@agentteams/cli 0.1.82 → 0.1.84

package/README.md

@@ -351,9 +351,10 @@ Configuration is merged in this priority order (highest first):
 }
 ```
 
-`apiUrl` is omitted for the default API. When `init` is completed against a non-default API
-such as dev, self-hosted, or localhost, the CLI persists that `apiUrl` so later commands keep
-using the same API.
+`apiUrl` is omitted for the default API. When `AGENTTEAMS_API_URL` points somewhere else — a
+local API or the dev environment — `init` persists that value so later commands keep using the
+same API. The API destination comes from the CLI's own environment only; the browser callback
+never supplies it.
 
 ### Environment Variable Example
 

package/dist/auth/activeCredential.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The credential this process is currently authenticating with, in a form the
+ * HTTP layer can act on.
+ *
+ * `utils/httpClient.ts` must be able to answer "can this 401 be fixed by a
+ * refresh?" without importing the config loader (which imports the token client,
+ * which would import the HTTP layer back). A one-slot registry keeps that
+ * dependency edge from existing at all.
+ *
+ * Only the personal-token path registers anything here. A legacy `key_` run
+ * leaves the slot empty, which is what makes "never attempt a refresh on the old
+ * path" a structural property rather than a conditional the caller must remember.
+ */
+export interface RefreshableCredential {
+    /** Discard the cached access token and fetch a new one. Null means "could not". */
+    refresh(): Promise<string | null>;
+}
+export declare function setActiveCredential(credential: RefreshableCredential | null): void;
+export declare function getActiveCredential(): RefreshableCredential | null;
+/** Test-only: return the process to the "no refreshable credential" state. */
+export declare function resetActiveCredentialForTests(): void;
+//# sourceMappingURL=activeCredential.d.ts.map

package/dist/auth/activeCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activeCredential.d.ts","sourceRoot":"","sources":["../../src/auth/activeCredential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnC;AAID,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAElF;AAED,wBAAgB,mBAAmB,IAAI,qBAAqB,GAAG,IAAI,CAElE;AAED,8EAA8E;AAC9E,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/auth/activeCredential.js

@@ -0,0 +1,25 @@
+/**
+ * The credential this process is currently authenticating with, in a form the
+ * HTTP layer can act on.
+ *
+ * `utils/httpClient.ts` must be able to answer "can this 401 be fixed by a
+ * refresh?" without importing the config loader (which imports the token client,
+ * which would import the HTTP layer back). A one-slot registry keeps that
+ * dependency edge from existing at all.
+ *
+ * Only the personal-token path registers anything here. A legacy `key_` run
+ * leaves the slot empty, which is what makes "never attempt a refresh on the old
+ * path" a structural property rather than a conditional the caller must remember.
+ */
+let active = null;
+export function setActiveCredential(credential) {
+    active = credential;
+}
+export function getActiveCredential() {
+    return active;
+}
+/** Test-only: return the process to the "no refreshable credential" state. */
+export function resetActiveCredentialForTests() {
+    active = null;
+}
+//# sourceMappingURL=activeCredential.js.map

package/dist/auth/activeCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activeCredential.js","sourceRoot":"","sources":["../../src/auth/activeCredential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,IAAI,MAAM,GAAiC,IAAI,CAAC;AAEhD,MAAM,UAAU,mBAAmB,CAAC,UAAwC;IAC1E,MAAM,GAAG,UAAU,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/auth/credentialStore.d.ts

@@ -0,0 +1,89 @@
+/**
+ * OS-protected credential storage for the CLI.
+ *
+ * The CLI ships as a plain npm package, so a native addon (keytar and friends)
+ * would add a build toolchain requirement to every install. Instead each
+ * platform's own credential tool is driven as a subprocess:
+ *
+ *   macOS    `security`     (login keychain)
+ *   Windows  `powershell`   (Windows.Security.Credentials.PasswordVault)
+ *   Linux    `secret-tool`  (libsecret / Secret Service)
+ *
+ * When none of them is usable the store **refuses to persist**: nothing is
+ * written to disk in plaintext, the secret is kept for this process only, and
+ * the caller is told so it can point CI users at the long-lived `key_` path
+ * instead. This mirrors `desktop/src/main/localAgent/credentialStore.ts`, which
+ * declines to write when `safeStorage` is unavailable — the two must not drift.
+ */
+/** One keychain "service" groups every CLI credential under a single name. */
+export declare const CREDENTIAL_SERVICE = "agentteams-cli";
+export type CredentialBackendId = 'macos-keychain' | 'windows-credential-manager' | 'libsecret' | 'none';
+/**
+ * Why the store can (or cannot) persist.
+ *
+ * `WRITE_FAILED` is the one that is only knowable after trying: the probe below
+ * is deliberately cheap, so a locked macOS keychain ("User interaction is not
+ * allowed") or a Linux box with `secret-tool` installed but no Secret Service
+ * daemon running still reports `OK` until the first write is attempted.
+ */
+export type CredentialStoreReason = 'OK' | 'NO_BACKEND' | 'UNSUPPORTED_PLATFORM' | 'WRITE_FAILED';
+export interface CredentialStoreStatus {
+    backend: CredentialBackendId;
+    /** false → nothing is ever written to disk; the secret lives in this process only. */
+    persisted: boolean;
+    reason: CredentialStoreReason;
+    /** Masked backend error, present only once a write has actually failed. */
+    detail?: string;
+}
+export interface CredentialSaveOutcome {
+    persisted: boolean;
+    reason: CredentialStoreReason;
+    /** Masked backend error, present only when `reason` is `WRITE_FAILED`. */
+    detail?: string;
+}
+export interface CommandResult {
+    /** null when the executable could not be spawned at all. */
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+export interface CredentialCommand {
+    command: string;
+    args: string[];
+    /** Written to the child's stdin. Never placed on argv — argv is world-readable via `ps`. */
+    input?: string;
+    /** Extra environment for the child. Used on Windows so the secret stays off argv. */
+    env?: Record<string, string>;
+}
+export type CommandRunner = (command: CredentialCommand) => CommandResult;
+export interface CredentialStore {
+    status(): CredentialStoreStatus;
+    read(account: string): string | null;
+    save(account: string, secret: string): CredentialSaveOutcome;
+    remove(account: string): void;
+}
+export interface CreateCredentialStoreOptions {
+    runner?: CommandRunner;
+    platform?: NodeJS.Platform;
+    service?: string;
+}
+export declare function resolveBackendId(platform: NodeJS.Platform): CredentialBackendId;
+/** Cheap "is this backend usable at all" call. Exit code 0 means yes. */
+export declare function buildProbeCommand(backend: CredentialBackendId): CredentialCommand | null;
+export declare function buildReadCommand(backend: CredentialBackendId, service: string, account: string): CredentialCommand | null;
+export declare function buildSaveCommand(backend: CredentialBackendId, service: string, account: string, secret: string): CredentialCommand | null;
+export declare function buildRemoveCommand(backend: CredentialBackendId, service: string, account: string): CredentialCommand | null;
+/**
+ * Strip a secret out of anything that is about to be surfaced.
+ *
+ * Backend tools do not normally echo the value back, but "normally" is not a
+ * guarantee worth betting a token on — and this store is the last boundary
+ * before text reaches a log or an error message.
+ */
+export declare function maskSecret(text: string, secret: string): string;
+export declare function createCredentialStore(options?: CreateCredentialStoreOptions): CredentialStore;
+/** Process-wide store. Tests build their own through {@link createCredentialStore}. */
+export declare function getCredentialStore(): CredentialStore;
+/** Test-only: drop the cached process-wide store. */
+export declare function resetCredentialStoreForTests(): void;
+//# sourceMappingURL=credentialStore.d.ts.map

package/dist/auth/credentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.d.ts","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,4BAA4B,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,GAAG,YAAY,GAAG,sBAAsB,GAAG,cAAc,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,sFAAsF;IACtF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,aAAa,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,MAAM,IAAI,qBAAqB,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAC7D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA2BD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,mBAAmB,CAW/E;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,GAAG,IAAI,CAWxF;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,iBAAiB,GAAG,IAAI,CAe1B;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,iBAAiB,GAAG,IAAI,CA0B1B;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,iBAAiB,GAAG,IAAI,CAc1B;AAiBD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,eAAe,CA6GjG;AAID,uFAAuF;AACvF,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED,qDAAqD;AACrD,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}

package/dist/auth/credentialStore.js

@@ -0,0 +1,254 @@
+/**
+ * OS-protected credential storage for the CLI.
+ *
+ * The CLI ships as a plain npm package, so a native addon (keytar and friends)
+ * would add a build toolchain requirement to every install. Instead each
+ * platform's own credential tool is driven as a subprocess:
+ *
+ *   macOS    `security`     (login keychain)
+ *   Windows  `powershell`   (Windows.Security.Credentials.PasswordVault)
+ *   Linux    `secret-tool`  (libsecret / Secret Service)
+ *
+ * When none of them is usable the store **refuses to persist**: nothing is
+ * written to disk in plaintext, the secret is kept for this process only, and
+ * the caller is told so it can point CI users at the long-lived `key_` path
+ * instead. This mirrors `desktop/src/main/localAgent/credentialStore.ts`, which
+ * declines to write when `safeStorage` is unavailable — the two must not drift.
+ */
+import { spawnSync } from 'node:child_process';
+/** One keychain "service" groups every CLI credential under a single name. */
+export const CREDENTIAL_SERVICE = 'agentteams-cli';
+const WINDOWS_SERVICE_ENV = 'AGENTTEAMS_CREDENTIAL_SERVICE';
+const WINDOWS_ACCOUNT_ENV = 'AGENTTEAMS_CREDENTIAL_ACCOUNT';
+const WINDOWS_SECRET_ENV = 'AGENTTEAMS_CREDENTIAL_SECRET';
+/**
+ * PasswordVault is WinRT, so it is projected into PowerShell rather than called
+ * directly. Every script starts from the same preamble; the caller appends the
+ * operation. Inputs arrive through the environment because a PowerShell command
+ * line is as visible as any other argv.
+ */
+const WINDOWS_PREAMBLE = [
+    '$ErrorActionPreference = "Stop"',
+    '[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]',
+    '$vault = New-Object Windows.Security.Credentials.PasswordVault',
+].join('; ');
+function powershellCommand(script, env) {
+    const command = {
+        command: 'powershell',
+        args: ['-NoProfile', '-NonInteractive', '-Command', `${WINDOWS_PREAMBLE}; ${script}`],
+    };
+    if (env)
+        command.env = env;
+    return command;
+}
+export function resolveBackendId(platform) {
+    switch (platform) {
+        case 'darwin':
+            return 'macos-keychain';
+        case 'win32':
+            return 'windows-credential-manager';
+        case 'linux':
+            return 'libsecret';
+        default:
+            return 'none';
+    }
+}
+/** Cheap "is this backend usable at all" call. Exit code 0 means yes. */
+export function buildProbeCommand(backend) {
+    switch (backend) {
+        case 'macos-keychain':
+            return { command: 'security', args: ['list-keychains'] };
+        case 'libsecret':
+            return { command: 'secret-tool', args: ['--version'] };
+        case 'windows-credential-manager':
+            return powershellCommand('exit 0');
+        default:
+            return null;
+    }
+}
+export function buildReadCommand(backend, service, account) {
+    switch (backend) {
+        case 'macos-keychain':
+            return { command: 'security', args: ['find-generic-password', '-a', account, '-s', service, '-w'] };
+        case 'libsecret':
+            return { command: 'secret-tool', args: ['lookup', 'service', service, 'account', account] };
+        case 'windows-credential-manager':
+            return powershellCommand(`$c = $vault.Retrieve($env:${WINDOWS_SERVICE_ENV}, $env:${WINDOWS_ACCOUNT_ENV}); ` +
+                '$c.RetrievePassword(); [Console]::Out.Write($c.Password)', { [WINDOWS_SERVICE_ENV]: service, [WINDOWS_ACCOUNT_ENV]: account });
+        default:
+            return null;
+    }
+}
+export function buildSaveCommand(backend, service, account, secret) {
+    switch (backend) {
+        case 'macos-keychain':
+            // `-w` without a value makes `security` read the password from stdin, and
+            // it asks for it twice ("retype password"), so the value is written twice.
+            // Passing `-w <secret>` instead would expose the token on argv.
+            return {
+                command: 'security',
+                args: ['add-generic-password', '-a', account, '-s', service, '-U', '-w'],
+                input: `${secret}\n${secret}\n`,
+            };
+        case 'libsecret':
+            return {
+                command: 'secret-tool',
+                args: ['store', '--label', `${service} (${account})`, 'service', service, 'account', account],
+                input: secret,
+            };
+        case 'windows-credential-manager':
+            return powershellCommand('$vault.Add((New-Object Windows.Security.Credentials.PasswordCredential(' +
+                `$env:${WINDOWS_SERVICE_ENV}, $env:${WINDOWS_ACCOUNT_ENV}, $env:${WINDOWS_SECRET_ENV})))`, { [WINDOWS_SERVICE_ENV]: service, [WINDOWS_ACCOUNT_ENV]: account, [WINDOWS_SECRET_ENV]: secret });
+        default:
+            return null;
+    }
+}
+export function buildRemoveCommand(backend, service, account) {
+    switch (backend) {
+        case 'macos-keychain':
+            return { command: 'security', args: ['delete-generic-password', '-a', account, '-s', service] };
+        case 'libsecret':
+            return { command: 'secret-tool', args: ['clear', 'service', service, 'account', account] };
+        case 'windows-credential-manager':
+            return powershellCommand(`$c = $vault.Retrieve($env:${WINDOWS_SERVICE_ENV}, $env:${WINDOWS_ACCOUNT_ENV}); $vault.Remove($c)`, { [WINDOWS_SERVICE_ENV]: service, [WINDOWS_ACCOUNT_ENV]: account });
+        default:
+            return null;
+    }
+}
+const defaultRunner = (command) => {
+    const result = spawnSync(command.command, command.args, {
+        encoding: 'utf-8',
+        input: command.input,
+        windowsHide: true,
+        env: command.env ? { ...process.env, ...command.env } : process.env,
+    });
+    return {
+        status: result.error ? null : result.status,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+};
+/**
+ * Strip a secret out of anything that is about to be surfaced.
+ *
+ * Backend tools do not normally echo the value back, but "normally" is not a
+ * guarantee worth betting a token on — and this store is the last boundary
+ * before text reaches a log or an error message.
+ */
+export function maskSecret(text, secret) {
+    if (!secret)
+        return text;
+    return text.split(secret).join('***');
+}
+export function createCredentialStore(options = {}) {
+    const runner = options.runner ?? defaultRunner;
+    const platform = options.platform ?? process.platform;
+    const service = options.service ?? CREDENTIAL_SERVICE;
+    const backend = resolveBackendId(platform);
+    /**
+     * Session-only fallback, and a read cache on top of a working backend.
+     * A one-shot command barely benefits, but `agentteams mcp` runs for hours and
+     * would otherwise re-shell out on every credential resolution.
+     */
+    const memory = new Map();
+    let availability = null;
+    /**
+     * Set once a write is rejected by a backend that passed the probe. From then
+     * on `status()` tells the truth — "this store looks present but will not keep
+     * anything" — instead of promising a durability it has already failed to give.
+     */
+    let writeFailureDetail = null;
+    const isAvailable = () => {
+        if (availability !== null)
+            return availability;
+        const probe = buildProbeCommand(backend);
+        if (!probe) {
+            availability = false;
+            return availability;
+        }
+        // A backend that cannot even be probed is treated as absent rather than as
+        // an error: the caller's job is to fall back, not to fail the command.
+        availability = runner(probe).status === 0;
+        return availability;
+    };
+    const status = () => {
+        if (backend === 'none') {
+            return { backend, persisted: false, reason: 'UNSUPPORTED_PLATFORM' };
+        }
+        if (writeFailureDetail !== null) {
+            return { backend, persisted: false, reason: 'WRITE_FAILED', detail: writeFailureDetail };
+        }
+        const available = isAvailable();
+        return { backend, persisted: available, reason: available ? 'OK' : 'NO_BACKEND' };
+    };
+    return {
+        status,
+        read(account) {
+            const cached = memory.get(account);
+            if (cached !== undefined)
+                return cached;
+            if (!isAvailable())
+                return null;
+            const command = buildReadCommand(backend, service, account);
+            if (!command)
+                return null;
+            const result = runner(command);
+            // A missing item (`security` 44, `secret-tool` 1) and a broken backend
+            // both mean the same thing to the caller: there is no credential to use.
+            if (result.status !== 0)
+                return null;
+            // `security -w` and `secret-tool lookup` both terminate the value with a
+            // newline; a token never legitimately ends in whitespace.
+            const secret = result.stdout.replace(/\r?\n$/, '');
+            if (secret.length === 0)
+                return null;
+            memory.set(account, secret);
+            return secret;
+        },
+        save(account, secret) {
+            memory.set(account, secret);
+            if (!isAvailable()) {
+                return { persisted: false, reason: backend === 'none' ? 'UNSUPPORTED_PLATFORM' : 'NO_BACKEND' };
+            }
+            const command = buildSaveCommand(backend, service, account, secret);
+            if (!command) {
+                return { persisted: false, reason: 'NO_BACKEND' };
+            }
+            const result = runner(command);
+            if (result.status !== 0) {
+                // Never thrown: the caller's contract is "you may not get persistence",
+                // and a rejected write is just another way of not getting it. Throwing
+                // here would kill the documented session-only fallback at the exact
+                // moment it is needed.
+                writeFailureDetail = maskSecret(`${result.stderr}`.trim(), secret) || 'the credential store rejected the write';
+                return { persisted: false, reason: 'WRITE_FAILED', detail: writeFailureDetail };
+            }
+            writeFailureDetail = null;
+            return { persisted: true, reason: 'OK' };
+        },
+        remove(account) {
+            memory.delete(account);
+            if (!isAvailable())
+                return;
+            const command = buildRemoveCommand(backend, service, account);
+            if (!command)
+                return;
+            // Removing something that is already gone is success as far as the caller
+            // is concerned, so a non-zero status is not escalated.
+            runner(command);
+        },
+    };
+}
+let sharedStore = null;
+/** Process-wide store. Tests build their own through {@link createCredentialStore}. */
+export function getCredentialStore() {
+    if (!sharedStore) {
+        sharedStore = createCredentialStore();
+    }
+    return sharedStore;
+}
+/** Test-only: drop the cached process-wide store. */
+export function resetCredentialStoreForTests() {
+    sharedStore = null;
+}
+//# sourceMappingURL=credentialStore.js.map

package/dist/auth/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AA6DnD,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAC5D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,iCAAiC;IACjC,4GAA4G;IAC5G,gEAAgE;CACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,iBAAiB,CAAC,MAAc,EAAE,GAA4B;IACrE,MAAM,OAAO,GAAsB;QACjC,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,gBAAgB,KAAK,MAAM,EAAE,CAAC;KACtF,CAAC;IACF,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACxD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,4BAA4B,CAAC;QACtC,KAAK,OAAO;YACV,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3D,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAA4B,EAC5B,OAAe,EACf,OAAe;IAEf,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACtG,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9F,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CACtB,6BAA6B,mBAAmB,UAAU,mBAAmB,KAAK;gBAChF,0DAA0D,EAC5D,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CACnE,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAA4B,EAC5B,OAAe,EACf,OAAe,EACf,MAAc;IAEd,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,0EAA0E;YAC1E,2EAA2E;YAC3E,gEAAgE;YAChE,OAAO;gBACL,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;gBACxE,KAAK,EAAE,GAAG,MAAM,KAAK,MAAM,IAAI;aAChC,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;gBAC7F,KAAK,EAAE,MAAM;aACd,CAAC;QACJ,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CACtB,yEAAyE;gBACvE,QAAQ,mBAAmB,UAAU,mBAAmB,UAAU,kBAAkB,KAAK,EAC3F,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CACjG,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA4B,EAC5B,OAAe,EACf,OAAe;IAEf,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAClG,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7F,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CACtB,6BAA6B,mBAAmB,UAAU,mBAAmB,sBAAsB,EACnG,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CACnE,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAkB,CAAC,OAAO,EAAE,EAAE;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;QACtD,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;KAC5B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAwC,EAAE;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACtD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE3C;;;;OAIG;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,YAAY,GAAmB,IAAI,CAAC;IACxC;;;;OAIG;IACH,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAE7C,MAAM,WAAW,GAAG,GAAY,EAAE;QAChC,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC;QAE/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;YACrB,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAA0B,EAAE;QACzC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACpF,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QAEN,IAAI,CAAC,OAAO;YACV,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;YACxC,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,IAAI,CAAC;YAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/B,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAErC,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAErC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,MAAM;YAClB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE5B,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACnB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YAClG,CAAC;YAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,wEAAwE;gBACxE,uEAAuE;gBACvE,oEAAoE;gBACpE,uBAAuB;gBACvB,kBAAkB,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,yCAAyC,CAAC;gBAChH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YAClF,CAAC;YAED,kBAAkB,GAAG,IAAI,CAAC;YAC1B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,OAAO;YACZ,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO;YAE3B,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,WAAW,GAA2B,IAAI,CAAC;AAE/C,uFAAuF;AACvF,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,qBAAqB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,4BAA4B;IAC1C,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC"}

package/dist/auth/personalTokenClient.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Personal opaque-token client for the CLI.
+ *
+ * Ported from `desktop/src/main/localAgent/personalTokenClient.ts`, which drives
+ * the same server endpoints (`/api/auth/desktop/{authorize,token,revoke}`). The
+ * two clients must keep the same three guarantees, because each one exists to
+ * stop a specific failure that has bitten this flow before:
+ *
+ *  1. Refresh ahead of expiry (60s skew) so a request never races the clock.
+ *  2. Collapse concurrent refreshes into one in-flight promise, so five
+ *     parallel calls rotate the refresh token once rather than five times.
+ *  3. Delete the stored refresh token **only** on an explicit `invalid_grant`.
+ *     A flaky network must not log the user out — otherwise one offline moment
+ *     costs a full re-login even after connectivity returns.
+ */
+import type { CredentialBackendId, CredentialStoreReason } from './credentialStore.js';
+import { type PersonalTokenStore } from './personalTokenStore.js';
+/** Registered in `api/src/services/personalTokenClients.ts`; the server rejects anything else. */
+export declare const CLI_OAUTH_CLIENT_ID = "agentteams-cli";
+/** Refresh this far before the server-declared expiry rather than at it. */
+export declare const ACCESS_REFRESH_SKEW_MS = 60000;
+export type PersonalTokenErrorCode = 'INVALID_GRANT' | 'TRANSIENT' | 'NOT_LOGGED_IN' | 'MALFORMED_RESPONSE' | 'REVOKE_FAILED'
+/** A fresh login succeeded but the credential could not be kept anywhere durable. */
+ | 'STORE_UNAVAILABLE';
+export declare class PersonalTokenError extends Error {
+    readonly code: PersonalTokenErrorCode;
+    constructor(code: PersonalTokenErrorCode, message: string);
+}
+export interface PersonalTokenIdentity {
+    memberId: string;
+    email: string;
+    nickname: string;
+}
+export interface PersonalTokenSession {
+    accessToken: string;
+    /** Epoch milliseconds, derived from the server's `expiresIn`. */
+    expiresAt: number;
+    identity: PersonalTokenIdentity;
+}
+export interface PersonalTokenState {
+    /** A refresh token exists locally. It may still turn out to be revoked. */
+    connected: boolean;
+    /** false → the refresh token is session-memory only and disappears with this process. */
+    persisted: boolean;
+    /** Which OS store is in play, regardless of whether it currently works. */
+    storeBackend: CredentialBackendId;
+    storeReason: CredentialStoreReason;
+    identity: PersonalTokenIdentity | null;
+    expiresAt: number | null;
+    /** The server rejected the refresh token; only a fresh login recovers. */
+    reconnectRequired: boolean;
+}
+export interface AuthorizationCodeGrant {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+export interface PersonalTokenClientDeps {
+    apiUrl: string;
+    store: PersonalTokenStore;
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+interface TokenResponse {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    identity: PersonalTokenIdentity;
+}
+type ParsedTokenResponse = {
+    kind: 'success';
+    tokens: TokenResponse;
+} | {
+    kind: 'invalidGrant';
+} | {
+    kind: 'transient';
+    detail: string;
+};
+/**
+ * Classify a token-endpoint response.
+ *
+ * The split that matters is `invalid_grant` (the server has definitively
+ * refused this refresh token) versus everything else (5xx, a proxy error page,
+ * a truncated body). Only the first justifies destroying local credentials.
+ */
+export declare function parseTokenResponse(response: Response): Promise<ParsedTokenResponse>;
+export declare class PersonalTokenClient {
+    private readonly deps;
+    private accessToken;
+    private accessExpiresAt;
+    private identity;
+    private reconnectRequired;
+    private refreshInFlight;
+    constructor(deps: PersonalTokenClientDeps);
+    state(): PersonalTokenState;
+    hasCredential(): boolean;
+    /**
+     * Trade a PKCE authorization code for the first token pair.
+     *
+     * A failure here leaves nothing behind: there is no prior credential to
+     * protect, and a half-finished login must not look like a connected one.
+     * That includes the case where the store refuses to keep the credential — a
+     * fresh login the next command cannot see is not a login, and the refresh
+     * token the server just minted would outlive this process with nobody able to
+     * use or cancel it. It is revoked rather than left orphaned.
+     */
+    exchangeAuthorizationCode(grant: AuthorizationCodeGrant): Promise<PersonalTokenSession>;
+    /**
+     * Undo a login whose credential could not be stored.
+     *
+     * Revoking is best-effort — an unreachable server is not a reason to keep a
+     * dangling local state — but the local copy always goes, so `hasCredential()`
+     * never reports a login the next process will not find.
+     */
+    private discardUnstorableTokens;
+    /**
+     * Current access token, refreshing pre-emptively when it is close to expiry.
+     * Returns null when there is nothing usable — the caller decides whether that
+     * is a hard failure or a reason to fall back to another credential.
+     */
+    getAccessToken(): Promise<string | null>;
+    /** Force the next {@link getAccessToken} to refresh even if the cached token looks fresh. */
+    invalidateAccessToken(): void;
+    /**
+     * Revoke the token family server-side, then drop the local copy.
+     *
+     * The order is not negotiable: clearing first and failing the revoke would
+     * leave a live refresh token on the server that the user can no longer see or
+     * cancel.
+     */
+    revoke(): Promise<void>;
+    /**
+     * Drop the local credential without asking the server.
+     *
+     * The offline escape hatch behind `auth logout --local`: the token stays valid
+     * server-side, so the caller owes the user a "revoke it in the web app" note.
+     */
+    forgetLocalCredential(): void;
+    private refresh;
+    private postToken;
+    /**
+     * A failed save is reported, never thrown: a long-running `agentteams mcp`
+     * that rotates its refresh token must keep running on the in-memory copy
+     * rather than die at the rotation.
+     */
+    private acceptTokens;
+    private clear;
+    private now;
+    private baseUrl;
+}
+export declare function getPersonalTokenClient(apiUrl: string): PersonalTokenClient;
+/** Test-only: drop every cached client so a test can inject its own deps. */
+export declare function resetPersonalTokenClientsForTests(): void;
+export {};
+//# sourceMappingURL=personalTokenClient.d.ts.map

package/dist/auth/personalTokenClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE5F,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAa3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAwBrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;YA6BP,SAAS;IAUvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IAQb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAQ1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}