@agentteams/cli 0.1.82 → 0.1.84

package/dist/mcp-registration/serverSpec.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverSpec.js","sourceRoot":"","sources":["../../src/mcp-registration/serverSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM,EAAE,oBAAoB;IAC5B,SAAS,EAAE,uBAAuB;IAClC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;CACpB,CAAC;AAyBX,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEzD,MAAM,GAAG,GAA2B;QAClC,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,GAAG;QACjH,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,SAAS;QACtD,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM;KACjD,CAAC;IAEF,+EAA+E;IAC/E,+DAA+D;IAC/D,IAAI,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjE,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;IACvD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;AACzE,CAAC"}
+{"version":3,"file":"serverSpec.js","sourceRoot":"","sources":["../../src/mcp-registration/serverSpec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGjE,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,iDAAiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AA2BlD,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,aAAwC,UAAU;IAElD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/F,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,EAAE,CAAC;YAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;AAChE,CAAC"}

package/dist/mcp-registration/types.d.ts

@@ -2,8 +2,6 @@
 export declare const MCP_CLIENT_IDS: readonly ["claude-code", "codex", "copilot-cli", "opencode", "amp", "cursor-cli", "kimi-cli", "antigravity"];
 export type McpClientId = (typeof MCP_CLIENT_IDS)[number];
 export type McpScope = 'user' | 'project';
-/** Syntax the client uses to inherit a secret from its parent process. */
-export type McpSecretReference = 'dollarBraces' | 'opencodeEnv' | 'codexEnvVars';
 /** How the AgentTeams entry reaches the client's configuration. */
 export type McpInstallStrategy = 
 /** The client owns the format; we shell out to its documented non-interactive command. */
@@ -61,7 +59,6 @@ export interface McpClientDefinition {
     label: string;
     /** Executable names looked up on PATH. */
     executables: string[];
-    secretReference: McpSecretReference;
     /** Extra directories to probe when the client installs outside PATH (e.g. Kimi). */
     extraBinDirs?: (context: McpPathContext) => string[];
     /** Files/directories whose presence proves the client has been configured on this machine. */

package/dist/mcp-registration/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/types.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,eAAO,MAAM,cAAc,8GASjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AAEjF,mEAAmE;AACnE,MAAM,MAAM,kBAAkB;AAC5B,0FAA0F;AACxF,eAAe;AACjB,6EAA6E;GAC3E,WAAW;AACb,6FAA6F;GAC3F,YAAY,CAAC;AAEjB,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,wEAAwE;AACxE,MAAM,MAAM,aAAa;AACvB,8CAA8C;AAC5C,OAAO;AACT,+BAA+B;GAC7B,OAAO;AACT,gEAAgE;GAC9D,UAAU,CAAC;AAEf,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,mDAAmD;IACnD,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACjE,aAAa,EAAE,mBAAmB,CAAC;QACnC,6DAA6D;QAC7D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,WAAW,CAAC;IAChB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,kBAAkB,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,8FAA8F;IAC9F,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;IACxD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/mcp-registration/types.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,eAAO,MAAM,cAAc,8GASjB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1C,mEAAmE;AACnE,MAAM,MAAM,kBAAkB;AAC5B,0FAA0F;AACxF,eAAe;AACjB,6EAA6E;GAC3E,WAAW;AACb,6FAA6F;GAC3F,YAAY,CAAC;AAEjB,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtD,wEAAwE;AACxE,MAAM,MAAM,aAAa;AACvB,8CAA8C;AAC5C,OAAO;AACT,+BAA+B;GAC7B,OAAO;AACT,gEAAgE;GAC9D,UAAU,CAAC;AAEf,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,mDAAmD;IACnD,MAAM,CAAC,EAAE;QACP,SAAS,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACjE,aAAa,EAAE,mBAAmB,CAAC;QACnC,6DAA6D;QAC7D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,WAAW,CAAC;IAChB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,8FAA8F;IAC9F,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,EAAE,CAAC;IACrD,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,QAAQ,CAAC;AAEb,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,EAAE,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;IACxD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB"}

package/dist/types/index.d.ts

@@ -6,6 +6,14 @@
  * CLI Configuration stored in .agentteams/config.json
  * Contains credentials and project context for API communication
  */
+/**
+ * Which credential family this project is configured to authenticate with.
+ *
+ * `personal-token` is the default: project config stays secret-free while a
+ * rotating refresh token lives in the OS credential store. `api-key` is the
+ * explicit compatibility path for existing automation and legacy projects.
+ */
+export type AuthMode = 'api-key' | 'personal-token';
 export interface Config {
     /** Team ID from AgentTeams */
     teamId: string;
@@ -15,6 +23,8 @@ export interface Config {
     apiKey: string;
     /** API URL (e.g., "http://localhost:3001") */
     apiUrl: string;
+    /** Legacy migration marker; absent configs choose by whether an apiKey exists. */
+    authMode?: AuthMode;
 }
 /**
  * Plan from API

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEpD,MAAM,WAAW,MAAM;IACrB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,wBAAwB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC"}

package/dist/utils/apiKeyInput.d.ts

@@ -0,0 +1,16 @@
+export interface ApiKeyInputOptions {
+    apiKey?: string;
+    apiKeyFile?: string;
+}
+export interface ApiKeyInputDependencies {
+    readFile: (path: string) => string;
+    readStdin: () => string;
+    warn: (message: string) => void;
+}
+/**
+ * Resolve explicit credential input without ever writing the credential to
+ * output. The legacy argv path remains compatible, but every use explains the
+ * safer environment, file and stdin alternatives on stderr.
+ */
+export declare function resolveApiKeyInput(options: ApiKeyInputOptions, dependencies?: ApiKeyInputDependencies): string | undefined;
+//# sourceMappingURL=apiKeyInput.d.ts.map

package/dist/utils/apiKeyInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyInput.d.ts","sourceRoot":"","sources":["../../src/utils/apiKeyInput.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAmBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,uBAA6C,GAC1D,MAAM,GAAG,SAAS,CA8BpB"}

package/dist/utils/apiKeyInput.js

@@ -0,0 +1,47 @@
+import { readFileSync } from 'node:fs';
+const defaultDependencies = {
+    readFile: (path) => readFileSync(path, 'utf-8'),
+    readStdin: () => readFileSync(0, 'utf-8'),
+    warn: (message) => process.stderr.write(message),
+};
+const normalizeApiKey = (value, source) => {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error(`${source} is empty.`);
+    }
+    if (/\s/.test(normalized)) {
+        throw new Error(`${source} must contain exactly one API key without whitespace.`);
+    }
+    return normalized;
+};
+/**
+ * Resolve explicit credential input without ever writing the credential to
+ * output. The legacy argv path remains compatible, but every use explains the
+ * safer environment, file and stdin alternatives on stderr.
+ */
+export function resolveApiKeyInput(options, dependencies = defaultDependencies) {
+    if (options.apiKey !== undefined && options.apiKeyFile !== undefined) {
+        throw new Error('--api-key and --api-key-file cannot be used together.');
+    }
+    if (options.apiKey !== undefined) {
+        dependencies.warn('[warn] --api-key exposes credentials in shell history and process listings. Prefer AGENTTEAMS_API_KEY, --api-key-file <path>, or --api-key-file - for stdin.\n');
+        return normalizeApiKey(options.apiKey, '--api-key');
+    }
+    if (options.apiKeyFile === undefined) {
+        return undefined;
+    }
+    const source = options.apiKeyFile === '-' ? 'stdin' : `API key file ${options.apiKeyFile}`;
+    try {
+        const value = options.apiKeyFile === '-' ? dependencies.readStdin() : dependencies.readFile(options.apiKeyFile);
+        return normalizeApiKey(value, source);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            (error.message.endsWith('is empty.') || error.message.includes('exactly one API key'))) {
+            throw error;
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read ${source}: ${detail}`);
+    }
+}
+//# sourceMappingURL=apiKeyInput.js.map

package/dist/utils/apiKeyInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyInput.js","sourceRoot":"","sources":["../../src/utils/apiKeyInput.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAavC,MAAM,mBAAmB,GAA4B;IACnD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;IAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;IACzC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;CACjD,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,uDAAuD,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2B,EAC3B,eAAwC,mBAAmB;IAE3D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,YAAY,CAAC,IAAI,CACf,gKAAgK,CACjK,CAAC;QACF,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChH,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,KAAK;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,EACtF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/utils/authServer.d.ts

@@ -4,15 +4,50 @@ export type AuthResult = {
     projectId: string;
     agentName: string;
     apiKey: string;
-    apiUrl?: string;
     configId: string;
     seedPlanId?: string | null;
 };
-type AuthServerResult = {
+/**
+ * The authorization-code callback. Deliberately smaller than {@link AuthResult}:
+ * a single-use code that is worthless without the `code_verifier` this process
+ * never sent anywhere, instead of a long-lived key travelling through a browser.
+ */
+export type AuthorizationCodeResult = {
+    code: string;
+    state: string;
+};
+type AuthServerResult<T> = {
     server: Server;
-    waitForCallback: () => Promise<AuthResult>;
+    waitForCallback: () => Promise<T>;
     port: number;
+    /** Echo this back through the authorize URL; the callback is rejected without it. */
+    state: string;
+};
+type StartLocalAuthServerOptions = {
+    state?: string;
+};
+/** Unguessable value that proves a callback belongs to the login this process started. */
+export declare function createAuthState(): string;
+export type PkcePair = {
+    /** Stays in this process. Without it a stolen code cannot be redeemed. */
+    verifier: string;
+    /** S256 hash sent through the browser. */
+    challenge: string;
 };
-export declare function startLocalAuthServer(): Promise<AuthServerResult>;
+/**
+ * PKCE S256 pair.
+ *
+ * 48 random bytes base64url-encode to 64 characters, inside the server's
+ * 43–128 range (`api/src/routes/desktop-auth/index.ts`).
+ */
+export declare function createPkcePair(): PkcePair;
+/**
+ * Legacy login callback: the web posts the issued agent key back to this port.
+ * Kept unchanged for CLI/web combinations that predate the authorization-code
+ * path; `P3` is where it goes away.
+ */
+export declare function startLocalAuthServer(options?: StartLocalAuthServerOptions): Promise<AuthServerResult<AuthResult>>;
+/** Authorization-code login callback: only `{ code, state }` crosses this boundary. */
+export declare function startAuthorizationCodeServer(options?: StartLocalAuthServerOptions): Promise<AuthServerResult<AuthorizationCodeResult>>;
 export {};
 //# sourceMappingURL=authServer.d.ts.map

package/dist/utils/authServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authServer.d.ts","sourceRoot":"","sources":["../../src/utils/authServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAOjG,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAyHF,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAoJtE"}
+{"version":3,"file":"authServer.d.ts","sourceRoot":"","sources":["../../src/utils/authServer.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AAejG,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,2BAA2B,GAAG;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAGzC;AAkUD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAEjH;AAED,uFAAuF;AACvF,wBAAgB,4BAA4B,CAC1C,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAKpD"}

package/dist/utils/authServer.js

@@ -1,36 +1,45 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
-const DEFAULT_OAUTH_PORT = 7777;
-const OAUTH_PORT_MIN = 7777;
-const OAUTH_PORT_MAX = 7790;
 const CALLBACK_TIMEOUT_MS = 60_000;
-function parsePort(value) {
-    if (!value) {
-        return null;
-    }
-    const parsedPort = Number.parseInt(value, 10);
-    if (Number.isNaN(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
-        return null;
-    }
-    return parsedPort;
+const DEFAULT_WEB_URL = 'https://agentteams.run';
+/** 24 random bytes → 32 base64url characters, comfortably above the 16-character floor. */
+const AUTH_STATE_BYTES = 24;
+// Only a web build older than this CLI omits the state, so a plain "try again"
+// would loop the user forever. Say what is actually wrong and give the two exits
+// that work: wait for the deploy, or install a CLI that matches the live web.
+const WEB_UPDATE_HINT = 'The AgentTeams web page did not echo the login state, so it is older than this CLI. ' +
+    'Hard-refresh /cli/authorize and retry; if it keeps failing, the web deploy has not caught up yet — ' +
+    'retry in a few minutes or install a CLI version matching the deployed web.';
+/** Unguessable value that proves a callback belongs to the login this process started. */
+export function createAuthState() {
+    return randomBytes(AUTH_STATE_BYTES).toString('base64url');
 }
-function buildCandidatePorts() {
-    const requestedPort = parsePort(process.env.AGENTTEAMS_OAUTH_PORT) ?? DEFAULT_OAUTH_PORT;
-    const rangePorts = [];
-    for (let port = OAUTH_PORT_MIN; port <= OAUTH_PORT_MAX; port += 1) {
-        rangePorts.push(port);
-    }
-    const uniquePorts = new Set();
-    uniquePorts.add(requestedPort);
-    for (const port of rangePorts) {
-        uniquePorts.add(port);
-    }
-    return Array.from(uniquePorts.values());
+/**
+ * PKCE S256 pair.
+ *
+ * 48 random bytes base64url-encode to 64 characters, inside the server's
+ * 43–128 range (`api/src/routes/desktop-auth/index.ts`).
+ */
+export function createPkcePair() {
+    const verifier = randomBytes(48).toString('base64url');
+    return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url') };
 }
-function listenOnPort(server, port) {
+function isAuthorizationCodeResult(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return typeof candidate.code === 'string' && candidate.code.length > 0;
+}
+function listenOnEphemeralPort(server) {
     return new Promise((resolve, reject) => {
         const onListening = () => {
             server.removeListener('error', onError);
-            resolve();
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                reject(new Error('The local OAuth callback server did not report a TCP port.'));
+                return;
+            }
+            resolve(address.port);
         };
         const onError = (error) => {
             server.removeListener('listening', onListening);
@@ -38,7 +47,9 @@ function listenOnPort(server, port) {
         };
         server.once('listening', onListening);
         server.once('error', onError);
-        server.listen(port, 'localhost');
+        // Port 0 asks the OS for a free port: nothing for another local process to
+        // squat on ahead of time, and no fixed range to exhaust.
+        server.listen(0, 'localhost');
     });
 }
 function isAuthResult(value) {
@@ -51,10 +62,34 @@ function isAuthResult(value) {
         typeof candidate.projectId === 'string' &&
         typeof candidate.agentName === 'string' &&
         typeof candidate.apiKey === 'string' &&
-        (candidate.apiUrl === undefined || typeof candidate.apiUrl === 'string') &&
         typeof candidate.configId === 'string' &&
         seedPlanIdValid);
 }
+/**
+ * Copy only the fields the CLI trusts. Anything else in the payload — notably an
+ * `apiUrl` pointing every later request at an attacker's server — is dropped here.
+ */
+function toAuthResult(payload) {
+    const result = {
+        teamId: payload.teamId,
+        projectId: payload.projectId,
+        agentName: payload.agentName,
+        apiKey: payload.apiKey,
+        configId: payload.configId,
+    };
+    if (payload.seedPlanId !== undefined) {
+        result.seedPlanId = payload.seedPlanId;
+    }
+    return result;
+}
+function statesMatch(expected, received) {
+    const expectedBytes = Buffer.from(expected, 'utf-8');
+    const receivedBytes = Buffer.from(received, 'utf-8');
+    if (expectedBytes.length !== receivedBytes.length) {
+        return false;
+    }
+    return timingSafeEqual(expectedBytes, receivedBytes);
+}
 function readRequestBody(request) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -63,24 +98,47 @@ function readRequestBody(request) {
         request.on('error', reject);
     });
 }
+function normalizeOrigin(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Only the configured web origin may post a callback. There is deliberately no
+ * blanket `http://localhost:*` allowance: any page served from any local port
+ * used to qualify. Local development and the dev environment opt in explicitly
+ * instead, through `AGENTTEAMS_WEB_URL` or `AGENTTEAMS_OAUTH_ALLOWED_ORIGINS`.
+ */
 function getAllowedOrigins() {
-    const webUrl = process.env.AGENTTEAMS_WEB_URL || 'https://agentteams.run';
-    return [webUrl.replace(/\/+$/, '')];
+    const origins = new Set();
+    const webOrigin = normalizeOrigin(process.env.AGENTTEAMS_WEB_URL || DEFAULT_WEB_URL);
+    if (webOrigin) {
+        origins.add(webOrigin);
+    }
+    for (const entry of (process.env.AGENTTEAMS_OAUTH_ALLOWED_ORIGINS ?? '').split(',')) {
+        const trimmed = entry.trim();
+        if (trimmed.length === 0) {
+            continue;
+        }
+        const origin = normalizeOrigin(trimmed);
+        if (origin) {
+            origins.add(origin);
+        }
+    }
+    return Array.from(origins.values());
 }
 function isAllowedOrigin(origin) {
-    const allowedOrigins = getAllowedOrigins();
-    if (allowedOrigins.includes(origin)) {
-        return true;
-    }
-    // Allow localhost with any port for dev
-    if (/^http:\/\/localhost(:\d+)?$/.test(origin)) {
-        return true;
+    if (!origin) {
+        return false;
     }
-    return false;
+    return getAllowedOrigins().includes(origin);
 }
 function setCorsHeaders(response, request) {
     const origin = request?.headers.origin;
-    if (origin && isAllowedOrigin(origin)) {
+    if (isAllowedOrigin(origin)) {
         response.setHeader('Access-Control-Allow-Origin', origin);
         response.setHeader('Vary', 'Origin');
     }
@@ -96,7 +154,16 @@ function sendJson(response, statusCode, payload, request) {
     });
     response.end(body);
 }
-export async function startLocalAuthServer() {
+/**
+ * The hardened loopback callback server, shared by both login paths.
+ *
+ * Origin allow-listing, constant-time state comparison, the ephemeral port, and
+ * the "a forged callback must not consume this login" rule all live here once:
+ * the authorization-code path must not get a second, weaker copy of them. The
+ * only difference between the two callers is which payload shape they accept.
+ */
+async function startCallbackServer(parsePayload, options) {
+    const expectedState = options?.state ?? createAuthState();
     let settled = false;
     let timeoutHandle = null;
     let isWaiting = false;
@@ -148,17 +215,39 @@ export async function startLocalAuthServer() {
             sendJson(response, 404, { message: 'Not found.' }, request);
             return;
         }
+        // CORS headers only tell a browser what to do with a response; the body was
+        // accepted long before that. Refuse the request itself instead.
+        if (!isAllowedOrigin(request.headers.origin)) {
+            sendJson(response, 403, { message: 'OAuth callback origin is not allowed.' }, request);
+            return;
+        }
         if (settled) {
             sendJson(response, 409, { message: 'OAuth callback already processed.' }, request);
             return;
         }
         try {
             const rawBody = await readRequestBody(request);
-            const payload = JSON.parse(rawBody);
-            if (!isAuthResult(payload)) {
+            const rawPayload = JSON.parse(rawBody);
+            const payload = parsePayload(rawPayload);
+            if (!payload) {
                 sendJson(response, 400, { message: 'Invalid OAuth callback payload.' }, request);
                 return;
             }
+            // The state is read from the raw body, not from the parsed result: the
+            // legacy parser strips every field the CLI does not trust, `state`
+            // included, and it must still be checked before anything is accepted.
+            const receivedState = rawPayload.state;
+            if (typeof receivedState !== 'string' || receivedState.length === 0) {
+                sendJson(response, 400, { message: `Missing OAuth callback state. ${WEB_UPDATE_HINT}` }, request);
+                return;
+            }
+            // A mismatch must not consume `settled`: the login this process started is
+            // still outstanding, and burning it here would hand a forged callback a
+            // trivial denial of service.
+            if (!statesMatch(expectedState, receivedState)) {
+                sendJson(response, 400, { message: 'OAuth callback state does not match this login.' }, request);
+                return;
+            }
             sendJson(response, 200, { success: true }, request);
             setTimeout(() => {
                 resolveAuth(payload);
@@ -168,27 +257,9 @@ export async function startLocalAuthServer() {
             sendJson(response, 400, { message: 'Invalid JSON body.' }, request);
         }
     });
-    let port = null;
-    for (const candidatePort of buildCandidatePorts()) {
-        try {
-            await listenOnPort(server, candidatePort);
-            port = candidatePort;
-            break;
-        }
-        catch (error) {
-            const errorCode = typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
-            if (errorCode !== 'EADDRINUSE') {
-                throw error;
-            }
-        }
-    }
-    if (port === null) {
-        throw new Error(`No available OAuth callback port found in ${OAUTH_PORT_MIN}-${OAUTH_PORT_MAX} and requested AGENTTEAMS_OAUTH_PORT.`);
-    }
+    const port = await listenOnEphemeralPort(server);
     server.on('error', (error) => {
-        rejectAuth(new Error(error.code === 'EADDRINUSE'
-            ? `OAuth callback port ${port} is already in use.`
-            : `OAuth callback server failed: ${error.message}`));
+        rejectAuth(new Error(`OAuth callback server failed: ${error.message}`));
     });
     server.once('close', () => {
         if (!settled && isWaiting) {
@@ -213,6 +284,19 @@ export async function startLocalAuthServer() {
         server,
         waitForCallback,
         port,
+        state: expectedState,
     };
 }
+/**
+ * Legacy login callback: the web posts the issued agent key back to this port.
+ * Kept unchanged for CLI/web combinations that predate the authorization-code
+ * path; `P3` is where it goes away.
+ */
+export function startLocalAuthServer(options) {
+    return startCallbackServer((value) => (isAuthResult(value) ? toAuthResult(value) : null), options);
+}
+/** Authorization-code login callback: only `{ code, state }` crosses this boundary. */
+export function startAuthorizationCodeServer(options) {
+    return startCallbackServer((value) => (isAuthorizationCodeResult(value) ? { code: value.code, state: value.state } : null), options);
+}
 //# sourceMappingURL=authServer.js.map

package/dist/utils/authServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"authServer.js","sourceRoot":"","sources":["../../src/utils/authServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAkBnC,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,kBAAkB,CAAC;IACzF,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,IAAI,IAAI,GAAG,cAAc,EAAE,IAAI,IAAI,cAAc,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAClE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAgC,EAAQ,EAAE;YACzD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,eAAe,GACnB,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC;IAElH,OAAO,CACL,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxE,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;QACtC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;IAC1E,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;IAE3C,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wCAAwC;IACxC,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB,EAAE,OAAyB;IACzE,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;IAEvC,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,UAAkB,EAAE,OAAgB,EAAE,OAAyB;IACzG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,aAAa,GAA0B,IAAI,CAAC;IAChD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,eAA2D,CAAC;IAChE,IAAI,cAAoD,CAAC;IAEzD,MAAM,eAAe,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClE,eAAe,GAAG,OAAO,CAAC;QAC1B,cAAc,GAAG,MAAM,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,OAAmB,EAAQ,EAAE;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,KAAY,EAAQ,EAAE;QACxC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,kBAAkB,EAAE,CAAC;QACrB,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,UAAU,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,OAAO,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAE7C,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAEpD,UAAU,CAAC,GAAG,EAAE;gBACd,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,aAAa,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC1C,IAAI,GAAG,aAAa,CAAC;YACrB,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAClH,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,6CAA6C,cAAc,IAAI,cAAc,uCAAuC,CACrH,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAgC,EAAE,EAAE;QACtD,UAAU,CACR,IAAI,KAAK,CACP,KAAK,CAAC,IAAI,KAAK,YAAY;YACzB,CAAC,CAAC,uBAAuB,IAAI,qBAAqB;YAClD,CAAC,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CACrD,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,kBAAkB,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,GAAwB,EAAE;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,UAAU,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACtE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,eAAe;QACf,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authServer.js","sourceRoot":"","sources":["../../src/utils/authServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,eAAe,GACnB,sFAAsF;IACtF,qGAAqG;IACrG,4EAA4E,CAAC;AAiC/E,0FAA0F;AAC1F,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7D,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,eAAe,GACnB,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC;IAElH,OAAO,CACL,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;QACtC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAA6C;IACjE,MAAM,MAAM,GAAe;QACzB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACzC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,QAAgB;IACrD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,eAAe,CAAC,CAAC;IACrF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,iBAAiB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB,EAAE,OAAyB;IACzE,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;IAEvC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,UAAkB,EAAE,OAAgB,EAAE,OAAyB;IACzG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE;QAC7B,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAA0C,EAC1C,OAAqC;IAErC,MAAM,aAAa,GAAG,OAAO,EAAE,KAAK,IAAI,eAAe,EAAE,CAAC;IAE1D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,aAAa,GAA0B,IAAI,CAAC;IAChD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,eAAkD,CAAC;IACvD,IAAI,cAAoD,CAAC;IAEzD,MAAM,eAAe,GAAG,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,eAAe,GAAG,OAAO,CAAC;QAC1B,cAAc,GAAG,MAAM,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAS,EAAE;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,OAAU,EAAQ,EAAE;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,KAAY,EAAQ,EAAE;QACxC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,kBAAkB,EAAE,CAAC;QACrB,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,UAAU,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,OAAO,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,OAAO,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,MAAM,aAAa,GAAI,UAAsC,CAAC,KAAK,CAAC;YACpE,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,iCAAiC,eAAe,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,6BAA6B;YAC7B,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC/C,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,EAAE,OAAO,CAAC,CAAC;gBACjG,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAEpD,UAAU,CAAC,GAAG,EAAE;gBACd,WAAW,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;QAClC,UAAU,CAAC,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC;YACf,kBAAkB,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,GAAe,EAAE;QACvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,UAAU,CAAC,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACtE,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1B,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,eAAe;QACf,IAAI;QACJ,KAAK,EAAE,aAAa;KACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAqC;IACxE,OAAO,mBAAmB,CAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACjH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,4BAA4B,CAC1C,OAAqC;IAErC,OAAO,mBAAmB,CACxB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAC/F,OAAO,CACR,CAAC;AACJ,CAAC"}