@aquex/cmos-mcp 1.0.0

package/dist/auth/device-code.js

@@ -0,0 +1,334 @@
+"use strict";
+// ABOUTME: RFC 8628 device code client for cmos-dashboard bootstrap auth.
+// ABOUTME: Thin request + poll loop + User-Agent helper; orchestrator persists into CredentialStore.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceCodeError = void 0;
+exports.buildUserAgent = buildUserAgent;
+exports.readPackageVersion = readPackageVersion;
+exports.requestDeviceCode = requestDeviceCode;
+exports.pollForToken = pollForToken;
+exports.pollForTokenBounded = pollForTokenBounded;
+exports.defaultPrompter = defaultPrompter;
+exports.runDeviceCodeFlow = runDeviceCodeFlow;
+/**
+ * Device code flow (RFC 8628) against the cmos-dashboard.
+ *
+ * Contract locked 2026-04-17 (dashboard message `aa02f1ec`):
+ * - `POST /api/auth/device/code` → `{ deviceCode, userCode, verificationUri, expiresIn, interval }`
+ * - `POST /api/auth/device/token` body `{ deviceCode }`:
+ *     - HTTP 200 + `{ key, keyId, label }` on approval
+ *     - HTTP 400 + `{ error, error_description? }` where
+ *       `error ∈ { authorization_pending, slow_down, expired_token, access_denied }`
+ *   Strict RFC 8628 shape — all errors at HTTP 400.
+ * - User-Agent on both endpoints: `cmos-mcp/<version> (<platform>; <hostname>)` so
+ *   the dashboard can auto-populate a human-readable label on issuance.
+ *
+ * @module auth/device-code
+ */
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = require("fs");
+const credential_store_1 = require("../intelligence/credential-store");
+/** Typed error covering the four RFC 8628 strings plus transport failures. */
+class DeviceCodeError extends Error {
+    constructor(code, message, description) {
+        super(message);
+        this.name = 'DeviceCodeError';
+        this.code = code;
+        if (description !== undefined) {
+            this.description = description;
+        }
+    }
+}
+exports.DeviceCodeError = DeviceCodeError;
+const DEFAULT_TIMEOUT_MS = 10000;
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+/**
+ * Build the MCP User-Agent string for device-code calls.
+ * Dashboard parses this to auto-populate the key label.
+ */
+function buildUserAgent(version, platform = os_1.default.platform(), hostname = os_1.default.hostname()) {
+    return `cmos-mcp/${version} (${platform}; ${hostname})`;
+}
+/** Read the package version so the runtime User-Agent matches the shipped build. */
+async function readPackageVersion() {
+    const pkgPath = path_1.default.join(__dirname, '..', '..', 'package.json');
+    try {
+        const raw = await fs_1.promises.readFile(pkgPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        return parsed.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+async function fetchWithTimeout(fetchImpl, url, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Internal: POST `/api/auth/device/code` and return the parsed response. */
+async function requestDeviceCode(baseUrl, userAgent, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = `${baseUrl.replace(/\/+$/, '')}/api/auth/device/code`;
+    let response;
+    try {
+        response = await fetchWithTimeout(fetchImpl, url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+                'User-Agent': userAgent,
+            },
+            body: JSON.stringify({}),
+        }, timeoutMs);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new DeviceCodeError('request_failed', `device/code request failed: ${msg}`);
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        throw new DeviceCodeError('request_failed', `device/code HTTP ${response.status}: ${text || 'no body'}`);
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        throw new DeviceCodeError('malformed_response', 'device/code returned invalid JSON');
+    }
+    if (typeof body.deviceCode !== 'string' ||
+        typeof body.userCode !== 'string' ||
+        typeof body.verificationUri !== 'string' ||
+        typeof body.expiresIn !== 'number' ||
+        typeof body.interval !== 'number') {
+        throw new DeviceCodeError('malformed_response', 'device/code missing required fields');
+    }
+    return {
+        deviceCode: body.deviceCode,
+        userCode: body.userCode,
+        verificationUri: body.verificationUri,
+        expiresIn: body.expiresIn,
+        interval: body.interval,
+    };
+}
+/**
+ * Internal: poll `/api/auth/device/token` until success or terminal error.
+ * Honors RFC 8628 semantics:
+ *  - `authorization_pending` → wait `interval` seconds and retry
+ *  - `slow_down` → add 5s to `interval` and retry
+ *  - `expired_token` / `access_denied` → throw `DeviceCodeError`
+ */
+async function pollForToken(baseUrl, deviceCode, userAgent, initialIntervalSeconds, expiresInSeconds, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sleepFn = options.sleepFn ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const nowFn = options.nowFn ?? (() => Date.now());
+    const url = `${baseUrl.replace(/\/+$/, '')}/api/auth/device/token`;
+    const deadlineMs = nowFn() + expiresInSeconds * 1000;
+    let intervalSeconds = initialIntervalSeconds;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        if (nowFn() >= deadlineMs) {
+            throw new DeviceCodeError('expired_token', 'device code expired before authorization completed');
+        }
+        await sleepFn(intervalSeconds * 1000);
+        let response;
+        try {
+            response = await fetchWithTimeout(fetchImpl, url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                    'User-Agent': userAgent,
+                },
+                body: JSON.stringify({ deviceCode }),
+            }, timeoutMs);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new DeviceCodeError('request_failed', `device/token request failed: ${msg}`);
+        }
+        if (response.status === 200) {
+            let body;
+            try {
+                body = (await response.json());
+            }
+            catch {
+                throw new DeviceCodeError('malformed_response', 'device/token returned invalid JSON');
+            }
+            if (typeof body.key !== 'string' ||
+                typeof body.keyId !== 'string' ||
+                typeof body.label !== 'string') {
+                throw new DeviceCodeError('malformed_response', 'device/token missing required fields');
+            }
+            return { key: body.key, keyId: body.keyId, label: body.label };
+        }
+        if (response.status === 400) {
+            let body;
+            try {
+                body = (await response.json());
+            }
+            catch {
+                throw new DeviceCodeError('malformed_response', 'device/token 400 response was not valid JSON');
+            }
+            const err = body.error;
+            const desc = body.error_description;
+            if (err === 'authorization_pending') {
+                continue;
+            }
+            if (err === 'slow_down') {
+                intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
+                continue;
+            }
+            if (err === 'expired_token' || err === 'access_denied') {
+                throw new DeviceCodeError(err, `device/token: ${err}`, desc);
+            }
+            throw new DeviceCodeError('request_failed', `device/token returned unknown error '${err ?? 'missing'}'`, desc);
+        }
+        const text = await response.text().catch(() => '');
+        throw new DeviceCodeError('request_failed', `device/token HTTP ${response.status}: ${text || 'no body'}`);
+    }
+}
+async function pollForTokenBounded(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sleepFn = options.sleepFn ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const nowFn = options.nowFn ?? (() => Date.now());
+    const url = `${options.baseUrl.replace(/\/+$/, '')}/api/auth/device/token`;
+    const pollDeadlineMs = nowFn() + options.maxWaitSeconds * 1000;
+    let intervalSeconds = options.intervalSeconds;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        // If the next required sleep would push us past the budget, return pending
+        // without sleeping — the agent can call again to keep polling.
+        if (nowFn() + intervalSeconds * 1000 > pollDeadlineMs) {
+            return { status: 'pending', intervalSeconds };
+        }
+        await sleepFn(intervalSeconds * 1000);
+        let response;
+        try {
+            response = await fetchWithTimeout(fetchImpl, url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                    'User-Agent': options.userAgent,
+                },
+                body: JSON.stringify({ deviceCode: options.deviceCode }),
+            }, timeoutMs);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new DeviceCodeError('request_failed', `device/token request failed: ${msg}`);
+        }
+        if (response.status === 200) {
+            let body;
+            try {
+                body = (await response.json());
+            }
+            catch {
+                throw new DeviceCodeError('malformed_response', 'device/token returned invalid JSON');
+            }
+            if (typeof body.key !== 'string' ||
+                typeof body.keyId !== 'string' ||
+                typeof body.label !== 'string') {
+                throw new DeviceCodeError('malformed_response', 'device/token missing required fields');
+            }
+            return {
+                status: 'approved',
+                key: body.key,
+                keyId: body.keyId,
+                label: body.label,
+                intervalSeconds,
+            };
+        }
+        if (response.status === 400) {
+            let body;
+            try {
+                body = (await response.json());
+            }
+            catch {
+                throw new DeviceCodeError('malformed_response', 'device/token 400 response was not valid JSON');
+            }
+            const err = body.error;
+            const desc = body.error_description;
+            if (err === 'authorization_pending') {
+                continue;
+            }
+            if (err === 'slow_down') {
+                intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
+                continue;
+            }
+            if (err === 'expired_token') {
+                return { status: 'expired' };
+            }
+            if (err === 'access_denied') {
+                return desc !== undefined ? { status: 'denied', description: desc } : { status: 'denied' };
+            }
+            throw new DeviceCodeError('request_failed', `device/token returned unknown error '${err ?? 'missing'}'`, desc);
+        }
+        const text = await response.text().catch(() => '');
+        throw new DeviceCodeError('request_failed', `device/token HTTP ${response.status}: ${text || 'no body'}`);
+    }
+}
+/** Print the user-facing prompt to stderr in a terminal-friendly form. */
+function defaultPrompter(response) {
+    const divider = '─'.repeat(60);
+    process.stderr.write([
+        '',
+        divider,
+        '[cmos-mcp] Dashboard authorization required',
+        divider,
+        `Open:  ${response.verificationUri}`,
+        `Code:  ${response.userCode}`,
+        `(Code expires in ${response.expiresIn}s; this client will poll every ${response.interval}s.)`,
+        divider,
+        '',
+    ].join('\n'));
+}
+/**
+ * Full RFC 8628 bootstrap: request a device code, print the prompt, poll
+ * until approval or terminal error, and persist the resulting user-scoped
+ * key to the CredentialStore.
+ *
+ * On success returns the `{key, keyId, label}` body so callers can also
+ * surface the minted identity (for m02's register call + m04's whoami).
+ */
+async function runDeviceCodeFlow(options) {
+    const version = options.version ?? (await readPackageVersion());
+    const userAgent = options.userAgent ?? buildUserAgent(version, options.platform, options.hostname);
+    const prompter = options.prompter ?? defaultPrompter;
+    const codeResponse = await requestDeviceCode(options.baseUrl, userAgent, {
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+    });
+    prompter(codeResponse);
+    const token = await pollForToken(options.baseUrl, codeResponse.deviceCode, userAgent, codeResponse.interval, codeResponse.expiresIn, {
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        ...(options.sleepFn ? { sleepFn: options.sleepFn } : {}),
+        ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+        ...(options.nowFn ? { nowFn: options.nowFn } : {}),
+    });
+    const store = options.credentialStore ?? (await credential_store_1.CredentialStore.create());
+    const now = new Date().toISOString();
+    const record = {
+        key: token.key,
+        label: token.label,
+        issuedAt: now,
+        lastUsedAt: now,
+    };
+    await store.upsertUserScopedKey(token.keyId, record);
+    return token;
+}
+//# sourceMappingURL=device-code.js.map

package/dist/auth/device-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code.js","sourceRoot":"","sources":["../../src/auth/device-code.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,qGAAqG;;;;;;AA2ErG,wCAMC;AAGD,gDASC;AAkBD,8CA8DC;AASD,oCA0GC;AA6CD,kDAsGC;AAGD,0CAeC;AAmCD,8CAuCC;AA7gBD;;;;;;;;;;;;;;GAcG;AAEH,4CAAoB;AACpB,gDAAwB;AACxB,2BAAoC;AACpC,uEAAmE;AA4BnE,8EAA8E;AAC9E,MAAa,eAAgB,SAAQ,KAAK;IAIxC,YAAY,IAA6B,EAAE,OAAe,EAAE,WAAoB;QAC9E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAZD,0CAYC;AAMD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAEtC;;;GAGG;AACH,SAAgB,cAAc,CAC5B,OAAe,EACf,WAAmB,YAAE,CAAC,QAAQ,EAAE,EAChC,WAAmB,YAAE,CAAC,QAAQ,EAAE;IAEhC,OAAO,YAAY,OAAO,KAAK,QAAQ,KAAK,QAAQ,GAAG,CAAC;AAC1D,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACvD,OAAO,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,SAAoB,EACpB,GAAW,EACX,IAAiB,EACjB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,SAAiB,EACjB,UAAyD,EAAE;IAE3D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC;IAElE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAC/B,SAAS,EACT,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,SAAS;aACxB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;SACzB,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,oBAAoB,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,SAAS,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IAED,IACE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QACxC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EACjC,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,qCAAqC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,UAAkB,EAClB,SAAiB,EACjB,sBAA8B,EAC9B,gBAAwB,EACxB,UAKI,EAAE;IAEN,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACrD,IAAI,eAAe,GAAG,sBAAsB,CAAC;IAE7C,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAEtC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,gBAAgB,CAC/B,SAAS,EACT,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,SAAS;iBACxB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;aACrC,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,gCAAgC,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,IAAI,IAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC;YACxF,CAAC;YACD,IACE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;gBAC5B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAC9B,CAAC;gBACD,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,IAAI,IAAoD,CAAC;YACzD,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmD,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACpC,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,eAAe,IAAI,2BAA2B,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBACvD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iBAAiB,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,wCAAwC,GAAG,IAAI,SAAS,GAAG,EAC3D,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,SAAS,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AA6CM,KAAK,UAAU,mBAAmB,CAAC,OAA2B;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC3E,MAAM,cAAc,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAC/D,IAAI,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAE9C,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,2EAA2E;QAC3E,+DAA+D;QAC/D,IAAI,KAAK,EAAE,GAAG,eAAe,GAAG,IAAI,GAAG,cAAc,EAAE,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAEtC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,gBAAgB,CAC/B,SAAS,EACT,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,OAAO,CAAC,SAAS;iBAChC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;aACzD,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,gCAAgC,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,IAAI,IAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC;YACxF,CAAC;YACD,IACE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;gBAC5B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAC9B,CAAC;gBACD,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,sCAAsC,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,UAAU;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,IAAI,IAAoD,CAAC;YACzD,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmD,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACpC,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,eAAe,IAAI,2BAA2B,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBAC5B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC7F,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,wCAAwC,GAAG,IAAI,SAAS,GAAG,EAC3D,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,SAAS,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,EAAE;QACF,OAAO;QACP,6CAA6C;QAC7C,OAAO;QACP,UAAU,QAAQ,CAAC,eAAe,EAAE;QACpC,UAAU,QAAQ,CAAC,QAAQ,EAAE;QAC7B,oBAAoB,QAAQ,CAAC,SAAS,kCAAkC,QAAQ,CAAC,QAAQ,KAAK;QAC9F,OAAO;QACP,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AA2BD;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE;QACvE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,QAAQ,CAAC,YAAY,CAAC,CAAC;IAEvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,OAAO,CAAC,OAAO,EACf,YAAY,CAAC,UAAU,EACvB,SAAS,EACT,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,SAAS,EACtB;QACE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,MAAM,kCAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,GAAG;QACb,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAErD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/project-key-capture.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Project-scoped key capture + /reissue recovery.
+ *
+ * This module centralizes the two write paths that move a project-scoped
+ * key from the dashboard into the local `CredentialStore`:
+ *
+ *  1. **Auto-capture on registration** (`captureRegisterResponse`) —
+ *     `POST /api/projects/register` returns `{ key, keyId, label }` on
+ *     first-time registration. We stamp it to `projectKeys[projectRoot]`
+ *     with `parentKeyId` set to the user-scoped credential that
+ *     authenticated the register call.
+ *
+ *  2. **Partial-failure recovery** (`recoverProjectKey`) — if the register
+ *     response arrives but the local write fails (crash, disk error), the
+ *     dashboard has a project-scoped key that we don't know about. We call
+ *     `POST /api/projects/:id/keys/reissue` on next startup, which revokes
+ *     the orphan and mints a fresh one bound to the same parent.
+ *
+ * @module auth/project-key-capture
+ */
+import { DashboardClient } from '../tools/cmos/dashboard-client';
+import type { RegisterProjectResult } from '../tools/cmos/dashboard-client';
+import { CredentialStore, type ProjectKeyRecord } from '../intelligence/credential-store';
+/**
+ * Status returned by the capture/recovery functions so callers can log
+ * the outcome without pattern-matching on errors.
+ */
+export type ProjectKeyCaptureStatus = 'captured' | 'reregistration-noop' | 'missing-parent-key-id' | 'no-key-in-response';
+export interface CaptureRegisterResponseOptions {
+    /** Absolute project root the captured key should be keyed under. */
+    projectRoot: string;
+    /** The dashboard response from `registerProject`. */
+    response: RegisterProjectResult;
+    /**
+     * Authenticating user-scoped keyId (from `client.authenticatingKeyId`).
+     * Stamped into `parentKeyId` on the resulting record. When undefined we
+     * bail out with `missing-parent-key-id` rather than write a record with
+     * empty attribution — m03's "mine-only" filter would silently skip it.
+     */
+    parentKeyId: string | undefined;
+    /** Override (tests) — defaults to the CredentialStore singleton. */
+    store?: CredentialStore;
+}
+/**
+ * Inspect a `/register` response and persist a new project-scoped key row
+ * when one was minted. Idempotent re-registrations (`keyRotated === false`)
+ * are no-ops; first-time registrations with a `key` produce a write.
+ */
+export declare function captureRegisterResponse(options: CaptureRegisterResponseOptions): Promise<ProjectKeyCaptureStatus>;
+export interface RecoverProjectKeyOptions {
+    /** Absolute project root the recovered key should be keyed under. */
+    projectRoot: string;
+    /** Dashboard-side project UUID — needed for the `/reissue` URL. */
+    projectId: string;
+    /** Client authenticated via the user-scoped credential. */
+    client: DashboardClient;
+    /** Override (tests) — defaults to the CredentialStore singleton. */
+    store?: CredentialStore;
+}
+export type ProjectKeyRecoveryStatus = {
+    kind: 'recovered';
+    record: ProjectKeyRecord;
+} | {
+    kind: 'no-op-already-present';
+} | {
+    kind: 'missing-parent-key-id';
+} | {
+    kind: 'reissue-failed';
+    error: string;
+};
+/**
+ * Call `/api/projects/:id/keys/reissue` and persist the response to the
+ * local store. Callers should gate this behind a check that `getProjectKey`
+ * returns undefined (otherwise the existing key is fine).
+ */
+export declare function recoverProjectKey(options: RecoverProjectKeyOptions): Promise<ProjectKeyRecoveryStatus>;
+/** Structured result for the startup recovery runner — logged by `initializeServer`. */
+export interface StartupProjectKeyRecoveryResult {
+    checked: boolean;
+    status: 'skipped-no-project' | 'skipped-not-registered' | 'skipped-already-present' | 'skipped-unconfigured' | 'skipped-no-parent-key-id' | 'recovered' | 'error';
+    message: string;
+}
+/** Thin abstraction so tests can stub SQLite metadata reads. */
+export type ProjectMetadataReader = (projectRoot: string) => Promise<{
+    registered: boolean;
+    projectId: string | null;
+} | null>;
+/** Thin abstraction so tests can stub dashboard-client construction. */
+export type DashboardClientFactory = (projectRoot: string) => Promise<DashboardClient | null>;
+/**
+ * Scan the current project for a registered-but-missing project key and call
+ * `/reissue` to recover it. Runs at startup after attribution self-test.
+ *
+ * Always returns a structured result — never throws. The caller (index.ts)
+ * logs a single line based on `status`.
+ */
+export declare function runStartupProjectKeyRecovery(options?: {
+    projectRoot?: string;
+    metadataReader?: ProjectMetadataReader;
+    clientFactory?: DashboardClientFactory;
+    store?: CredentialStore;
+}): Promise<StartupProjectKeyRecoveryResult>;
+export type StartupCredentialCheckStatus = 'has-user-scoped-keys' | 'empty-credential-store';
+export interface StartupCredentialCheckResult {
+    status: StartupCredentialCheckStatus;
+    /** True when we emitted the [WARN] line on stderr for this run. */
+    warned: boolean;
+    /** Count of user-scoped keys observed in the local store (0 when empty). */
+    userScopedKeyCount: number;
+}
+/**
+ * Inspect the local credential store on startup and emit a one-line [WARN]
+ * when no user-scoped keys are present. A fresh install with no device-code
+ * bootstrap looks identical to a broken install from the MCP's perspective —
+ * this makes that state audible so the operator knows to run
+ * `cmos_auth(action="login")` before attempting a send.
+ *
+ * Non-fatal: never throws. Startup continues regardless.
+ */
+export declare function runStartupCredentialCheck(options?: {
+    store?: CredentialStore;
+    writer?: (line: string) => void;
+}): Promise<StartupCredentialCheckResult>;
+//# sourceMappingURL=project-key-capture.d.ts.map

package/dist/auth/project-key-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-key-capture.d.ts","sourceRoot":"","sources":["../../src/auth/project-key-capture.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAC/B,UAAU,GACV,qBAAqB,GACrB,uBAAuB,GACvB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,8BAA8B;IAC7C,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,QAAQ,EAAE,qBAAqB,CAAC;IAChC;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,oEAAoE;IACpE,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,uBAAuB,CAAC,CA4BlC;AAED,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,MAAM,EAAE,eAAe,CAAC;IACxB,oEAAoE;IACpE,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,wBAAwB,CAAC,CA+BnC;AAID,wFAAwF;AACxF,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EACF,oBAAoB,GACpB,wBAAwB,GACxB,yBAAyB,GACzB,sBAAsB,GACtB,0BAA0B,GAC1B,WAAW,GACX,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,CAClC,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAAC;AAEvE,wEAAwE;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAwC9F;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,KAAK,CAAC,EAAE,eAAe,CAAC;CACpB,GACL,OAAO,CAAC,+BAA+B,CAAC,CAyE1C;AAID,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;AAE7F,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,4BAA4B,CAAC;IACrC,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GACzE,OAAO,CAAC,4BAA4B,CAAC,CAevC"}