the CLI could
		// fetch at runtime. This is the same hand-duplication already accepted for
		// `ToolScope` in `../route-types.ts`; keep both sides in sync by hand until a
		// shared package exists.
		/** Mirrors `apps/api/src/mcp/constants.ts`'s `MCP_HTTP_PATH`. */
		const MCP_HTTP_PATH = "/mcp";
		/**
		* The OAuth resource (`RFC 8707`) the CLI requests. Passing `resource` at the
		* token endpoint is what makes better-auth's oauth-provider mint a JWT-format
		* access token (see `checkResource`/`isJwtAccessToken` in
		* `@better-auth/oauth-provider`); without it the server returns an opaque
		* token that the CLI cannot decode for `stella auth whoami`.
		*/
		export const getMcpResourceUrl = (serverUrl) => new URL(MCP_HTTP_PATH, serverUrl).toString();
		/**
		* Candidate RFC 8414 authorization-server-metadata paths, tried in order.
		* The first is the spec's root-issuer convention; the second matches
		* better-auth's actual (default `/api/auth`) mount point, which is what
		* stella's own server uses today. Self-hosted forks that change
		* `advanced.basePath` are covered as long as they keep one of these two
		* shapes; forks using a third convention are a follow-up, not a Phase 2 gap.
		*/
		export const AUTHORIZATION_SERVER_METADATA_PATHS = [
		"/.well-known/oauth-authorization-server",
		"/api/auth/.well-known/oauth-authorization-server",
		];
		/**
		* Loopback redirect URI registered with the OAuth client. Deliberately has no
		* port: better-auth's redirect-uri matcher (`isLoopbackIP` in
		* `@better-auth/core/utils/host`) only compares hostname/pathname/protocol/
		* search for loopback hosts, never the port (RFC 8252 S7.3). Registering a
		* portless URI once lets every login reuse the same client registration with
		* a fresh ephemeral port each run.
		*/
		export const LOOPBACK_REDIRECT_PATH = "/callback";
		export const LOOPBACK_REDIRECT_URI = `http://127.0.0.1${LOOPBACK_REDIRECT_PATH}`;
		/** Default scopes requested when `stella auth login` is run without `--scopes`. */
		export const CLI_DEFAULT_SCOPES = [
		"openid",
		"profile",
		"email",
		"stella:read",
		"stella:search",
		];
		/** Every OAuth scope `stella auth login --scopes` is documented to accept. */
		export const CLI_KNOWN_SCOPES = [
		"openid",
		"profile",
		"email",
		"stella:search",
		"stella:read",
		"stella:templates",
		"stella:documents_write",
		"stella:matters_write",
		"stella:knowledge_write",
		"stella:billing_write",
		"stella:admin_read",
		"stella:admin_write",
		"stella:onboarding",
		"stella:skills",
		"stella:external_mcps",
		];
		export const CLIENT_NAME = "stella-cli";
		/** `--server` resolution: env var name, checked between the flag and the config file. */
		export const SERVER_URL_ENV_VAR = "STELLA_SERVER_URL";
		/** How long the CLI waits for the browser round-trip before giving up. */
		export const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
		/** Network timeout for every discovery/registration/token request the CLI makes. */
		export const AUTH_FETCH_TIMEOUT_MS = 10_000;
		//# sourceMappingURL=constants.js.map

+1

dist/auth/constants.js.map

{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,sEAAsE;AACtE,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,yBAAyB;AAEzB,iEAAiE;AACjE,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC7D,IAAI,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,yCAAyC;IACzC,kDAAkD;CAC1C,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAClD,MAAM,CAAC,MAAM,qBAAqB,GAAW,mBAAmB,sBAAsB,EAAE,CAAC;AAEzF,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ;IACR,SAAS;IACT,OAAO;IACP,aAAa;IACb,eAAe;CACP,CAAC;AAEX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ;IACR,SAAS;IACT,OAAO;IACP,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,wBAAwB;IACxB,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,sBAAsB;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AAExC,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC"}

+41

dist/auth/credential-store.d.ts

		import { defaultConfigDir, resolveConfigDir } from "./config-dir.js";
		import type { ConfigPathOverrides } from "./config-dir.js";
		export { defaultConfigDir, resolveConfigDir };
		export type { ConfigPathOverrides };
		export type StoredCredential = {
		readonly serverUrl: string;
		readonly orgId: string;
		/**
		* Best-effort label the user passed via `--org` at login time. Not
		* cryptographically verified against the token (see `login.ts` for why:
		* the server has no cheap org-slug-lookup endpoint and org selection
		* happens entirely in the browser). Purely a display/lookup convenience.
		*/
		readonly orgLabel?: string \| undefined;
		readonly clientId: string;
		readonly accessToken: string;
		readonly refreshToken?: string \| undefined;
		readonly scope: string;
		readonly tokenType: string;
		readonly expiresAt: number;
		readonly createdAt: number;
		readonly updatedAt: number;
		};
		export type CredentialFile = {
		readonly version: 1;
		/** serverUrl -> orgId, the org used when a command targets a server without an explicit `--org`. */
		readonly defaultOrgByServer: Readonly<Record<string, string>>;
		readonly credentials: readonly StoredCredential[];
		};
		export declare const credentialsFilePath: (configDir: string) => string;
		export declare const readCredentialFile: (configDir: string) => Promise<CredentialFile>;
		export declare const writeCredentialFile: (configDir: string, file: CredentialFile) => Promise<void>;
		export declare const findCredentialByOrgId: (file: CredentialFile, serverUrl: string, orgId: string) => StoredCredential \| undefined;
		/** Matches on org id first, then the unverified `orgLabel`. */
		export declare const findCredentialByOrgHint: (file: CredentialFile, serverUrl: string, orgHint: string) => StoredCredential \| undefined;
		export declare const findDefaultCredential: (file: CredentialFile, serverUrl: string) => StoredCredential \| undefined;
		export declare const listCredentialsForServer: (file: CredentialFile, serverUrl: string) => readonly StoredCredential[];
		/** Inserts or replaces the (serverUrl, orgId) credential; sets it as the server's default if none was set. */
		export declare const upsertCredential: (file: CredentialFile, credential: StoredCredential) => CredentialFile;
		export declare const removeCredential: (file: CredentialFile, serverUrl: string, orgId: string) => CredentialFile;
		export declare const setDefaultOrg: (file: CredentialFile, serverUrl: string, orgId: string) => CredentialFile;

+115

dist/auth/credential-store.js

		// Token storage.
		//
		// OS keychain is the target end state (see the design brief and
		// `apps/desktop/src-tauri/src/keychain.rs`'s policy precedent), but wiring a
		// native keyring binding is real native-dependency surface (napi-rs
		// prebuilds, per-platform CI, etc.) that this phase deliberately does not
		// pull in without a separate flag-and-discuss. The XDG file is the only
		// backend today; `--no-keychain` (see `../commands/login.ts`) is accepted
		// and threaded through for forward compatibility but is currently a no-op,
		// since there is nothing else to fall back from yet.
		//
		// One credential per (serverUrl, orgId) pair, mode 0600, analogous to the
		// `aws`/`gh` multi-profile credential file pattern.
		import { Result } from "better-result";
		import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
		import path from "node:path";
		import * as v from "valibot";
		import { defaultConfigDir, resolveConfigDir } from "./config-dir.js";
		export { defaultConfigDir, resolveConfigDir };
		const CREDENTIALS_FILE_MODE = 0o600;
		const storedCredentialSchema = v.strictObject({
		serverUrl: v.string(),
		orgId: v.string(),
		orgLabel: v.optional(v.string()),
		clientId: v.string(),
		accessToken: v.string(),
		refreshToken: v.optional(v.string()),
		scope: v.string(),
		tokenType: v.string(),
		expiresAt: v.number(),
		createdAt: v.number(),
		updatedAt: v.number(),
		});
		const credentialFileSchema = v.strictObject({
		version: v.literal(1),
		defaultOrgByServer: v.record(v.string(), v.string()),
		credentials: v.array(storedCredentialSchema),
		});
		const EMPTY_FILE = {
		credentials: [],
		defaultOrgByServer: {},
		version: 1,
		};
		export const credentialsFilePath = (configDir) => path.join(configDir, "credentials.json");
		export const readCredentialFile = async (configDir) => {
		const filePath = credentialsFilePath(configDir);
		const raw = await Result.tryPromise(async () => await readFile(filePath, "utf-8"));
		if (Result.isError(raw)) {
		return EMPTY_FILE;
		}
		const parsedJson = Result.try(() => JSON.parse(raw.value));
		if (Result.isError(parsedJson)) {
		return EMPTY_FILE;
		}
		const parsed = v.safeParse(credentialFileSchema, parsedJson.value);
		return parsed.success ? parsed.output : EMPTY_FILE;
		};
		export const writeCredentialFile = async (configDir, file) => {
		const filePath = credentialsFilePath(configDir);
		await mkdir(configDir, { mode: 0o700, recursive: true });
		await writeFile(filePath, `${JSON.stringify(file, null, 2)}\n`, {
		mode: CREDENTIALS_FILE_MODE,
		});
		// `writeFile`'s `mode` option only applies when the file is created; force
		// it on every write so a pre-existing looser-permission file gets fixed.
		await chmod(filePath, CREDENTIALS_FILE_MODE);
		};
		const credentialKey = (serverUrl, orgId) => `${serverUrl}::${orgId}`;
		export const findCredentialByOrgId = (file, serverUrl, orgId) => file.credentials.find((credential) => credentialKey(credential.serverUrl, credential.orgId) ===
		credentialKey(serverUrl, orgId));
		/** Matches on org id first, then the unverified `orgLabel`. */
		export const findCredentialByOrgHint = (file, serverUrl, orgHint) => file.credentials.find((credential) => credential.serverUrl === serverUrl &&
		(credential.orgId === orgHint \|\| credential.orgLabel === orgHint));
		export const findDefaultCredential = (file, serverUrl) => {
		const defaultOrgId = file.defaultOrgByServer[serverUrl];
		if (defaultOrgId) {
		return findCredentialByOrgId(file, serverUrl, defaultOrgId);
		}
		return file.credentials.find((credential) => credential.serverUrl === serverUrl);
		};
		export const listCredentialsForServer = (file, serverUrl) => file.credentials.filter((credential) => credential.serverUrl === serverUrl);
		/** Inserts or replaces the (serverUrl, orgId) credential; sets it as the server's default if none was set. */
		export const upsertCredential = (file, credential) => {
		const withoutExisting = file.credentials.filter((existing) => credentialKey(existing.serverUrl, existing.orgId) !==
		credentialKey(credential.serverUrl, credential.orgId));
		const defaultOrgByServer = file.defaultOrgByServer[credential.serverUrl]
		? file.defaultOrgByServer
		: { ...file.defaultOrgByServer, [credential.serverUrl]: credential.orgId };
		return {
		...file,
		credentials: [...withoutExisting, credential],
		defaultOrgByServer,
		};
		};
		export const removeCredential = (file, serverUrl, orgId) => {
		const credentials = file.credentials.filter((existing) => credentialKey(existing.serverUrl, existing.orgId) !==
		credentialKey(serverUrl, orgId));
		if (file.defaultOrgByServer[serverUrl] !== orgId) {
		return { ...file, credentials };
		}
		// The removed credential was the server's default; drop it and, if
		// another credential remains for that server, promote it in one step
		// (destructuring-omit instead of `delete`, per repo convention).
		const { [serverUrl]: _removedDefault, ...remainingDefaults } = file.defaultOrgByServer;
		const nextDefault = credentials.find((c) => c.serverUrl === serverUrl);
		const defaultOrgByServer = nextDefault
		? { ...remainingDefaults, [serverUrl]: nextDefault.orgId }
		: remainingDefaults;
		return { ...file, credentials, defaultOrgByServer };
		};
		export const setDefaultOrg = (file, serverUrl, orgId) => ({
		...file,
		defaultOrgByServer: { ...file.defaultOrgByServer, [serverUrl]: orgId },
		});
		//# sourceMappingURL=credential-store.js.map

+1

dist/auth/credential-store.js.map

+19

dist/auth/ensure-fresh-credential.d.ts

		import { Result } from "better-result";
		import type { CredentialFile, StoredCredential } from "./credential-store.js";
		import type { CliAuthError } from "./errors.js";
		import type { AuthorizationServerMetadata } from "./oauth-metadata.js";
		export type EnsureFreshCredentialInput = {
		readonly configDir: string;
		readonly credential: StoredCredential;
		readonly credentialFile: CredentialFile;
		readonly metadata: AuthorizationServerMetadata;
		readonly now?: number;
		};
		/**
		* Returns a credential guaranteed usable "now" (with `REFRESH_SKEW_MS` of
		* slack), refreshing and persisting it first if it is expired or about to
		* expire. Errors when the credential is expired and either has no refresh
		* token or the refresh call itself fails — both cases mean the caller must
		* fall back to `stella auth login`.
		*/
		export declare const ensureFreshCredential: (input: EnsureFreshCredentialInput) => Promise<Result<StoredCredential, CliAuthError>>;

+57

dist/auth/ensure-fresh-credential.js

		// Token refresh state machine: called proactively (context/whoami resolution)
		// and reactively (a future Phase 3+ HTTP client on a 401) to keep a stored
		// credential usable without forcing a full re-login.
		//
		// Today's server config issues no refresh tokens at all (the oauthProvider's
		// `scopes` list has no `offline_access`, which is what
		// `@better-auth/oauth-provider` gates refresh-token issuance on — see
		// `packages/cli/src/auth/login.ts`'s module comment and the design brief).
		// This function is still exercised end-to-end against a mocked provider
		// (see `ensure-fresh-credential.test.ts`) so it is ready the moment that
		// scope is added server-side; until then every credential this CLI stores
		// simply has no `refreshToken` and expires after `ACCESS_TOKEN_EXPIRES_IN`.
		import { Result } from "better-result";
		import { getMcpResourceUrl } from "./constants.js";
		import { upsertCredential, writeCredentialFile } from "./credential-store.js";
		import { NoRefreshTokenError } from "./errors.js";
		import { refreshAccessToken } from "./token-exchange.js";
		/** How much of a credential's remaining lifetime triggers a proactive refresh. */
		const REFRESH_SKEW_MS = 30_000;
		/**
		* Returns a credential guaranteed usable "now" (with `REFRESH_SKEW_MS` of
		* slack), refreshing and persisting it first if it is expired or about to
		* expire. Errors when the credential is expired and either has no refresh
		* token or the refresh call itself fails — both cases mean the caller must
		* fall back to `stella auth login`.
		*/
		export const ensureFreshCredential = async (input) => {
		const now = input.now ?? Date.now();
		if (input.credential.expiresAt - REFRESH_SKEW_MS > now) {
		return Result.ok(input.credential);
		}
		if (!input.credential.refreshToken) {
		return Result.err(new NoRefreshTokenError({
		message: "The stored access token has expired and no refresh token is available. Run `stella auth login` again.",
		}));
		}
		const refreshed = await refreshAccessToken({
		clientId: input.credential.clientId,
		metadata: input.metadata,
		refreshToken: input.credential.refreshToken,
		resource: getMcpResourceUrl(input.credential.serverUrl),
		});
		if (Result.isError(refreshed)) {
		return Result.err(refreshed.error);
		}
		const updated = {
		...input.credential,
		accessToken: refreshed.value.access_token,
		expiresAt: now + refreshed.value.expires_in * 1000,
		refreshToken: refreshed.value.refresh_token ?? input.credential.refreshToken,
		scope: refreshed.value.scope ?? input.credential.scope,
		updatedAt: now,
		};
		await writeCredentialFile(input.configDir, upsertCredential(input.credentialFile, updated));
		return Result.ok(updated);
		};
		//# sourceMappingURL=ensure-fresh-credential.js.map

+1

dist/auth/ensure-fresh-credential.js.map

{"version":3,"file":"ensure-fresh-credential.js","sourceRoot":"","sources":["../../src/auth/ensure-fresh-credential.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,qDAAqD;AACrD,EAAE;AACF,6EAA6E;AAC7E,uDAAuD;AACvD,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAE5E,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,kFAAkF;AAClF,MAAM,eAAe,GAAG,MAAM,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,KAAiC,EACgB,EAAE;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,GAAG,eAAe,GAAG,GAAG,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,mBAAmB,CAAC;YACtB,OAAO,EACL,uGAAuG;SAC1G,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY;QAC3C,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAqB;QAChC,GAAG,KAAK,CAAC,UAAU;QACnB,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY;QACzC,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI;QAClD,YAAY,EACV,SAAS,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY;QAChE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK;QACtD,SAAS,EAAE,GAAG;KACf,CAAC;IAEF,MAAM,mBAAmB,CACvB,KAAK,CAAC,SAAS,EACf,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAChD,CAAC;IAEF,OAAO,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC,CAAC"}

+96

dist/auth/errors.d.ts

		export declare class CliBaseError<Tag extends string> extends Error {
		readonly name: Tag;
		readonly _tag: Tag;
		constructor(tag: Tag, message: string);
		}
		export declare class OAuthMetadataError extends CliBaseError<"OAuthMetadataError"> {
		readonly name = "OAuthMetadataError";
		readonly serverUrl: string;
		readonly cause?: unknown;
		constructor(props: {
		message: string;
		serverUrl: string;
		cause?: unknown;
		});
		}
		export declare class ClientRegistrationError extends CliBaseError<"ClientRegistrationError"> {
		readonly name = "ClientRegistrationError";
		readonly cause?: unknown;
		constructor(props: {
		message: string;
		cause?: unknown;
		});
		}
		export declare class TokenExchangeError extends CliBaseError<"TokenExchangeError"> {
		readonly name = "TokenExchangeError";
		readonly oauthError?: string \| undefined;
		readonly cause?: unknown;
		constructor(props: {
		message: string;
		oauthError?: string \| undefined;
		cause?: unknown;
		});
		}
		export declare class TokenRefreshError extends CliBaseError<"TokenRefreshError"> {
		readonly name = "TokenRefreshError";
		readonly oauthError?: string \| undefined;
		readonly cause?: unknown;
		constructor(props: {
		message: string;
		oauthError?: string \| undefined;
		cause?: unknown;
		});
		}
		export declare class LoopbackTimeoutError extends CliBaseError<"LoopbackTimeoutError"> {
		readonly name = "LoopbackTimeoutError";
		constructor(props: {
		message: string;
		});
		}
		export declare class LoopbackCallbackError extends CliBaseError<"LoopbackCallbackError"> {
		readonly name = "LoopbackCallbackError";
		readonly oauthError: string;
		readonly oauthErrorDescription?: string \| undefined;
		constructor(props: {
		message: string;
		oauthError: string;
		oauthErrorDescription?: string \| undefined;
		});
		}
		export declare class ManualCallbackParseError extends CliBaseError<"ManualCallbackParseError"> {
		readonly name = "ManualCallbackParseError";
		constructor(props: {
		message: string;
		});
		}
		export declare class ServerUrlNotConfiguredError extends CliBaseError<"ServerUrlNotConfiguredError"> {
		readonly name = "ServerUrlNotConfiguredError";
		constructor(props: {
		message: string;
		});
		}
		export declare class CredentialNotFoundError extends CliBaseError<"CredentialNotFoundError"> {
		readonly name = "CredentialNotFoundError";
		readonly serverUrl: string;
		readonly org?: string \| undefined;
		constructor(props: {
		message: string;
		serverUrl: string;
		org?: string \| undefined;
		});
		}
		export declare class MissingOrgClaimError extends CliBaseError<"MissingOrgClaimError"> {
		readonly name = "MissingOrgClaimError";
		readonly serverUrl: string;
		constructor(props: {
		message: string;
		serverUrl: string;
		});
		}
		export declare class NoRefreshTokenError extends CliBaseError<"NoRefreshTokenError"> {
		readonly name = "NoRefreshTokenError";
		constructor(props: {
		message: string;
		});
		}
		export type CliAuthError = OAuthMetadataError \| ClientRegistrationError \| TokenExchangeError \| TokenRefreshError \| LoopbackTimeoutError \| LoopbackCallbackError \| ManualCallbackParseError \| ServerUrlNotConfiguredError \| CredentialNotFoundError \| MissingOrgClaimError \| NoRefreshTokenError;

+113

dist/auth/errors.js

		// Tagged errors for the `stella auth` flow (see AGENTS.md "Error Handling":
		// tagged errors over bare `Error`, one `message: string` field on every one).
		//
		// Hand-rolled rather than `better-result`'s `TaggedError(tag)<Props>()`
		// factory: that factory's `class Foo extends TaggedError("Foo")<Props>() {}`
		// shape requires a call expression in the `extends` clause, which
		// `isolatedDeclarations` (this package builds with it — see
		// `cli-config.ts`) rejects outright (`TS9021`). `CliBaseError<Tag>` below
		// gives the same discriminated-union/`_tag` shape without a factory call.
		// Every subclass also declares its own literal `name` field (oxlint's
		// `unicorn/custom-error-definition` checks each class individually, not
		// through inheritance).
		export class CliBaseError extends Error {
		name;
		_tag;
		constructor(tag, message) {
		super(message);
		// eslint-disable-next-line unicorn/custom-error-definition -- generic base, never instantiated directly; every concrete subclass sets its own literal `name` too
		this.name = tag;
		this._tag = tag;
		}
		}
		export class OAuthMetadataError extends CliBaseError {
		name = "OAuthMetadataError";
		serverUrl;
		cause;
		constructor(props) {
		super("OAuthMetadataError", props.message);
		this.serverUrl = props.serverUrl;
		this.cause = props.cause;
		}
		}
		export class ClientRegistrationError extends CliBaseError {
		name = "ClientRegistrationError";
		cause;
		constructor(props) {
		super("ClientRegistrationError", props.message);
		this.cause = props.cause;
		}
		}
		export class TokenExchangeError extends CliBaseError {
		name = "TokenExchangeError";
		oauthError;
		cause;
		constructor(props) {
		super("TokenExchangeError", props.message);
		this.oauthError = props.oauthError;
		this.cause = props.cause;
		}
		}
		export class TokenRefreshError extends CliBaseError {
		name = "TokenRefreshError";
		oauthError;
		cause;
		constructor(props) {
		super("TokenRefreshError", props.message);
		this.oauthError = props.oauthError;
		this.cause = props.cause;
		}
		}
		export class LoopbackTimeoutError extends CliBaseError {
		name = "LoopbackTimeoutError";
		constructor(props) {
		super("LoopbackTimeoutError", props.message);
		}
		}
		export class LoopbackCallbackError extends CliBaseError {
		name = "LoopbackCallbackError";
		oauthError;
		oauthErrorDescription;
		constructor(props) {
		super("LoopbackCallbackError", props.message);
		this.oauthError = props.oauthError;
		this.oauthErrorDescription = props.oauthErrorDescription;
		}
		}
		export class ManualCallbackParseError extends CliBaseError {
		name = "ManualCallbackParseError";
		constructor(props) {
		super("ManualCallbackParseError", props.message);
		}
		}
		export class ServerUrlNotConfiguredError extends CliBaseError {
		name = "ServerUrlNotConfiguredError";
		constructor(props) {
		super("ServerUrlNotConfiguredError", props.message);
		}
		}
		export class CredentialNotFoundError extends CliBaseError {
		name = "CredentialNotFoundError";
		serverUrl;
		org;
		constructor(props) {
		super("CredentialNotFoundError", props.message);
		this.serverUrl = props.serverUrl;
		this.org = props.org;
		}
		}
		export class MissingOrgClaimError extends CliBaseError {
		name = "MissingOrgClaimError";
		serverUrl;
		constructor(props) {
		super("MissingOrgClaimError", props.message);
		this.serverUrl = props.serverUrl;
		}
		}
		export class NoRefreshTokenError extends CliBaseError {
		name = "NoRefreshTokenError";
		constructor(props) {
		super("NoRefreshTokenError", props.message);
		}
		}
		//# sourceMappingURL=errors.js.map

+1

dist/auth/errors.js.map

{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,kEAAkE;AAClE,4DAA4D;AAC5D,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,wBAAwB;AAExB,MAAM,OAAO,YAAiC,SAAQ,KAAK;IACvC,IAAI,CAAM;IACnB,IAAI,CAAM;IAEnB,YAAY,GAAQ,EAAE,OAAe;QACnC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,iKAAiK;QACjK,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,YAAkC;IACtD,IAAI,GAAG,oBAAoB,CAAC;IACrC,SAAS,CAAS;IACT,KAAK,CAAW;IAElC,YAAY,KAA8D;QACxE,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,YAAuC;IAChE,IAAI,GAAG,yBAAyB,CAAC;IACjC,KAAK,CAAW;IAElC,YAAY,KAA2C;QACrD,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,YAAkC;IACtD,IAAI,GAAG,oBAAoB,CAAC;IACrC,UAAU,CAAsB;IACvB,KAAK,CAAW;IAElC,YAAY,KAIX;QACC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,YAAiC;IACpD,IAAI,GAAG,mBAAmB,CAAC;IACpC,UAAU,CAAsB;IACvB,KAAK,CAAW;IAElC,YAAY,KAIX;QACC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,YAAoC;IAC1D,IAAI,GAAG,sBAAsB,CAAC;IAEhD,YAAY,KAA0B;QACpC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,YAAqC;IAC5D,IAAI,GAAG,uBAAuB,CAAC;IACxC,UAAU,CAAS;IACnB,qBAAqB,CAAsB;IAEpD,YAAY,KAIX;QACC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,YAAwC;IAClE,IAAI,GAAG,0BAA0B,CAAC;IAEpD,YAAY,KAA0B;QACpC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,YAA2C;IACxE,IAAI,GAAG,6BAA6B,CAAC;IAEvD,YAAY,KAA0B;QACpC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,YAAuC;IAChE,IAAI,GAAG,yBAAyB,CAAC;IAC1C,SAAS,CAAS;IAClB,GAAG,CAAsB;IAElC,YAAY,KAIX;QACC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,YAAoC;IAC1D,IAAI,GAAG,sBAAsB,CAAC;IACvC,SAAS,CAAS;IAE3B,YAAY,KAA6C;QACvD,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,YAAmC;IACxD,IAAI,GAAG,qBAAqB,CAAC;IAE/C,YAAY,KAA0B;QACpC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;CACF"}

+13

dist/auth/jwt.d.ts

		export type AccessTokenClaims = {
		readonly sub: string;
		readonly org_id?: string \| undefined;
		readonly scope?: string \| undefined;
		readonly exp: number;
		readonly iat?: number \| undefined;
		readonly aud?: string \| readonly string[] \| undefined;
		};
		/**
		* Decodes a JWT's payload segment without verifying its signature. Returns
		* `undefined` for opaque (non-JWT) tokens or malformed payloads.
		*/
		export declare const decodeAccessTokenClaims: (accessToken: string) => AccessTokenClaims \| undefined;

+37

dist/auth/jwt.js

		// Local (unverified) decode of the access token for `stella auth whoami`.
		//
		// The provider only mints a JWT-format access token when the CLI requests a
		// `resource` at the token endpoint (see `constants.ts#getMcpResourceUrl`);
		// its authenticity was already established by receiving it directly from the
		// token endpoint over TLS, so `whoami` decodes locally rather than making a
		// server round trip, per the design brief. There is no cheap endpoint to
		// resolve `org_id` back to an org slug/name (`/oauth2/userinfo` only returns
		// `sub`/`email`/`name`/`picture`), so `whoami` reports the id verbatim.
		import { Result } from "better-result";
		import * as v from "valibot";
		const accessTokenClaimsSchema = v.strictObject({
		sub: v.string(),
		org_id: v.optional(v.string()),
		scope: v.optional(v.string()),
		exp: v.number(),
		iat: v.optional(v.number()),
		aud: v.optional(v.union([v.string(), v.array(v.string())])),
		});
		/**
		* Decodes a JWT's payload segment without verifying its signature. Returns
		* `undefined` for opaque (non-JWT) tokens or malformed payloads.
		*/
		export const decodeAccessTokenClaims = (accessToken) => {
		const segments = accessToken.split(".");
		const payloadSegment = segments.length === 3 ? segments.at(1) : undefined;
		if (!payloadSegment) {
		return undefined;
		}
		const decoded = Result.try(() => JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf-8")));
		if (Result.isError(decoded)) {
		return undefined;
		}
		const parsed = v.safeParse(accessTokenClaimsSchema, decoded.value);
		return parsed.success ? parsed.output : undefined;
		};
		//# sourceMappingURL=jwt.js.map

+1

dist/auth/jwt.js.map

{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,6EAA6E;AAC7E,wEAAwE;AAExE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAa7B,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CAC5D,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,WAAmB,EACY,EAAE;IACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAY,EAAE,CACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACvE,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,uBAAuB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC,CAAC"}

+17

dist/auth/login.d.ts

		import { Result } from "better-result";
		import type { CliAuthError } from "./errors.js";
		export type LoginOptions = {
		readonly configDir: string;
		readonly orgHint: string \| undefined;
		readonly registrationScopes: readonly string[];
		readonly requestedScopes: readonly string[];
		readonly serverFlag: string \| undefined;
		};
		export type LoginSuccess = {
		readonly serverUrl: string;
		readonly orgId: string;
		readonly grantedScopes: string;
		readonly expiresAt: number;
		readonly hasRefreshToken: boolean;
		};
		export declare const login: (process: NodeJS.Process, options: LoginOptions) => Promise<Result<LoginSuccess, CliAuthError>>;

+177

dist/auth/login.js

		// Orchestrates `stella auth login`: PKCE authorization-code flow against
		// stella's own oauthProvider, with a loopback listener as the primary
		// transport and a manual URL/code paste as the fallback for headless
		// environments (see module comments in `loopback-listener.ts` and
		// `manual-callback.ts`).
		import { Result } from "better-result";
		import { createInterface } from "node:readline/promises";
		import { openInBrowser } from "./browser-open.js";
		import { getRegisteredClientId, setRegisteredClientId } from "./cli-config.js";
		import { getMcpResourceUrl, LOGIN_TIMEOUT_MS, LOOPBACK_REDIRECT_URI, } from "./constants.js";
		import { readCredentialFile, setDefaultOrg, upsertCredential, writeCredentialFile, } from "./credential-store.js";
		import { MissingOrgClaimError } from "./errors.js";
		import { decodeAccessTokenClaims } from "./jwt.js";
		import { startLoopbackListener, toLoopbackCallbackError, } from "./loopback-listener.js";
		import { parseManualCallbackInput } from "./manual-callback.js";
		import { registerLoopbackClient } from "./oauth-client-registration.js";
		import { discoverAuthorizationServerMetadata } from "./oauth-metadata.js";
		import { createOAuthState, createPkcePair } from "./pkce.js";
		import { resolveServerUrl } from "./server-resolution.js";
		import { exchangeAuthorizationCode } from "./token-exchange.js";
		const buildIo = (process) => ({
		print: (line) => {
		process.stdout.write(`${line}\n`);
		},
		promptLine: async (question) => {
		const rl = createInterface({
		input: process.stdin,
		output: process.stdout,
		});
		try {
		return await rl.question(question);
		}
		finally {
		rl.close();
		}
		},
		});
		const buildAuthorizeUrl = (input) => {
		const url = new URL(input.authorizationEndpoint);
		url.searchParams.set("response_type", "code");
		url.searchParams.set("client_id", input.clientId);
		url.searchParams.set("redirect_uri", input.redirectUri);
		url.searchParams.set("code_challenge", input.codeChallenge);
		url.searchParams.set("code_challenge_method", "S256");
		url.searchParams.set("state", input.state);
		if (input.scopes.length > 0) {
		url.searchParams.set("scope", input.scopes.join(" "));
		}
		return url.toString();
		};
		/** Gets the cached loopback client id for `serverUrl`, registering one if none exists yet. */
		const getOrRegisterClient = async (configDir, serverUrl, metadata, registrationScopes) => {
		const cached = await getRegisteredClientId(configDir, serverUrl);
		if (cached) {
		return Result.ok(cached);
		}
		const registered = await registerLoopbackClient(metadata, registrationScopes);
		if (Result.isError(registered)) {
		return registered;
		}
		await setRegisteredClientId(configDir, serverUrl, registered.value);
		return Result.ok(registered.value);
		};
		const isLoopbackCallback = (value) => "kind" in value;
		const awaitManualCode = async (io, redirectUri, expectedState) => {
		const pasted = await io.promptLine("Paste the redirected URL or code: ");
		const parsed = parseManualCallbackInput(pasted);
		if (Result.isError(parsed)) {
		return Result.err(parsed.error);
		}
		if (parsed.value.state && parsed.value.state !== expectedState) {
		return Result.err(toLoopbackCallbackError({ error: "invalid_state", kind: "error" }));
		}
		return Result.ok({ code: parsed.value.code, redirectUri });
		};
		/**
		* Waits for the loopback callback, falling back to manual paste if the
		* listener never fires. `redirectUri` must be whichever URI was actually
		* used to build the authorize request (the listener's port-specific one, or
		* the portless default when no listener could be started) — the token
		* endpoint later requires an exact match (RFC 6749 S4.1.3).
		*/
		const awaitAuthorizationCode = async (io, authorizeUrl, redirectUri, listener, expectedState) => {
		io.print("Opening the stella sign-in page in your browser:");
		io.print(` ${authorizeUrl}`);
		void openInBrowser(authorizeUrl);
		if (!listener) {
		io.print("Could not start a local listener; complete sign-in in any browser, then paste the redirected URL (or just the code) below.");
		return awaitManualCode(io, redirectUri, expectedState);
		}
		const result = await listener.waitForCallback(LOGIN_TIMEOUT_MS);
		listener.close();
		if (!isLoopbackCallback(result)) {
		// Timed out waiting locally: the browser most likely isn't reachable
		// from this machine (SSH/remote dev/agent sandbox). Fall back to manual.
		io.print("Timed out waiting for the browser. If you're running headless, complete sign-in in any browser, then paste the redirected URL (or just the code) below.");
		return awaitManualCode(io, redirectUri, expectedState);
		}
		if (result.kind === "error") {
		return Result.err(toLoopbackCallbackError(result));
		}
		if (result.state !== expectedState) {
		return Result.err(toLoopbackCallbackError({ error: "invalid_state", kind: "error" }));
		}
		return Result.ok({ code: result.code, redirectUri });
		};
		// Sequential steps with different Ok types chained via `Result.gen` +
		// `yield* Result.await(...)` (see AGENTS.md's Error Handling conventions):
		// this avoids re-wrapping every intermediate error result by hand.
		export const login = async (process, options) => await Result.gen(async function* loginGen() {
		const io = buildIo(process);
		const serverUrl = yield* Result.await(resolveServerUrl(options.configDir, options.serverFlag));
		const metadata = yield* Result.await(discoverAuthorizationServerMetadata(serverUrl));
		const clientId = yield* Result.await(getOrRegisterClient(options.configDir, serverUrl, metadata, options.registrationScopes));
		const { codeChallenge, codeVerifier } = createPkcePair();
		const state = createOAuthState();
		if (options.orgHint) {
		io.print(`If prompted to select an organization in the browser, choose: ${options.orgHint} (the CLI cannot preselect it for you; org selection happens in the browser UI).`);
		}
		// Start the listener before building the authorize URL: the redirect_uri
		// sent to the authorization server must be whichever one the browser
		// will actually be redirected back to (the listener's ephemeral port, or
		// the portless default if binding failed), and it must stay identical
		// through to the token exchange.
		const listener = await startLoopbackListener();
		const redirectUri = listener?.redirectUri ?? LOOPBACK_REDIRECT_URI;
		const authorizeUrl = buildAuthorizeUrl({
		authorizationEndpoint: metadata.authorization_endpoint,
		clientId,
		codeChallenge,
		redirectUri,
		scopes: options.requestedScopes,
		state,
		});
		const callback = yield* Result.await(awaitAuthorizationCode(io, authorizeUrl, redirectUri, listener, state));
		const token = yield* Result.await(exchangeAuthorizationCode({
		clientId,
		code: callback.code,
		codeVerifier,
		metadata,
		redirectUri: callback.redirectUri,
		resource: getMcpResourceUrl(serverUrl),
		}));
		const claims = decodeAccessTokenClaims(token.access_token);
		if (!claims?.org_id) {
		return Result.err(new MissingOrgClaimError({
		message: "The access token has no org_id claim, so the CLI cannot tell which organization was granted. Re-run `stella auth login` and make sure an organization is active when you reach the consent screen.",
		serverUrl,
		}));
		}
		const now = Date.now();
		const credential = {
		accessToken: token.access_token,
		clientId,
		createdAt: now,
		expiresAt: now + token.expires_in * 1000,
		orgId: claims.org_id,
		...(options.orgHint ? { orgLabel: options.orgHint } : {}),
		refreshToken: token.refresh_token,
		scope: token.scope ?? options.requestedScopes.join(" "),
		serverUrl,
		tokenType: token.token_type,
		updatedAt: now,
		};
		const existingFile = await readCredentialFile(options.configDir);
		const withCredential = upsertCredential(existingFile, credential);
		const withDefaultOrg = setDefaultOrg(withCredential, serverUrl, credential.orgId);
		await writeCredentialFile(options.configDir, withDefaultOrg);
		return Result.ok({
		expiresAt: credential.expiresAt,
		grantedScopes: credential.scope,
		hasRefreshToken: Boolean(credential.refreshToken),
		orgId: credential.orgId,
		serverUrl,
		});
		});
		//# sourceMappingURL=login.js.map

+1

dist/auth/login.js.map

+28

dist/auth/loopback-listener.d.ts

		import { LoopbackCallbackError, LoopbackTimeoutError } from "./errors.js";
		export type LoopbackCallback = {
		readonly kind: "success";
		readonly code: string;
		readonly state: string;
		} \| {
		readonly kind: "error";
		readonly error: string;
		readonly errorDescription?: string;
		readonly state?: string;
		};
		export type LoopbackListener = {
		readonly port: number;
		readonly redirectUri: string;
		readonly waitForCallback: (timeoutMs: number) => Promise<LoopbackCallback \| LoopbackTimeoutError>;
		readonly close: () => void;
		};
		/**
		* Starts the loopback HTTP listener. Resolves to `undefined` if binding fails
		* (sandboxed/offline environments) so callers can fall back to the manual
		* paste flow instead of crashing. Async because `node:http`'s `listen` reports
		* its OS-assigned port on the `listening` event, not synchronously.
		*/
		export declare const startLoopbackListener: () => Promise<LoopbackListener \| undefined>;
		/** Converts a listener callback into the `TaggedError` shape the login flow expects. */
		export declare const toLoopbackCallbackError: (callback: Extract<LoopbackCallback, {
		kind: "error";
		}>) => LoopbackCallbackError;

+113

dist/auth/loopback-listener.js

		// Ephemeral 127.0.0.1 listener for the loopback redirect (RFC 8252).
		//
		// Binds port 0 (OS-assigned) so concurrent logins and busy dev machines never
		// collide. The registered client's redirect_uri has no port (see
		// `constants.ts#LOOPBACK_REDIRECT_URI`); better-auth's loopback exemption
		// matches on hostname/pathname/protocol/search only, so any ephemeral port
		// still satisfies the registered redirect_uri.
		import { createServer } from "node:http";
		import { LOOPBACK_REDIRECT_PATH } from "./constants.js";
		import { LoopbackCallbackError, LoopbackTimeoutError } from "./errors.js";
		const renderCallbackPage = (ok) => `<!doctype html><html><head><meta charset="utf-8"><title>stella CLI</title></head>` +
		`<body><p>${ok ? "Signed in. You can close this tab and return to the terminal." : "Sign-in failed. Return to the terminal for details."}</p></body></html>`;
		const raceWithTimeout = async (received, timeoutMs) => {
		let timer;
		const timeout = new Promise((resolve) => {
		timer = setTimeout(() => {
		resolve(new LoopbackTimeoutError({
		message: `Timed out after ${Math.round(timeoutMs / 1000)}s waiting for the browser sign-in to complete.`,
		}));
		}, timeoutMs);
		});
		try {
		return await Promise.race([received, timeout]);
		}
		finally {
		if (timer) {
		clearTimeout(timer);
		}
		}
		};
		/**
		* Starts the loopback HTTP listener. Resolves to `undefined` if binding fails
		* (sandboxed/offline environments) so callers can fall back to the manual
		* paste flow instead of crashing. Async because `node:http`'s `listen` reports
		* its OS-assigned port on the `listening` event, not synchronously.
		*/
		export const startLoopbackListener = async () => {
		let deliver;
		const received = new Promise((resolve) => {
		deliver = resolve;
		});
		const server = createServer((request, response) => {
		// `request.url` is the path+query only; rebuild a full URL against the
		// fixed loopback host to parse the query string.
		const url = new URL(request.url ?? "/", "http://127.0.0.1");
		if (url.pathname !== LOOPBACK_REDIRECT_PATH) {
		response.writeHead(404);
		response.end("Not found");
		return;
		}
		const error = url.searchParams.get("error");
		if (error) {
		const errorDescription = url.searchParams.get("error_description");
		const state = url.searchParams.get("state");
		deliver?.({
		error,
		kind: "error",
		...(errorDescription ? { errorDescription } : {}),
		...(state ? { state } : {}),
		});
		response.writeHead(200, { "Content-Type": "text/html" });
		response.end(renderCallbackPage(false));
		return;
		}
		const code = url.searchParams.get("code");
		const state = url.searchParams.get("state");
		if (!code \|\| !state) {
		response.writeHead(400);
		response.end("Missing code or state");
		return;
		}
		deliver?.({ code, kind: "success", state });
		response.writeHead(200, { "Content-Type": "text/html" });
		response.end(renderCallbackPage(true));
		});
		const listenerPort = await new Promise((resolve) => {
		// A pre-`listening` bind error (EADDRINUSE, EACCES, sandbox) resolves to
		// `undefined`; the same handler stays attached afterward so a later socket
		// error is absorbed rather than thrown as an uncaught `error` event.
		server.on("error", () => resolve(undefined));
		server.listen(0, "127.0.0.1", () => {
		const address = server.address();
		resolve(address !== null && typeof address === "object"
		? address.port
		: undefined);
		});
		});
		if (listenerPort === undefined) {
		server.close();
		return undefined;
		}
		return {
		// The CLI just needs the port freed and no more callbacks delivered;
		// `closeAllConnections` drops any lingering keep-alive socket so the
		// event loop can exit, then `close` stops accepting new connections.
		close: () => {
		server.closeAllConnections();
		server.close();
		},
		port: listenerPort,
		redirectUri: `http://127.0.0.1:${listenerPort}${LOOPBACK_REDIRECT_PATH}`,
		waitForCallback: async (timeoutMs) => await raceWithTimeout(received, timeoutMs),
		};
		};
		/** Converts a listener callback into the `TaggedError` shape the login flow expects. */
		export const toLoopbackCallbackError = (callback) => new LoopbackCallbackError({
		message: callback.error === "set_organization"
		? "Your account needs an active organization before granting stella CLI access. Complete organization setup in the browser (create or select one), then re-run `stella auth login`."
		: (callback.errorDescription ?? callback.error),
		oauthError: callback.error,
		oauthErrorDescription: callback.errorDescription,
		});
		//# sourceMappingURL=loopback-listener.js.map

+1

dist/auth/loopback-listener.js.map

{"version":3,"file":"loopback-listener.js","sourceRoot":"","sources":["../../src/auth/loopback-listener.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,iEAAiE;AACjE,0EAA0E;AAC1E,2EAA2E;AAC3E,+CAA+C;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAoB1E,MAAM,kBAAkB,GAAG,CAAC,EAAW,EAAU,EAAE,CACjD,mFAAmF;IACnF,YAAY,EAAE,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,qDAAqD,oBAAoB,CAAC;AAE/J,MAAM,eAAe,GAAG,KAAK,EAC3B,QAAmC,EACnC,SAAiB,EACiC,EAAE;IACpD,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,EAAE;QAC5D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,CACL,IAAI,oBAAoB,CAAC;gBACvB,OAAO,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,gDAAgD;aACzG,CAAC,CACH,CAAC;QACJ,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,IAExC,EAAE;IACF,IAAI,OAA2D,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QACzD,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YAC5C,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC;gBACR,KAAK;gBACL,IAAI,EAAE,OAAO;gBACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACzD,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QACzD,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QACrE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,CACL,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAC7C,CAAC,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,SAAS,CACd,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,oBAAoB,YAAY,GAAG,sBAAsB,EAAE;QACxE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CACnC,MAAM,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC7C,CAAC;AACJ,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAsD,EAC/B,EAAE,CACzB,IAAI,qBAAqB,CAAC;IACxB,OAAO,EACL,QAAQ,CAAC,KAAK,KAAK,kBAAkB;QACnC,CAAC,CAAC,kLAAkL;QACpL,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,KAAK,CAAC;IACnD,UAAU,EAAE,QAAQ,CAAC,KAAK;IAC1B,qBAAqB,EAAE,QAAQ,CAAC,gBAAgB;CACjD,CAAC,CAAC"}

+20

dist/auth/manage.d.ts

		import { Result } from "better-result";
		import type { CliAuthError } from "./errors.js";
		import type { AccessTokenClaims } from "./jwt.js";
		export type WhoamiInfo = {
		readonly serverUrl: string;
		readonly orgId: string;
		readonly orgLabel: string \| undefined;
		readonly scope: string;
		readonly expiresAt: number;
		readonly isExpired: boolean;
		readonly hasRefreshToken: boolean;
		readonly claims: AccessTokenClaims \| undefined;
		};
		export declare const whoami: (configDir: string, serverUrl: string, orgHint: string \| undefined) => Promise<Result<WhoamiInfo, CliAuthError>>;
		export declare const logout: (configDir: string, serverUrl: string, orgHint: string \| undefined) => Promise<Result<{
		orgId: string;
		}, CliAuthError>>;
		export declare const switchOrg: (configDir: string, serverUrl: string, orgHint: string) => Promise<Result<{
		orgId: string;
		}, CliAuthError>>;

+82

dist/auth/manage.js

		// `stella auth whoami` / `logout` / `switch`: read-mostly operations against
		// the credential store, resolved for whichever server is currently active.
		import { Result } from "better-result";
		import { findCredentialByOrgHint, findDefaultCredential, listCredentialsForServer, readCredentialFile, removeCredential, setDefaultOrg, writeCredentialFile, } from "./credential-store.js";
		import { CredentialNotFoundError } from "./errors.js";
		import { decodeAccessTokenClaims } from "./jwt.js";
		const resolveCredential = async (configDir, serverUrl, orgHint) => {
		const file = await readCredentialFile(configDir);
		const allForServer = listCredentialsForServer(file, serverUrl);
		const credential = orgHint
		? findCredentialByOrgHint(file, serverUrl, orgHint)
		: findDefaultCredential(file, serverUrl);
		if (!credential) {
		const guidance = orgHint && allForServer.length > 0
		? `Not signed in to "${orgHint}" on ${serverUrl}. Known orgs here: ${allForServer.map((c) => c.orgLabel ?? c.orgId).join(", ")}.`
		: `Not signed in to ${serverUrl}. Run \`stella auth login\`${orgHint ? ` --org ${orgHint}` : ""}.`;
		return Result.err(new CredentialNotFoundError({
		message: guidance,
		org: orgHint,
		serverUrl,
		}));
		}
		return Result.ok({ allForServer, credential });
		};
		export const whoami = async (configDir, serverUrl, orgHint) => {
		const resolved = await resolveCredential(configDir, serverUrl, orgHint);
		if (Result.isError(resolved)) {
		return Result.err(resolved.error);
		}
		const { credential } = resolved.value;
		return Result.ok({
		claims: decodeAccessTokenClaims(credential.accessToken),
		expiresAt: credential.expiresAt,
		hasRefreshToken: Boolean(credential.refreshToken),
		isExpired: credential.expiresAt <= Date.now(),
		orgId: credential.orgId,
		orgLabel: credential.orgLabel,
		scope: credential.scope,
		serverUrl: credential.serverUrl,
		});
		};
		export const logout = async (configDir, serverUrl, orgHint) => {
		const file = await readCredentialFile(configDir);
		const allForServer = listCredentialsForServer(file, serverUrl);
		if (allForServer.length === 0) {
		return Result.err(new CredentialNotFoundError({
		message: `Not signed in to ${serverUrl}.`,
		serverUrl,
		}));
		}
		let target;
		if (orgHint) {
		target = findCredentialByOrgHint(file, serverUrl, orgHint);
		}
		else if (allForServer.length === 1) {
		target = allForServer.at(0);
		}
		if (!target) {
		return Result.err(new CredentialNotFoundError({
		message: `Multiple organizations are signed in on ${serverUrl} (${allForServer.map((c) => c.orgLabel ?? c.orgId).join(", ")}); pass --org to pick one.`,
		serverUrl,
		}));
		}
		await writeCredentialFile(configDir, removeCredential(file, serverUrl, target.orgId));
		return Result.ok({ orgId: target.orgId });
		};
		export const switchOrg = async (configDir, serverUrl, orgHint) => {
		const file = await readCredentialFile(configDir);
		const target = findCredentialByOrgHint(file, serverUrl, orgHint);
		if (!target) {
		const allForServer = listCredentialsForServer(file, serverUrl);
		const known = allForServer.map((c) => c.orgLabel ?? c.orgId).join(", ");
		return Result.err(new CredentialNotFoundError({
		message: `Not signed in to "${orgHint}" on ${serverUrl}.${known ? ` Known orgs here: ${known}.` : ""} Run \`stella auth login --org ${orgHint}\` first.`,
		org: orgHint,
		serverUrl,
		}));
		}
		await writeCredentialFile(configDir, setDefaultOrg(file, serverUrl, target.orgId));
		return Result.ok({ orgId: target.orgId });
		};
		//# sourceMappingURL=manage.js.map

+1

dist/auth/manage.js.map

{"version":3,"file":"manage.js","sourceRoot":"","sources":["../../src/auth/manage.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,2EAA2E;AAE3E,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAGnD,MAAM,iBAAiB,GAAG,KAAK,EAC7B,SAAiB,EACjB,SAAiB,EACjB,OAA2B,EAM3B,EAAE;IACF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC;QACnD,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,GACZ,OAAO,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAChC,CAAC,CAAC,qBAAqB,OAAO,QAAQ,SAAS,sBAAsB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACjI,CAAC,CAAC,oBAAoB,SAAS,8BAA8B,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QACvG,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,uBAAuB,CAAC;YAC1B,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,OAAO;YACZ,SAAS;SACV,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;AACjD,CAAC,CAAC;AAaF,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,SAAiB,EACjB,SAAiB,EACjB,OAA2B,EACgB,EAAE;IAC7C,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAEtC,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,WAAW,CAAC;QACvD,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QACjD,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC7C,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,SAAiB,EACjB,SAAiB,EACjB,OAA2B,EACuB,EAAE;IACpD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,uBAAuB,CAAC;YAC1B,OAAO,EAAE,oBAAoB,SAAS,GAAG;YACzC,SAAS;SACV,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAoC,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,uBAAuB,CAAC;YAC1B,OAAO,EAAE,2CAA2C,SAAS,KAAK,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B;YACvJ,SAAS;SACV,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,CACvB,SAAS,EACT,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAChD,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAiB,EACjB,SAAiB,EACjB,OAAe,EACmC,EAAE;IACpD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEjE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,uBAAuB,CAAC;YAC1B,OAAO,EAAE,qBAAqB,OAAO,QAAQ,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,kCAAkC,OAAO,WAAW;YACxJ,GAAG,EAAE,OAAO;YACZ,SAAS;SACV,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,CACvB,SAAS,EACT,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAC7C,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC,CAAC"}

+12

dist/auth/manual-callback.d.ts

		import { Result } from "better-result";
		import { ManualCallbackParseError } from "./errors.js";
		export type ParsedManualCallback = {
		readonly code: string;
		/** `undefined` when the user pasted a bare code and no state could be checked. */
		readonly state: string \| undefined;
		};
		/**
		* Parses manual-paste input. Accepts a full redirect URL (`http://127.0.0.1/
		* callback?code=...&state=...`) or a bare authorization code.
		*/
		export declare const parseManualCallbackInput: (input: string) => Result<ParsedManualCallback, ManualCallbackParseError>;

+42

dist/auth/manual-callback.js

		// Headless fallback: the user completes the OAuth flow in any browser (not
		// necessarily one reachable from the CLI's machine) and pastes back either
		// the full redirected URL or the bare `code` value.
		import { Result } from "better-result";
		import { ManualCallbackParseError } from "./errors.js";
		/**
		* Parses manual-paste input. Accepts a full redirect URL (`http://127.0.0.1/
		* callback?code=...&state=...`) or a bare authorization code.
		*/
		export const parseManualCallbackInput = (input) => {
		const trimmed = input.trim();
		if (trimmed.length === 0) {
		return Result.err(new ManualCallbackParseError({ message: "No input provided" }));
		}
		if (!trimmed.includes("://")) {
		return Result.ok({ code: trimmed, state: undefined });
		}
		const parsedUrl = Result.try(() => new URL(trimmed));
		if (Result.isError(parsedUrl)) {
		return Result.err(new ManualCallbackParseError({
		message: `Could not parse "${trimmed}" as a URL or a bare authorization code`,
		}));
		}
		const error = parsedUrl.value.searchParams.get("error");
		if (error) {
		const description = parsedUrl.value.searchParams.get("error_description");
		return Result.err(new ManualCallbackParseError({
		message: description ?? error,
		}));
		}
		const code = parsedUrl.value.searchParams.get("code");
		if (!code) {
		return Result.err(new ManualCallbackParseError({
		message: "The pasted URL has no `code` query parameter",
		}));
		}
		return Result.ok({
		code,
		state: parsedUrl.value.searchParams.get("state") ?? undefined,
		});
		};
		//# sourceMappingURL=manual-callback.js.map

+1

dist/auth/manual-callback.js.map

{"version":3,"file":"manual-callback.js","sourceRoot":"","sources":["../../src/auth/manual-callback.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,2EAA2E;AAC3E,oDAAoD;AAEpD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAQvD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,KAAa,EAC2C,EAAE;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,wBAAwB,CAAC;YAC3B,OAAO,EAAE,oBAAoB,OAAO,yCAAyC;SAC9E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC1E,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,wBAAwB,CAAC;YAC3B,OAAO,EAAE,WAAW,IAAI,KAAK;SAC9B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,wBAAwB,CAAC;YAC3B,OAAO,EAAE,8CAA8C;SACxD,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC;QACf,IAAI;QACJ,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;KAC9D,CAAC,CAAC;AACL,CAAC,CAAC"}

+5

dist/auth/oauth-client-registration.d.ts

		import { Result } from "better-result";
		import { ClientRegistrationError } from "./errors.js";
		import type { AuthorizationServerMetadata } from "./oauth-metadata.js";
		/** Registers a fresh public loopback client with the requested scopes. */
		export declare const registerLoopbackClient: (metadata: AuthorizationServerMetadata, scopes: readonly string[]) => Promise<Result<string, ClientRegistrationError>>;

+57

dist/auth/oauth-client-registration.js

		// Dynamic client registration (RFC 7591) against a `registration_endpoint`
		// better-auth's oauth-provider exposes with `allowDynamicClientRegistration`
		// and `allowUnauthenticatedClientRegistration` both enabled (see
		// `apps/api/src/lib/auth.ts`). Unauthenticated registration always resolves
		// to a public client (`token_endpoint_auth_method: "none"`) server-side
		// regardless of what the request asks for, so the CLI's request body is
		// mostly documentation of intent.
		import { Result } from "better-result";
		import * as v from "valibot";
		import { AUTH_FETCH_TIMEOUT_MS, CLIENT_NAME, LOOPBACK_REDIRECT_URI, } from "./constants.js";
		import { ClientRegistrationError } from "./errors.js";
		const registrationResponseSchema = v.looseObject({
		client_id: v.string(),
		});
		/** Registers a fresh public loopback client with the requested scopes. */
		export const registerLoopbackClient = async (metadata, scopes) => {
		if (!metadata.registration_endpoint) {
		return Result.err(new ClientRegistrationError({
		message: "The server does not advertise a registration_endpoint (allowDynamicClientRegistration is off). A pre-registered loopback client id would need to be configured out of band; this is a server-side gap, not something the CLI can work around.",
		}));
		}
		const body = {
		client_name: CLIENT_NAME,
		grant_types: ["authorization_code", "refresh_token"],
		redirect_uris: [LOOPBACK_REDIRECT_URI],
		response_types: ["code"],
		scope: scopes.join(" "),
		token_endpoint_auth_method: "none",
		type: "native",
		};
		return await Result.tryPromise({
		catch: (cause) => cause instanceof ClientRegistrationError
		? cause
		: new ClientRegistrationError({
		cause,
		message: "Failed to register the stella CLI as an OAuth client",
		}),
		try: async () => {
		const response = await fetch(metadata.registration_endpoint ?? "", {
		body: JSON.stringify(body),
		headers: { "Content-Type": "application/json" },
		method: "POST",
		signal: AbortSignal.timeout(AUTH_FETCH_TIMEOUT_MS),
		});
		if (!response.ok) {
		const text = await response.text();
		throw new ClientRegistrationError({
		message: `registration_endpoint responded ${response.status}: ${text}`,
		});
		}
		const json = await response.json();
		const parsed = v.parse(registrationResponseSchema, json);
		return parsed.client_id;
		},
		});
		};
		//# sourceMappingURL=oauth-client-registration.js.map

+1

dist/auth/oauth-client-registration.js.map

{"version":3,"file":"oauth-client-registration.js","sourceRoot":"","sources":["../../src/auth/oauth-client-registration.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,6EAA6E;AAC7E,iEAAiE;AACjE,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AACxE,kCAAkC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,QAAqC,EACrC,MAAyB,EACyB,EAAE;IACpD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,uBAAuB,CAAC;YAC1B,OAAO,EACL,+OAA+O;SAClP,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,aAAa,EAAE,CAAC,qBAAqB,CAAC;QACtC,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,0BAA0B,EAAE,MAAM;QAClC,IAAI,EAAE,QAAQ;KACf,CAAC;IAEF,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,uBAAuB;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,uBAAuB,CAAC;gBAC1B,KAAK;gBACL,OAAO,EAAE,sDAAsD;aAChE,CAAC;QACR,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,IAAI,EAAE,EAAE;gBACjE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;aACnD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,uBAAuB,CAAC;oBAChC,OAAO,EAAE,mCAAmC,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;YACzD,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

+19

dist/auth/oauth-metadata.d.ts

		import { Result } from "better-result";
		import { OAuthMetadataError } from "./errors.js";
		export type AuthorizationServerMetadata = {
		readonly issuer: string;
		readonly authorization_endpoint: string;
		readonly token_endpoint: string;
		readonly registration_endpoint?: string \| undefined;
		readonly code_challenge_methods_supported?: readonly string[] \| undefined;
		readonly scopes_supported?: readonly string[] \| undefined;
		readonly token_endpoint_auth_methods_supported?: readonly string[] \| undefined;
		};
		/**
		* Discovers the OAuth authorization-server metadata for `serverUrl` by
		* trying both the RFC 8414 root-issuer path and better-auth's actual mount
		* path (see `AUTHORIZATION_SERVER_METADATA_PATHS`), in order. The two
		* candidates are unrolled explicitly (not looped) so the second request
		* only ever fires once the first has definitively failed.
		*/
		export declare const discoverAuthorizationServerMetadata: (serverUrl: string) => Promise<Result<AuthorizationServerMetadata, OAuthMetadataError>>;

+49

dist/auth/oauth-metadata.js

		// RFC 8414 authorization-server-metadata discovery.
		import { Result } from "better-result";
		import * as v from "valibot";
		import { AUTH_FETCH_TIMEOUT_MS, AUTHORIZATION_SERVER_METADATA_PATHS, } from "./constants.js";
		import { OAuthMetadataError } from "./errors.js";
		const authorizationServerMetadataSchema = v.strictObject({
		issuer: v.pipe(v.string(), v.url()),
		authorization_endpoint: v.pipe(v.string(), v.url()),
		token_endpoint: v.pipe(v.string(), v.url()),
		registration_endpoint: v.optional(v.pipe(v.string(), v.url())),
		code_challenge_methods_supported: v.optional(v.array(v.string())),
		scopes_supported: v.optional(v.array(v.string())),
		token_endpoint_auth_methods_supported: v.optional(v.array(v.string())),
		});
		const fetchCandidate = async (url) => {
		const attempt = await Result.tryPromise(async () => {
		const response = await fetch(url, {
		headers: { Accept: "application/json" },
		signal: AbortSignal.timeout(AUTH_FETCH_TIMEOUT_MS),
		});
		return response.ok ? await response.json() : undefined;
		});
		if (Result.isError(attempt) \|\| attempt.value === undefined) {
		return undefined;
		}
		const parsed = v.safeParse(authorizationServerMetadataSchema, attempt.value);
		return parsed.success ? parsed.output : undefined;
		};
		/**
		* Discovers the OAuth authorization-server metadata for `serverUrl` by
		* trying both the RFC 8414 root-issuer path and better-auth's actual mount
		* path (see `AUTHORIZATION_SERVER_METADATA_PATHS`), in order. The two
		* candidates are unrolled explicitly (not looped) so the second request
		* only ever fires once the first has definitively failed.
		*/
		export const discoverAuthorizationServerMetadata = async (serverUrl) => {
		const origin = serverUrl.replace(/\/$/u, "");
		const [rootPath, mountedPath] = AUTHORIZATION_SERVER_METADATA_PATHS;
		const found = (await fetchCandidate(`${origin}${rootPath}`)) ??
		(await fetchCandidate(`${origin}${mountedPath}`));
		if (found) {
		return Result.ok(found);
		}
		return Result.err(new OAuthMetadataError({
		message: `Could not discover OAuth authorization server metadata at ${serverUrl}. Pass --server pointing at the stella API origin (not the web app), and confirm the server exposes ${AUTHORIZATION_SERVER_METADATA_PATHS.join(" or ")}.`,
		serverUrl,
		}));
		};
		//# sourceMappingURL=oauth-metadata.js.map

+1

dist/auth/oauth-metadata.js.map

{"version":3,"file":"oauth-metadata.js","sourceRoot":"","sources":["../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAAA,oDAAoD;AAEpD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAgBjD,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACnC,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACnD,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,gCAAgC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,qCAAqC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,KAAK,EAC1B,GAAW,EACuC,EAAE;IACpD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,iCAAiC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAK,EACtD,SAAiB,EACiD,EAAE;IACpE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,mCAAmC,CAAC;IAEpE,MAAM,KAAK,GACT,CAAC,MAAM,cAAc,CAAC,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC9C,CAAC,MAAM,cAAc,CAAC,GAAG,MAAM,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,kBAAkB,CAAC;QACrB,OAAO,EAAE,6DAA6D,SAAS,uGAAuG,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;QACzO,SAAS;KACV,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

+10

dist/auth/pkce.d.ts

		export type PkcePair = {
		readonly codeVerifier: string;
		readonly codeChallenge: string;
		};
		/** Generates a fresh PKCE verifier/challenge pair (S256). */
		export declare const createPkcePair: () => PkcePair;
		/** Derives the S256 code challenge for a given verifier (exported for tests/vectors). */
		export declare const generateCodeChallenge: (codeVerifier: string) => string;
		/** Generates a random `state` parameter used to bind the callback to this login attempt. */
		export declare const createOAuthState: () => string;

+25

dist/auth/pkce.js

		// PKCE (RFC 7636) helpers for the loopback authorization-code flow.
		//
		// Mirrors the existing repo convention for PKCE generation
		// (`apps/api/src/handlers/mcp-connectors/oauth.ts`'s `createPkce`): random
		// bytes via Web Crypto, S256 challenge via `node:crypto` `createHash` so the
		// published CLI runs under plain Node (Bun executes `node:*` natively).
		import { createHash } from "node:crypto";
		const VERIFIER_BYTES = 32;
		const STATE_BYTES = 32;
		const randomBase64Url = (byteLength) => {
		const bytes = new Uint8Array(byteLength);
		crypto.getRandomValues(bytes);
		return Buffer.from(bytes).toString("base64url");
		};
		/** Generates a fresh PKCE verifier/challenge pair (S256). */
		export const createPkcePair = () => {
		const codeVerifier = randomBase64Url(VERIFIER_BYTES);
		const codeChallenge = generateCodeChallenge(codeVerifier);
		return { codeChallenge, codeVerifier };
		};
		/** Derives the S256 code challenge for a given verifier (exported for tests/vectors). */
		export const generateCodeChallenge = (codeVerifier) => createHash("sha256").update(codeVerifier).digest("base64url");
		/** Generates a random `state` parameter used to bind the callback to this login attempt. */
		export const createOAuthState = () => randomBase64Url(STATE_BYTES);
		//# sourceMappingURL=pkce.js.map

+1

dist/auth/pkce.js.map

{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,2DAA2D;AAC3D,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AAExE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAU,EAAE;IACrD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC,CAAC;AAOF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,GAAa,EAAE;IAC3C,MAAM,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACzC,CAAC,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAU,EAAE,CACpE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEhE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC"}

+8

dist/auth/scopes.d.ts

		import { Result } from "better-result";
		import { CliBaseError } from "./errors.js";
		declare class InvalidScopeInputError extends CliBaseError<"InvalidScopeInputError"> {
		readonly name = "InvalidScopeInputError";
		constructor(message: string);
		}
		export declare const parseScopesFlag: (input: string) => Result<readonly string[], InvalidScopeInputError>;
		export { InvalidScopeInputError };

+31

dist/auth/scopes.js

		// `--scopes` parsing. Validity of individual scope names is ultimately the
		// server's call (`opts.scopes` in `oauthProvider`, see the design brief's
		// "let a feature-disabled call fail with the server's actual error"
		// principle applied to scopes): this only rejects obviously-malformed input
		// (empty, containing whitespace) before it reaches a URL query string.
		import { Result } from "better-result";
		import * as v from "valibot";
		import { CliBaseError } from "./errors.js";
		class InvalidScopeInputError extends CliBaseError {
		name = "InvalidScopeInputError";
		constructor(message) {
		super("InvalidScopeInputError", message);
		}
		}
		const scopeTokenSchema = v.pipe(v.string(), v.trim(), v.minLength(1), v.regex(/^\S+$/u, "Scope names cannot contain whitespace"));
		export const parseScopesFlag = (input) => {
		const tokens = input
		.split(",")
		.map((token) => token.trim())
		.filter((token) => token.length > 0);
		if (tokens.length === 0) {
		return Result.err(new InvalidScopeInputError("--scopes was empty"));
		}
		const parsed = v.safeParse(v.array(scopeTokenSchema), tokens);
		if (!parsed.success) {
		return Result.err(new InvalidScopeInputError(`Invalid --scopes value: ${parsed.issues.map((issue) => issue.message).join("; ")}`));
		}
		return Result.ok(parsed.output);
		};
		export { InvalidScopeInputError };
		//# sourceMappingURL=scopes.js.map

+1

dist/auth/scopes.js.map

{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AAEvE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,sBAAuB,SAAQ,YAAsC;IACvD,IAAI,GAAG,wBAAwB,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAC7B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAC3D,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAAa,EACsC,EAAE;IACrD,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,sBAAsB,CACxB,2BAA2B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

+3

dist/auth/server-resolution.d.ts

		import { Result } from "better-result";
		import { ServerUrlNotConfiguredError } from "./errors.js";
		export declare const resolveServerUrl: (configDir: string, flagValue: string \| undefined) => Promise<Result<string, ServerUrlNotConfiguredError>>;

+26

dist/auth/server-resolution.js

		// `--server` resolution: no hosted-SaaS URL is baked in (self-hosting is
		// first-class; the CLI must not silently assume a build-time origin).
		// Priority: `--server` flag > `STELLA_SERVER_URL` env var > the last server
		// `stella auth login` succeeded against (`config.json#defaultServerUrl`).
		import { Result } from "better-result";
		import { STELLA_SERVER_URL } from "../env.js";
		import { readCliConfig } from "./cli-config.js";
		import { SERVER_URL_ENV_VAR } from "./constants.js";
		import { ServerUrlNotConfiguredError } from "./errors.js";
		const normalizeServerUrl = (input) => input.replace(/\/$/u, "");
		export const resolveServerUrl = async (configDir, flagValue) => {
		if (flagValue) {
		return Result.ok(normalizeServerUrl(flagValue));
		}
		if (STELLA_SERVER_URL) {
		return Result.ok(normalizeServerUrl(STELLA_SERVER_URL));
		}
		const config = await readCliConfig(configDir);
		if (config.defaultServerUrl) {
		return Result.ok(normalizeServerUrl(config.defaultServerUrl));
		}
		return Result.err(new ServerUrlNotConfiguredError({
		message: `No server configured. Pass --server <url>, set ${SERVER_URL_ENV_VAR}, or run \`stella auth login --server <url>\` once to set the default.`,
		}));
		};
		//# sourceMappingURL=server-resolution.js.map

+1

dist/auth/server-resolution.js.map

{"version":3,"file":"server-resolution.js","sourceRoot":"","sources":["../../src/auth/server-resolution.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,sEAAsE;AACtE,4EAA4E;AAC5E,0EAA0E;AAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,SAAiB,EACjB,SAA6B,EACyB,EAAE;IACxD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,2BAA2B,CAAC;QAC9B,OAAO,EAAE,kDAAkD,kBAAkB,wEAAwE;KACtJ,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

+26

dist/auth/token-exchange.d.ts

		import { Result } from "better-result";
		import { TokenExchangeError, TokenRefreshError } from "./errors.js";
		import type { AuthorizationServerMetadata } from "./oauth-metadata.js";
		export type TokenResponse = {
		readonly access_token: string;
		readonly expires_in: number;
		readonly refresh_token?: string \| undefined;
		readonly scope?: string \| undefined;
		readonly token_type: string;
		};
		export type ExchangeAuthorizationCodeInput = {
		readonly metadata: AuthorizationServerMetadata;
		readonly clientId: string;
		readonly code: string;
		readonly codeVerifier: string;
		readonly redirectUri: string;
		readonly resource: string;
		};
		export declare const exchangeAuthorizationCode: ({ clientId, code, codeVerifier, metadata, redirectUri, resource, }: ExchangeAuthorizationCodeInput) => Promise<Result<TokenResponse, TokenExchangeError>>;
		export type RefreshAccessTokenInput = {
		readonly metadata: AuthorizationServerMetadata;
		readonly clientId: string;
		readonly refreshToken: string;
		readonly resource: string;
		};
		export declare const refreshAccessToken: ({ clientId, metadata, refreshToken, resource, }: RefreshAccessTokenInput) => Promise<Result<TokenResponse, TokenRefreshError>>;

+102

dist/auth/token-exchange.js

		// `/oauth2/token` grant handling: authorization_code exchange and
		// refresh_token rotation.
		import { Result } from "better-result";
		import * as v from "valibot";
		import { AUTH_FETCH_TIMEOUT_MS } from "./constants.js";
		import { TokenExchangeError, TokenRefreshError } from "./errors.js";
		const tokenResponseSchema = v.looseObject({
		access_token: v.string(),
		expires_in: v.number(),
		refresh_token: v.optional(v.string()),
		scope: v.optional(v.string()),
		token_type: v.string(),
		});
		const oauthErrorBodySchema = v.looseObject({
		error: v.string(),
		error_description: v.optional(v.string()),
		});
		const describeTokenEndpointError = async (response) => {
		const text = await response.text();
		const fallback = {
		message: text.length > 0 ? text : `token endpoint responded ${response.status}`,
		};
		const parsedJson = Result.try(() => JSON.parse(text));
		if (Result.isError(parsedJson)) {
		return fallback;
		}
		const parsed = v.safeParse(oauthErrorBodySchema, parsedJson.value);
		if (!parsed.success) {
		return fallback;
		}
		return {
		error: parsed.output.error,
		message: parsed.output.error_description ?? parsed.output.error,
		};
		};
		export const exchangeAuthorizationCode = async ({ clientId, code, codeVerifier, metadata, redirectUri, resource, }) => {
		const body = new URLSearchParams({
		client_id: clientId,
		code,
		code_verifier: codeVerifier,
		grant_type: "authorization_code",
		redirect_uri: redirectUri,
		resource,
		});
		return await Result.tryPromise({
		catch: (cause) => cause instanceof TokenExchangeError
		? cause
		: new TokenExchangeError({
		cause,
		message: "Failed to exchange the authorization code for a token",
		}),
		try: async () => {
		const response = await fetch(metadata.token_endpoint, {
		body,
		headers: { "Content-Type": "application/x-www-form-urlencoded" },
		method: "POST",
		signal: AbortSignal.timeout(AUTH_FETCH_TIMEOUT_MS),
		});
		if (!response.ok) {
		const described = await describeTokenEndpointError(response);
		throw new TokenExchangeError({
		message: described.message,
		oauthError: described.error,
		});
		}
		return v.parse(tokenResponseSchema, await response.json());
		},
		});
		};
		export const refreshAccessToken = async ({ clientId, metadata, refreshToken, resource, }) => {
		const body = new URLSearchParams({
		client_id: clientId,
		grant_type: "refresh_token",
		refresh_token: refreshToken,
		resource,
		});
		return await Result.tryPromise({
		catch: (cause) => cause instanceof TokenRefreshError
		? cause
		: new TokenRefreshError({
		cause,
		message: "Failed to refresh the access token",
		}),
		try: async () => {
		const response = await fetch(metadata.token_endpoint, {
		body,
		headers: { "Content-Type": "application/x-www-form-urlencoded" },
		method: "POST",
		signal: AbortSignal.timeout(AUTH_FETCH_TIMEOUT_MS),
		});
		if (!response.ok) {
		const described = await describeTokenEndpointError(response);
		throw new TokenRefreshError({
		message: described.message,
		oauthError: described.error,
		});
		}
		return v.parse(tokenResponseSchema, await response.json());
		},
		});
		};
		//# sourceMappingURL=token-exchange.js.map

+1

dist/auth/token-exchange.js.map

{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../src/auth/token-exchange.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0BAA0B;AAE1B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAapE,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,KAAK,EACtC,QAAkB,EAC4B,EAAE;IAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf,OAAO,EACL,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B,QAAQ,CAAC,MAAM,EAAE;KACzE,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,GAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;QAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK;KAChE,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,EAC9C,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,QAAQ,GACuB,EAE/B,EAAE;IACF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,QAAQ;QACnB,IAAI;QACJ,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,WAAW;QACzB,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,kBAAkB;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,kBAAkB,CAAC;gBACrB,KAAK;gBACL,OAAO,EAAE,uDAAuD;aACjE,CAAC;QACR,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;gBACpD,IAAI;gBACJ,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;aACnD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBAC7D,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,UAAU,EAAE,SAAS,CAAC,KAAK;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,OAAO,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,QAAQ,GACgB,EAExB,EAAE;IACF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,YAAY,iBAAiB;YAChC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,iBAAiB,CAAC;gBACpB,KAAK;gBACL,OAAO,EAAE,oCAAoC;aAC9C,CAAC;QACR,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;gBACpD,IAAI;gBACJ,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;aACnD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;gBAC7D,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,UAAU,EAAE,SAAS,CAAC,KAAK;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,OAAO,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC"}

+17

dist/build-cli-tree.d.ts

		import type { Command, RouteMap } from "@stricli/core";
		import type { Context } from "./context.js";
		import type { ResourceNode } from "./resource-types.js";
		import type { RouteNode } from "./route-types.js";
		/** A stricli routing target: a leaf command or a nested route map. */
		type RoutingTarget = Command<Context> \| RouteMap<Context>;
		/**
		* Fold a generated `RouteNode` (route) into stricli `RoutingTarget` children,
		* ready to merge into the root route map's `routes`.
		*/
		export declare const buildGeneratedRoutes: (node: RouteNode) => Record<string, RoutingTarget>;
		/**
		* Fold a generated resource `ResourceNode` (route) into a single stricli
		* `RouteMap` for the reserved `reference` top-level command (spec S5.4).
		*/
		export declare const buildResourceRoutes: (node: ResourceNode) => RouteMap<Context>;
		export type { RouteMap };

+161

dist/build-cli-tree.js

		// Assembles a stricli `RoutingTarget` tree from a generated `RouteNode` (spec
		// 051 S5.1). Each leaf becomes a `buildCommand` whose `func` delegates to the
		// generic `runLeafCommand` executor; each route node becomes a `buildRouteMap`.
		// stricli's own flag parsing is kept deliberately permissive (every value flag
		// is an optional parsed string, booleans are optional): all validation and
		// exit-code selection happen inside the executor, so `process.exitCode` is set
		// precisely rather than defaulted by stricli.
		import { buildCommand, buildRouteMap } from "@stricli/core";
		import { flagKey, RESERVED_FLAG_KEYS, runLeafCommand, } from "./run-leaf-command.js";
		import { runResourceCommand } from "./run-resource-command.js";
		const identity = (value) => value;
		const parsedStringFlag = (brief) => ({ brief, kind: "parsed", optional: true, parse: identity });
		const variadicFlag = (brief) => ({ brief, kind: "parsed", variadic: true, parse: identity });
		const booleanFlag = (brief, withNegated) => ({ brief, kind: "boolean", optional: true, withNegated });
		const flagBrief = (spec) => {
		const parts = [spec.required ? "(required)" : "(optional)", spec.kind];
		if (spec.enum) {
		parts.push(`one of: ${spec.enum.join(", ")}`);
		}
		if (spec.min !== undefined \|\| spec.max !== undefined) {
		parts.push(`range ${spec.min ?? "-inf"}..${spec.max ?? "inf"}`);
		}
		if (spec.repeatable) {
		parts.push("repeatable");
		}
		return parts.join(" ");
		};
		const hasLimitProp = (spec) => {
		const properties = spec.inputSchema["properties"];
		if (typeof properties !== "object" \|\| properties === null) {
		return false;
		}
		return "limit" in properties;
		};
		const buildLeafFlags = (spec) => {
		const flags = {};
		for (const flagSpec of spec.flags) {
		const key = flagKey(flagSpec);
		const brief = flagBrief(flagSpec);
		if (flagSpec.kind === "boolean") {
		flags[key] = booleanFlag(brief, true);
		continue;
		}
		if (flagSpec.repeatable) {
		flags[key] = variadicFlag(brief);
		continue;
		}
		flags[key] = parsedStringFlag(brief);
		}
		// Reserved global flags every command carries (spec S1/S3).
		flags[RESERVED_FLAG_KEYS.input] = parsedStringFlag("Full tool-args JSON: '<json>' \| - (stdin) \| @file");
		flags[RESERVED_FLAG_KEYS.output] = parsedStringFlag("Output format: json \| table");
		flags[RESERVED_FLAG_KEYS.json] = booleanFlag("Output JSON (= --output json)", false);
		flags[RESERVED_FLAG_KEYS.table] = booleanFlag("Output a table (= --output table)", false);
		if (spec.paginated) {
		flags[RESERVED_FLAG_KEYS.cursor] = parsedStringFlag("Opaque pagination cursor from a previous page");
		flags[RESERVED_FLAG_KEYS.all] = booleanFlag("Follow cursors and return every page (bounded)", false);
		if (hasLimitProp(spec)) {
		flags[RESERVED_FLAG_KEYS.limit] = parsedStringFlag("Max items per page");
		}
		}
		if (spec.destructive) {
		flags[RESERVED_FLAG_KEYS.yes] = booleanFlag("Skip the destructive-op confirmation prompt", false);
		}
		return flags;
		};
		const leafBrief = (spec) => {
		const inputHint = spec.inputOnly.length > 0
		? ` (via --input only: ${spec.inputOnly.join(", ")})`
		: "";
		return `Run the ${spec.toolName} tool${inputHint}`;
		};
		const buildLeafCommand = (spec) => {
		const flags = buildLeafFlags(spec);
		const builderArgs = {
		docs: { brief: leafBrief(spec) },
		parameters: { flags },
		func: async function func(parsedFlags) {
		await runLeafCommand({ context: this, flags: parsedFlags, spec });
		},
		};
		// SAFETY: flags is assembled from FlagSpecs at build time, so the concrete
		// FLAGS generic cannot be spelled out; every entry is a valid stricli flag
		// parameter and the executor reads flags by name.
		const typedArgs =
		// eslint-disable-next-line no-unsafe-type-assertion -- see SAFETY comment above
		builderArgs;
		return buildCommand(typedArgs);
		};
		const buildRouteNode = (node, brief) => {
		if (node.kind === "leaf") {
		return buildLeafCommand(node.spec);
		}
		const routes = {};
		for (const [name, child] of Object.entries(node.children)) {
		routes[name] = buildRouteNode(child, `The ${name} command group`);
		}
		return buildRouteMap({ docs: { brief }, routes });
		};
		/**
		* Fold a generated `RouteNode` (route) into stricli `RoutingTarget` children,
		* ready to merge into the root route map's `routes`.
		*/
		export const buildGeneratedRoutes = (node) => {
		if (node.kind !== "route") {
		return {};
		}
		const routes = {};
		for (const [name, child] of Object.entries(node.children)) {
		routes[name] = buildRouteNode(child, `The ${name} command group`);
		}
		return routes;
		};
		const outputOnlyFlags = () => ({
		[RESERVED_FLAG_KEYS.output]: parsedStringFlag("Output format: json \| table"),
		[RESERVED_FLAG_KEYS.json]: booleanFlag("Output JSON (= --output json)", false),
		[RESERVED_FLAG_KEYS.table]: booleanFlag("Output a table (= --output table)", false),
		});
		const resourceLeafBrief = (spec) => spec.kind === "list"
		? "List the static reference resources exposed by the stella server"
		: `Read the ${spec.name} reference resource`;
		const buildResourceLeaf = (spec) => {
		const builderArgs = {
		docs: { brief: resourceLeafBrief(spec) },
		parameters: { flags: outputOnlyFlags() },
		func: async function func(parsedFlags) {
		await runResourceCommand({ context: this, flags: parsedFlags, spec });
		},
		};
		const typedArgs =
		// eslint-disable-next-line no-unsafe-type-assertion -- see SAFETY comment on buildLeafCommand
		builderArgs;
		return buildCommand(typedArgs);
		};
		const buildResourceNode = (node, brief) => {
		if (node.kind === "leaf") {
		return buildResourceLeaf(node.spec);
		}
		const routes = {};
		for (const [name, child] of Object.entries(node.children)) {
		routes[name] = buildResourceNode(child, `The ${name} command group`);
		}
		return buildRouteMap({ docs: { brief }, routes });
		};
		/**
		* Fold a generated resource `ResourceNode` (route) into a single stricli
		* `RouteMap` for the reserved `reference` top-level command (spec S5.4).
		*/
		export const buildResourceRoutes = (node) => {
		const routes = {};
		if (node.kind === "route") {
		for (const [name, child] of Object.entries(node.children)) {
		routes[name] = buildResourceNode(child, `The ${name} command group`);
		}
		}
		return buildRouteMap({
		docs: { brief: "Read the server's static reference resources" },
		routes,
		});
		};
		//# sourceMappingURL=build-cli-tree.js.map

+1

dist/build-cli-tree.js.map

+21

dist/cli-version-nudge.d.ts

		export declare const CLI_LATEST_HEADER = "x-stella-cli-latest";
		export declare const CLI_MINIMUM_HEADER = "x-stella-cli-minimum";
		/** -1 / 0 / 1 when both versions parse; `undefined` when either does not. */
		export declare const compareVersions: (a: string \| undefined, b: string \| undefined) => number \| undefined;
		/** What a nudge evaluation produced: an optional line + the version to remember. */
		export type VersionNudge = {
		line?: string;
		nudgeVersion?: string;
		};
		/**
		* Decide whether to nudge (spec 051 addendum). Priority: an explicit minimum the
		* current version is below becomes an "unsupported" warning; otherwise a newer
		* latest becomes an update hint. Anti-nag: if the target version equals the one
		* last nudged, stay silent. Any unparsable/missing version yields no nudge.
		*/
		export declare const buildVersionNudge: ({ current, latest, minimum, lastNudged, }: {
		current: string;
		latest: string \| undefined;
		minimum: string \| undefined;
		lastNudged: string \| undefined;
		}) => VersionNudge;

+68

dist/cli-version-nudge.js

		// CLI update nudge (spec 051 addendum). The runtime `tools/list` fetch carries
		// the server's advertised latest CLI version in a response header; if it is
		// newer than the running CLI, we print exactly one stderr hint. This module is
		// pure (no I/O): version parsing is Valibot-validated and any unparsable or
		// missing input yields no nudge (fail-silent). The nudge never touches stdout
		// or the exit code.
		import * as v from "valibot";
		// Mirror of `apps/api/src/mcp/constants.ts` (no shared module between the API and
		// the published CLI by design). Keep these header names in sync with that file.
		export const CLI_LATEST_HEADER = "x-stella-cli-latest";
		export const CLI_MINIMUM_HEADER = "x-stella-cli-minimum";
		const SemVerSchema = v.pipe(v.string(), v.regex(/^\d+\.\d+\.\d+$/u));
		const parseVersion = (raw) => {
		if (raw === undefined) {
		return undefined;
		}
		const parsed = v.safeParse(SemVerSchema, raw);
		if (!parsed.success) {
		return undefined;
		}
		const parts = parsed.output.split(".");
		return [Number(parts[0]), Number(parts[1]), Number(parts[2])];
		};
		/** -1 / 0 / 1 when both versions parse; `undefined` when either does not. */
		export const compareVersions = (a, b) => {
		const left = parseVersion(a);
		const right = parseVersion(b);
		if (left === undefined \|\| right === undefined) {
		return undefined;
		}
		for (let index = 0; index < 3; index += 1) {
		const delta = (left[index] ?? 0) - (right[index] ?? 0);
		if (delta !== 0) {
		return delta > 0 ? 1 : -1;
		}
		}
		return 0;
		};
		/**
		* Decide whether to nudge (spec 051 addendum). Priority: an explicit minimum the
		* current version is below becomes an "unsupported" warning; otherwise a newer
		* latest becomes an update hint. Anti-nag: if the target version equals the one
		* last nudged, stay silent. Any unparsable/missing version yields no nudge.
		*/
		export const buildVersionNudge = ({ current, latest, minimum, lastNudged, }) => {
		if (compareVersions(current, minimum) === -1) {
		// The comparison only returns -1 when `minimum` parsed, so it is defined.
		const target = latest ?? minimum;
		if (target === undefined \|\| target === lastNudged) {
		return {};
		}
		return {
		line: `stella ${current} is no longer supported (server requires >= ${minimum}); upgrade with: npm i -g @stll/cli`,
		nudgeVersion: target,
		};
		}
		if (latest !== undefined && compareVersions(latest, current) === 1) {
		if (latest === lastNudged) {
		return {};
		}
		return {
		line: `stella ${current} -> ${latest} available; npm i -g @stll/cli`,
		nudgeVersion: latest,
		};
		}
		return {};
		};
		//# sourceMappingURL=cli-version-nudge.js.map

+1

dist/cli-version-nudge.js.map

{"version":3,"file":"cli-version-nudge.js","sourceRoot":"","sources":["../src/cli-version-nudge.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,oBAAoB;AAEpB,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,kFAAkF;AAClF,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAErE,MAAM,YAAY,GAAG,CACnB,GAAuB,EACwB,EAAE;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,CAAqB,EACrB,CAAqB,EACD,EAAE;IACtB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAQF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAChC,OAAO,EACP,MAAM,EACN,OAAO,EACP,UAAU,GAMX,EAAgB,EAAE;IACjB,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7C,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU,OAAO,+CAA+C,OAAO,qCAAqC;YAClH,YAAY,EAAE,MAAM;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU,OAAO,OAAO,MAAM,gCAAgC;YACpE,YAAY,EAAE,MAAM;SACrB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC"}

+2

dist/cli.d.ts

		#!/usr/bin/env bun
		export {};

+148

dist/cli.js

		#!/usr/bin/env node
		// Application shell for the `stella` CLI (spec 051). Startup builds the command
		// tree from the baked-in `generatedRouteMap` (instant, offline); the runtime
		// path (S5.3) swaps in a validated cached-listings tree only when a fetched
		// `tools/list` has diverged, and refreshes the per-origin cache behind the
		// fail-closed trust boundary (S5.5). `stella auth *` (Phase 2) resolves its own
		// server from flags and is the one moment the cache is force-refreshed.
		import { buildApplication, buildCommand, buildRouteMap, run, } from "@stricli/core";
		import { Result } from "better-result";
		import packageJson from "../package.json" with { type: "json" };
		import { defaultConfigDir } from "./auth/cli-config.js";
		import { findDefaultCredential, readCredentialFile, } from "./auth/credential-store.js";
		import { resolveServerUrl } from "./auth/server-resolution.js";
		import { buildGeneratedRoutes, buildResourceRoutes } from "./build-cli-tree.js";
		import { authRoute } from "./commands/auth.js";
		import { HOME, XDG_CACHE_HOME } from "./env.js";
		import { generatedResourceTree } from "./generated/resource-tree.js";
		import { refreshRegistryCache, resolveCommandTree, } from "./registry-refresh.js";
		const collectLeafPaths = (node, path, lines) => {
		if (node.kind === "leaf") {
		lines.push(`${path.join(" ")}\t(${node.spec.toolName})`);
		return;
		}
		for (const [name, child] of Object.entries(node.children)) {
		collectLeafPaths(child, [...path, name], lines);
		}
		};
		const buildApp = (tree) => {
		const toolsListCommand = buildCommand({
		docs: {
		brief: "List the CLI commands generated from the stella MCP tool registry",
		},
		func() {
		const lines = [];
		// Reflect the ACTIVE tree (the cached-listings tree when the server
		// registry has diverged), so the divergence notice's pointer is honest.
		collectLeafPaths(tree, [], lines);
		this.process.stdout.write(`${lines.sort().join("\n")}\n`);
		},
		parameters: {},
		});
		const toolsRoute = buildRouteMap({
		docs: { brief: "Inspect the generated command registry" },
		routes: { list: toolsListCommand },
		});
		const rootRoute = buildRouteMap({
		docs: { brief: "Stella command-line client" },
		routes: {
		auth: authRoute,
		tools: toolsRoute,
		reference: buildResourceRoutes(generatedResourceTree),
		...buildGeneratedRoutes(tree),
		},
		});
		return buildApplication(rootRoute, {
		name: "stella",
		// Renders (and accepts) multi-word flags as kebab-case, e.g. the
		// `keychain` flag's auto-generated negation as `--no-keychain` rather
		// than `--noKeychain` — matches the documented command surface and every
		// other kebab-case CLI convention (gh, npm, docker).
		scanner: { caseStyle: "allow-kebab-for-camel" },
		versionInfo: { currentVersion: packageJson.version },
		});
		};
		const resolvePreamble = async () => {
		const configDir = defaultConfigDir();
		const serverUrlResult = await resolveServerUrl(configDir, undefined);
		const serverUrl = Result.isOk(serverUrlResult)
		? serverUrlResult.value
		: undefined;
		const token = serverUrl
		? findDefaultCredential(await readCredentialFile(configDir), serverUrl)
		?.accessToken
		: undefined;
		return { configDir, serverUrl, token };
		};
		// SAFETY: Node's `process.exitCode` type allows an explicit `undefined`
		// value (not just "absent"), which conflicts with stricli's own
		// `StricliProcess.exitCode?: string \| number \| null` under this package's
		// `exactOptionalPropertyTypes`. The real process object satisfies
		// `StricliProcess` at runtime regardless (it has every field stricli reads
		// or writes); this is a type-only mismatch between two independently-typed
		// libraries, not an actual runtime risk. Passing the real `process` (rather
		// than a constructed stand-in) matters: stricli sets `context.process.exitCode`
		// on it directly, and that must land on the process that is actually exiting.
		// eslint-disable-next-line no-unsafe-type-assertion -- see SAFETY comment above
		const stricliProcess = process;
		const main = async () => {
		const argv = process.argv.slice(2);
		const isAuthLogin = argv.at(0) === "auth" && argv.at(1) === "login";
		// A named slice of the env (read through `env.ts`) so the cache module never
		// touches the full `ProcessEnv` (whose index signature would not narrow to
		// `CacheEnv`).
		const cacheEnv = { XDG_CACHE_HOME, HOME };
		const { configDir, serverUrl, token } = await resolvePreamble();
		// Keep an EXISTING per-origin cache current before building the tree; a
		// missing cache stays offline-instant (seeded at `auth login` below). Any
		// transport/trust failure warns and falls back to the baked-in tree (S5.5).
		if (serverUrl !== undefined && token !== undefined && !isAuthLogin) {
		const outcome = await refreshRegistryCache({
		serverOrigin: serverUrl,
		token,
		env: cacheEnv,
		});
		if (outcome.status === "failed") {
		process.stderr.write(`${outcome.warning}\n`);
		}
		else if (outcome.status === "refreshed" && outcome.nudge !== undefined) {
		process.stderr.write(`${outcome.nudge}\n`);
		}
		}
		// Startup always resolves against the baked-in tree unless a validated cache
		// shows a non-empty delta, in which case build from the cached listings and
		// surface the one-line divergence notice (spec S5.3). No network here.
		const { tree, notice } = await resolveCommandTree({
		serverOrigin: serverUrl,
		env: cacheEnv,
		});
		if (notice !== undefined) {
		process.stderr.write(notice);
		}
		await run(buildApp(tree), argv, {
		forCommand: () => ({ configDir, process, serverUrl, token }),
		process: stricliProcess,
		});
		// Seed/refresh the cache right after a successful `auth login` (the one
		// explicit-network moment), using the freshly stored credential.
		if (isAuthLogin) {
		const refreshed = await resolvePreamble();
		if (refreshed.serverUrl !== undefined && refreshed.token !== undefined) {
		const outcome = await refreshRegistryCache({
		serverOrigin: refreshed.serverUrl,
		token: refreshed.token,
		env: cacheEnv,
		force: true,
		});
		if (outcome.status === "failed") {
		process.stderr.write(`${outcome.warning}\n`);
		}
		else if (outcome.status === "refreshed" &&
		outcome.nudge !== undefined) {
		process.stderr.write(`${outcome.nudge}\n`);
		}
		}
		}
		};
		void main();
		//# sourceMappingURL=cli.js.map

+1

dist/cli.js.map

+2

dist/codegen.d.ts

		#!/usr/bin/env bun
		export {};

+121

dist/codegen.js

		#!/usr/bin/env bun
		// Build-time codegen (spec 051 S5.2, build-time call site). Reads the committed
		// registry snapshot (produced by `apps/api/scripts/export-mcp-tool-registry.ts`,
		// the only place the heavy registry imports resolve), runs the pure
		// `generateRouteMap` with the baked-in Annotation Table, and writes the result
		// to `generated/route-map.ts`. The snapshot keeps `@stll/cli` free of any
		// `apps/api` import; the committed output means registry drift shows as a diff.
		//
		// Run via `bun run codegen` (which regenerates the snapshot first).
		import { panic } from "better-result";
		import { readFile, writeFile } from "node:fs/promises";
		import * as v from "valibot";
		import packageJson from "../package.json" with { type: "json" };
		import { TOOL_ANNOTATIONS } from "./annotations.js";
		import { generateResourceTree } from "./generate-resource-tree.js";
		import { generateRouteMap } from "./generate-route-map.js";
		const snapshotUrl = new URL("generated/registry-snapshot.json", import.meta.url);
		const outputUrl = new URL("generated/route-map.ts", import.meta.url);
		const resourceSnapshotUrl = new URL("generated/resources-snapshot.json", import.meta.url);
		const resourceOutputUrl = new URL("generated/resource-tree.ts", import.meta.url);
		// Validate the snapshot into the four wire fields so the codegen input is typed
		// (not `any` off `.json()`) and a malformed snapshot fails loudly.
		const listingSchema = v.array(v.looseObject({
		name: v.string(),
		description: v.string(),
		inputSchema: v.record(v.string(), v.unknown()),
		annotations: v.optional(v.looseObject({
		readOnlyHint: v.optional(v.boolean()),
		destructiveHint: v.optional(v.boolean()),
		})),
		}));
		const snapshot = v.safeParse(listingSchema, JSON.parse(await readFile(snapshotUrl, "utf-8")));
		if (!snapshot.success) {
		panic("registry-snapshot.json does not match the expected listing shape");
		}
		// Project the validated snapshot to the exact `RegistryToolListing` shape
		// (dropping valibot's `\| undefined` widening on optional annotation hints).
		const listings = [];
		for (const tool of snapshot.output) {
		const annotations = {};
		if (tool.annotations?.readOnlyHint !== undefined) {
		annotations.readOnlyHint = tool.annotations.readOnlyHint;
		}
		if (tool.annotations?.destructiveHint !== undefined) {
		annotations.destructiveHint = tool.annotations.destructiveHint;
		}
		listings.push({
		name: tool.name,
		description: tool.description,
		inputSchema: tool.inputSchema,
		...(tool.annotations === undefined ? {} : { annotations }),
		});
		}
		const routeMap = generateRouteMap(listings, TOOL_ANNOTATIONS);
		const header = `/* eslint-disable unicorn/numeric-separators-style -- generated JSON literals */
		// GENERATED by \`bun run codegen\` (spec 051 S5.2). Do not edit by hand.
		//
		// The committed route tree built from the MCP tool registry snapshot through
		// \`generateRouteMap\`. Regenerate after any registry change; drift shows up here
		// as a diff instead of a runtime surprise.

		import type { RouteNode } from "../route-types.js";

		export const generatedRouteMap: RouteNode = `;
		await writeFile(outputUrl, `${header}${JSON.stringify(routeMap, null, 2)};\n`);
		process.stderr.write(`Wrote ${outputUrl.pathname}\n`);
		// The resource tree (spec 051 S5.4) is generated the same way from its own
		// snapshot so `reference list`/`reference show` can never drift from the
		// server's static resources.
		const resourceSchema = v.array(v.strictObject({
		uri: v.string(),
		name: v.string(),
		title: v.optional(v.string()),
		description: v.optional(v.string()),
		mimeType: v.optional(v.string()),
		}));
		const resourceSnapshot = v.safeParse(resourceSchema, JSON.parse(await readFile(resourceSnapshotUrl, "utf-8")));
		if (!resourceSnapshot.success) {
		panic("resources-snapshot.json does not match the expected listing shape");
		}
		// Project to the exact `ResourceListing` shape, dropping valibot's `\| undefined`
		// widening on the optional fields under `exactOptionalPropertyTypes`.
		const resourceListings = [];
		for (const resource of resourceSnapshot.output) {
		const listing = { uri: resource.uri, name: resource.name };
		if (resource.title !== undefined) {
		listing.title = resource.title;
		}
		if (resource.description !== undefined) {
		listing.description = resource.description;
		}
		if (resource.mimeType !== undefined) {
		listing.mimeType = resource.mimeType;
		}
		resourceListings.push(listing);
		}
		const resourceTree = generateResourceTree(resourceListings);
		const resourceHeader = `// GENERATED by \`bun run codegen\` (spec 051 S5.4). Do not edit by hand.
		//
		// The committed resource tree built from the MCP \`resources/list\` snapshot
		// through \`generateResourceTree\`. Regenerate after any resource change; drift
		// shows up here as a diff instead of a runtime surprise.

		import type { ResourceNode } from "../resource-types.js";

		export const generatedResourceTree: ResourceNode = `;
		await writeFile(resourceOutputUrl, `${resourceHeader}${JSON.stringify(resourceTree, null, 2)};\n`);
		process.stderr.write(`Wrote ${resourceOutputUrl.pathname}\n`);
		// Bake the package version in at codegen time (spec 051 addendum: the CLI update
		// nudge must not read package.json at runtime from dist). Regenerating after a
		// version bump keeps this in lockstep with package.json.
		const versionOutputUrl = new URL("generated/cli-version.ts", import.meta.url);
		const versionHeader = `// GENERATED by \`bun run codegen\`. Do not edit by hand.
		//
		// The running CLI's own version, baked in at codegen time so the update nudge
		// (spec 051 addendum) never reads package.json from the published dist.

		export const CLI_VERSION = `;
		await writeFile(versionOutputUrl, `${versionHeader}${JSON.stringify(packageJson.version)};\n`);
		process.stderr.write(`Wrote ${versionOutputUrl.pathname}\n`);
		//# sourceMappingURL=codegen.js.map

+1

dist/codegen.js.map

+3

dist/commands/auth.d.ts

		import type { RouteMap } from "@stricli/core";
		import type { Context } from "../context.js";
		export declare const authRoute: RouteMap<Context>;

+149

dist/commands/auth.js

		// `stella auth login\|logout\|whoami\|switch` (spec 051 Phase 2).
		import { buildCommand, buildRouteMap } from "@stricli/core";
		import { Result } from "better-result";
		import { CLI_DEFAULT_SCOPES, CLI_KNOWN_SCOPES } from "../auth/constants.js";
		import { login } from "../auth/login.js";
		import { logout, switchOrg, whoami } from "../auth/manage.js";
		import { parseScopesFlag } from "../auth/scopes.js";
		import { resolveServerUrl } from "../auth/server-resolution.js";
		const parseString = (input) => input;
		const stringFlag = (brief) => ({ brief, kind: "parsed", optional: true, parse: parseString });
		const requiredStringFlag = (brief) => ({ brief, kind: "parsed", parse: parseString });
		const formatDate = (epochMs) => new Date(epochMs).toISOString();
		const loginCommand = buildCommand({
		docs: {
		brief: "Sign in to a stella server via the browser (PKCE loopback flow)",
		fullDescription: "Opens the stella sign-in page in your default browser and waits for the redirect on an ephemeral localhost port. If the browser can't reach this machine (SSH/remote/headless), paste the redirected URL or the bare authorization code back into the prompt instead.",
		},
		func: async function func(flags) {
		let requestedScopes = CLI_DEFAULT_SCOPES;
		if (flags.scopes) {
		const parsedScopes = parseScopesFlag(flags.scopes);
		if (Result.isError(parsedScopes)) {
		return new Error(parsedScopes.error.message);
		}
		requestedScopes = parsedScopes.value;
		}
		if (!flags.keychain) {
		this.process.stdout.write("Note: --no-keychain has no effect yet; credentials are always stored at ~/.config/stella/credentials.json (mode 0600). OS keychain support is a follow-up.\n");
		}
		const result = await login(this.process, {
		configDir: this.configDir,
		orgHint: flags.org,
		registrationScopes: CLI_KNOWN_SCOPES,
		requestedScopes,
		serverFlag: flags.server,
		});
		if (Result.isError(result)) {
		return new Error(result.error.message);
		}
		const refreshNote = result.value.hasRefreshToken
		? ""
		: "No refresh token was issued (the server has not enabled offline_access yet); re-run `stella auth login` once this token expires.\n";
		const lines = [
		`Signed in to ${result.value.serverUrl} (org ${result.value.orgId}).`,
		`Granted scopes: ${result.value.grantedScopes}`,
		`Access token expires: ${formatDate(result.value.expiresAt)}`,
		];
		this.process.stdout.write(`${lines.join("\n")}\n${refreshNote}`);
		return undefined;
		},
		parameters: {
		flags: {
		keychain: {
		brief: "Use the OS keychain for storage (currently always falls back to the XDG credentials file; see --help)",
		default: true,
		kind: "boolean",
		},
		org: stringFlag("Organization slug to select in the browser when prompted (label only, not enforced server-side; see --help)"),
		scopes: stringFlag(`Comma-separated OAuth scopes to request (default: ${CLI_DEFAULT_SCOPES.join(",")})`),
		server: stringFlag("Stella API origin to sign in to"),
		},
		},
		});
		const whoamiCommand = buildCommand({
		docs: { brief: "Show the signed-in organization, scopes, and token expiry" },
		func: async function func(flags) {
		const serverUrlResult = await resolveServerUrl(this.configDir, flags.server);
		if (Result.isError(serverUrlResult)) {
		return new Error(serverUrlResult.error.message);
		}
		const result = await whoami(this.configDir, serverUrlResult.value, flags.org);
		if (Result.isError(result)) {
		return new Error(result.error.message);
		}
		const info = result.value;
		const lines = [
		`Server: ${info.serverUrl}`,
		`Organization: ${info.orgLabel ? `${info.orgLabel} (${info.orgId})` : info.orgId}`,
		`Scopes: ${info.scope}`,
		`Expires: ${formatDate(info.expiresAt)}${info.isExpired ? " (expired)" : ""}`,
		`Refresh token: ${info.hasRefreshToken ? "yes" : "no"}`,
		];
		if (info.claims?.sub) {
		lines.push(`Subject: ${info.claims.sub}`);
		}
		this.process.stdout.write(`${lines.join("\n")}\n`);
		return undefined;
		},
		parameters: {
		flags: {
		org: stringFlag("Organization to inspect (default: this server's default org)"),
		server: stringFlag("Stella API origin to inspect (default: resolved server)"),
		},
		},
		});
		const logoutCommand = buildCommand({
		docs: { brief: "Remove a stored stella credential" },
		func: async function func(flags) {
		const serverUrlResult = await resolveServerUrl(this.configDir, flags.server);
		if (Result.isError(serverUrlResult)) {
		return new Error(serverUrlResult.error.message);
		}
		const result = await logout(this.configDir, serverUrlResult.value, flags.org);
		if (Result.isError(result)) {
		return new Error(result.error.message);
		}
		this.process.stdout.write(`Signed out of ${serverUrlResult.value} (org ${result.value.orgId}).\n`);
		return undefined;
		},
		parameters: {
		flags: {
		org: stringFlag("Organization to sign out of (default: the only signed-in org)"),
		server: stringFlag("Stella API origin to sign out of (default: resolved server)"),
		},
		},
		});
		const switchCommand = buildCommand({
		docs: {
		brief: "Switch the default organization for a server (no re-auth if already signed in)",
		},
		func: async function func(flags) {
		const serverUrlResult = await resolveServerUrl(this.configDir, flags.server);
		if (Result.isError(serverUrlResult)) {
		return new Error(serverUrlResult.error.message);
		}
		const result = await switchOrg(this.configDir, serverUrlResult.value, flags.org);
		if (Result.isError(result)) {
		return new Error(result.error.message);
		}
		this.process.stdout.write(`Default organization for ${serverUrlResult.value} is now ${result.value.orgId}.\n`);
		return undefined;
		},
		parameters: {
		flags: {
		org: requiredStringFlag("Organization to switch to"),
		server: stringFlag("Stella API origin (default: resolved server)"),
		},
		},
		});
		export const authRoute = buildRouteMap({
		docs: { brief: "Manage stella authentication" },
		routes: {
		login: loginCommand,
		logout: logoutCommand,
		switch: switchCommand,
		whoami: whoamiCommand,
		},
		});
		//# sourceMappingURL=auth.js.map

+1

dist/commands/auth.js.map

+21

dist/context.d.ts

 import type { CommandContext } from "@stricli/core";
 /** Context every generated (and hand-written) command receives. */
 export type Context = CommandContext & {
     /**
      * Real Node/Bun process, not just stricli's minimal `WritableStreams`:
      * `stella auth login`'s manual-paste fallback needs `stdin`, and server
      * resolution reads `env`.
      */
     readonly process: NodeJS.Process;
     /** `~/.config/stella` (or `$XDG_CONFIG_HOME/stella`), resolved once per invocation. */
     readonly configDir: string;
     /** Resolved server origin (`--server`/env/config; see `auth/server-resolution.ts`), if any. */
     readonly serverUrl: string | undefined;
     /**
      * The default org's stored access token for `serverUrl`, if signed in.
      * Not proactively refreshed here — a Phase 3+ HTTP client wrapper should
      * call `auth/ensure-fresh-credential.ts` reactively on a 401, matching
      * `stella auth whoami`'s "no extra server calls unless needed" stance.
      */
     readonly token: string | undefined;
 };

+8

dist/context.js

 // Shared stricli application context (spec 051 S5.1): a single `Context` type
 // threaded through every command. Generated (Phase 3+) commands read
 // `serverUrl`/`token` directly instead of re-resolving them; hand-written
 // `stella auth` commands (this phase) resolve their own server/org from
 // flags since they operate on a specific (possibly not-yet-configured)
 // server rather than "the" current one.
 export {};
 //# sourceMappingURL=context.js.map

+1

dist/context.js.map

{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,wCAAwC"}

+8

dist/env.d.ts

		/** XDG base-directory override for `~/.config/stella`; see `auth/config-dir.ts`. */
		export declare const XDG_CONFIG_HOME: string \| undefined;
		/** Default `--server` origin when neither the flag nor a saved config exists; see `auth/server-resolution.ts`. */
		export declare const STELLA_SERVER_URL: string \| undefined;
		/** XDG cache base for the per-origin registry cache; see `registry-cache.ts`. */
		export declare const XDG_CACHE_HOME: string \| undefined;
		/** Home directory, the `~/.cache` fallback root for the registry cache. */
		export declare const HOME: string \| undefined;

+14

dist/env.js

		// Centralizes every `process.env` read for `@stll/cli` (the
		// `forbid-process-env-outside-env-ts` lint rule requires reads to live in an
		// `env.ts`-named module; see `oxlint.config.ts`). Both variables are
		// optional: the CLI never hard-requires an env var to start (self-hosting
		// first-class — `--server`/`credentials.json` always work without either).
		/** XDG base-directory override for `~/.config/stella`; see `auth/config-dir.ts`. */
		export const XDG_CONFIG_HOME = process.env["XDG_CONFIG_HOME"];
		/** Default `--server` origin when neither the flag nor a saved config exists; see `auth/server-resolution.ts`. */
		export const STELLA_SERVER_URL = process.env["STELLA_SERVER_URL"];
		/** XDG cache base for the per-origin registry cache; see `registry-cache.ts`. */
		export const XDG_CACHE_HOME = process.env["XDG_CACHE_HOME"];
		/** Home directory, the `~/.cache` fallback root for the registry cache. */
		export const HOME = process.env["HOME"];
		//# sourceMappingURL=env.js.map

+1

dist/env.js.map

{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,2EAA2E;AAE3E,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAEjC,kHAAkH;AAClH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAuB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAEhF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,IAAI,GAAuB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC"}

+7

dist/generate-resource-tree.d.ts

		import type { ResourceListing, ResourceNode } from "./resource-types.js";
		/**
		* Fold a `resources/list` projection into a `reference` resource tree. `list`
		* enumerates; each resource becomes a `show <name>` leaf keyed by its
		* kebab-cased name. A duplicate resource name is a hard generation error.
		*/
		export declare const generateResourceTree: (resources: readonly ResourceListing[]) => ResourceNode;

+45

dist/generate-resource-tree.js

		// THE resource-tree generator (spec 051 S5.4), mirroring `generateRouteMap`:
		// pure, deterministic, no I/O. Given a `resources/list` projection it emits a
		// `reference` route with a `list` enumerator and one `show <name>` leaf per
		// resource, so the tree is generated (never drifts) yet still fully offline.
		// Both call sites (build-time codegen and the runtime path) share this function.
		import { RouteGenerationError } from "./generate-route-map.js";
		/** snake_case, camelCase, or a `stella://` uri path segment -> kebab-case. */
		const kebabCase = (segment) => segment
		.replace(/_/gu, "-")
		.replace(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower>-$<upper>")
		.toLowerCase();
		/**
		* Fold a `resources/list` projection into a `reference` resource tree. `list`
		* enumerates; each resource becomes a `show <name>` leaf keyed by its
		* kebab-cased name. A duplicate resource name is a hard generation error.
		*/
		export const generateResourceTree = (resources) => {
		const showChildren = {};
		for (const resource of resources) {
		const key = kebabCase(resource.name);
		if (showChildren[key] !== undefined) {
		throw new RouteGenerationError(`Duplicate resource command 'reference show ${key}' (uri ${resource.uri})`);
		}
		showChildren[key] = {
		kind: "leaf",
		spec: {
		kind: "show",
		commandPath: ["reference", "show", key],
		name: resource.name,
		uri: resource.uri,
		},
		};
		}
		return {
		kind: "route",
		children: {
		list: {
		kind: "leaf",
		spec: { kind: "list", commandPath: ["reference", "list"] },
		},
		show: { kind: "route", children: showChildren },
		},
		};
		};
		//# sourceMappingURL=generate-resource-tree.js.map

+1

dist/generate-resource-tree.js.map

{"version":3,"file":"generate-resource-tree.js","sourceRoot":"","sources":["../src/generate-resource-tree.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAG/D,8EAA8E;AAC9E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAU,EAAE,CAC5C,OAAO;KACJ,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;KACnB,OAAO,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;KACnE,WAAW,EAAE,CAAC;AAEnB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,SAAqC,EACvB,EAAE;IAChB,MAAM,YAAY,GAAiC,EAAE,CAAC;IAEtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,oBAAoB,CAC5B,8CAA8C,GAAG,UAAU,QAAQ,CAAC,GAAG,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG;YAClB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC;gBACvC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;aAClB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;aAC3D;YACD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;SAChD;KACF,CAAC;AACJ,CAAC,CAAC"}

+14

dist/generate-route-map.d.ts

		import { CliBaseError } from "./auth/errors.js";
		import type { RegistryToolListing, RouteNode, ToolAnnotation } from "./route-types.js";
		/** Hard codegen failure: a collision or reserved-name violation (spec S1). */
		export declare class RouteGenerationError extends CliBaseError<"RouteGenerationError"> {
		readonly name = "RouteGenerationError";
		constructor(message: string);
		}
		/**
		* THE generator. Deterministic and pure: same inputs -> byte-identical
		* `RouteNode`. Excludes tools annotated `excluded`, splits required-enum
		* discriminators into subcommands, maps every prop to a flag or `inputOnly`
		* per spec S3, and fails hard on any reserved-name or kebab collision.
		*/
		export declare const generateRouteMap: (listings: readonly RegistryToolListing[], annotations: Readonly<Record<string, ToolAnnotation>>) => RouteNode;

+465

dist/generate-route-map.js

		// THE generator (spec 051 S5.2): JSON-Schema tool listings + the baked-in
		// Annotation Table -> a stricli-ready `RouteNode` tree. Pure, deterministic, no
		// I/O, no `Date.now()`/`Math.random()`. Called at build time by the codegen
		// script and (later, out of scope here) at runtime with a validated
		// `tools/list`; both call sites share this one function and the same
		// annotations, so the trees are byte-identical.
		import { RESERVED_FLAGS, RESERVED_TOP_LEVEL_NAMES } from "./annotations.js";
		import { CliBaseError } from "./auth/errors.js";
		/** Argument keys the pagination flags map onto, shared across every list tool. */
		const CURSOR_ARG = "cursor";
		const LIMIT_ARG = "limit";
		/** Prefixes that split an unknown tool name into `verb domain` (spec S1 rule 5). */
		const VERB_PREFIXES = new Set([
		"list",
		"save",
		"delete",
		"read",
		"get",
		"search",
		]);
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		/** Extract a `{ prop: schema }` map from a schema's `properties`, guarding shapes. */
		const propertyMap = (schema) => {
		const raw = schema["properties"];
		if (!isRecord(raw)) {
		return {};
		}
		const out = {};
		for (const [key, value] of Object.entries(raw)) {
		if (isRecord(value)) {
		out[key] = value;
		}
		}
		return out;
		};
		/** Hard codegen failure: a collision or reserved-name violation (spec S1). */
		export class RouteGenerationError extends CliBaseError {
		name = "RouteGenerationError";
		constructor(message) {
		super("RouteGenerationError", message);
		}
		}
		/** snake_case or camelCase segment -> kebab-case. */
		const kebabCase = (segment) => segment
		.replace(/_/gu, "-")
		.replace(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower>-$<upper>")
		.toLowerCase();
		const schemaTypeList = (rawType) => {
		if (Array.isArray(rawType)) {
		return rawType.filter((t) => typeof t === "string");
		}
		return typeof rawType === "string" ? [rawType] : [];
		};
		const typeInfo = (schema) => {
		const types = schemaTypeList(schema["type"]);
		const nullable = types.includes("null");
		const base = types.find((t) => t !== "null");
		return { base, nullable };
		};
		const enumValues = (schema) => {
		const values = schema["enum"];
		if (!Array.isArray(values)) {
		return undefined;
		}
		return values.every((v) => typeof v === "string")
		? values
		: undefined;
		};
		/** Conditionally include `min`/`max` so an absent bound is omitted, not `undefined`. */
		const boundFields = (schema) => {
		const minimum = schema["minimum"];
		const maximum = schema["maximum"];
		return {
		...(typeof minimum === "number" ? { min: minimum } : {}),
		...(typeof maximum === "number" ? { max: maximum } : {}),
		};
		};
		const scalarFlagKind = (base) => {
		if (base === "string") {
		return "string";
		}
		if (base === "integer") {
		return "int";
		}
		if (base === "number") {
		return "number";
		}
		if (base === "boolean") {
		return "boolean";
		}
		return undefined;
		};
		const classifyArrayItems = (prop, items) => {
		const { base } = typeInfo(items);
		const itemEnum = enumValues(items);
		if (itemEnum) {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "enum-array",
		enum: itemEnum,
		repeatable: true,
		},
		};
		}
		if (base === "string") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "string-array",
		repeatable: true,
		},
		};
		}
		if (base === "integer" \|\| base === "number") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "int-array",
		repeatable: true,
		},
		};
		}
		// array-of-object (and anything else) -> --input only (spec S3).
		return { kind: "input-only" };
		};
		const classifyObject = (prop, schema) => {
		// Free map (additionalProperties: true) -> --input only (spec S3).
		if (schema["additionalProperties"] === true) {
		return { kind: "input-only" };
		}
		if (!isRecord(schema["properties"])) {
		return { kind: "input-only" };
		}
		// Dot-path flags only for a depth-2 object all of whose children are scalars
		// (spec S3). Any non-scalar child (nested object/array/untyped) pushes the
		// whole subtree to --input rather than emitting half-generated flags.
		const children = [];
		for (const [childName, childSchema] of Object.entries(schema["properties"])) {
		if (!isRecord(childSchema)) {
		return { kind: "input-only" };
		}
		const child = childSchema;
		const childEnum = enumValues(child);
		const { base } = typeInfo(child);
		if (childEnum) {
		children.push({
		flag: `--${kebabCase(prop)}.${kebabCase(childName)}`,
		prop: `${prop}.${childName}`,
		kind: "enum",
		enum: childEnum,
		repeatable: false,
		});
		continue;
		}
		const scalar = scalarFlagKind(base ?? "");
		if (scalar === undefined) {
		return { kind: "input-only" };
		}
		children.push({
		flag: `--${kebabCase(prop)}.${kebabCase(childName)}`,
		prop: `${prop}.${childName}`,
		kind: scalar,
		...(scalar === "int" \|\| scalar === "number" ? boundFields(child) : {}),
		repeatable: false,
		});
		}
		return { kind: "dot-path", children };
		};
		const classifyProp = (prop, schema) => {
		const { base, nullable } = typeInfo(schema);
		const values = enumValues(schema);
		if (values && base === "string") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "enum",
		enum: values,
		repeatable: false,
		},
		};
		}
		if (base === "string") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: nullable ? "nullable-string" : "string",
		repeatable: false,
		},
		};
		}
		if (base === "integer") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "int",
		...boundFields(schema),
		repeatable: false,
		},
		};
		}
		if (base === "number") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "number",
		...boundFields(schema),
		repeatable: false,
		},
		};
		}
		if (base === "boolean") {
		return {
		kind: "flag",
		spec: {
		flag: `--${kebabCase(prop)}`,
		prop,
		kind: "boolean",
		repeatable: false,
		},
		};
		}
		if (base === "array") {
		const items = schema["items"];
		if (!isRecord(items)) {
		return { kind: "input-only" };
		}
		return classifyArrayItems(prop, items);
		}
		if (base === "object") {
		return classifyObject(prop, schema);
		}
		return { kind: "input-only" };
		};
		const resolvePaginationMode = (properties, annotation) => {
		const cursor = properties[CURSOR_ARG];
		const limit = properties[LIMIT_ARG];
		const hasCursor = cursor !== undefined && typeInfo(cursor).base === "string";
		const hasLimit = limit !== undefined && typeInfo(limit).base === "integer";
		if (!hasCursor) {
		return "none";
		}
		// Windowed-text and paginationless tools page a cursor but expose no --limit.
		if (annotation?.windowedText \|\| annotation?.paginationless) {
		return "cursor-only";
		}
		return hasLimit ? "full" : "cursor-only";
		};
		const buildFlags = ({ properties, required, includeProps, skipProps, }) => {
		const flags = [];
		const inputOnly = [];
		const seenFlags = new Set();
		const propNames = includeProps ?? Object.keys(properties).filter((p) => !skipProps.has(p));
		for (const prop of propNames) {
		if (skipProps.has(prop)) {
		continue;
		}
		const schema = properties[prop];
		if (schema === undefined) {
		continue;
		}
		const classification = classifyProp(prop, schema);
		if (classification.kind === "input-only") {
		inputOnly.push(prop);
		continue;
		}
		const isRequired = required.has(prop);
		const candidates = classification.kind === "flag"
		? [classification.spec]
		: classification.children;
		for (const candidate of candidates) {
		if (RESERVED_FLAGS.has(candidate.flag)) {
		throw new RouteGenerationError(`Generated flag ${candidate.flag} (from prop ${candidate.prop}) collides with a reserved global flag`);
		}
		if (seenFlags.has(candidate.flag)) {
		throw new RouteGenerationError(`Flag ${candidate.flag} is generated twice within one command; add a flagRename annotation`);
		}
		seenFlags.add(candidate.flag);
		// A dot-path leaf is required only if the whole object prop is required
		// AND the child schema itself is required; the CLI keeps this simple by
		// treating dot-path leaves as optional (the server enforces sub-requiredness).
		flags.push({
		...candidate,
		required: classification.kind === "flag" ? isRequired : false,
		});
		}
		}
		return { flags, inputOnly };
		};
		const scopeOf = (annotation) => annotation.scope;
		/** Split an unknown tool name into a `[domain, verb]` command path (spec S1 rule 5). */
		const heuristicCommandPath = (name) => {
		const underscore = name.indexOf("_");
		if (underscore === -1) {
		return [kebabCase(name)];
		}
		const head = name.slice(0, underscore);
		const rest = name.slice(underscore + 1);
		if (VERB_PREFIXES.has(head)) {
		return [kebabCase(rest), head];
		}
		return [kebabCase(head), kebabCase(rest)];
		};
		const leafSpecsForTool = ({ listing, annotation, }) => {
		const schema = listing.inputSchema;
		const properties = propertyMap(schema);
		const requiredList = Array.isArray(schema["required"])
		? schema["required"].filter((r) => typeof r === "string")
		: [];
		const required = new Set(requiredList);
		const destructiveHint = listing.annotations?.destructiveHint === true;
		const command = annotation?.command ?? heuristicCommandPath(listing.name);
		const scope = annotation ? scopeOf(annotation) : undefined;
		const itemsKey = annotation?.itemsKey;
		const windowedText = annotation?.windowedText === true;
		const mode = resolvePaginationMode(properties, annotation);
		const paginated = mode !== "none";
		const paginationSkip = new Set();
		if (mode === "full") {
		paginationSkip.add(CURSOR_ARG);
		paginationSkip.add(LIMIT_ARG);
		}
		else if (mode === "cursor-only") {
		paginationSkip.add(CURSOR_ARG);
		}
		// Discriminator split (spec S2). An ANNOTATED tool splits only when its
		// annotation explicitly marks a `discriminator` (so a plain required-enum
		// filter such as `lookup_business_registry.registry` stays a normal flag). An
		// UNKNOWN tool (runtime, no annotation) falls back to the safe-superset
		// heuristic: split on its first required-enum prop.
		const discriminatorProp = annotation
		? annotation.discriminator?.prop
		: Object.keys(properties).find((prop) => {
		const values = enumValues(properties[prop] ?? {});
		return values !== undefined && required.has(prop);
		});
		if (discriminatorProp !== undefined) {
		const propSchema = properties[discriminatorProp];
		const values = enumValues(propSchema ?? {}) ?? [];
		const skipWithDiscriminator = new Set([
		...paginationSkip,
		discriminatorProp,
		]);
		const baseRequired = new Set([...required].filter((r) => r !== discriminatorProp));
		const specs = [];
		for (const value of values) {
		const sub = annotation?.discriminator?.subcommands[value];
		const subCommandName = sub?.command ?? kebabCase(value);
		const subRequired = new Set([...baseRequired, ...(sub?.required ?? [])]);
		const { flags, inputOnly } = buildFlags({
		properties,
		required: subRequired,
		includeProps: sub?.include,
		skipProps: skipWithDiscriminator,
		});
		specs.push({
		commandPath: [...command, subCommandName],
		toolName: listing.name,
		discriminatorInject: { [discriminatorProp]: value },
		flags,
		inputOnly,
		paginated,
		windowedText,
		...(itemsKey === undefined ? {} : { itemsKey }),
		destructive: sub?.destructive === true \|\| destructiveHint,
		...(scope === undefined ? {} : { scope }),
		inputSchema: schema,
		});
		}
		return specs;
		}
		const { flags, inputOnly } = buildFlags({
		properties,
		required,
		includeProps: undefined,
		skipProps: paginationSkip,
		});
		return [
		{
		commandPath: command,
		toolName: listing.name,
		flags,
		inputOnly,
		paginated,
		windowedText,
		...(itemsKey === undefined ? {} : { itemsKey }),
		destructive: destructiveHint,
		...(scope === undefined ? {} : { scope }),
		inputSchema: schema,
		},
		];
		};
		const insertLeaf = (root, spec) => {
		if (root.kind !== "route") {
		throw new RouteGenerationError("Cannot insert into a leaf node");
		}
		const path = spec.commandPath;
		const top = path[0];
		if (top !== undefined && RESERVED_TOP_LEVEL_NAMES.has(top)) {
		throw new RouteGenerationError(`Command domain '${top}' (tool ${spec.toolName}) collides with a reserved top-level name`);
		}
		let node = root;
		for (let index = 0; index < path.length - 1; index += 1) {
		const segment = path[index];
		if (segment === undefined) {
		continue;
		}
		if (node.kind !== "route") {
		throw new RouteGenerationError(`Command path ${path.join(" ")} passes through leaf '${segment}'`);
		}
		const existing = node.children[segment];
		if (existing === undefined) {
		const created = { kind: "route", children: {} };
		node.children[segment] = created;
		node = created;
		continue;
		}
		node = existing;
		}
		const verb = path.at(-1);
		if (verb === undefined) {
		throw new RouteGenerationError(`Tool ${spec.toolName} produced an empty command path`);
		}
		if (node.kind !== "route") {
		throw new RouteGenerationError(`Command path ${path.join(" ")} cannot attach under a leaf`);
		}
		if (node.children[verb] !== undefined) {
		throw new RouteGenerationError(`Duplicate command '${path.join(" ")}' (tool ${spec.toolName})`);
		}
		node.children[verb] = { kind: "leaf", spec };
		};
		/**
		* THE generator. Deterministic and pure: same inputs -> byte-identical
		* `RouteNode`. Excludes tools annotated `excluded`, splits required-enum
		* discriminators into subcommands, maps every prop to a flag or `inputOnly`
		* per spec S3, and fails hard on any reserved-name or kebab collision.
		*/
		export const generateRouteMap = (listings, annotations) => {
		const root = { kind: "route", children: {} };
		for (const listing of listings) {
		const annotation = annotations[listing.name];
		if (annotation?.excluded === true) {
		continue;
		}
		for (const spec of leafSpecsForTool({ listing, annotation })) {
		insertLeaf(root, spec);
		}
		}
		return root;
		};
		//# sourceMappingURL=generate-route-map.js.map

+1

dist/generate-route-map.js.map

+1

dist/generated/cli-version.d.ts

export declare const CLI_VERSION = "0.1.0";

+6

dist/generated/cli-version.js

		// GENERATED by `bun run codegen`. Do not edit by hand.
		//
		// The running CLI's own version, baked in at codegen time so the update nudge
		// (spec 051 addendum) never reads package.json from the published dist.
		export const CLI_VERSION = "0.1.0";
		//# sourceMappingURL=cli-version.js.map

+1

dist/generated/cli-version.js.map

{"version":3,"file":"cli-version.js","sourceRoot":"","sources":["../../src/generated/cli-version.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AAExE,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC"}

dist/generated/registry-snapshot.json

Sorry, the diff of this file is too big to display

+2

dist/generated/resource-tree.d.ts

		import type { ResourceNode } from "../resource-types.js";
		export declare const generatedResourceTree: ResourceNode;

+32

dist/generated/resource-tree.js

		// GENERATED by `bun run codegen` (spec 051 S5.4). Do not edit by hand.
		//
		// The committed resource tree built from the MCP `resources/list` snapshot
		// through `generateResourceTree`. Regenerate after any resource change; drift
		// shows up here as a diff instead of a runtime surprise.
		export const generatedResourceTree = {
		kind: "route",
		children: {
		list: {
		kind: "leaf",
		spec: {
		kind: "list",
		commandPath: ["reference", "list"],
		},
		},
		show: {
		kind: "route",
		children: {
		"template-markers": {
		kind: "leaf",
		spec: {
		kind: "show",
		commandPath: ["reference", "show", "template-markers"],
		name: "template-markers",
		uri: "stella://reference/template-markers",
		},
		},
		},
		},
		},
		};
		//# sourceMappingURL=resource-tree.js.map

+1

dist/generated/resource-tree.js.map

{"version":3,"file":"resource-tree.js","sourceRoot":"","sources":["../../src/generated/resource-tree.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,yDAAyD;AAIzD,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE;QACR,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;aACnC;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,kBAAkB,EAAE;oBAClB,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,IAAI,EAAE,MAAM;wBACZ,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,kBAAkB,CAAC;wBACtD,IAAI,EAAE,kBAAkB;wBACxB,GAAG,EAAE,qCAAqC;qBAC3C;iBACF;aACF;SACF;KACF;CACF,CAAC"}

+2

dist/generated/route-map.d.ts

		import type { RouteNode } from "../route-types.js";
		export declare const generatedRouteMap: RouteNode;

dist/generated/route-map.js

Sorry, the diff of this file is too big to display

+1

dist/generated/route-map.js.map

{"version":3,"file":"route-map.js","sourceRoot":"","sources":["../../src/generated/route-map.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAI3C,MAAM,CAAC,MAAM,iBAAiB,GAAc;IAC1C,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;wBAC/B,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,SAAS;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,gFAAgF;iCACnF;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;oCACvB,WAAW,EAAE,qCAAqC;iCACnD;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,mCAAmC;oCAChD,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wEAAwE;oCAC1E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;wBAC/B,QAAQ,EAAE,aAAa;wBACvB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,qBAAqB;gCAC3B,IAAI,EAAE,mBAAmB;gCACzB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;gCAC5B,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,4DAA4D;iCAC/D;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qCAAqC;oCAClD,SAAS,EAAE,GAAG;iCACf;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,6EAA6E;iCAChF;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,2DAA2D;oCAC7D,SAAS,EAAE,EAAE;iCACd;gCACD,iBAAiB,EAAE;oCACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,kEAAkE;oCACpE,SAAS,EAAE,GAAG;iCACf;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;oCAC5B,WAAW,EACT,6FAA6F;iCAChG;6BACF;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;wBACjC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,+BAA+B;iCAC7C;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;wBACvC,QAAQ,EAAE,qBAAqB;wBAC/B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE;oCACJ,gBAAgB;oCAChB,kBAAkB;oCAClB,YAAY;oCACZ,SAAS;oCACT,gBAAgB;oCAChB,aAAa;oCACb,OAAO;oCACP,UAAU;oCACV,OAAO;iCACR;gCACD,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,wBAAwB;gCAC9B,IAAI,EAAE,sBAAsB;gCAC5B,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qBAAqB;iCACnC;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,kFAAkF;iCACrF;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE;wCACJ,gBAAgB;wCAChB,kBAAkB;wCAClB,YAAY;wCACZ,SAAS;wCACT,gBAAgB;wCAChB,aAAa;wCACb,OAAO;wCACP,UAAU;wCACV,OAAO;qCACR;oCACD,WAAW,EACT,iEAAiE;iCACpE;gCACD,oBAAoB,EAAE;oCACpB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,8DAA8D;iCACjE;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;aACF;SACF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;wBAClC,QAAQ,EAAE,uBAAuB;wBACjC,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,MAAM;wBAChB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,QAAQ;wBACf,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,cAAc;oCAC3B,SAAS,EAAE,GAAG;iCACf;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,uBAAuB;oCACpC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,EAAE;iCACZ;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iFAAiF;oCACnF,SAAS,EAAE,GAAG;iCACf;6BACF;4BACD,QAAQ,EAAE,CAAC,OAAO,CAAC;yBACpB;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;wBAC/B,QAAQ,EAAE,6BAA6B;wBACvC,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,IAAI;wBAClB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,WAAW;iCACzB;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,oEAAoE;oCACtE,SAAS,EAAE,GAAG;iCACf;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;wBACnC,QAAQ,EAAE,iBAAiB;wBAC3B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,SAAS;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,QAAQ;wBACf,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,cAAc;oCAC3B,SAAS,EAAE,GAAG;iCACf;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,uBAAuB;oCACpC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,EAAE;iCACZ;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,oDAAoD;oCACtD,SAAS,EAAE,GAAG;iCACf;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,sBAAsB;oCACnC,SAAS,EAAE,GAAG;iCACf;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,wBAAwB;oCACrC,SAAS,EAAE,CAAC;iCACb;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,yBAAyB;oCACtC,SAAS,EAAE,CAAC;iCACb;gCACD,aAAa,EAAE;oCACb,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,yBAAyB;oCACtC,SAAS,EAAE,GAAG;iCACf;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qBAAqB;oCAClC,SAAS,EAAE,EAAE;iCACd;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,kDAAkD;oCACpD,SAAS,EAAE,EAAE;iCACd;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,mDAAmD;oCACrD,SAAS,EAAE,EAAE;iCACd;6BACF;4BACD,QAAQ,EAAE,CAAC,OAAO,CAAC;yBACpB;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,wBAAwB;wBAClC,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,IAAI;wBAClB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,sBAAsB;iCACpC;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,2FAA2F;oCAC7F,SAAS,EAAE,GAAG;iCACf;6BACF;4BACD,QAAQ,EAAE,CAAC,aAAa,CAAC;yBAC1B;qBACF;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;wBAChC,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,YAAY;iCAC1B;6BACF;4BACD,QAAQ,EAAE,CAAC,YAAY,CAAC;yBACzB;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;wBAChC,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;gCAChC,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,gBAAgB;gCACtB,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,qBAAqB;gCAC3B,IAAI,EAAE,mBAAmB;gCACzB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,sCAAsC;iCACpD;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;oCAChC,WAAW,EAAE,sCAAsC;iCACpD;gCACD,YAAY,EAAE;oCACZ,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,+DAA+D;oCACjE,SAAS,EAAE,GAAG;iCACf;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,gCAAgC;oCAC7C,SAAS,EAAE,GAAG;iCACf;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,+BAA+B;oCAC5C,SAAS,EAAE,GAAG;iCACf;gCACD,iBAAiB,EAAE;oCACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,uCAAuC;oCACpD,SAAS,EAAE,GAAG;iCACf;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,qCAAqC;iCACnD;6BACF;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;wBAClC,QAAQ,EAAE,gBAAgB;wBAC1B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,sBAAsB;iCACpC;6BACF;4BACD,QAAQ,EAAE,CAAC,YAAY,CAAC;yBACzB;qBACF;iBACF;gBACD,iBAAiB,EAAE;oBACjB,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,SAAS,EAAE,iBAAiB,CAAC;wBAC3C,QAAQ,EAAE,0BAA0B;wBACpC,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE;oCACJ,MAAM;oCACN,OAAO;oCACP,iBAAiB;oCACjB,OAAO;oCACP,MAAM;oCACN,KAAK;oCACL,MAAM;oCACN,KAAK;oCACL,uBAAuB;oCACvB,MAAM;iCACP;gCACD,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE;wCACJ,MAAM;wCACN,OAAO;wCACP,iBAAiB;wCACjB,OAAO;wCACP,MAAM;wCACN,KAAK;wCACL,MAAM;wCACN,KAAK;wCACL,uBAAuB;wCACvB,MAAM;qCACP;oCACD,WAAW,EAAE,4BAA4B;iCAC1C;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wEAAwE;oCAC1E,SAAS,EAAE,GAAG;iCACf;6BACF;4BACD,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;yBAChC;qBACF;iBACF;aACF;SACF;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,mBAAmB,EAAE;oBACnB,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;wBAClD,QAAQ,EAAE,4BAA4B;wBACtC,KAAK,EAAE,EAAE;wBACT,SAAS,EAAE,CAAC,eAAe,CAAC;wBAC5B,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,YAAY;wBACnB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,aAAa,EAAE;oCACb,IAAI,EAAE,OAAO;oCACb,WAAW,EACT,0IAA0I;oCAC5I,QAAQ,EAAE,CAAC;oCACX,QAAQ,EAAE,EAAE;oCACZ,KAAK,EAAE;wCACL,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE;4CACV,WAAW,EAAE;gDACX,IAAI,EAAE,QAAQ;gDACd,WAAW,EAAE,iCAAiC;gDAC9C,IAAI,EAAE;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;oDACJ,IAAI;iDACL;6CACF;4CACD,SAAS,EAAE;gDACT,IAAI,EAAE,SAAS;gDACf,WAAW,EACT,yDAAyD;6CAC5D;yCACF;wCACD,QAAQ,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;qCACvC;iCACF;6BACF;4BACD,QAAQ,EAAE,CAAC,eAAe,CAAC;yBAC5B;qBACF;iBACF;gBACD,YAAY,EAAE;oBACZ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,mBAAmB,EAAE;4BACnB,MAAM,EAAE,YAAY;yBACrB;wBACD,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,qBAAqB,CAAC;oCAC5D,WAAW,EAAE,kCAAkC;iCAChD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sDAAsD;iCACzD;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iDAAiD;iCACpD;gCACD,qBAAqB,EAAE;oCACrB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,8EAA8E;oCAChF,SAAS,EAAE,GAAG;iCACf;gCACD,qBAAqB,EAAE;oCACrB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,yFAAyF;oCAC3F,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,CAAC;iCACX;gCACD,sBAAsB,EAAE;oCACtB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,qEAAqE;iCACxE;6BACF;4BACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;yBACrB;qBACF;iBACF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;wBAC9C,QAAQ,EAAE,qBAAqB;wBAC/B,mBAAmB,EAAE;4BACnB,MAAM,EAAE,eAAe;yBACxB;wBACD,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,qBAAqB,CAAC;oCAC5D,WAAW,EAAE,kCAAkC;iCAChD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sDAAsD;iCACzD;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iDAAiD;iCACpD;gCACD,qBAAqB,EAAE;oCACrB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,8EAA8E;oCAChF,SAAS,EAAE,GAAG;iCACf;gCACD,qBAAqB,EAAE;oCACrB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,yFAAyF;oCAC3F,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,CAAC;iCACX;gCACD,sBAAsB,EAAE;oCACtB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,qEAAqE;iCACxE;6BACF;4BACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;yBACrB;qBACF;iBACF;gBACD,iBAAiB,EAAE;oBACjB,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;wBAChD,QAAQ,EAAE,qBAAqB;wBAC/B,mBAAmB,EAAE;4BACnB,MAAM,EAAE,qBAAqB;yBAC9B;wBACD,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,yBAAyB;gCAC/B,IAAI,EAAE,uBAAuB;gCAC7B,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,yBAAyB;gCAC/B,IAAI,EAAE,uBAAuB;gCAC7B,IAAI,EAAE,KAAK;gCACX,GAAG,EAAE,CAAC;gCACN,GAAG,EAAE,CAAC;gCACN,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,0BAA0B;gCAChC,IAAI,EAAE,wBAAwB;gCAC9B,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,qBAAqB,CAAC;oCAC5D,WAAW,EAAE,kCAAkC;iCAChD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sDAAsD;iCACzD;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iDAAiD;iCACpD;gCACD,qBAAqB,EAAE;oCACrB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,8EAA8E;oCAChF,SAAS,EAAE,GAAG;iCACf;gCACD,qBAAqB,EAAE;oCACrB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,yFAAyF;oCAC3F,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,CAAC;iCACX;gCACD,sBAAsB,EAAE;oCACtB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,qEAAqE;iCACxE;6BACF;4BACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;yBACrB;qBACF;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,gBAAgB;wBAC1B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,WAAW;wBACrB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sEAAsE;iCACzE;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,0EAA0E;oCAC5E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,CAAC,QAAQ,CAAC;wBACrB,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4CAA4C;iCAC1D;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,6BAA6B;oCAC1C,oBAAoB,EAAE,IAAI;iCAC3B;6BACF;4BACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;yBACpC;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,CAAC,QAAQ,CAAC;wBACrB,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,gGAAgG;iCACnG;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,+CAA+C;oCAC5D,SAAS,EAAE,GAAG;iCACf;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,qHAAqH;iCACxH;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,OAAO;oCACb,WAAW,EACT,4dAA4d;oCAC9d,KAAK,EAAE;wCACL,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE;4CACV,IAAI,EAAE;gDACJ,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,sDAAsD;6CACzD;4CACD,KAAK,EAAE;gDACL,IAAI,EAAE,QAAQ;gDACd,WAAW,EAAE,4BAA4B;6CAC1C;4CACD,IAAI,EAAE;gDACJ,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,2DAA2D;6CAC9D;4CACD,SAAS,EAAE;gDACT,IAAI,EAAE,QAAQ;gDACd,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;gDACrD,WAAW,EAAE,oBAAoB;6CAClC;4CACD,QAAQ,EAAE;gDACR,IAAI,EAAE,SAAS;gDACf,WAAW,EAAE,6BAA6B;6CAC3C;4CACD,OAAO,EAAE;gDACP,IAAI,EAAE,OAAO;gDACb,KAAK,EAAE;oDACL,IAAI,EAAE,QAAQ;iDACf;gDACD,WAAW,EACT,2CAA2C;6CAC9C;4CACD,WAAW,EAAE;gDACX,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,2EAA2E;6CAC9E;4CACD,QAAQ,EAAE;gDACR,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,4EAA4E;6CAC/E;4CACD,OAAO,EAAE;gDACP,IAAI,EAAE,SAAS;gDACf,WAAW,EACT,+EAA+E;6CAClF;4CACD,OAAO,EAAE;gDACP,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,oFAAoF;6CACvF;4CACD,SAAS,EAAE;gDACT,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,kOAAkO;6CACrO;4CACD,KAAK,EAAE;gDACL,IAAI,EAAE,OAAO;gDACb,WAAW,EACT,4CAA4C;gDAC9C,KAAK,EAAE;oDACL,IAAI,EAAE,QAAQ;oDACd,oBAAoB,EAAE,IAAI;iDAC3B;6CACF;4CACD,MAAM,EAAE;gDACN,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,mEAAmE;6CACtE;4CACD,UAAU,EAAE;gDACV,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,8CAA8C;gDAChD,UAAU,EAAE;oDACV,MAAM,EAAE;wDACN,IAAI,EAAE,QAAQ;wDACd,WAAW,EACT,4CAA4C;qDAC/C;oDACD,KAAK,EAAE;wDACL,IAAI,EAAE,QAAQ;wDACd,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;wDACxC,WAAW,EAAE,YAAY;qDAC1B;iDACF;gDACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;6CAC9B;4CACD,MAAM,EAAE;gDACN,IAAI,EAAE,QAAQ;gDACd,WAAW,EAAE,qCAAqC;gDAClD,UAAU,EAAE;oDACV,QAAQ,EAAE;wDACR,IAAI,EAAE,QAAQ;wDACd,WAAW,EAAE,2BAA2B;qDACzC;oDACD,OAAO,EAAE;wDACP,IAAI,EAAE,OAAO;wDACb,WAAW,EACT,2EAA2E;wDAC7E,KAAK,EAAE;4DACL,IAAI,EAAE,QAAQ;4DACd,UAAU,EAAE;gEACV,GAAG,EAAE;oEACH,IAAI,EAAE,QAAQ;oEACd,WAAW,EACT,6CAA6C;iEAChD;gEACD,QAAQ,EAAE;oEACR,IAAI,EAAE,QAAQ;oEACd,WAAW,EACT,mDAAmD;iEACtD;6DACF;4DACD,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;yDAC9B;qDACF;iDACF;gDACD,QAAQ,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;6CAClC;yCACF;wCACD,QAAQ,EAAE,CAAC,MAAM,CAAC;wCAClB,oBAAoB,EAAE,KAAK;qCAC5B;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,gBAAgB;wBAC1B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;gCAC1B,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,WAAW;wBACrB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,0CAA0C;iCACxD;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;oCAC1B,WAAW,EACT,4QAA4Q;iCAC/Q;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iLAAiL;iCACpL;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,wBAAwB;oCACrC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,0EAA0E;oCAC5E,SAAS,EAAE,GAAG;iCACf;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,2BAA2B;gCACjC,IAAI,EAAE,yBAAyB;gCAC/B,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,oBAAoB;gCAC1B,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,mBAAmB;gCACzB,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,oBAAoB;iCAClC;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,gFAAgF;iCACnF;gCACD,uBAAuB,EAAE;oCACvB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,mGAAmG;iCACtG;gCACD,gBAAgB,EAAE;oCAChB,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,4CAA4C;iCAC1D;gCACD,eAAe,EAAE;oCACf,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,8EAA8E;oCAChF,SAAS,EAAE,GAAG;iCACf;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;gCAC5B,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,gBAAgB;gCACtB,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,iBAAiB;wBACxB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8CAA8C;iCAC5D;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,qEAAqE;iCACxE;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,qEAAqE;oCACvE,SAAS,EAAE,GAAG;iCACf;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,4GAA4G;iCAC/G;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;oCAC5B,WAAW,EACT,0EAA0E;iCAC7E;gCACD,YAAY,EAAE;oCACZ,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,oFAAoF;iCACvF;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,+FAA+F;iCAClG;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,oGAAoG;oCACtG,SAAS,EAAE,GAAG;iCACf;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,0GAA0G;oCAC5G,SAAS,EAAE,IAAI;iCAChB;6BACF;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;wBACnC,QAAQ,EAAE,iBAAiB;wBAC3B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,iBAAiB;wBACxB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8BAA8B;iCAC5C;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wDAAwD;iCAC3D;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE;wBACR,IAAI,EAAE;4BACJ,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,WAAW,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC;gCAC/C,QAAQ,EAAE,iBAAiB;gCAC3B,KAAK,EAAE;oCACL;wCACE,IAAI,EAAE,aAAa;wCACnB,IAAI,EAAE,WAAW;wCACjB,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE,KAAK;wCACjB,QAAQ,EAAE,IAAI;qCACf;iCACF;gCACD,SAAS,EAAE,EAAE;gCACb,SAAS,EAAE,IAAI;gCACf,YAAY,EAAE,KAAK;gCACnB,QAAQ,EAAE,YAAY;gCACtB,WAAW,EAAE,KAAK;gCAClB,KAAK,EAAE,MAAM;gCACb,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,SAAS,EAAE;4CACT,IAAI,EAAE,QAAQ;4CACd,WAAW,EAAE,4CAA4C;yCAC1D;wCACD,KAAK,EAAE;4CACL,IAAI,EAAE,SAAS;4CACf,WAAW,EAAE,0BAA0B;4CACvC,OAAO,EAAE,CAAC;4CACV,OAAO,EAAE,GAAG;yCACb;wCACD,MAAM,EAAE;4CACN,IAAI,EAAE,QAAQ;4CACd,WAAW,EACT,2EAA2E;4CAC7E,SAAS,EAAE,GAAG;yCACf;qCACF;oCACD,QAAQ,EAAE,CAAC,WAAW,CAAC;iCACxB;6BACF;yBACF;qBACF;iBACF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE;wBACR,GAAG,EAAE;4BACH,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,WAAW,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC;gCACzC,QAAQ,EAAE,iBAAiB;gCAC3B,KAAK,EAAE;oCACL;wCACE,IAAI,EAAE,aAAa;wCACnB,IAAI,EAAE,WAAW;wCACjB,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE,KAAK;wCACjB,QAAQ,EAAE,IAAI;qCACf;oCACD;wCACE,IAAI,EAAE,eAAe;wCACrB,IAAI,EAAE,aAAa;wCACnB,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE,KAAK;wCACjB,QAAQ,EAAE,IAAI;qCACf;iCACF;gCACD,SAAS,EAAE,CAAC,SAAS,CAAC;gCACtB,SAAS,EAAE,KAAK;gCAChB,YAAY,EAAE,KAAK;gCACnB,WAAW,EAAE,KAAK;gCAClB,KAAK,EAAE,iBAAiB;gCACxB,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,SAAS,EAAE;4CACT,IAAI,EAAE,QAAQ;4CACd,WAAW,EAAE,sCAAsC;yCACpD;wCACD,WAAW,EAAE;4CACX,IAAI,EAAE,QAAQ;4CACd,WAAW,EACT,6CAA6C;yCAChD;wCACD,OAAO,EAAE;4CACP,IAAI,EAAE,QAAQ;4CACd,WAAW,EACT,mDAAmD;4CACrD,UAAU,EAAE;gDACV,IAAI,EAAE;oDACJ,IAAI,EAAE,QAAQ;oDACd,IAAI,EAAE;wDACJ,MAAM;wDACN,eAAe;wDACf,cAAc;wDACd,MAAM;wDACN,KAAK;qDACN;oDACD,WAAW,EACT,kDAAkD;iDACrD;gDACD,KAAK,EAAE;oDACL,WAAW,EACT,mLAAmL;iDACtL;gDACD,QAAQ,EAAE;oDACR,IAAI,EAAE,QAAQ;oDACd,WAAW,EACT,0DAA0D;oDAC5D,SAAS,EAAE,CAAC;iDACb;6CACF;4CACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;yCAC5B;qCACF;oCACD,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC;iCAClD;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;wBAC7B,QAAQ,EAAE,YAAY;wBACtB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,OAAO;wBACjB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wEAAwE;iCAC3E;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,kCAAkC;iCAChD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,4DAA4D;oCAC9D,SAAS,EAAE,EAAE;iCACd;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,6DAA6D;oCAC/D,SAAS,EAAE,EAAE;iCACd;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,kCAAkC;oCAC/C,SAAS,EAAE,EAAE;iCACd;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,qBAAqB;oCAClC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sEAAsE;oCACxE,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;wBAC7B,QAAQ,EAAE,WAAW;wBACrB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,wBAAwB;gCAC9B,IAAI,EAAE,sBAAsB;gCAC5B,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,2BAA2B;gCACjC,IAAI,EAAE,yBAAyB;gCAC/B,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,gBAAgB;gCACtB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,gBAAgB;gCACtB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,0CAA0C;iCACxD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,mEAAmE;iCACtE;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,mCAAmC;oCAChD,SAAS,EAAE,GAAG;iCACf;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4CAA4C;oCACzD,SAAS,EAAE,EAAE;iCACd;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8CAA8C;oCAC3D,SAAS,EAAE,EAAE;iCACd;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,+CAA+C;oCAC5D,SAAS,EAAE,EAAE;iCACd;gCACD,oBAAoB,EAAE;oCACpB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,4DAA4D;iCAC/D;gCACD,uBAAuB,EAAE;oCACvB,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,mCAAmC;iCACjD;gCACD,cAAc,EAAE;oCACd,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,mEAAmE;iCACtE;gCACD,cAAc,EAAE;oCACd,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,0BAA0B;iCACxC;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;wBAC/B,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,sBAAsB;gCAC5B,IAAI,EAAE,oBAAoB;gCAC1B,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,SAAS;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,2CAA2C;iCACzD;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,0EAA0E;iCAC7E;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,yDAAyD;iCAC5D;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,gEAAgE;iCACnE;gCACD,kBAAkB,EAAE;oCAClB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,8DAA8D;iCACjE;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,uBAAuB;oCACpC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wEAAwE;oCAC1E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;wBAC/B,QAAQ,EAAE,aAAa;wBACvB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,oBAAoB;gCAC1B,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;wBAC/B,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,iBAAiB;wBACxB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qCAAqC;iCACnD;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,sCAAsC;oCACnD,SAAS,EAAE,GAAG;iCACf;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,OAAO;oCACb,WAAW,EACT,8GAA8G;oCAChH,KAAK,EAAE;wCACL,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE;4CACV,IAAI,EAAE;gDACJ,IAAI,EAAE,QAAQ;gDACd,WAAW,EAAE,sBAAsB;6CACpC;4CACD,KAAK,EAAE;gDACL,IAAI,EAAE,QAAQ;gDACd,WAAW,EAAE,+BAA+B;6CAC7C;4CACD,KAAK,EAAE;gDACL,IAAI,EAAE,SAAS;gDACf,WAAW,EAAE,gCAAgC;6CAC9C;4CACD,IAAI,EAAE;gDACJ,IAAI,EAAE,OAAO;gDACb,WAAW,EACT,0EAA0E;gDAC5E,KAAK,EAAE;oDACL,IAAI,EAAE,QAAQ;oDACd,UAAU,EAAE;wDACV,IAAI,EAAE;4DACJ,IAAI,EAAE,QAAQ;4DACd,WAAW,EAAE,UAAU;yDACxB;wDACD,IAAI,EAAE;4DACJ,IAAI,EAAE,SAAS;4DACf,WAAW,EAAE,qBAAqB;yDACnC;wDACD,MAAM,EAAE;4DACN,IAAI,EAAE,SAAS;4DACf,WAAW,EAAE,uBAAuB;yDACrC;qDACF;oDACD,QAAQ,EAAE,CAAC,MAAM,CAAC;iDACnB;6CACF;4CACD,QAAQ,EAAE;gDACR,IAAI,EAAE,QAAQ;gDACd,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;gDAC3B,WAAW,EACT,kDAAkD;6CACrD;4CACD,SAAS,EAAE;gDACT,IAAI,EAAE,SAAS;gDACf,WAAW,EACT,4CAA4C;6CAC/C;4CACD,WAAW,EAAE;gDACX,IAAI,EAAE,SAAS;gDACf,WAAW,EACT,sDAAsD;6CACzD;4CACD,aAAa,EAAE;gDACb,IAAI,EAAE,QAAQ;gDACd,IAAI,EAAE;oDACJ,IAAI;oDACJ,QAAQ;oDACR,MAAM;oDACN,OAAO;oDACP,MAAM;oDACN,SAAS;iDACV;gDACD,WAAW,EAAE,wCAAwC;6CACtD;4CACD,mBAAmB,EAAE;gDACnB,IAAI,EAAE,QAAQ;gDACd,WAAW,EACT,+CAA+C;6CAClD;yCACF;wCACD,QAAQ,EAAE,CAAC,MAAM,CAAC;qCACnB;iCACF;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,0DAA0D;iCAC7D;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,wDAAwD;oCAC1D,SAAS,EAAE,EAAE;iCACd;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,8CAA8C;oCAC3D,SAAS,EAAE,IAAI;iCAChB;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,wDAAwD;oCAC1D,SAAS,EAAE,IAAI;iCAChB;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,+CAA+C;oCAC5D,oBAAoB,EAAE,IAAI;iCAC3B;gCACD,gBAAgB,EAAE;oCAChB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,2DAA2D;iCAC9D;6BACF;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;wBACjC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,iBAAiB;wBACxB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qBAAqB;iCACnC;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,CAAC;yBACxB;qBACF;iBACF;aACF;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;wBACjC,QAAQ,EAAE,gBAAgB;wBAC1B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,OAAO;wBACjB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,uDAAuD;iCAC1D;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,yBAAyB;oCACtC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,0EAA0E;oCAC5E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;gBACD,GAAG,EAAE;oBACH,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;wBAChC,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,iBAAiB;wBACxB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8CAA8C;iCAC5D;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,oBAAoB;iCAClC;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;yBACvC;qBACF;iBACF;aACF;SACF;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;wBACnC,QAAQ,EAAE,mBAAmB;wBAC7B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;gCACpD,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,SAAS;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,qFAAqF;iCACxF;gCACD,aAAa,EAAE;oCACb,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,iCAAiC;iCAC/C;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,gGAAgG;iCACnG;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,yCAAyC;iCACvD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iEAAiE;oCACnE,SAAS,EAAE,EAAE;iCACd;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,kEAAkE;oCACpE,SAAS,EAAE,EAAE;iCACd;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC;oCACpD,WAAW,EAAE,oCAAoC;iCAClD;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,uBAAuB;oCACpC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,6EAA6E;oCAC/E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;wBACnC,QAAQ,EAAE,iBAAiB;wBAC3B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,oBAAoB;gCAC1B,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,KAAK;gCACX,GAAG,EAAE,CAAC;gCACN,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,KAAK;gCACX,GAAG,EAAE,CAAC;gCACN,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,qBAAqB;gCAC3B,IAAI,EAAE,mBAAmB;gCACzB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,iBAAiB;gCACvB,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;gCAC3B,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,aAAa,EAAE;oCACb,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,yCAAyC;iCACvD;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,oEAAoE;iCACvE;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iKAAiK;iCACpK;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iEAAiE;oCACnE,SAAS,EAAE,EAAE;iCACd;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,+FAA+F;oCACjG,SAAS,EAAE,EAAE;iCACd;gCACD,gBAAgB,EAAE;oCAChB,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,wDAAwD;oCAC1D,OAAO,EAAE,CAAC;iCACX;gCACD,aAAa,EAAE;oCACb,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,kFAAkF;oCACpF,OAAO,EAAE,CAAC;iCACX;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,oDAAoD;oCACtD,SAAS,EAAE,CAAC;iCACb;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,iDAAiD;oCACnD,SAAS,EAAE,KAAK;iCACjB;gCACD,iBAAiB,EAAE;oCACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EACT,6FAA6F;oCAC/F,SAAS,EAAE,KAAK;iCACjB;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,6CAA6C;iCAC3D;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,0EAA0E;iCAC7E;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,2CAA2C;oCACxD,SAAS,EAAE,EAAE;iCACd;gCACD,aAAa,EAAE;oCACb,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;oCACxB,WAAW,EAAE,+CAA+C;oCAC5D,SAAS,EAAE,EAAE;iCACd;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;oCAC3B,WAAW,EACT,mDAAmD;iCACtD;6BACF;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;wBACrC,QAAQ,EAAE,mBAAmB;wBAC7B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,IAAI;wBACjB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,aAAa,EAAE;oCACb,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,sCAAsC;iCACpD;6BACF;4BACD,QAAQ,EAAE,CAAC,eAAe,CAAC;yBAC5B;qBACF;iBACF;aACF;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;wBAChC,QAAQ,EAAE,cAAc;wBACxB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,IAAI;6BACf;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,4CAA4C;iCAC1D;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,iCAAiC;iCAC/C;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8CAA8C;oCAC3D,SAAS,EAAE,EAAE;iCACd;6BACF;4BACD,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;yBAC3C;qBACF;iBACF;aACF;SACF;QACD,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;wBAChC,QAAQ,EAAE,eAAe;wBACzB,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,UAAU;wBACpB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,8EAA8E;iCACjF;gCACD,UAAU,EAAE;oCACV,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8BAA8B;iCAC5C;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,wBAAwB;oCACrC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,yEAAyE;oCAC3E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;wBAC7B,QAAQ,EAAE,WAAW;wBACrB,KAAK,EAAE,EAAE;wBACT,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;wBACnB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,EAAE;yBACf;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,MAAM,EAAE;oBACN,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;wBACtC,QAAQ,EAAE,oBAAoB;wBAC9B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,mBAAmB;gCACzB,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,oBAAoB;gCAC1B,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,YAAY;gCAClB,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE;oCACJ,UAAU;oCACV,YAAY;oCACZ,WAAW;oCACX,aAAa;oCACb,KAAK;iCACN;gCACD,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,OAAO;wBACjB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,MAAM;wBACb,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,gDAAgD;oCAC7D,SAAS,EAAE,GAAG;iCACf;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qCAAqC;oCAClD,SAAS,EAAE,GAAG;iCACf;gCACD,eAAe,EAAE;oCACf,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,0CAA0C;oCACvD,SAAS,EAAE,EAAE;iCACd;gCACD,gBAAgB,EAAE;oCAChB,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sDAAsD;oCACxD,SAAS,EAAE,EAAE;iCACd;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8CAA8C;oCAC3D,SAAS,EAAE,EAAE;iCACd;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sDAAsD;oCACxD,SAAS,EAAE,CAAC;iCACb;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,uDAAuD;oCACzD,SAAS,EAAE,CAAC;iCACb;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,8BAA8B;oCAC3C,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,yEAAyE;oCAC3E,SAAS,EAAE,CAAC;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wEAAwE;iCAC3E;gCACD,QAAQ,EAAE;oCACR,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,wEAAwE;oCAC1E,SAAS,EAAE,GAAG;iCACf;gCACD,aAAa,EAAE;oCACb,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE;wCACJ,UAAU;wCACV,YAAY;wCACZ,WAAW;wCACX,aAAa;wCACb,KAAK;qCACN;oCACD,WAAW,EACT,8EAA8E;iCACjF;gCACD,SAAS,EAAE;oCACT,IAAI,EAAE,SAAS;oCACf,WAAW,EACT,6EAA6E;iCAChF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,WAAW,EAAE;YACX,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE;gBACR,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;wBAClC,QAAQ,EAAE,gBAAgB;wBAC1B,KAAK,EAAE;4BACL;gCACE,IAAI,EAAE,gBAAgB;gCACtB,IAAI,EAAE,cAAc;gCACpB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,UAAU;gCAChB,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,iBAAiB;gCACvB,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,eAAe;gCACrB,IAAI,EAAE,aAAa;gCACnB,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,WAAW;gCACjB,IAAI,EAAE,SAAS;gCACf,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;4BACD;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,IAAI;gCACV,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE,KAAK;gCACjB,QAAQ,EAAE,KAAK;6BAChB;yBACF;wBACD,SAAS,EAAE,EAAE;wBACb,SAAS,EAAE,IAAI;wBACf,YAAY,EAAE,KAAK;wBACnB,QAAQ,EAAE,OAAO;wBACjB,WAAW,EAAE,KAAK;wBAClB,KAAK,EAAE,YAAY;wBACnB,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,8CAA8C;iCAC5D;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,qCAAqC;iCACnD;gCACD,aAAa,EAAE;oCACb,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,uCAAuC;iCACrD;gCACD,WAAW,EAAE;oCACX,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,6DAA6D;iCAChE;gCACD,OAAO,EAAE;oCACP,IAAI,EAAE,QAAQ;oCACd,WAAW,EAAE,uCAAuC;iCACrD;gCACD,IAAI,EAAE;oCACJ,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,qDAAqD;oCACvD,SAAS,EAAE,EAAE;iCACd;gCACD,EAAE,EAAE;oCACF,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,sDAAsD;oCACxD,SAAS,EAAE,EAAE;iCACd;gCACD,KAAK,EAAE;oCACL,IAAI,EAAE,SAAS;oCACf,WAAW,EAAE,uBAAuB;oCACpC,OAAO,EAAE,CAAC;oCACV,OAAO,EAAE,GAAG;iCACb;gCACD,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,WAAW,EACT,0EAA0E;oCAC5E,SAAS,EAAE,GAAG;iCACf;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF;CACF,CAAC"}

+15

dist/json-schema-validate.d.ts

		type JsonSchema = Record<string, unknown>;
		/** A validation outcome: valid, or the failing JSON path plus a message. */
		export type ValidationResult = {
		valid: true;
		} \| {
		valid: false;
		path: string;
		message: string;
		};
		/**
		* Validate `data` against a tool's `inputSchema` in interpreted mode. The root
		* schema is always an object schema (`{ type: "object", properties }`).
		*/
		export declare const validateAgainstSchema: (schema: JsonSchema, data: unknown) => ValidationResult;
		export {};

+132

dist/json-schema-validate.js

		// Interpreted JSON-Schema validator for the `--input` escape hatch (spec 051
		// S5.5 rule 1): it walks the schema and the data recursively, with NO
		// `Function`/`eval`/dynamic code generation. Scoped to exactly the shapes the
		// MCP prop builders emit (string, nullable-string, integer/number with
		// min/max, enum, boolean, array + items, object + properties, free map). A
		// hand-rolled walker is simpler and lighter than a general-purpose library for
		// this closed shape set, and it structurally cannot run generated code.
		const ok = { valid: true };
		const fail = (path, message) => ({
		valid: false,
		path: path === "" ? "(root)" : path,
		message,
		});
		const schemaTypes = (schema) => {
		const rawType = schema["type"];
		if (Array.isArray(rawType)) {
		return rawType.filter((t) => typeof t === "string");
		}
		return typeof rawType === "string" ? [rawType] : [];
		};
		const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		const enumValues = (schema) => Array.isArray(schema["enum"]) ? schema["enum"] : undefined;
		const validateString = (schema, value, path) => {
		const maxLength = schema["maxLength"];
		if (typeof maxLength === "number" && value.length > maxLength) {
		return fail(path, `string longer than maxLength ${maxLength}`);
		}
		return ok;
		};
		const validateNumber = (schema, value, path, integer) => {
		if (integer && !Number.isInteger(value)) {
		return fail(path, "expected an integer");
		}
		const minimum = schema["minimum"];
		if (typeof minimum === "number" && value < minimum) {
		return fail(path, `number below minimum ${minimum}`);
		}
		const maximum = schema["maximum"];
		if (typeof maximum === "number" && value > maximum) {
		return fail(path, `number above maximum ${maximum}`);
		}
		return ok;
		};
		const validateArray = (schema, value, path) => {
		const minItems = schema["minItems"];
		if (typeof minItems === "number" && value.length < minItems) {
		return fail(path, `array shorter than minItems ${minItems}`);
		}
		const maxItems = schema["maxItems"];
		if (typeof maxItems === "number" && value.length > maxItems) {
		return fail(path, `array longer than maxItems ${maxItems}`);
		}
		const items = schema["items"];
		if (isPlainObject(items)) {
		for (const [index, element] of value.entries()) {
		const result = validateValue(items, element, `${path}[${index}]`);
		if (!result.valid) {
		return result;
		}
		}
		}
		return ok;
		};
		const validateObject = (schema, value, path) => {
		const properties = isPlainObject(schema["properties"])
		? schema["properties"]
		: {};
		const allowsAdditional = schema["additionalProperties"] === true;
		const required = Array.isArray(schema["required"]) ? schema["required"] : [];
		for (const key of required) {
		if (typeof key === "string" && value[key] === undefined) {
		return fail(path === "" ? key : `${path}.${key}`, "missing required property");
		}
		}
		for (const [key, child] of Object.entries(value)) {
		const childSchema = properties[key];
		const childPath = path === "" ? key : `${path}.${key}`;
		if (isPlainObject(childSchema)) {
		const result = validateValue(childSchema, child, childPath);
		if (!result.valid) {
		return result;
		}
		continue;
		}
		if (!allowsAdditional && Object.keys(properties).length > 0) {
		return fail(childPath, "unknown property");
		}
		}
		return ok;
		};
		const validateValue = (schema, value, path) => {
		const values = enumValues(schema);
		if (values && !values.includes(value)) {
		return fail(path, `value is not one of ${JSON.stringify(values)}`);
		}
		const types = schemaTypes(schema);
		if (types.length === 0) {
		// A schema with no `type` (e.g. set_field_value.content.value) accepts any
		// JSON value; only its enum (checked above) constrains it.
		return ok;
		}
		if (value === null) {
		return types.includes("null")
		? ok
		: fail(path, `null is not allowed (expected ${types.join("\|")})`);
		}
		if (types.includes("string") && typeof value === "string") {
		return validateString(schema, value, path);
		}
		if (types.includes("integer") && typeof value === "number") {
		return validateNumber(schema, value, path, true);
		}
		if (types.includes("number") && typeof value === "number") {
		return validateNumber(schema, value, path, false);
		}
		if (types.includes("boolean") && typeof value === "boolean") {
		return ok;
		}
		if (types.includes("array") && Array.isArray(value)) {
		return validateArray(schema, value, path);
		}
		if (types.includes("object") && isPlainObject(value)) {
		return validateObject(schema, value, path);
		}
		return fail(path, `expected ${types.join("\|")}`);
		};
		/**
		* Validate `data` against a tool's `inputSchema` in interpreted mode. The root
		* schema is always an object schema (`{ type: "object", properties }`).
		*/
		export const validateAgainstSchema = (schema, data) => validateValue(schema, data, "");
		//# sourceMappingURL=json-schema-validate.js.map

+1

dist/json-schema-validate.js.map

+98

dist/mcp-client.d.ts

		import { Result } from "better-result";
		import { CliBaseError } from "./auth/errors.js";
		/** One text content block of a `CallToolResult`. */
		export type ToolResultContent = {
		type: string;
		text: string;
		};
		/** The `tools/call` result envelope (a success envelope even when isError). */
		export type CallToolResult = {
		content: readonly ToolResultContent[];
		isError?: boolean;
		};
		/** One tool as returned by `tools/list` (the four wire fields). */
		export type ListedTool = {
		name: string;
		description?: string;
		inputSchema: Record<string, unknown>;
		annotations?: {
		readOnlyHint?: boolean;
		destructiveHint?: boolean;
		};
		};
		export type ListToolsResult = {
		tools: readonly unknown[];
		};
		/** One `content` block of a `resources/read` result. */
		export type ResourceContent = {
		uri?: string;
		mimeType?: string;
		text?: string;
		};
		/** The `resources/read` result envelope. */
		export type ReadResourceResult = {
		contents: readonly ResourceContent[];
		};
		/**
		* A transport/HTTP/protocol failure. The three tiers (spec 051 S0/S4) are
		* carried on `kind` so the exit-code mapping can distinguish them:
		* - `transport`: fetch threw / timed out / body was not JSON
		* - `http`: non-2xx HTTP status (401/403/404/5xx)
		* - `rpc`: a JSON-RPC protocol error object (`error.code`)
		*
		* An application-level tool error (`isError: true`, HTTP 200) is NOT this: it
		* comes back as a normal `CallToolResult` for the output layer to surface.
		*/
		export declare class McpClientError extends CliBaseError<"McpClientError"> {
		readonly name = "McpClientError";
		readonly kind: "transport" \| "http" \| "rpc";
		readonly httpStatus?: number;
		readonly rpcCode?: number;
		constructor(props: {
		message: string;
		kind: "transport" \| "http" \| "rpc";
		httpStatus?: number;
		rpcCode?: number;
		});
		}
		/** Invoke a tool via `tools/call`. `isError:true` results come back as success. */
		export declare const callTool: ({ serverUrl, token, name, args, }: {
		serverUrl: string;
		token: string;
		name: string;
		args: Record<string, unknown>;
		}) => Promise<Result<CallToolResult, McpClientError>>;
		/** Enumerate the server's tools via `tools/list`. */
		export declare const listTools: ({ serverUrl, token, }: {
		serverUrl: string;
		token: string;
		}) => Promise<Result<ListToolsResult, McpClientError>>;
		/** The raw `tools/list` body plus the CLI-version headers riding on it. */
		export type RawToolsList = {
		rawBody: string;
		cliLatest?: string;
		cliMinimum?: string;
		};
		/**
		* Fetch the raw `tools/list` response body (spec S5.5). The runtime trust
		* boundary hashes and validates the exact bytes the server returned, so this
		* returns the unparsed text rather than a decoded envelope, plus the advertised
		* CLI-version headers (spec 051 addendum) for the update nudge.
		*/
		export declare const fetchToolsListRaw: ({ serverUrl, token, }: {
		serverUrl: string;
		token: string;
		}) => Promise<Result<RawToolsList, McpClientError>>;
		/** Enumerate the server's static resources via `resources/list`. */
		export declare const listResources: ({ serverUrl, token, }: {
		serverUrl: string;
		token: string;
		}) => Promise<Result<{
		resources: readonly unknown[];
		}, McpClientError>>;
		/** Read one resource by URI via `resources/read`. */
		export declare const readResource: ({ serverUrl, token, uri, }: {
		serverUrl: string;
		token: string;
		uri: string;
		}) => Promise<Result<ReadResourceResult, McpClientError>>;

+277

dist/mcp-client.js

		// Minimal hand-rolled JSON-RPC 2.0 client for the stella MCP endpoint (spec 051
		// S0). The server runs the SDK transport in stateless JSON mode
		// (`enableJsonResponse: true`) with no `initialize` handshake required, so a
		// bare `tools/call`/`tools/list` POST works. We do not depend on
		// `@modelcontextprotocol/sdk`: the client only ever plumbs these two methods.
		//
		// The bearer token is NEVER logged or embedded in an error message.
		import { Result } from "better-result";
		import { CliBaseError } from "./auth/errors.js";
		import { MCP_HTTP_PATH } from "./mcp-constants.js";
		// `tools/call` can drive a long server operation (e.g. fill_template), so it
		// keeps a generous ceiling. The `tools/list` metadata fetch, by contrast, runs
		// on the startup refresh path and is awaited before the command executes, so a
		// tighter ceiling bounds how long an offline/slow client stalls before it falls
		// back to the baked-in tree.
		const REQUEST_TIMEOUT_MS = 30_000;
		const LIST_REQUEST_TIMEOUT_MS = 10_000;
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		/**
		* A transport/HTTP/protocol failure. The three tiers (spec 051 S0/S4) are
		* carried on `kind` so the exit-code mapping can distinguish them:
		* - `transport`: fetch threw / timed out / body was not JSON
		* - `http`: non-2xx HTTP status (401/403/404/5xx)
		* - `rpc`: a JSON-RPC protocol error object (`error.code`)
		*
		* An application-level tool error (`isError: true`, HTTP 200) is NOT this: it
		* comes back as a normal `CallToolResult` for the output layer to surface.
		*/
		export class McpClientError extends CliBaseError {
		name = "McpClientError";
		kind;
		httpStatus;
		rpcCode;
		constructor(props) {
		super("McpClientError", props.message);
		this.kind = props.kind;
		if (props.httpStatus !== undefined) {
		this.httpStatus = props.httpStatus;
		}
		if (props.rpcCode !== undefined) {
		this.rpcCode = props.rpcCode;
		}
		}
		}
		const mcpUrl = (serverUrl) => new URL(MCP_HTTP_PATH, `${serverUrl.replace(/\/$/u, "")}/`).toString();
		const callRpc = async ({ serverUrl, token, method, params, }) => {
		const body = { jsonrpc: "2.0", id: 1, method, params };
		const response = await Result.tryPromise({
		try: async () => await fetch(mcpUrl(serverUrl), {
		method: "POST",
		headers: {
		"Content-Type": "application/json",
		// Both required or the streamable-HTTP transport answers 406.
		Accept: "application/json, text/event-stream",
		Authorization: `Bearer ${token}`,
		},
		body: JSON.stringify(body),
		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
		}),
		catch: (cause) => cause,
		});
		if (Result.isError(response)) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: `Request to the MCP server failed: ${response.error instanceof Error
		? response.error.message
		: "network error"}`,
		}));
		}
		const httpResponse = response.value;
		const rawText = await Result.tryPromise({
		try: async () => await httpResponse.text(),
		catch: (cause) => cause,
		});
		const text = Result.isOk(rawText) ? rawText.value : "";
		if (!httpResponse.ok) {
		return Result.err(new McpClientError({
		kind: "http",
		httpStatus: httpResponse.status,
		message: `MCP server returned HTTP ${httpResponse.status}${text ? `: ${text.slice(0, 500)}` : ""}`,
		}));
		}
		const parsed = Result.try(() => JSON.parse(text));
		if (Result.isError(parsed)) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "MCP server returned a non-JSON response body",
		}));
		}
		const envelope = parsed.value;
		if (!isRecord(envelope)) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "MCP server returned an unexpected response envelope",
		}));
		}
		const errorField = envelope["error"];
		if (isRecord(errorField)) {
		const rawCode = errorField["code"];
		const code = typeof rawCode === "number" ? rawCode : undefined;
		const rawMessage = errorField["message"];
		const message = typeof rawMessage === "string" ? rawMessage : "MCP protocol error";
		return Result.err(new McpClientError({
		kind: "rpc",
		...(code === undefined ? {} : { rpcCode: code }),
		message,
		}));
		}
		if (!("result" in envelope)) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "MCP response envelope had neither result nor error",
		}));
		}
		return Result.ok(envelope["result"]);
		};
		const isCallToolResult = (value) => typeof value === "object" &&
		value !== null &&
		"content" in value &&
		Array.isArray(value.content);
		/** Invoke a tool via `tools/call`. `isError:true` results come back as success. */
		export const callTool = async ({ serverUrl, token, name, args, }) => {
		const result = await callRpc({
		serverUrl,
		token,
		method: "tools/call",
		params: { name, arguments: args },
		});
		if (Result.isError(result)) {
		return Result.err(result.error);
		}
		if (!isCallToolResult(result.value)) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "tools/call returned an unexpected result shape",
		}));
		}
		return Result.ok(result.value);
		};
		/** Enumerate the server's tools via `tools/list`. */
		export const listTools = async ({ serverUrl, token, }) => {
		const result = await callRpc({
		serverUrl,
		token,
		method: "tools/list",
		params: {},
		});
		if (Result.isError(result)) {
		return Result.err(result.error);
		}
		const value = result.value;
		if (!isRecord(value) \|\| !Array.isArray(value["tools"])) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "tools/list returned an unexpected result shape",
		}));
		}
		return Result.ok({ tools: value["tools"] });
		};
		/** Header names carrying the advertised/minimum CLI version (spec 051 addendum). */
		const CLI_LATEST_HEADER = "x-stella-cli-latest";
		const CLI_MINIMUM_HEADER = "x-stella-cli-minimum";
		/**
		* Fetch the raw `tools/list` response body (spec S5.5). The runtime trust
		* boundary hashes and validates the exact bytes the server returned, so this
		* returns the unparsed text rather than a decoded envelope, plus the advertised
		* CLI-version headers (spec 051 addendum) for the update nudge.
		*/
		export const fetchToolsListRaw = async ({ serverUrl, token, }) => {
		const body = {
		jsonrpc: "2.0",
		id: 1,
		method: "tools/list",
		params: {},
		};
		const response = await Result.tryPromise({
		try: async () => await fetch(mcpUrl(serverUrl), {
		method: "POST",
		headers: {
		"Content-Type": "application/json",
		Accept: "application/json, text/event-stream",
		Authorization: `Bearer ${token}`,
		},
		body: JSON.stringify(body),
		signal: AbortSignal.timeout(LIST_REQUEST_TIMEOUT_MS),
		}),
		catch: (cause) => cause,
		});
		if (Result.isError(response)) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: `Request to the MCP server failed: ${response.error instanceof Error
		? response.error.message
		: "network error"}`,
		}));
		}
		const httpResponse = response.value;
		const rawText = await Result.tryPromise({
		try: async () => await httpResponse.text(),
		catch: (cause) => cause,
		});
		const text = Result.isOk(rawText) ? rawText.value : "";
		if (!httpResponse.ok) {
		return Result.err(new McpClientError({
		kind: "http",
		httpStatus: httpResponse.status,
		message: `MCP server returned HTTP ${httpResponse.status}`,
		}));
		}
		const out = { rawBody: text };
		const cliLatest = httpResponse.headers.get(CLI_LATEST_HEADER);
		if (cliLatest !== null) {
		out.cliLatest = cliLatest;
		}
		const cliMinimum = httpResponse.headers.get(CLI_MINIMUM_HEADER);
		if (cliMinimum !== null) {
		out.cliMinimum = cliMinimum;
		}
		return Result.ok(out);
		};
		/** Enumerate the server's static resources via `resources/list`. */
		export const listResources = async ({ serverUrl, token, }) => {
		const result = await callRpc({
		serverUrl,
		token,
		method: "resources/list",
		params: {},
		});
		if (Result.isError(result)) {
		return Result.err(result.error);
		}
		const value = result.value;
		if (!isRecord(value) \|\| !Array.isArray(value["resources"])) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "resources/list returned an unexpected result shape",
		}));
		}
		return Result.ok({ resources: value["resources"] });
		};
		/** Read one resource by URI via `resources/read`. */
		export const readResource = async ({ serverUrl, token, uri, }) => {
		const result = await callRpc({
		serverUrl,
		token,
		method: "resources/read",
		params: { uri },
		});
		if (Result.isError(result)) {
		return Result.err(result.error);
		}
		const value = result.value;
		if (!isRecord(value) \|\| !Array.isArray(value["contents"])) {
		return Result.err(new McpClientError({
		kind: "transport",
		message: "resources/read returned an unexpected result shape",
		}));
		}
		const contents = [];
		for (const entry of value["contents"]) {
		if (isRecord(entry)) {
		const content = {};
		if (typeof entry["uri"] === "string") {
		content.uri = entry["uri"];
		}
		if (typeof entry["mimeType"] === "string") {
		content.mimeType = entry["mimeType"];
		}
		if (typeof entry["text"] === "string") {
		content.text = entry["text"];
		}
		contents.push(content);
		}
		}
		return Result.ok({ contents });
		};
		//# sourceMappingURL=mcp-client.js.map

+1

dist/mcp-client.js.map

+26

dist/mcp-constants.d.ts

		/** The MCP JSON-RPC endpoint path, mirroring the server's `MCP_HTTP_PATH`. */
		export declare const MCP_HTTP_PATH = "/mcp";
		/** `--all` cursor-following ceilings (spec 051 S4). Bounded, moved client-side. */
		export declare const MAX_ALL_PAGES = 50;
		export declare const MAX_ALL_ITEMS = 10000;
		export declare const MAX_ALL_BYTES: number;
		/**
		* Machine codes a tool `isError` payload may carry to identify a disabled
		* `FEATURE_*` gate (spec 051 S4, exit 5). `feature` is not on the wire and is
		* per-org server state, so the CLI never gates a command client-side; it only
		* upgrades the exit class from 4 to 5 when the server tags the failure with one
		* of these codes. Until the server tags it, a feature error stays exit 4.
		*/
		export declare const FEATURE_DISABLED_ERROR_CODES: ReadonlySet<string>;
		/** Exit-code classes (spec 051 S4), distinct per failure class. */
		export declare const EXIT_CODES: {
		readonly ok: 0;
		readonly unexpected: 1;
		readonly validation: 2;
		readonly auth: 3;
		readonly server: 4;
		readonly featureDisabled: 5;
		readonly notFound: 6;
		readonly aborted: 7;
		};
		export type ExitCode = (typeof EXIT_CODES)[keyof typeof EXIT_CODES];

+30

dist/mcp-constants.js

		// Shared constants for the domain-command runtime (spec 051).
		/** The MCP JSON-RPC endpoint path, mirroring the server's `MCP_HTTP_PATH`. */
		export const MCP_HTTP_PATH = "/mcp";
		/** `--all` cursor-following ceilings (spec 051 S4). Bounded, moved client-side. */
		export const MAX_ALL_PAGES = 50;
		export const MAX_ALL_ITEMS = 10_000;
		export const MAX_ALL_BYTES = 32 * 1024 * 1024;
		/**
		* Machine codes a tool `isError` payload may carry to identify a disabled
		* `FEATURE_*` gate (spec 051 S4, exit 5). `feature` is not on the wire and is
		* per-org server state, so the CLI never gates a command client-side; it only
		* upgrades the exit class from 4 to 5 when the server tags the failure with one
		* of these codes. Until the server tags it, a feature error stays exit 4.
		*/
		export const FEATURE_DISABLED_ERROR_CODES = new Set([
		"feature_disabled",
		"FEATURE_DISABLED",
		]);
		/** Exit-code classes (spec 051 S4), distinct per failure class. */
		export const EXIT_CODES = {
		ok: 0,
		unexpected: 1,
		validation: 2,
		auth: 3,
		server: 4,
		featureDisabled: 5,
		notFound: 6,
		aborted: 7,
		};
		//# sourceMappingURL=mcp-constants.js.map

+1

dist/mcp-constants.js.map

{"version":3,"file":"mcp-constants.js","sourceRoot":"","sources":["../src/mcp-constants.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAEpC,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAW,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,EAAE,EAAE,CAAC;IACL,UAAU,EAAE,CAAC;IACb,UAAU,EAAE,CAAC;IACb,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,eAAe,EAAE,CAAC;IAClB,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;CACF,CAAC"}

+52

dist/output.d.ts

		export type OutputFormat = "json" \| "table";
		/** Reserved output flags read off a parsed command's flags. */
		export type OutputFlags = {
		output?: OutputFormat \| undefined;
		json?: boolean \| undefined;
		table?: boolean \| undefined;
		};
		export declare const selectFormat: ({ flags, isTTY, }: {
		flags: OutputFlags;
		isTTY: boolean;
		}) => OutputFormat;
		/** The four mutually exclusive render shapes (spec S4). */
		export type RenderPlan = {
		kind: "page";
		itemsKey: string;
		items: readonly unknown[];
		payload: unknown;
		nextCursor: string \| null;
		columns: readonly string[] \| undefined;
		} \| {
		kind: "single";
		payload: unknown;
		} \| {
		kind: "windowed-text";
		text: string;
		nextCursor: string \| null;
		} \| {
		kind: "raw-text";
		text: string;
		};
		/**
		* Choose the render shape for a parsed payload given the leaf's annotations and
		* whether a single-read flip is active for this invocation (spec S4).
		*/
		export declare const buildRenderPlan: ({ payload, itemsKey, windowedText, singleReadActive, columns, }: {
		payload: unknown;
		itemsKey: string \| undefined;
		windowedText: boolean;
		singleReadActive: boolean;
		columns: readonly string[] \| undefined;
		}) => RenderPlan;
		export type Writers = {
		stdout: (text: string) => void;
		stderr: (text: string) => void;
		};
		/** Render a plan to stdout, emitting a `--cursor` resume hint on stderr. */
		export declare const renderResult: ({ plan, format, writers, allActive, }: {
		plan: RenderPlan;
		format: OutputFormat;
		writers: Writers;
		allActive: boolean;
		}) => void;

+135

dist/output.js

		// Output layer (spec 051 S4). Every response is parsed as
		// `JSON.parse(content[0].text)` upstream; here we pick the render shape as a
		// discriminated union (page envelope / single object / windowed text / raw
		// text) and render it as a table (default on a TTY) or pretty JSON (default off
		// a TTY), honoring `--output`/`--json`/`--table`. `nextCursor` hints and `--all`
		// truncation notices go to stderr so a piped JSON stdout stays clean.
		export const selectFormat = ({ flags, isTTY, }) => {
		if (flags.output !== undefined) {
		return flags.output;
		}
		if (flags.json === true) {
		return "json";
		}
		if (flags.table === true) {
		return "table";
		}
		return isTTY ? "table" : "json";
		};
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		const asString = (value) => typeof value === "string" ? value : null;
		const arrayAt = (payload, key) => {
		if (!isRecord(payload)) {
		return null;
		}
		const value = payload[key];
		return Array.isArray(value) ? value : null;
		};
		const fieldOf = (payload, key) => isRecord(payload) ? payload[key] : undefined;
		/**
		* Choose the render shape for a parsed payload given the leaf's annotations and
		* whether a single-read flip is active for this invocation (spec S4).
		*/
		export const buildRenderPlan = ({ payload, itemsKey, windowedText, singleReadActive, columns, }) => {
		if (windowedText) {
		return {
		kind: "windowed-text",
		text: asString(fieldOf(payload, "text")) ?? "",
		nextCursor: asString(fieldOf(payload, "nextCursor")),
		};
		}
		if (!singleReadActive && itemsKey !== undefined) {
		const items = arrayAt(payload, itemsKey);
		if (items !== null) {
		return {
		kind: "page",
		itemsKey,
		items,
		payload,
		nextCursor: asString(fieldOf(payload, "nextCursor")),
		columns,
		};
		}
		}
		return { kind: "single", payload };
		};
		const formatCell = (value) => {
		if (value === null \|\| value === undefined) {
		return "";
		}
		if (typeof value === "string") {
		return value;
		}
		if (typeof value === "number" \|\| typeof value === "boolean") {
		return String(value);
		}
		return JSON.stringify(value);
		};
		const renderTable = ({ items, columns, }) => {
		if (items.length === 0) {
		return "(no results)";
		}
		const first = items.at(0);
		const cols = columns ?? (isRecord(first) ? Object.keys(first) : ["value"]);
		const rows = items.map((item) => cols.map((col) => isRecord(item) ? formatCell(item[col]) : formatCell(item)));
		const widths = cols.map((col, index) => Math.max(col.length, ...rows.map((row) => (row[index] ?? "").length)));
		const pad = (cells) => cells
		.map((cell, index) => cell.padEnd(widths[index] ?? cell.length))
		.join(" ")
		.trimEnd();
		const header = pad(cols);
		const separator = widths.map((width) => "-".repeat(width)).join(" ");
		return [header, separator, ...rows.map(pad)].join("\n");
		};
		const renderKeyValue = (payload) => {
		if (!isRecord(payload)) {
		return formatCell(payload);
		}
		const keys = Object.keys(payload);
		if (keys.length === 0) {
		return "(empty)";
		}
		const width = Math.max(...keys.map((key) => key.length));
		return keys
		.map((key) => `${key.padEnd(width)} ${formatCell(payload[key])}`)
		.join("\n");
		};
		/** Render a plan to stdout, emitting a `--cursor` resume hint on stderr. */
		export const renderResult = ({ plan, format, writers, allActive, }) => {
		if (plan.kind === "raw-text") {
		writers.stdout(plan.text.endsWith("\n") ? plan.text : `${plan.text}\n`);
		return;
		}
		if (plan.kind === "windowed-text") {
		if (format === "json") {
		writers.stdout(`${JSON.stringify({ text: plan.text }, null, 2)}\n`);
		}
		else {
		writers.stdout(plan.text.endsWith("\n") ? plan.text : `${plan.text}\n`);
		}
		if (!allActive && plan.nextCursor !== null) {
		writers.stderr(`more: --cursor ${plan.nextCursor}\n`);
		}
		return;
		}
		if (plan.kind === "single") {
		if (format === "json") {
		writers.stdout(`${JSON.stringify(plan.payload, null, 2)}\n`);
		}
		else {
		writers.stdout(`${renderKeyValue(plan.payload)}\n`);
		}
		return;
		}
		// page envelope
		if (format === "json") {
		writers.stdout(`${JSON.stringify(plan.payload, null, 2)}\n`);
		}
		else {
		writers.stdout(`${renderTable({ items: plan.items, columns: plan.columns })}\n`);
		}
		if (!allActive && plan.nextCursor !== null) {
		writers.stderr(`more: --cursor ${plan.nextCursor}\n`);
		}
		};
		//# sourceMappingURL=output.js.map

+1

dist/output.js.map

+50

dist/registry-cache.d.ts

		import type { RegistryToolListing } from "./route-types.js";
		export declare const CACHE_SCHEMA_VERSION = 2;
		/** Default time-to-live before a cached listing is refetched (spec S5.3). */
		export declare const DEFAULT_TTL_SECONDS = 86400;
		/** The delta of a fetched registry vs the baked-in tree (spec S5.3). */
		export type RegistryDelta = {
		added: readonly string[];
		removed: readonly string[];
		changed: readonly string[];
		};
		/** The on-disk cache file shape (spec S5.3). */
		export type RegistryCacheFile = {
		version: number;
		serverOrigin: string;
		fetchedAt: string;
		ttlSeconds: number;
		toolsListHash: string;
		listings: readonly RegistryToolListing[];
		delta: RegistryDelta;
		/** The latest CLI version we last nudged about (update-nudge anti-nag key). */
		lastNudgedVersion?: string;
		};
		/** The environment slice the cache directory resolution needs. */
		export type CacheEnv = {
		XDG_CACHE_HOME?: string \| undefined;
		HOME?: string \| undefined;
		};
		/** The `stella/registry` cache directory (XDG, `~/.cache` fallback; spec S5.3). */
		export declare const cacheDir: (env: CacheEnv) => string;
		/** A stable sha256 hex of the server origin, used as the cache filename. */
		export declare const originHash: (serverOrigin: string) => string;
		/** The cache file path for a given origin (one file per origin; spec S5.5 rule 5). */
		export declare const cachePathFor: (serverOrigin: string, env: CacheEnv) => string;
		/** True when the cache is older than its TTL and should be refetched. */
		export declare const isCacheStale: (file: RegistryCacheFile, nowMs: number) => boolean;
		/** True when a delta has no additions, removals, or changes. */
		export declare const isDeltaEmpty: (delta: RegistryDelta) => boolean;
		/**
		* Diff fetched listings against the baked-in listings (spec S5.3): a tool is
		* `changed` when its `inputSchema` shape (which drives generated flags, incl.
		* `required[]`) differs. Descriptions and annotations do not count as changes.
		*/
		export declare const computeDelta: (baked: readonly RegistryToolListing[], fetched: readonly RegistryToolListing[]) => RegistryDelta;
		/**
		* Read and shape-validate the cache file for an origin. A missing, corrupt, or
		* wrong-version file returns `undefined` (the caller falls back to baked-in).
		*/
		export declare const readCacheFile: (filePath: string) => Promise<RegistryCacheFile \| undefined>;
		/** Write the cache file, creating the cache directory if needed. */
		export declare const writeCacheFile: (filePath: string, file: RegistryCacheFile) => Promise<void>;

+192

dist/registry-cache.js

		// The per-origin XDG registry cache (spec 051 S5.3). One file per server origin
		// under `$XDG_CACHE_HOME/stella/registry/<origin-hash>.json` (`~/.cache/...`
		// fallback). The cache lets a `tools/list` fetched once (at `auth login` or on a
		// TTL refresh) drive the command tree offline until it goes stale, and records
		// the delta vs the baked-in tree so a divergence can be surfaced on stderr.
		//
		// This module is I/O-bounded (reads/writes the cache file); pure helpers
		// (`computeDelta`, `isCacheStale`, `isDeltaEmpty`) are exported for the runtime
		// path and its tests. It stores no secrets: only public tool listings.
		import { Result } from "better-result";
		import { createHash } from "node:crypto";
		import { mkdir, readFile, writeFile } from "node:fs/promises";
		import path from "node:path";
		// Cache schema version; a bump invalidates every existing cache file. Bumped to
		// 2 when `lastNudgedVersion` (the CLI update-nudge anti-nag key) was added.
		export const CACHE_SCHEMA_VERSION = 2;
		/** Default time-to-live before a cached listing is refetched (spec S5.3). */
		export const DEFAULT_TTL_SECONDS = 86_400;
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		/** The `stella/registry` cache directory (XDG, `~/.cache` fallback; spec S5.3). */
		export const cacheDir = (env) => {
		const base = env.XDG_CACHE_HOME && env.XDG_CACHE_HOME.length > 0
		? env.XDG_CACHE_HOME
		: path.join(env.HOME ?? ".", ".cache");
		return path.join(base, "stella", "registry");
		};
		/** A stable sha256 hex of the server origin, used as the cache filename. */
		export const originHash = (serverOrigin) => createHash("sha256").update(serverOrigin).digest("hex");
		/** The cache file path for a given origin (one file per origin; spec S5.5 rule 5). */
		export const cachePathFor = (serverOrigin, env) => path.join(cacheDir(env), `${originHash(serverOrigin)}.json`);
		/** True when the cache is older than its TTL and should be refetched. */
		export const isCacheStale = (file, nowMs) => {
		const fetchedAtMs = Date.parse(file.fetchedAt);
		if (Number.isNaN(fetchedAtMs)) {
		return true;
		}
		return nowMs - fetchedAtMs > file.ttlSeconds * 1000;
		};
		/** True when a delta has no additions, removals, or changes. */
		export const isDeltaEmpty = (delta) => delta.added.length === 0 &&
		delta.removed.length === 0 &&
		delta.changed.length === 0;
		/** Deterministic key-sorted stringify, so a re-ordered schema is not a "change". */
		const stableStringify = (value) => {
		if (Array.isArray(value)) {
		return `[${value.map(stableStringify).join(",")}]`;
		}
		if (isRecord(value)) {
		const keys = Object.keys(value).sort();
		return `{${keys
		.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`)
		.join(",")}}`;
		}
		// `value` here is a parsed-JSON primitive (string/number/boolean/null), for
		// which `JSON.stringify` is always defined.
		return JSON.stringify(value);
		};
		/**
		* Diff fetched listings against the baked-in listings (spec S5.3): a tool is
		* `changed` when its `inputSchema` shape (which drives generated flags, incl.
		* `required[]`) differs. Descriptions and annotations do not count as changes.
		*/
		export const computeDelta = (baked, fetched) => {
		const bakedByName = new Map(baked.map((tool) => [tool.name, tool]));
		const fetchedByName = new Map(fetched.map((tool) => [tool.name, tool]));
		const added = [];
		const removed = [];
		const changed = [];
		for (const tool of fetched) {
		if (!bakedByName.has(tool.name)) {
		added.push(tool.name);
		}
		}
		for (const tool of baked) {
		if (!fetchedByName.has(tool.name)) {
		removed.push(tool.name);
		}
		}
		for (const tool of fetched) {
		const bakedTool = bakedByName.get(tool.name);
		if (bakedTool === undefined) {
		continue;
		}
		if (stableStringify(bakedTool.inputSchema) !==
		stableStringify(tool.inputSchema)) {
		changed.push(tool.name);
		}
		}
		return { added, removed, changed };
		};
		/**
		* Re-shape the cached `listings` on read (defense in depth for a locally-tampered
		* cache): keep only the wire fields, and drop the whole file if any entry is
		* malformed so the caller falls back to the baked-in tree.
		*/
		const parseListings = (value) => {
		if (!Array.isArray(value)) {
		return undefined;
		}
		const listings = [];
		for (const entry of value) {
		if (!isRecord(entry) \|\|
		typeof entry["name"] !== "string" \|\|
		typeof entry["description"] !== "string" \|\|
		!isRecord(entry["inputSchema"])) {
		return undefined;
		}
		const listing = {
		name: entry["name"],
		description: entry["description"],
		inputSchema: entry["inputSchema"],
		};
		const annotations = entry["annotations"];
		if (isRecord(annotations)) {
		const hints = {};
		if (typeof annotations["readOnlyHint"] === "boolean") {
		hints.readOnlyHint = annotations["readOnlyHint"];
		}
		if (typeof annotations["destructiveHint"] === "boolean") {
		hints.destructiveHint = annotations["destructiveHint"];
		}
		listing.annotations = hints;
		}
		listings.push(listing);
		}
		return listings;
		};
		const parseDelta = (value) => {
		if (!isRecord(value)) {
		return undefined;
		}
		const asStrings = (raw) => Array.isArray(raw) && raw.every((item) => typeof item === "string")
		? raw
		: undefined;
		const added = asStrings(value["added"]);
		const removed = asStrings(value["removed"]);
		const changed = asStrings(value["changed"]);
		if (added === undefined \|\| removed === undefined \|\| changed === undefined) {
		return undefined;
		}
		return { added, removed, changed };
		};
		/**
		* Read and shape-validate the cache file for an origin. A missing, corrupt, or
		* wrong-version file returns `undefined` (the caller falls back to baked-in).
		*/
		export const readCacheFile = async (filePath) => {
		const parsed = await Result.tryPromise({
		try: async () => JSON.parse(await readFile(filePath, "utf-8")),
		catch: (cause) => cause,
		});
		if (Result.isError(parsed)) {
		return undefined;
		}
		const value = parsed.value;
		if (!isRecord(value) \|\| value["version"] !== CACHE_SCHEMA_VERSION) {
		return undefined;
		}
		const serverOrigin = value["serverOrigin"];
		const fetchedAt = value["fetchedAt"];
		const ttlSeconds = value["ttlSeconds"];
		const toolsListHash = value["toolsListHash"];
		const listings = parseListings(value["listings"]);
		const delta = parseDelta(value["delta"]);
		if (typeof serverOrigin !== "string" \|\|
		typeof fetchedAt !== "string" \|\|
		typeof ttlSeconds !== "number" \|\|
		typeof toolsListHash !== "string" \|\|
		listings === undefined \|\|
		delta === undefined) {
		return undefined;
		}
		const lastNudgedVersion = value["lastNudgedVersion"];
		return {
		version: CACHE_SCHEMA_VERSION,
		serverOrigin,
		fetchedAt,
		ttlSeconds,
		toolsListHash,
		listings,
		delta,
		...(typeof lastNudgedVersion === "string" ? { lastNudgedVersion } : {}),
		};
		};
		/** Write the cache file, creating the cache directory if needed. */
		export const writeCacheFile = async (filePath, file) => {
		// `Bun.write` created missing parent directories implicitly; `node:fs`
		// `writeFile` does not, so mkdir the origin cache dir first (spec S5.3).
		await mkdir(path.dirname(filePath), { recursive: true });
		await writeFile(filePath, `${JSON.stringify(file, null, 2)}\n`);
		};
		//# sourceMappingURL=registry-cache.js.map

+1

dist/registry-cache.js.map

+53

dist/registry-refresh.d.ts

		import { Result } from "better-result";
		import { type McpClientError, type RawToolsList } from "./mcp-client.js";
		import { type CacheEnv } from "./registry-cache.js";
		import type { RegistryToolListing, RouteNode } from "./route-types.js";
		/**
		* Pick the command tree for this invocation without any network (spec S5.3).
		* The baked-in tree is the default; a valid same-origin cache with a non-empty
		* delta builds from the cached listings and carries the one-line stderr notice
		* for that divergence. The notice reflects a persistent state (the server tree
		* differs from the built-in tree until the next refresh reconciles the cache),
		* so it is emitted per invocation while divergent rather than suppressed after
		* the first: this read path takes no network and writes no disk. Provenance is
		* pinned: a cache whose `serverOrigin` differs is ignored (rule 5), and a
		* cached tree that fails to build falls back to baked-in (rule 6).
		*/
		export declare const resolveCommandTree: ({ serverOrigin, env, }: {
		serverOrigin: string \| undefined;
		env: CacheEnv;
		}) => Promise<{
		tree: RouteNode;
		notice?: string;
		}>;
		/** The outcome of a cache-refresh attempt (spec S5.3/S5.5 + addendum nudge). */
		export type RefreshOutcome = {
		status: "skipped";
		reason: "no-cache" \| "fresh";
		} \| {
		status: "failed";
		warning: string;
		} \| {
		status: "refreshed";
		deltaEmpty: boolean;
		nudge?: string;
		};
		type FetchRaw = () => Promise<Result<RawToolsList, McpClientError>>;
		/**
		* Refresh the per-origin cache (spec S5.3). Force-refreshes on `auth login`;
		* otherwise only refreshes an existing cache once it is stale (a missing cache
		* stays offline-instant and is seeded at login). Fails closed on any transport
		* or trust-boundary violation, keeping the baked-in tree (rule 6).
		*/
		export declare const refreshRegistryCache: ({ serverOrigin, token, env, now, force, ttlSeconds, currentVersion, fetchRaw, bakedListings, }: {
		serverOrigin: string;
		token: string;
		env: CacheEnv;
		now?: number;
		force?: boolean;
		ttlSeconds?: number;
		currentVersion?: string;
		fetchRaw?: FetchRaw;
		bakedListings?: readonly RegistryToolListing[];
		}) => Promise<RefreshOutcome>;
		export {};

+149

dist/registry-refresh.js

		// The runtime-fetch call site (spec 051 S5.2 runtime + S5.3 + S5.5). Startup
		// always uses the baked-in tree (instant, offline); this module keeps the
		// per-origin cache current and, when a validated fetch diverges from the
		// baked-in tree, lets the next command build from the cached listings.
		//
		// Two entry points:
		// - `resolveCommandTree`: read-only, no network. Picks the baked-in tree, or
		// the cached-listings tree when the cache shows a non-empty delta, and
		// returns the one-line stderr notice for that case.
		// - `refreshRegistryCache`: fetch `tools/list`, validate through the S5.5
		// trust boundary, diff vs baked-in, and write the cache. Fails closed: any
		// transport/validation failure leaves the trusted baked-in tree in place.
		//
		// Both share the ONE pure `generateRouteMap` and the ONE baked-in Annotation
		// Table, so unknown fetched tools get the same S1 heuristic defaults as the
		// build-time path.
		import { Result } from "better-result";
		import { readFile } from "node:fs/promises";
		import { TOOL_ANNOTATIONS } from "./annotations.js";
		import { buildVersionNudge } from "./cli-version-nudge.js";
		import { generateRouteMap } from "./generate-route-map.js";
		import { CLI_VERSION } from "./generated/cli-version.js";
		import { generatedRouteMap } from "./generated/route-map.js";
		import { fetchToolsListRaw, } from "./mcp-client.js";
		import { CACHE_SCHEMA_VERSION, cachePathFor, computeDelta, DEFAULT_TTL_SECONDS, isCacheStale, isDeltaEmpty, readCacheFile, writeCacheFile, } from "./registry-cache.js";
		import { validateFetchedToolsList } from "./registry-trust.js";
		const SNAPSHOT_URL = new URL("generated/registry-snapshot.json", import.meta.url);
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		/** Load the baked-in listings (the committed snapshot) for the delta diff. */
		const loadBakedListings = async () => {
		const parsed = await Result.tryPromise({
		try: async () => JSON.parse(await readFile(SNAPSHOT_URL, "utf-8")),
		catch: (cause) => cause,
		});
		if (Result.isError(parsed) \|\| !Array.isArray(parsed.value)) {
		return [];
		}
		const listings = [];
		for (const entry of parsed.value) {
		// The snapshot is committed, trusted data; project the diff-relevant fields
		// (name identity + schema shape) with plain guards, no casts.
		if (!isRecord(entry)) {
		continue;
		}
		const name = entry["name"];
		const inputSchema = entry["inputSchema"];
		const description = entry["description"];
		if (typeof name === "string" && isRecord(inputSchema)) {
		listings.push({
		name,
		description: typeof description === "string" ? description : "",
		inputSchema,
		});
		}
		}
		return listings;
		};
		/** The one-line stderr notice for a diverged registry (spec S5.3). */
		const divergenceNotice = (file) => `server registry differs (+${file.delta.added.length} −${file.delta.removed.length} ~${file.delta.changed.length}); see 'stella tools list'\n`;
		/**
		* Pick the command tree for this invocation without any network (spec S5.3).
		* The baked-in tree is the default; a valid same-origin cache with a non-empty
		* delta builds from the cached listings and carries the one-line stderr notice
		* for that divergence. The notice reflects a persistent state (the server tree
		* differs from the built-in tree until the next refresh reconciles the cache),
		* so it is emitted per invocation while divergent rather than suppressed after
		* the first: this read path takes no network and writes no disk. Provenance is
		* pinned: a cache whose `serverOrigin` differs is ignored (rule 5), and a
		* cached tree that fails to build falls back to baked-in (rule 6).
		*/
		export const resolveCommandTree = async ({ serverOrigin, env, }) => {
		if (serverOrigin === undefined) {
		return { tree: generatedRouteMap };
		}
		const file = await readCacheFile(cachePathFor(serverOrigin, env));
		if (file === undefined \|\| file.serverOrigin !== serverOrigin) {
		return { tree: generatedRouteMap };
		}
		if (isDeltaEmpty(file.delta)) {
		return { tree: generatedRouteMap };
		}
		const built = Result.try(() => generateRouteMap(file.listings, TOOL_ANNOTATIONS));
		if (Result.isError(built)) {
		return { tree: generatedRouteMap };
		}
		return { tree: built.value, notice: divergenceNotice(file) };
		};
		/**
		* Refresh the per-origin cache (spec S5.3). Force-refreshes on `auth login`;
		* otherwise only refreshes an existing cache once it is stale (a missing cache
		* stays offline-instant and is seeded at login). Fails closed on any transport
		* or trust-boundary violation, keeping the baked-in tree (rule 6).
		*/
		export const refreshRegistryCache = async ({ serverOrigin, token, env, now = Date.now(), force = false, ttlSeconds = DEFAULT_TTL_SECONDS, currentVersion = CLI_VERSION, fetchRaw, bakedListings, }) => {
		const filePath = cachePathFor(serverOrigin, env);
		const existing = await readCacheFile(filePath);
		if (!force) {
		if (existing === undefined) {
		return { status: "skipped", reason: "no-cache" };
		}
		if (!isCacheStale(existing, now)) {
		return { status: "skipped", reason: "fresh" };
		}
		}
		const fetcher = fetchRaw ??
		(async () => await fetchToolsListRaw({ serverUrl: serverOrigin, token }));
		const raw = await fetcher();
		if (Result.isError(raw)) {
		return {
		status: "failed",
		warning: `registry refresh skipped: ${raw.error.message}`,
		};
		}
		const trust = validateFetchedToolsList(raw.value.rawBody);
		if (!trust.ok) {
		return {
		status: "failed",
		warning: `registry refresh rejected (using built-in commands): ${trust.violation}`,
		};
		}
		const baked = bakedListings ?? (await loadBakedListings());
		const delta = computeDelta(baked, trust.listings);
		// CLI update nudge (spec 051 addendum): evaluate the advertised version headers
		// against this build; anti-nag on the version last nudged for this origin.
		const nudge = buildVersionNudge({
		current: currentVersion,
		latest: raw.value.cliLatest,
		minimum: raw.value.cliMinimum,
		lastNudged: existing?.lastNudgedVersion,
		});
		const lastNudgedVersion = nudge.nudgeVersion ?? existing?.lastNudgedVersion;
		const file = {
		version: CACHE_SCHEMA_VERSION,
		serverOrigin,
		fetchedAt: new Date(now).toISOString(),
		ttlSeconds,
		toolsListHash: trust.toolsListHash,
		listings: trust.listings,
		delta,
		...(lastNudgedVersion === undefined ? {} : { lastNudgedVersion }),
		};
		await writeCacheFile(filePath, file);
		return {
		status: "refreshed",
		deltaEmpty: isDeltaEmpty(delta),
		...(nudge.line === undefined ? {} : { nudge: nudge.line }),
		};
		};
		//# sourceMappingURL=registry-refresh.js.map

+1

dist/registry-refresh.js.map

+31

dist/registry-trust.d.ts

		import type { RegistryToolListing } from "./route-types.js";
		/** Reject a whole fetched body larger than this (bytes). */
		export declare const MAX_LISTING_BYTES: number;
		/** Reject a body advertising more tools than this. */
		export declare const MAX_TOOLS = 200;
		/** Reject an `inputSchema` nested deeper than this (also catches `$ref` cycles). */
		export declare const MAX_SCHEMA_DEPTH = 8;
		/** Reject a single tool whose serialized `inputSchema` exceeds this (bytes). */
		export declare const MAX_TOOL_SCHEMA_BYTES: number;
		/** Reject an `enum` with more members than this. */
		export declare const MAX_ENUM = 300;
		/** Reject a `properties` object with more keys than this. */
		export declare const MAX_PROPS = 100;
		/** Tool names must match this (spec S5.5 rule 2). */
		export declare const TOOL_NAME_PATTERN: RegExp;
		/** The success/failure result of validating a fetched tools/list body. */
		export type TrustResult = {
		ok: true;
		listings: RegistryToolListing[];
		toolsListHash: string;
		} \| {
		ok: false;
		violation: string;
		};
		/**
		* Validate a raw fetched `tools/list` body (spec S5.5). On success returns the
		* projected `RegistryToolListing[]` plus the sha256 of the raw body; on any
		* violation returns `{ ok: false }` so the caller falls back to the baked-in
		* tree. Never throws.
		*/
		export declare const validateFetchedToolsList: (rawBody: string) => TrustResult;

+234

dist/registry-trust.js

		// Trust boundary for runtime-fetched `tools/list` bodies (spec 051 S5.5). The
		// runtime path turns a remote server's JSON into executable command
		// definitions, so every fetched body is validated here before it can reach the
		// pure `generateRouteMap`. Validation is INTERPRETED (a hand-rolled walker, no
		// `Function`/`eval`/dynamic codegen; rule 1) and FAILS CLOSED (any violation is
		// returned as a failure so the caller keeps the trusted baked-in tree; rule 6).
		//
		// The meta-schema (rule 2), the size/depth caps (rule 3), and the
		// no-executable-content checks (rule 4) are enforced with the named constants
		// below, exactly as the spec pins them.
		import { Result } from "better-result";
		import { createHash } from "node:crypto";
		// --- Size / depth caps (spec S5.5 rule 3), named constants, not literals. ---
		/** Reject a whole fetched body larger than this (bytes). */
		export const MAX_LISTING_BYTES = 1024 * 1024; // 1 MiB
		/** Reject a body advertising more tools than this. */
		export const MAX_TOOLS = 200;
		// Depth/enum caps bound recursion and abuse; they must clear the first-party
		// registry with headroom (the `registry snapshot validates` test in
		// registry-trust.test.ts fails closed if a shipped schema outgrows either cap).
		// The deepest baked-in schema is `save_template` (depth 7); the largest enum is
		// `set_practice_jurisdictions` (250). Both were raised from their spec S5.5
		// starting values (depth 6, enum 200) once the real registry exceeded them.
		/** Reject an `inputSchema` nested deeper than this (also catches `$ref` cycles). */
		export const MAX_SCHEMA_DEPTH = 8;
		/** Reject a single tool whose serialized `inputSchema` exceeds this (bytes). */
		export const MAX_TOOL_SCHEMA_BYTES = 64 * 1024; // 64 KiB
		/** Reject an `enum` with more members than this. */
		export const MAX_ENUM = 300;
		/** Reject a `properties` object with more keys than this. */
		export const MAX_PROPS = 100;
		/** Tool names must match this (spec S5.5 rule 2). */
		export const TOOL_NAME_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
		/** The only annotation hints a fetched listing may carry (spec S5.5 rule 2). */
		const ALLOWED_ANNOTATION_KEYS = new Set([
		"readOnlyHint",
		"destructiveHint",
		]);
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		// A guard that narrows to `readonly unknown[]` (not `any[]`, which `Array.isArray`
		// would introduce), keeping the walker fully typed.
		const isUnknownArray = (value) => Array.isArray(value);
		/** Pull the `tools` array from a tools/list body (bare, `{tools}`, or envelope). */
		const extractTools = (parsed) => {
		if (isUnknownArray(parsed)) {
		return parsed;
		}
		if (isRecord(parsed) && isUnknownArray(parsed["tools"])) {
		return parsed["tools"];
		}
		const result = isRecord(parsed) ? parsed["result"] : undefined;
		if (isRecord(result) && isUnknownArray(result["tools"])) {
		return result["tools"];
		}
		return undefined;
		};
		/**
		* Walk one `inputSchema` subtree enforcing the depth/enum/props caps and the
		* no-remote-`$ref` rule. Interpreted recursion with an explicit depth counter;
		* the depth cap bounds resolution and catches any `$ref` cycle (rule 4).
		* Returns a violation string, or `undefined` when the subtree is within bounds.
		*/
		const walkSchema = (schema, depth) => {
		if (depth > MAX_SCHEMA_DEPTH) {
		return `schema nested deeper than ${MAX_SCHEMA_DEPTH}`;
		}
		if (!isRecord(schema)) {
		return undefined;
		}
		const ref = schema["$ref"];
		if (ref !== undefined && (typeof ref !== "string" \|\| !ref.startsWith("#/"))) {
		return "only local #/... $ref is allowed";
		}
		const enumValues = schema["enum"];
		if (Array.isArray(enumValues) && enumValues.length > MAX_ENUM) {
		return `enum larger than ${MAX_ENUM}`;
		}
		const properties = schema["properties"];
		if (isRecord(properties)) {
		if (Object.keys(properties).length > MAX_PROPS) {
		return `properties object larger than ${MAX_PROPS}`;
		}
		for (const child of Object.values(properties)) {
		const violation = walkSchema(child, depth + 1);
		if (violation !== undefined) {
		return violation;
		}
		}
		}
		const items = schema["items"];
		if (Array.isArray(items)) {
		for (const item of items) {
		const violation = walkSchema(item, depth + 1);
		if (violation !== undefined) {
		return violation;
		}
		}
		}
		else if (isRecord(items)) {
		const violation = walkSchema(items, depth + 1);
		if (violation !== undefined) {
		return violation;
		}
		}
		const additional = schema["additionalProperties"];
		if (isRecord(additional)) {
		return walkSchema(additional, depth + 1);
		}
		return undefined;
		};
		/** Validate the `annotations` field to the two known boolean hints (rule 2). */
		const annotationsViolation = (annotations) => {
		if (annotations === undefined) {
		return undefined;
		}
		if (!isRecord(annotations)) {
		return "annotations must be an object";
		}
		for (const [key, value] of Object.entries(annotations)) {
		if (!ALLOWED_ANNOTATION_KEYS.has(key)) {
		return `annotations has an unknown key '${key}'`;
		}
		if (typeof value !== "boolean") {
		return `annotations.${key} must be a boolean`;
		}
		}
		return undefined;
		};
		/** Project a validated entry to `RegistryToolListing`, keeping only wire fields. */
		const projectListing = (entry, name, description, inputSchema) => {
		const rawAnnotations = entry["annotations"];
		if (!isRecord(rawAnnotations)) {
		return { name, description, inputSchema };
		}
		const annotations = {};
		if (typeof rawAnnotations["readOnlyHint"] === "boolean") {
		annotations.readOnlyHint = rawAnnotations["readOnlyHint"];
		}
		if (typeof rawAnnotations["destructiveHint"] === "boolean") {
		annotations.destructiveHint = rawAnnotations["destructiveHint"];
		}
		return { name, description, inputSchema, annotations };
		};
		/** Validate one entry against the meta-schema + per-tool caps (rules 2, 3, 4). */
		const validateEntry = (entry) => {
		if (!isRecord(entry)) {
		return { ok: false, violation: "tool entry is not an object" };
		}
		const name = entry["name"];
		if (typeof name !== "string" \|\| !TOOL_NAME_PATTERN.test(name)) {
		return { ok: false, violation: `tool name is invalid: ${String(name)}` };
		}
		const description = entry["description"];
		if (typeof description !== "string") {
		return {
		ok: false,
		violation: `tool ${name} description must be a string`,
		};
		}
		const inputSchema = entry["inputSchema"];
		if (!isRecord(inputSchema)) {
		return {
		ok: false,
		violation: `tool ${name} inputSchema must be an object`,
		};
		}
		if (inputSchema["type"] !== "object") {
		return {
		ok: false,
		violation: `tool ${name} inputSchema.type must be "object"`,
		};
		}
		if (!isRecord(inputSchema["properties"])) {
		return {
		ok: false,
		violation: `tool ${name} inputSchema.properties must be an object`,
		};
		}
		const schemaBytes = Buffer.byteLength(JSON.stringify(inputSchema));
		if (schemaBytes > MAX_TOOL_SCHEMA_BYTES) {
		return {
		ok: false,
		violation: `tool ${name} inputSchema larger than ${MAX_TOOL_SCHEMA_BYTES} bytes`,
		};
		}
		const annotationViolation = annotationsViolation(entry["annotations"]);
		if (annotationViolation !== undefined) {
		return { ok: false, violation: `tool ${name}: ${annotationViolation}` };
		}
		const schemaViolation = walkSchema(inputSchema, 1);
		if (schemaViolation !== undefined) {
		return { ok: false, violation: `tool ${name}: ${schemaViolation}` };
		}
		return {
		ok: true,
		listing: projectListing(entry, name, description, inputSchema),
		};
		};
		/**
		* Validate a raw fetched `tools/list` body (spec S5.5). On success returns the
		* projected `RegistryToolListing[]` plus the sha256 of the raw body; on any
		* violation returns `{ ok: false }` so the caller falls back to the baked-in
		* tree. Never throws.
		*/
		export const validateFetchedToolsList = (rawBody) => {
		if (Buffer.byteLength(rawBody) > MAX_LISTING_BYTES) {
		return {
		ok: false,
		violation: `body larger than ${MAX_LISTING_BYTES} bytes`,
		};
		}
		const parsed = Result.try(() => JSON.parse(rawBody));
		if (Result.isError(parsed)) {
		return { ok: false, violation: "body is not valid JSON" };
		}
		const tools = extractTools(parsed.value);
		if (tools === undefined) {
		return { ok: false, violation: "body has no tools array" };
		}
		if (tools.length > MAX_TOOLS) {
		return { ok: false, violation: `more than ${MAX_TOOLS} tools` };
		}
		const listings = [];
		for (const entry of tools) {
		const validated = validateEntry(entry);
		if (!validated.ok) {
		return { ok: false, violation: validated.violation };
		}
		listings.push(validated.listing);
		}
		const toolsListHash = createHash("sha256").update(rawBody).digest("hex");
		return { ok: true, listings, toolsListHash };
		};
		//# sourceMappingURL=registry-trust.js.map

+1

dist/registry-trust.js.map

+29

dist/resource-types.d.ts

		/** One resource as returned by `resources/list` (the wire fields the CLI uses). */
		export type ResourceListing = {
		uri: string;
		name: string;
		title?: string;
		description?: string;
		mimeType?: string;
		};
		/**
		* A generated resource leaf: either the `list` enumerator or a per-resource
		* `show` reader carrying the fixed URI it dispatches `resources/read` with.
		*/
		export type ResourceLeafSpec = {
		kind: "list";
		commandPath: readonly string[];
		} \| {
		kind: "show";
		commandPath: readonly string[];
		name: string;
		uri: string;
		};
		/** stricli assembly for the resource tree, mirroring the tool `RouteNode`. */
		export type ResourceNode = {
		kind: "leaf";
		spec: ResourceLeafSpec;
		} \| {
		kind: "route";
		children: Record<string, ResourceNode>;
		};

+6

dist/resource-types.js

		// Data shapes for the MCP resources -> stricli route-map generator (spec 051
		// S5.4). Resources are a small parallel tree to the tool tree: `resources/list`
		// projects to `reference list`, and each resource projects to a
		// `reference show <name>` leaf that reads it via `resources/read`. Types only.
		export {};
		//# sourceMappingURL=resource-types.js.map

+1

dist/resource-types.js.map

{"version":3,"file":"resource-types.js","sourceRoot":"","sources":["../src/resource-types.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,gFAAgF;AAChF,gEAAgE;AAChE,+EAA+E"}

+72

dist/route-types.d.ts

		/** A JSON Schema fragment, as emitted by the MCP tool registry's prop builders. */
		export type JsonSchema = Record<string, unknown>;
		/** The MCP scope strings a tool annotation can require (client-side precheck only). */
		export type ToolScope = "read" \| "matters_write" \| "documents_write" \| "knowledge_write" \| "search" \| "onboarding" \| "templates" \| "billing_write" \| "admin_read" \| "admin_write";
		/** Wire fields from `tools/list` (build-time: projected from `DEFAULT_MCP_TOOL_DEFINITIONS`). */
		export type RegistryToolListing = {
		name: string;
		description: string;
		inputSchema: JsonSchema;
		annotations?: {
		readOnlyHint?: boolean;
		destructiveHint?: boolean;
		};
		};
		/** One required-enum subcommand produced by a discriminator split (spec S2). */
		export type DiscriminatorSubcommand = {
		command: string;
		destructive?: true;
		include?: readonly string[];
		required?: readonly string[];
		};
		/** Baked-in per-tool annotation (spec S1), keyed by tool name and merged with the listing. */
		export type ToolAnnotation = {
		command: readonly string[];
		excluded?: true;
		scope?: ToolScope;
		itemsKey?: string;
		singleReadWhen?: string;
		columns?: readonly string[];
		windowedText?: true;
		paginationless?: true;
		inputOnly?: readonly string[];
		discriminator?: {
		prop: string;
		subcommands: Record<string, DiscriminatorSubcommand>;
		};
		flagRename?: Record<string, string>;
		};
		/** One generated CLI flag, derived from an `inputSchema` prop (spec S3). */
		export type FlagSpec = {
		flag: string;
		prop: string;
		kind: "string" \| "int" \| "number" \| "boolean" \| "enum" \| "nullable-string" \| "string-array" \| "int-array" \| "enum-array";
		required: boolean;
		enum?: readonly string[];
		min?: number;
		max?: number;
		repeatable: boolean;
		default?: unknown;
		};
		/** The generator's per-leaf output before handing to stricli's `buildCommand`. */
		export type LeafCommandSpec = {
		commandPath: readonly string[];
		toolName: string;
		discriminatorInject?: Record<string, string>;
		flags: readonly FlagSpec[];
		inputOnly: readonly string[];
		paginated: boolean;
		windowedText: boolean;
		itemsKey?: string;
		destructive: boolean;
		scope?: ToolScope;
		inputSchema: JsonSchema;
		};
		/** stricli assembly: `LeafCommandSpec[]` folds into a nested route tree. */
		export type RouteNode = {
		kind: "leaf";
		spec: LeafCommandSpec;
		} \| {
		kind: "route";
		children: Record<string, RouteNode>;
		};

+8

dist/route-types.js

		// Data shapes for the JSON-Schema -> stricli route-map generator.
		//
		// This module is types only (spec 051 S5.1). The generator itself
		// (`generateRouteMap`), the annotation table (S1), and every domain command
		// are out of scope for this phase; see `src/generated/route-map.ts` for the
		// placeholder the real generator will replace.
		export {};
		//# sourceMappingURL=route-types.js.map

+1

dist/route-types.js.map

{"version":3,"file":"route-types.js","sourceRoot":"","sources":["../src/route-types.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,kEAAkE;AAClE,4EAA4E;AAC5E,4EAA4E;AAC5E,+CAA+C"}

+37

dist/run-leaf-command.d.ts

		import type { Context } from "./context.js";
		import { type OutputFormat, type Writers } from "./output.js";
		import type { FlagSpec, LeafCommandSpec } from "./route-types.js";
		/** stricli flag record key for a FlagSpec: snake/dot path -> camelCase identifier. */
		export declare const flagKey: (spec: Pick<FlagSpec, "prop">) => string;
		/** Reserved global flag keys present on generated commands (spec S1/S3). */
		export declare const RESERVED_FLAG_KEYS: {
		readonly input: "input";
		readonly output: "output";
		readonly json: "json";
		readonly table: "table";
		readonly cursor: "cursor";
		readonly limit: "limit";
		readonly all: "all";
		readonly yes: "yes";
		};
		type LeafFlags = Record<string, unknown>;
		/** Bind a command's `Context` streams to the output layer's `Writers`. */
		export declare const writersFor: (context: Context) => Writers;
		type ArgsResult = {
		ok: true;
		args: Record<string, unknown>;
		} \| {
		ok: false;
		message: string;
		};
		/** Build the tool-args object from parsed value flags (spec S3). Exported for tests. */
		export declare const buildArgsFromFlags: (spec: LeafCommandSpec, flags: LeafFlags) => Promise<ArgsResult>;
		/** Resolve the effective `OutputFormat` from the reserved output flags + TTY. */
		export declare const readOutputFormat: (flags: LeafFlags, context: Context) => OutputFormat;
		/** Run one leaf command end to end. Sets `process.exitCode` per spec S4. */
		export declare const runLeafCommand: ({ context, flags, spec, }: {
		context: Context;
		flags: LeafFlags;
		spec: LeafCommandSpec;
		}) => Promise<void>;
		export {};

+505

dist/run-leaf-command.js

		// The generic executor every generated leaf command dispatches through (spec 051
		// S3/S4). It builds the tool-args object from parsed flags (or the `--input`
		// escape hatch), runs the client-side scope precheck, confirms destructive ops,
		// calls the MCP endpoint (following cursors under `--all`, bounded by the
		// ceilings), and renders the result. Exit codes are set on `process.exitCode`
		// directly so stricli's `??=` never overrides them.
		import { Result } from "better-result";
		import { readFile } from "node:fs/promises";
		import { createInterface } from "node:readline/promises";
		import { text as readStreamText } from "node:stream/consumers";
		import { decodeAccessTokenClaims } from "./auth/jwt.js";
		import { validateAgainstSchema } from "./json-schema-validate.js";
		import { callTool, } from "./mcp-client.js";
		import { EXIT_CODES, FEATURE_DISABLED_ERROR_CODES, MAX_ALL_BYTES, MAX_ALL_ITEMS, MAX_ALL_PAGES, } from "./mcp-constants.js";
		import { buildRenderPlan, renderResult, selectFormat, } from "./output.js";
		/** stricli flag record key for a FlagSpec: snake/dot path -> camelCase identifier. */
		export const flagKey = (spec) => spec.prop.replace(/[._](?<char>[a-z0-9])/gu, (_match, char) => char.toUpperCase());
		/** Reserved global flag keys present on generated commands (spec S1/S3). */
		export const RESERVED_FLAG_KEYS = {
		input: "input",
		output: "output",
		json: "json",
		table: "table",
		cursor: "cursor",
		limit: "limit",
		all: "all",
		yes: "yes",
		};
		const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
		const stringField = (value, key) => {
		if (!isRecord(value)) {
		return null;
		}
		const field = value[key];
		return typeof field === "string" ? field : null;
		};
		const arrayField = (value, key) => {
		if (!isRecord(value)) {
		return [];
		}
		const field = value[key];
		return Array.isArray(field) ? field : [];
		};
		/** Bind a command's `Context` streams to the output layer's `Writers`. */
		export const writersFor = (context) => ({
		stdout: (text) => {
		context.process.stdout.write(text);
		},
		stderr: (text) => {
		context.process.stderr.write(text);
		},
		});
		const setExit = (context, code) => {
		context.process.exitCode = code;
		};
		// Read all of stdin to a string (the `@-` / `--input -` escape hatch). Consumes
		// `process.stdin` to EOF so the published CLI runs under plain Node.
		const readAllStdin = async () => await readStreamText(process.stdin);
		/** Apply gh-style `@file`/`@-`/`@@` sugar to a string flag value (spec S3). */
		const resolveStringValue = async (raw) => {
		if (raw.startsWith("@@")) {
		return Result.ok(raw.slice(1));
		}
		if (raw === "@-") {
		return Result.ok((await readAllStdin()).replace(/\n$/u, ""));
		}
		if (raw.startsWith("@")) {
		const path = raw.slice(1);
		const read = await Result.tryPromise({
		try: async () => await readFile(path, "utf-8"),
		catch: (cause) => cause,
		});
		if (Result.isError(read)) {
		return Result.err(`could not read file ${path}`);
		}
		return Result.ok(read.value);
		}
		return Result.ok(raw);
		};
		const setPath = (target, path, value) => {
		const segments = path.split(".");
		let node = target;
		for (let index = 0; index < segments.length - 1; index += 1) {
		const segment = segments[index] ?? "";
		const next = node[segment];
		if (isRecord(next)) {
		node = next;
		}
		else {
		const created = {};
		node[segment] = created;
		node = created;
		}
		}
		node[segments.at(-1) ?? path] = value;
		};
		const parseBoundedInt = (spec, raw) => {
		if (!/^-?\d+$/u.test(raw.trim())) {
		return Result.err(`${spec.flag} expects an integer`);
		}
		const value = Number.parseInt(raw.trim(), 10);
		if (spec.min !== undefined && value < spec.min) {
		return Result.err(`${spec.flag} must be >= ${spec.min}`);
		}
		if (spec.max !== undefined && value > spec.max) {
		return Result.err(`${spec.flag} must be <= ${spec.max}`);
		}
		return Result.ok(value);
		};
		const parseBoundedNumber = (spec, raw) => {
		const value = Number(raw.trim());
		if (!Number.isFinite(value)) {
		return Result.err(`${spec.flag} expects a number`);
		}
		if (spec.min !== undefined && value < spec.min) {
		return Result.err(`${spec.flag} must be >= ${spec.min}`);
		}
		if (spec.max !== undefined && value > spec.max) {
		return Result.err(`${spec.flag} must be <= ${spec.max}`);
		}
		return Result.ok(value);
		};
		/** stricli gives string values for scalar flags; guard against anything else. */
		const asFlagString = (value) => typeof value === "string" ? value : null;
		const coerceArrayFlag = (flagSpec, value) => {
		const raw = [];
		for (const element of Array.isArray(value) ? value : []) {
		const asString = asFlagString(element);
		if (asString === null) {
		return Result.err(`${flagSpec.flag} values must be strings`);
		}
		raw.push(asString);
		}
		if (flagSpec.kind === "string-array") {
		return Result.ok(raw);
		}
		if (flagSpec.kind === "enum-array") {
		for (const element of raw) {
		if (flagSpec.enum && !flagSpec.enum.includes(element)) {
		return Result.err(`${flagSpec.flag} values must each be one of ${flagSpec.enum.join(", ")}`);
		}
		}
		return Result.ok(raw);
		}
		const ints = [];
		for (const element of raw) {
		const parsed = parseBoundedInt(flagSpec, element);
		if (Result.isError(parsed)) {
		return parsed;
		}
		ints.push(parsed.value);
		}
		return Result.ok(ints);
		};
		/** Coerce one parsed flag value to its JSON tool-arg value (spec S3). */
		const coerceFlagValue = async (flagSpec, value) => {
		if (flagSpec.kind === "boolean") {
		return Result.ok(value === true);
		}
		if (flagSpec.kind === "string-array" \|\|
		flagSpec.kind === "enum-array" \|\|
		flagSpec.kind === "int-array") {
		return coerceArrayFlag(flagSpec, value);
		}
		const raw = asFlagString(value);
		if (raw === null) {
		return Result.err(`${flagSpec.flag} expects a value`);
		}
		if (flagSpec.kind === "nullable-string") {
		if (raw === "null") {
		return Result.ok(null);
		}
		const resolved = await resolveStringValue(raw);
		return resolved;
		}
		if (flagSpec.kind === "string") {
		const resolved = await resolveStringValue(raw);
		return resolved;
		}
		if (flagSpec.kind === "int") {
		return parseBoundedInt(flagSpec, raw);
		}
		if (flagSpec.kind === "number") {
		return parseBoundedNumber(flagSpec, raw);
		}
		// enum
		if (flagSpec.enum && !flagSpec.enum.includes(raw)) {
		return Result.err(`${flagSpec.flag} must be one of ${flagSpec.enum.join(", ")}`);
		}
		return Result.ok(raw);
		};
		/** Build the tool-args object from parsed value flags (spec S3). Exported for tests. */
		export const buildArgsFromFlags = async (spec, flags) => {
		const args = {};
		for (const flagSpec of spec.flags) {
		const value = flags[flagKey(flagSpec)];
		if (value === undefined) {
		continue;
		}
		// eslint-disable-next-line no-await-in-loop -- @file/@- reads must stay sequential
		const coerced = await coerceFlagValue(flagSpec, value);
		if (Result.isError(coerced)) {
		return { ok: false, message: coerced.error };
		}
		setPath(args, flagSpec.prop, coerced.value);
		}
		// Enforce required flags (spec S3): missing -> usage error (exit 2 upstream).
		for (const flagSpec of spec.flags) {
		if (flagSpec.required && flags[flagKey(flagSpec)] === undefined) {
		return { ok: false, message: `missing required flag ${flagSpec.flag}` };
		}
		}
		return { ok: true, args };
		};
		const buildArgsFromInput = async ({ inputRaw, spec, writers, }) => {
		let jsonText;
		if (inputRaw === "-") {
		jsonText = await readAllStdin();
		}
		else if (inputRaw.startsWith("@")) {
		const read = await Result.tryPromise({
		try: async () => await readFile(inputRaw.slice(1), "utf-8"),
		catch: (cause) => cause,
		});
		if (Result.isError(read)) {
		writers.stderr(`--input could not read file ${inputRaw.slice(1)}\n`);
		return undefined;
		}
		jsonText = read.value;
		}
		else {
		jsonText = inputRaw;
		}
		const parsed = Result.try(() => JSON.parse(jsonText));
		if (Result.isError(parsed)) {
		writers.stderr("--input is not valid JSON.\n");
		return undefined;
		}
		if (!isRecord(parsed.value)) {
		writers.stderr("--input must be a JSON object.\n");
		return undefined;
		}
		const validation = validateAgainstSchema(spec.inputSchema, parsed.value);
		if (!validation.valid) {
		writers.stderr(`--input invalid at ${validation.path}: ${validation.message}\n`);
		return undefined;
		}
		return parsed.value;
		};
		const scopeGranted = ({ token, scope, }) => {
		const claims = decodeAccessTokenClaims(token);
		if (claims?.scope === undefined) {
		// Opaque token or no scope claim: cannot verify locally, let the server rule.
		return true;
		}
		return claims.scope.split(/\s+/u).includes(`stella:${scope}`);
		};
		const confirmDestructive = async ({ context, flags, writers, label, }) => {
		if (flags[RESERVED_FLAG_KEYS.yes] === true) {
		return "proceed";
		}
		if (!context.process.stdin.isTTY) {
		writers.stderr("refusing destructive op without --yes on non-TTY\n");
		return "aborted";
		}
		// A TTY confirmation must read a single line: `readAllStdin` waits for EOF,
		// so `y`+Enter would never complete the prompt on a terminal.
		const rl = createInterface({
		input: context.process.stdin,
		output: context.process.stdout,
		});
		const rawAnswer = await rl.question(`Run destructive command '${label}'? [y/N] `);
		rl.close();
		const answer = rawAnswer.trim().toLowerCase();
		return answer === "y" \|\| answer === "yes" ? "proceed" : "aborted";
		};
		const mapClientErrorExit = (error) => {
		if (error.kind === "http") {
		if (error.httpStatus === 401) {
		return EXIT_CODES.auth;
		}
		if (error.httpStatus === 404) {
		return EXIT_CODES.notFound;
		}
		return EXIT_CODES.server;
		}
		if (error.kind === "rpc") {
		if (error.rpcCode === -32_602) {
		return EXIT_CODES.validation;
		}
		if (error.rpcCode === -32_601) {
		return EXIT_CODES.notFound;
		}
		return EXIT_CODES.server;
		}
		return EXIT_CODES.server;
		};
		const parsePayload = (result) => {
		const text = result.content.at(0)?.text ?? "";
		const parsed = Result.try(() => JSON.parse(text));
		return Result.isOk(parsed) ? parsed.value : undefined;
		};
		/**
		* Map a tool `isError` result to an exit class (spec 051 S4). A feature-disabled
		* failure is exit 5 only when the server tags the error payload with a known
		* machine code; a plain-text error (today's server) has no code and falls to
		* exit 4. Text is never pattern-matched (it is locale-dependent server output).
		*/
		const classifyToolError = (payload) => {
		if (!isRecord(payload)) {
		return EXIT_CODES.server;
		}
		const code = stringField(payload, "code") ?? stringField(payload["error"], "code");
		if (code !== null && FEATURE_DISABLED_ERROR_CODES.has(code)) {
		return EXIT_CODES.featureDisabled;
		}
		return EXIT_CODES.server;
		};
		/** Resolve the effective `OutputFormat` from the reserved output flags + TTY. */
		export const readOutputFormat = (flags, context) => {
		const output = flags[RESERVED_FLAG_KEYS.output];
		return selectFormat({
		flags: {
		output: output === "json" \|\| output === "table" ? output : undefined,
		json: flags[RESERVED_FLAG_KEYS.json] === true,
		table: flags[RESERVED_FLAG_KEYS.table] === true,
		},
		isTTY: context.process.stdout.isTTY,
		});
		};
		/** Follow `nextCursor` under `--all`, concatenating items/text within ceilings. */
		const followAll = async ({ spec, baseArgs, serverUrl, token, }) => {
		const items = [];
		let text = "";
		let firstPayload = {};
		let cursor = null;
		let pages = 0;
		let bytes = 0;
		let truncated = false;
		do {
		const args = { ...baseArgs, ...(cursor === null ? {} : { cursor }) };
		// eslint-disable-next-line no-await-in-loop -- each page's cursor comes from the previous response
		const call = await callTool({
		serverUrl,
		token,
		name: spec.toolName,
		args,
		});
		if (Result.isError(call)) {
		return call;
		}
		const payload = parsePayload(call.value);
		if (pages === 0 && isRecord(payload)) {
		firstPayload = payload;
		}
		pages += 1;
		if (spec.windowedText) {
		const chunk = stringField(payload, "text") ?? "";
		bytes += Buffer.byteLength(chunk);
		text += chunk;
		}
		else if (spec.itemsKey !== undefined) {
		const pageItems = arrayField(payload, spec.itemsKey);
		bytes += Buffer.byteLength(JSON.stringify(pageItems));
		items.push(...pageItems);
		}
		cursor = stringField(payload, "nextCursor");
		if (pages >= MAX_ALL_PAGES \|\|
		items.length >= MAX_ALL_ITEMS \|\|
		bytes >= MAX_ALL_BYTES) {
		truncated = cursor !== null;
		break;
		}
		} while (cursor !== null);
		const mergedPayload = spec.windowedText
		? { text, nextCursor: null }
		: { ...firstPayload, [spec.itemsKey ?? "items"]: items, nextCursor: null };
		return Result.ok({
		payload: mergedPayload,
		truncated,
		lastCursor: cursor,
		count: spec.windowedText ? Buffer.byteLength(text) : items.length,
		});
		};
		const renderCallResult = ({ context, spec, result, format, writers, }) => {
		if (result.isError) {
		writers.stderr(`${result.content.at(0)?.text ?? "Tool error"}\n`);
		setExit(context, classifyToolError(parsePayload(result)));
		return;
		}
		const payload = parsePayload(result);
		if (payload === undefined) {
		writers.stdout(`${result.content.at(0)?.text ?? ""}\n`);
		return;
		}
		const plan = buildRenderPlan({
		payload,
		itemsKey: spec.itemsKey,
		windowedText: spec.windowedText,
		singleReadActive: false,
		columns: undefined,
		});
		renderResult({ plan, format, writers, allActive: false });
		};
		/** Run one leaf command end to end. Sets `process.exitCode` per spec S4. */
		export const runLeafCommand = async ({ context, flags, spec, }) => {
		const writers = writersFor(context);
		const { serverUrl, token } = context;
		if (serverUrl === undefined \|\| token === undefined) {
		writers.stderr("Not signed in. Run 'stella auth login' to authenticate.\n");
		setExit(context, EXIT_CODES.auth);
		return;
		}
		const inputRaw = flags[RESERVED_FLAG_KEYS.input];
		let args;
		if (typeof inputRaw === "string") {
		const conflicting = spec.flags.some((flagSpec) => flags[flagKey(flagSpec)] !== undefined);
		if (conflicting) {
		writers.stderr("--input is exclusive with per-tool value flags.\n");
		setExit(context, EXIT_CODES.validation);
		return;
		}
		const parsed = await buildArgsFromInput({ inputRaw, spec, writers });
		if (parsed === undefined) {
		setExit(context, EXIT_CODES.validation);
		return;
		}
		args = parsed;
		}
		else {
		const built = await buildArgsFromFlags(spec, flags);
		if (!built.ok) {
		writers.stderr(`${built.message}\n`);
		setExit(context, EXIT_CODES.validation);
		return;
		}
		args = built.args;
		}
		if (spec.discriminatorInject !== undefined) {
		args = { ...args, ...spec.discriminatorInject };
		}
		// Client-side scope precheck (spec S3): fail before any server call.
		if (spec.scope !== undefined && !scopeGranted({ token, scope: spec.scope })) {
		writers.stderr(`Missing scope stella:${spec.scope}. Re-run 'stella auth login' to grant stella:${spec.scope}.\n`);
		setExit(context, EXIT_CODES.auth);
		return;
		}
		if (spec.destructive) {
		const outcome = await confirmDestructive({
		context,
		flags,
		writers,
		label: spec.commandPath.join(" "),
		});
		if (outcome === "aborted") {
		setExit(context, EXIT_CODES.aborted);
		return;
		}
		}
		// Windowed-text commands print raw document text by default; only an explicit
		// --json / --output json switches them to a structured envelope (spec S4).
		const explicitJson = flags[RESERVED_FLAG_KEYS.json] === true \|\|
		flags[RESERVED_FLAG_KEYS.output] === "json";
		const format = spec.windowedText && !explicitJson
		? "table"
		: readOutputFormat(flags, context);
		const allActive = spec.paginated && flags[RESERVED_FLAG_KEYS.all] === true;
		// Reserved pagination flags map onto the tool's cursor/limit args (spec S3).
		const cursorFlag = flags[RESERVED_FLAG_KEYS.cursor];
		const limitFlag = flags[RESERVED_FLAG_KEYS.limit];
		if (!allActive && typeof cursorFlag === "string") {
		args["cursor"] = cursorFlag;
		}
		if (typeof limitFlag === "string" && /^-?\d+$/u.test(limitFlag.trim())) {
		args["limit"] = Number.parseInt(limitFlag.trim(), 10);
		}
		if (allActive) {
		const outcome = await followAll({ spec, baseArgs: args, serverUrl, token });
		if (Result.isError(outcome)) {
		writers.stderr(`${outcome.error.message}\n`);
		setExit(context, mapClientErrorExit(outcome.error));
		return;
		}
		const plan = buildRenderPlan({
		payload: outcome.value.payload,
		itemsKey: spec.itemsKey,
		windowedText: spec.windowedText,
		singleReadActive: false,
		columns: undefined,
		});
		renderResult({ plan, format, writers, allActive: true });
		if (outcome.value.truncated) {
		writers.stderr(`--all truncated at ${outcome.value.count} items/pages; resume with --cursor ${outcome.value.lastCursor}\n`);
		}
		return;
		}
		const call = await callTool({ serverUrl, token, name: spec.toolName, args });
		if (Result.isError(call)) {
		writers.stderr(`${call.error.message}\n`);
		setExit(context, mapClientErrorExit(call.error));
		return;
		}
		renderCallResult({ context, spec, result: call.value, format, writers });
		};
		//# sourceMappingURL=run-leaf-command.js.map

+1

dist/run-leaf-command.js.map

+10

dist/run-resource-command.d.ts

		import type { Context } from "./context.js";
		import type { ResourceLeafSpec } from "./resource-types.js";
		type LeafFlags = Record<string, unknown>;
		/** Run one generated `reference` command end to end (spec 051 S5.4). */
		export declare const runResourceCommand: ({ context, flags, spec, }: {
		context: Context;
		flags: LeafFlags;
		spec: ResourceLeafSpec;
		}) => Promise<void>;
		export {};

+97

dist/run-resource-command.js

		// Executor for the generated `reference` resource commands (spec 051 S5.4).
		// `reference list` enumerates `resources/list` as a table; `reference show
		// <name>` reads the resource's fixed URI via `resources/read` and prints
		// `contents[0].text`, honoring `--output`. Resources are public (no scope
		// precheck); an unknown resource (server `resources/read` rejection) is exit 6.
		import { Result } from "better-result";
		import { listResources, readResource, } from "./mcp-client.js";
		import { EXIT_CODES } from "./mcp-constants.js";
		import { renderResult } from "./output.js";
		import { readOutputFormat, RESERVED_FLAG_KEYS, writersFor, } from "./run-leaf-command.js";
		const REFERENCE_COLUMNS = ["name", "title", "mimeType"];
		/** Resources fail only with unknown-URI: any rpc/404 maps to not-found (spec S4). */
		const mapResourceErrorExit = (error) => {
		if (error.kind === "rpc") {
		return EXIT_CODES.notFound;
		}
		if (error.kind === "http") {
		if (error.httpStatus === 401) {
		return EXIT_CODES.auth;
		}
		if (error.httpStatus === 404) {
		return EXIT_CODES.notFound;
		}
		return EXIT_CODES.server;
		}
		return EXIT_CODES.server;
		};
		const runList = async ({ context, serverUrl, token, format, writers, }) => {
		const result = await listResources({ serverUrl, token });
		if (Result.isError(result)) {
		writers.stderr(`${result.error.message}\n`);
		context.process.exitCode = mapResourceErrorExit(result.error);
		return;
		}
		const items = result.value.resources;
		renderResult({
		plan: {
		kind: "page",
		itemsKey: "resources",
		items,
		payload: { resources: items },
		nextCursor: null,
		columns: REFERENCE_COLUMNS,
		},
		format,
		writers,
		allActive: false,
		});
		};
		const runShow = async ({ context, spec, serverUrl, token, format, writers, }) => {
		const result = await readResource({ serverUrl, token, uri: spec.uri });
		if (Result.isError(result)) {
		writers.stderr(`${result.error.message}\n`);
		context.process.exitCode = mapResourceErrorExit(result.error);
		return;
		}
		const text = result.value.contents.at(0)?.text ?? "";
		renderResult({
		plan: { kind: "windowed-text", text, nextCursor: null },
		format,
		writers,
		allActive: false,
		});
		};
		/** Run one generated `reference` command end to end (spec 051 S5.4). */
		export const runResourceCommand = async ({ context, flags, spec, }) => {
		const writers = writersFor(context);
		const { serverUrl, token } = context;
		if (serverUrl === undefined \|\| token === undefined) {
		writers.stderr("Not signed in. Run 'stella auth login' to authenticate.\n");
		context.process.exitCode = EXIT_CODES.auth;
		return;
		}
		if (spec.kind === "list") {
		await runList({
		context,
		serverUrl,
		token,
		format: readOutputFormat(flags, context),
		writers,
		});
		return;
		}
		// `reference show` prints the resource text raw by default (like windowed-text
		// tool output); only an explicit --json/--output json wraps it (spec S5.4).
		const explicitJson = flags[RESERVED_FLAG_KEYS.json] === true \|\|
		flags[RESERVED_FLAG_KEYS.output] === "json";
		await runShow({
		context,
		spec,
		serverUrl,
		token,
		format: explicitJson ? "json" : "table",
		writers,
		});
		};
		//# sourceMappingURL=run-resource-command.js.map

+1

dist/run-resource-command.js.map

{"version":3,"file":"run-resource-command.js","sourceRoot":"","sources":["../src/run-resource-command.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGvC,OAAO,EACL,aAAa,EAEb,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAiB,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAmC,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAI/B,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAEjE,qFAAqF;AACrF,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAY,EAAE;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,QAAQ,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,KAAK,EAAE,EACrB,OAAO,EACP,SAAS,EACT,KAAK,EACL,MAAM,EACN,OAAO,GAOR,EAAiB,EAAE;IAClB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;IACrC,YAAY,CAAC;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,WAAW;YACrB,KAAK;YACL,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC7B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,iBAAiB;SAC3B;QACD,MAAM;QACN,OAAO;QACP,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,KAAK,EAAE,EACrB,OAAO,EACP,IAAI,EACJ,SAAS,EACT,KAAK,EACL,MAAM,EACN,OAAO,GAQR,EAAiB,EAAE;IAClB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IACrD,YAAY,CAAC;QACX,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;QACvD,MAAM;QACN,OAAO;QACP,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,OAAO,EACP,KAAK,EACL,IAAI,GAKL,EAAiB,EAAE;IAClB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QAC5E,OAAO,CAAC,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC;YACZ,OAAO;YACP,SAAS;YACT,KAAK;YACL,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;YACxC,OAAO;SACR,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI;QACvC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC;IAC9C,MAAM,OAAO,CAAC;QACZ,OAAO;QACP,IAAI;QACJ,SAAS;QACT,KAAK;QACL,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACvC,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC"}

+26

README.md

		# @stll/cli

		The `stella` command-line client.

		## Install

		```sh
		npm i -g @stll/cli
		```

		## Usage

		The command surface (`stella <resource> <action>`) is generated from the
		Stella MCP tool registry, so it mirrors the tools exposed by a Stella server.
		Run `stella --help` to list available commands.

		Authenticate against a Stella server with:

		```sh
		stella auth login
		```

		## Links

		- Repository: https://github.com/stella/stella/tree/main/packages/cli
		- Issues: https://github.com/stella/stella/issues

+61

-2

package.json

		{
		"name": "@stll/cli",
		"version": "0.0.1-placeholder.0",
		"description": "Placeholder to bootstrap npm trusted publishing. The real package ships from https://github.com/stella/stella (packages/cli)."
		"version": "0.1.0",
		"description": "Stella command-line client",
		"keywords": [
		"cli",
		"legal",
		"stella"
		],
		"homepage": "https://github.com/stella/stella/tree/main/packages/cli",
		"bugs": {
		"url": "https://github.com/stella/stella/issues"
		},
		"license": "Apache-2.0",
		"repository": {
		"type": "git",
		"url": "https://github.com/stella/stella.git",
		"directory": "packages/cli"
		},
		"bin": {
		"stella": "./dist/cli.js"
		},
		"files": [
		"dist",
		"README.md"
		],
		"type": "module",
		"engines": {
		"node": ">=20"
		},
		"sideEffects": false,
		"exports": {
		".": {
		"types": "./dist/cli.d.ts",
		"import": "./dist/cli.js"
		}
		},
		"publishConfig": {
		"access": "public"
		},
		"scripts": {
		"clean": "git clean -xdf dist .cache .turbo node_modules",
		"codegen": "cd ../../apps/api && bun scripts/export-mcp-tool-registry.ts && cd ../../packages/cli && bun run src/codegen.ts && oxfmt .",
		"build": "rm -rf dist && tsgo -p tsconfig.build.json && cp src/generated/registry-snapshot.json dist/generated/registry-snapshot.json && printf '%s\\n' '#!/usr/bin/env node' > dist/cli.js.tmp && tail -n +2 dist/cli.js >> dist/cli.js.tmp && mv dist/cli.js.tmp dist/cli.js && chmod +x dist/cli.js",
		"prepack": "bun run build",
		"pack:dry-run": "bun pm pack --dry-run",
		"test": "bun test src",
		"typecheck": "tsgo --noEmit",
		"lint": "cd ../.. && bun --bun oxlint -c oxlint.config.ts --report-unused-disable-directives-severity=error --deny-warnings --type-aware packages/cli",
		"lint:fix": "cd ../.. && bun --bun oxlint -c oxlint.config.ts --type-aware --fix packages/cli",
		"format": "oxfmt ."
		},
		"dependencies": {
		"@stricli/core": "^1.2.8",
		"better-result": "2.9.2",
		"valibot": "1.4.2"
		},
		"devDependencies": {
		"@stll/typescript-config": "0.0.0",
		"@types/bun": "1.3.14"
		},
		"main": "./dist/cli.js",
		"types": "./dist/cli.d.ts"
		}

@stll/cli - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics

Dependency changes