@civitai/app-sdk 0.1.0

package/README.md

@@ -0,0 +1,100 @@
+# `@civitai/app-sdk`
+
+Shared OAuth + orchestrator glue for building third-party [Civitai](https://civitai.com) apps. Used internally by every starter in [`civitai/civitai-app-starters`](https://github.com/civitai/civitai-app-starters), and publishable for direct use in your own app.
+
+This package is **runtime-agnostic** — Node 20+ APIs only. There is no Next.js, SvelteKit, or Express coupling. Each starter writes a ~30-line framework adapter that calls into these primitives.
+
+## Install
+
+```bash
+pnpm add @civitai/app-sdk
+```
+
+## What it does
+
+| Surface | Why it exists |
+|---|---|
+| `oauth/*` — `generatePkce`, `buildAuthorizeUrl`, `exchangeCode`, `refreshToken`, `revokeToken`, `fetchMe` | The Civitai OAuth flow (Authorization Code + PKCE S256), as a set of stateless functions you call from your server-side handlers. |
+| `scopes/*` — `TokenScope`, `TokenScopePresets`, `bitmaskFromScopes`, `scopesFromBitmask`, `hasScope`, `getScopeLabel` | Civitai scopes are stored as bitmasks. These helpers let you compose scope sets from named flags rather than magic numbers. |
+| `cookies/*` — `sealCookie`, `unsealCookie`, `buildSetCookieHeader`, `readCookie` | AES-256-CTR encrypted cookie crypto. Use to seal a session blob (refresh token, expiry, scope) into an `httpOnly` cookie with zero external session store. |
+| `orchestrator/*` — `createOrchestratorClient`, `estimateWorkflow`, `submitWorkflow`, `getWorkflow`, `pollWorkflow`, `buildTextToImageBody`, `isTerminal`, `extractImageUrls`, `OrchestratorError`, `WorkflowSnapshot`, `GenerateInput`, `DEFAULT_MODEL_AIR` | Orchestrator workflow glue — types, body builder, raw HTTP, and long-poll helper. Client + server safe (fetch-only). `estimateWorkflow` calls `?whatif=true` to preview Buzz cost without spending. `pollWorkflow` long-polls to terminal status. |
+
+## Minimal usage example
+
+```ts
+import {
+  buildAuthorizeUrl, generatePkce, generateState,
+  exchangeCode, fetchMe,
+  TokenScope, bitmaskFromScopes,
+  sealCookie, unsealCookie, buildSetCookieHeader,
+  createOrchestratorClient, buildTextToImageBody,
+  estimateWorkflow, submitWorkflow, pollWorkflow,
+} from '@civitai/app-sdk';
+
+// 1. Kick off OAuth login from your server-side handler
+const { verifier, challenge } = generatePkce();
+const state = generateState();
+const scope = bitmaskFromScopes(['AIServicesWrite', 'BuzzRead', 'UserRead']);
+
+// Persist { verifier, state, scope } against the user's session — e.g. in an
+// encrypted cookie sealed with `sealCookie`. Then redirect to:
+const authorizeUrl = buildAuthorizeUrl({
+  clientId: process.env.CIVITAI_CLIENT_ID!,
+  redirectUri: 'https://your-app.com/api/auth/callback/civitai',
+  scope,
+  state,
+  codeChallenge: challenge,
+});
+
+// 2. In your callback handler, exchange the code for tokens
+const tokens = await exchangeCode({
+  clientId: process.env.CIVITAI_CLIENT_ID!,
+  clientSecret: process.env.CIVITAI_CLIENT_SECRET, // omit for public clients
+  redirectUri: 'https://your-app.com/api/auth/callback/civitai',
+  code: codeFromQuery,
+  codeVerifier: verifierFromSealedCookie,
+});
+
+// 3. Store tokens in an encrypted httpOnly cookie
+const sealed = sealCookie(JSON.stringify(tokens), process.env.SESSION_SECRET!);
+const setCookie = buildSetCookieHeader('civ_session', sealed, { maxAge: 3600 });
+
+// 4. Use the token to make orchestrator calls
+const client = createOrchestratorClient({ accessToken: tokens.access_token });
+const me = await fetchMe({ accessToken: tokens.access_token });
+console.log(`Hi ${me.username}, you have ${me.balance} Buzz`);
+
+// 5. Estimate cost, then submit
+const body = buildTextToImageBody({ prompt: 'a fox' }, { tags: ['my-app'] });
+const estimate = await estimateWorkflow(client, body);
+console.log(`This will cost ${estimate.cost?.total ?? 0} Buzz`);
+// ...show to user, get confirmation...
+const submitted = await submitWorkflow(client, body);
+const finished = await pollWorkflow(client, submitted.id, { timeoutMs: 30_000 });
+```
+
+The starters in `civitai/civitai-app-starters` wire this into framework-specific route handlers (Next.js App Router, SvelteKit `+server.ts`, Hono inside a Vite-built PWA). Read those for end-to-end reference implementations.
+
+## Public vs. confidential clients
+
+Civitai's OAuth server supports both:
+
+- **Confidential** — your server holds `CIVITAI_CLIENT_SECRET`. Use this for any starter that has a server side at all (Next.js, SvelteKit, or PWAs with a BFF). This is what every current starter uses.
+- **Public** — no `client_secret`, PKCE alone is the security boundary. Civitai's token endpoint supports CORS for browser-direct exchange. Useful for fully static PWAs. We don't currently ship a static-PWA starter; planned for a later milestone.
+
+Pass `clientSecret` to `exchangeCode` / `refreshToken` / `revokeToken` for confidential, omit for public.
+
+## Buzz mechanics (important)
+
+When your app calls the orchestrator with a user's OAuth access token, the orchestrator debits **the user's Buzz**, not yours. This is the right tenant model for a third-party app, but it means:
+
+1. **Request `AIServicesWrite` scope at consent time.** Without it the user can't grant their Buzz for generation.
+2. **Show cost before spending.** Call `estimateCost` first — it returns `cost.total` in Buzz without debiting. Display it. Let the user confirm.
+3. **Show balance.** Request `BuzzRead` scope, then call Civitai's balance endpoint. Don't surprise users.
+4. **Handle the cap-denial case.** Per-app spending caps (set by the user at consent and at Account → Connected Apps) can cause a successful `whatif` to be rejected at real submit time with a generic `BAD_REQUEST`. Treat that as "insufficient or denied" in your UI.
+
+## TODOs / future work
+
+- `scopes/index.ts` is hand-copied from `civitai/civitai`'s `src/shared/constants/token-scope.constants.ts`. Plan: replace with build-time codegen from `/.well-known/openid-configuration`.
+- Add a `tokenStore/` abstraction so starters can plug in alternative storage (Redis, KV) without rewriting auth handlers.
+- Static-PWA helpers for the public-client flow (browser-side token exchange via CORS, in-memory token storage, no refresh persistence).

package/dist/client/index.d.ts

@@ -0,0 +1,23 @@
+import { createCivitaiClient } from '@civitai/client';
+/** The orchestrator client returned by `createCivitaiClient`. */
+export type CivitaiClient = ReturnType<typeof createCivitaiClient>;
+export interface CreateAppClientOptions {
+    /** OAuth access token or personal API key. Used as Bearer credential. */
+    token: string;
+    /** Orchestrator base URL. Defaults to Civitai's prod orchestrator. */
+    baseUrl?: string;
+    /** SDK env mode. Defaults to 'prod'. */
+    env?: 'dev' | 'prod';
+}
+/**
+ * Create a typed Civitai orchestrator client authenticated with the user's
+ * OAuth access token (or a personal API key — same Bearer scheme).
+ *
+ * Wraps `@civitai/client`'s factory with sensible defaults. The returned
+ * client is the same shape `@civitai/client` produces — pass it to the
+ * SDK's standalone functions (`submitWorkflow({ client, body })`, etc.)
+ * or to the wrappers in `@civitai/app-sdk/workflows`.
+ */
+export declare function createAppClient(opts: CreateAppClientOptions): CivitaiClient;
+export type AppClient = CivitaiClient;
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,iEAAiE;AACjE,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACtB;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,aAAa,CAM3E;AAED,MAAM,MAAM,SAAS,GAAG,aAAa,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,19 @@
+import { createCivitaiClient } from '@civitai/client';
+const DEFAULT_ORCHESTRATOR_BASE_URL = 'https://orchestration-new.civitai.com';
+/**
+ * Create a typed Civitai orchestrator client authenticated with the user's
+ * OAuth access token (or a personal API key — same Bearer scheme).
+ *
+ * Wraps `@civitai/client`'s factory with sensible defaults. The returned
+ * client is the same shape `@civitai/client` produces — pass it to the
+ * SDK's standalone functions (`submitWorkflow({ client, body })`, etc.)
+ * or to the wrappers in `@civitai/app-sdk/workflows`.
+ */
+export function createAppClient(opts) {
+    return createCivitaiClient({
+        baseUrl: opts.baseUrl ?? DEFAULT_ORCHESTRATOR_BASE_URL,
+        env: opts.env ?? 'prod',
+        auth: opts.token,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AActD,MAAM,6BAA6B,GAAG,uCAAuC,CAAC;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,OAAO,mBAAmB,CAAC;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,6BAA6B;QACtD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,MAAM;QACvB,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB,CAAC,CAAC;AACL,CAAC"}

package/dist/cookies/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Encrypt an arbitrary string for storage in a cookie value.
+ * Returns `${iv}:${tag}:${ciphertext}`, hex-encoded.
+ *
+ * The `secret` should be a high-entropy value held server-side only,
+ * supplied via env (e.g. SESSION_SECRET). Treat it like a session key.
+ */
+export declare function sealCookie(plaintext: string, secret: string): string;
+/**
+ * Reverse of `sealCookie`. Returns `null` on any error (tampered, wrong
+ * secret, malformed) — never throws. Callers should treat `null` as
+ * "session missing or invalid" and re-issue.
+ */
+export declare function unsealCookie(sealed: string, secret: string): string | null;
+export interface CookieAttributes {
+    maxAge?: number;
+    path?: string;
+    domain?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+}
+/** Build a `Set-Cookie` header value with sensible defaults for session cookies. */
+export declare function buildSetCookieHeader(name: string, value: string, attrs?: CookieAttributes): string;
+/** Parse a `Cookie` request header and return a value by name, or null. */
+export declare function readCookie(cookieHeader: string | null | undefined, name: string): string | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/cookies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cookies/index.ts"],"names":[],"mappings":"AAqBA;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB1E;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,gBAAqB,GAC3B,MAAM,CASR;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ/F"}

package/dist/cookies/index.js

@@ -0,0 +1,85 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+/**
+ * Sealed cookie format: `${iv}:${tag}:${ciphertext}` (all hex).
+ *
+ * AES-256-GCM (authenticated encryption — AEAD). Wrong secret or tampered
+ * ciphertext causes decryption to throw, which `unsealCookie` catches and
+ * returns `null`. This is a security upgrade over plain AES-CTR (which is
+ * malleable and silently returns garbage on wrong keys).
+ */
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+const SALT = 'civitai-app-sdk-cookie-salt';
+function getKey(secret) {
+    return scryptSync(secret, SALT, KEY_BYTES);
+}
+/**
+ * Encrypt an arbitrary string for storage in a cookie value.
+ * Returns `${iv}:${tag}:${ciphertext}`, hex-encoded.
+ *
+ * The `secret` should be a high-entropy value held server-side only,
+ * supplied via env (e.g. SESSION_SECRET). Treat it like a session key.
+ */
+export function sealCookie(plaintext, secret) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGORITHM, getKey(secret), iv);
+    const enc = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${iv.toString('hex')}:${tag.toString('hex')}:${enc.toString('hex')}`;
+}
+/**
+ * Reverse of `sealCookie`. Returns `null` on any error (tampered, wrong
+ * secret, malformed) — never throws. Callers should treat `null` as
+ * "session missing or invalid" and re-issue.
+ */
+export function unsealCookie(sealed, secret) {
+    try {
+        const parts = sealed.split(':');
+        if (parts.length !== 3)
+            return null;
+        const [ivHex, tagHex, ctHex] = parts;
+        if (!ivHex || !tagHex || !ctHex)
+            return null;
+        const iv = Buffer.from(ivHex, 'hex');
+        const tag = Buffer.from(tagHex, 'hex');
+        const ciphertext = Buffer.from(ctHex, 'hex');
+        if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES)
+            return null;
+        const decipher = createDecipheriv(ALGORITHM, getKey(secret), iv);
+        decipher.setAuthTag(tag);
+        const dec = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        return dec.toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Build a `Set-Cookie` header value with sensible defaults for session cookies. */
+export function buildSetCookieHeader(name, value, attrs = {}) {
+    const parts = [`${name}=${value}`];
+    parts.push(`Max-Age=${attrs.maxAge ?? 3600}`);
+    parts.push(`Path=${attrs.path ?? '/'}`);
+    if (attrs.domain)
+        parts.push(`Domain=${attrs.domain}`);
+    if (attrs.secure !== false)
+        parts.push('Secure');
+    if (attrs.httpOnly !== false)
+        parts.push('HttpOnly');
+    parts.push(`SameSite=${attrs.sameSite ?? 'lax'}`);
+    return parts.join('; ');
+}
+/** Parse a `Cookie` request header and return a value by name, or null. */
+export function readCookie(cookieHeader, name) {
+    if (!cookieHeader)
+        return null;
+    const target = `${name}=`;
+    for (const raw of cookieHeader.split(';')) {
+        const trimmed = raw.trim();
+        if (trimmed.startsWith(target))
+            return trimmed.slice(target.length);
+    }
+    return null;
+}
+//# sourceMappingURL=index.js.map

package/dist/cookies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cookies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExF;;;;;;;GAOG;AAEH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAE3C,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,MAAc;IAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,MAAc;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,KAAa,EACb,QAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,YAAuC,EAAE,IAAY;IAC9E,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './oauth/index.js';
+export * from './scopes/index.js';
+export * from './cookies/index.js';
+export * from './orchestrator/index.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,mBAAmB,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from './oauth/index.js';
+export * from './scopes/index.js';
+export * from './cookies/index.js';
+export * from './orchestrator/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC"}

package/dist/oauth/authorize.d.ts

@@ -0,0 +1,15 @@
+export interface BuildAuthorizeUrlOptions {
+    baseUrl?: string;
+    clientId: string;
+    redirectUri: string;
+    scope: number;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod?: 'S256';
+}
+/**
+ * Build the Civitai OAuth authorize URL. The returned URL is what you redirect
+ * the browser to. Token exchange happens on the redirect_uri callback.
+ */
+export declare function buildAuthorizeUrl(opts: BuildAuthorizeUrlOptions): string;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/oauth/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAWxE"}

package/dist/oauth/authorize.js

@@ -0,0 +1,18 @@
+const DEFAULT_CIVITAI_BASE_URL = 'https://civitai.com';
+/**
+ * Build the Civitai OAuth authorize URL. The returned URL is what you redirect
+ * the browser to. Token exchange happens on the redirect_uri callback.
+ */
+export function buildAuthorizeUrl(opts) {
+    const base = opts.baseUrl ?? DEFAULT_CIVITAI_BASE_URL;
+    const url = new URL('/api/auth/oauth/authorize', base);
+    url.searchParams.set('client_id', opts.clientId);
+    url.searchParams.set('redirect_uri', opts.redirectUri);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('state', opts.state);
+    url.searchParams.set('scope', String(opts.scope));
+    url.searchParams.set('code_challenge', opts.codeChallenge);
+    url.searchParams.set('code_challenge_method', opts.codeChallengeMethod ?? 'S256');
+    return url.toString();
+}
+//# sourceMappingURL=authorize.js.map

package/dist/oauth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/oauth/authorize.ts"],"names":[],"mappings":"AAUA,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8B;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/oauth/index.d.ts

@@ -0,0 +1,4 @@
+export * from './pkce.js';
+export * from './authorize.js';
+export * from './token.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/oauth/index.js

@@ -0,0 +1,4 @@
+export * from './pkce.js';
+export * from './authorize.js';
+export * from './token.js';
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,10 @@
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+    method: 'S256';
+}
+/** Generate a PKCE code verifier and S256 challenge. */
+export declare function generatePkce(): Pkce;
+/** Generate a random URL-safe state value for OAuth state-parameter use. */
+export declare function generateState(byteLength?: number): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,wBAAgB,YAAY,IAAI,IAAI,CAInC;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,UAAU,SAAK,GAAG,MAAM,CAErD"}

package/dist/oauth/pkce.js

@@ -0,0 +1,15 @@
+import { createHash, randomBytes } from 'node:crypto';
+function base64UrlEncode(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Generate a PKCE code verifier and S256 challenge. */
+export function generatePkce() {
+    const verifier = base64UrlEncode(randomBytes(32));
+    const challenge = base64UrlEncode(createHash('sha256').update(verifier).digest());
+    return { verifier, challenge, method: 'S256' };
+}
+/** Generate a random URL-safe state value for OAuth state-parameter use. */
+export function generateState(byteLength = 16) {
+    return base64UrlEncode(randomBytes(byteLength));
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAQD,wDAAwD;AACxD,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,UAAU,GAAG,EAAE;IAC3C,OAAO,eAAe,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/oauth/token.d.ts

@@ -0,0 +1,37 @@
+import type { OAuthTokens } from '../types.js';
+interface CommonOpts {
+    baseUrl?: string;
+    clientId: string;
+    /** Only required for confidential clients. Public clients omit this. */
+    clientSecret?: string;
+}
+export interface ExchangeCodeOpts extends CommonOpts {
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+}
+export interface RefreshTokenOpts extends CommonOpts {
+    refreshToken: string;
+}
+export interface RevokeTokenOpts extends CommonOpts {
+    token: string;
+}
+export declare class OAuthError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    readonly name = "OAuthError";
+    constructor(message: string, status: number, body: unknown);
+}
+/** Exchange an authorization code for tokens (PKCE flow). */
+export declare function exchangeCode(opts: ExchangeCodeOpts): Promise<OAuthTokens>;
+/** Refresh an access token using a refresh_token grant. */
+export declare function refreshToken(opts: RefreshTokenOpts): Promise<OAuthTokens>;
+/** Revoke an access or refresh token. */
+export declare function revokeToken(opts: RevokeTokenOpts): Promise<void>;
+/** Fetch the OAuth-authenticated user's profile via `/api/v1/me`. */
+export declare function fetchMe(opts: {
+    baseUrl?: string;
+    accessToken: string;
+}): Promise<unknown>;
+export {};
+//# sourceMappingURL=token.d.ts.map

package/dist/oauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,WAAW,EAAE,MAAM,aAAa,CAAC;AAInE,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,UAAW,SAAQ,KAAK;IAIjC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO;IAJxB,SAAkB,IAAI,gBAAgB;gBAEpC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO;CAIzB;AA0CD,6DAA6D;AAC7D,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAW/E;AAED,2DAA2D;AAC3D,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAS/E;AAED,yCAAyC;AACzC,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtE;AAED,qEAAqE;AACrE,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/F"}

package/dist/oauth/token.js

@@ -0,0 +1,89 @@
+const DEFAULT_CIVITAI_BASE_URL = 'https://civitai.com';
+export class OAuthError extends Error {
+    status;
+    body;
+    name = 'OAuthError';
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+async function postForm(url, body) {
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(body)) {
+        if (v !== undefined)
+            params.set(k, v);
+    }
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: params,
+    });
+    const text = await res.text();
+    let parsed;
+    try {
+        parsed = text.length > 0 ? JSON.parse(text) : null;
+    }
+    catch {
+        parsed = text;
+    }
+    if (!res.ok) {
+        throw new OAuthError(`OAuth request failed: ${res.status} ${res.statusText}`, res.status, parsed);
+    }
+    return parsed;
+}
+function shapeTokens(json, fallbackScope) {
+    return {
+        access_token: json.access_token,
+        refresh_token: json.refresh_token,
+        expires_at: Date.now() + (json.expires_in ?? 3600) * 1000,
+        scope: typeof json.scope === 'number' ? json.scope : Number(json.scope ?? fallbackScope ?? 0),
+        token_type: json.token_type ?? 'Bearer',
+    };
+}
+/** Exchange an authorization code for tokens (PKCE flow). */
+export async function exchangeCode(opts) {
+    const base = opts.baseUrl ?? DEFAULT_CIVITAI_BASE_URL;
+    const json = (await postForm(`${base}/api/auth/oauth/token`, {
+        grant_type: 'authorization_code',
+        code: opts.code,
+        redirect_uri: opts.redirectUri,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret,
+        code_verifier: opts.codeVerifier,
+    }));
+    return shapeTokens(json);
+}
+/** Refresh an access token using a refresh_token grant. */
+export async function refreshToken(opts) {
+    const base = opts.baseUrl ?? DEFAULT_CIVITAI_BASE_URL;
+    const json = (await postForm(`${base}/api/auth/oauth/token`, {
+        grant_type: 'refresh_token',
+        refresh_token: opts.refreshToken,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret,
+    }));
+    return shapeTokens(json);
+}
+/** Revoke an access or refresh token. */
+export async function revokeToken(opts) {
+    const base = opts.baseUrl ?? DEFAULT_CIVITAI_BASE_URL;
+    await postForm(`${base}/api/auth/oauth/revoke`, {
+        token: opts.token,
+        client_id: opts.clientId,
+        client_secret: opts.clientSecret,
+    });
+}
+/** Fetch the OAuth-authenticated user's profile via `/api/v1/me`. */
+export async function fetchMe(opts) {
+    const base = opts.baseUrl ?? DEFAULT_CIVITAI_BASE_URL;
+    const res = await fetch(`${base}/api/v1/me`, {
+        headers: { Authorization: `Bearer ${opts.accessToken}` },
+    });
+    if (!res.ok) {
+        throw new OAuthError(`/api/v1/me failed: ${res.status}`, res.status, await res.text());
+    }
+    return res.json();
+}
+//# sourceMappingURL=token.js.map

package/dist/oauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/oauth/token.ts"],"names":[],"mappings":"AAEA,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAuBvD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAIxB;IACA;IAJO,IAAI,GAAG,YAAY,CAAC;IACtC,YACE,OAAe,EACN,MAAc,EACd,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;IAGxB,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,IAAwC;IAExC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EACvD,GAAG,CAAC,MAAM,EACV,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB,EAAE,aAAsB;IACnE,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;QACzD,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,IAAI,CAAC,CAAC;QAC7F,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;KACxC,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAuB,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAuB,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IACtD,MAAM,QAAQ,CAAC,GAAG,IAAI,wBAAwB,EAAE;QAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAA+C;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,wBAAwB,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC"}