@cleocode/core 2026.9.23 → 2026.9.25

package/dist/llm/credential-remove-entry.js

@@ -0,0 +1,101 @@
+/**
+ * Remove one credential from the unified pool: the logic behind
+ * `cleo auth remove <provider> <label>` and `cleo logout <provider> [label]`.
+ *
+ * 1. Resolve the entry from the pool (`list()` is a pure store read).
+ * 2. Dispatch to the per-source {@link RemovalStep} (never deletes files CLEO
+ *    does not own).
+ * 3. Persist suppression when the step asks for it, so the next seed pass
+ *    does not re-import the entry.
+ * 4. Drop the entry from `llm-credentials.json`.
+ *
+ * Failures are returned, not thrown, with the exit code and remedy the CLI
+ * has always emitted for them.
+ *
+ * @task T9416
+ * @task T12712
+ */
+import { getCredentialPool } from './credential-pool.js';
+import { addSuppression, REMOVAL_REGISTRY } from './credential-removal.js';
+import { removeCredential } from './credentials-store.js';
+/** Every seeder source id, for narrowing the store's untyped `source` field. */
+const SEEDER_SOURCE_IDS = new Set([
+    'env',
+    'claude-code', // llm-resolve-allowed: seeder source id, not a model
+    'cleo-pkce',
+    'codex-cli',
+    'gemini-cli', // llm-resolve-allowed: seeder source id, not a model
+    'gh-cli',
+    'manual',
+    'cli-input',
+]);
+/** `true` when `source` names a known seeder source. */
+function isSeederSourceId(source) {
+    return SEEDER_SOURCE_IDS.has(source);
+}
+/**
+ * Remove a pool credential by provider and label. When `label` is omitted the
+ * provider must have exactly one entry.
+ *
+ * @param provider - Provider id (e.g. `anthropic`).
+ * @param label - Entry label; optional when the provider has a single entry.
+ * @returns The removal, or a typed failure.
+ */
+export async function removeLlmCredential(provider, label) {
+    const entries = (await getCredentialPool().list()).filter((c) => c.provider === provider);
+    const matches = label === undefined ? entries : entries.filter((c) => c.label === label);
+    const entry = matches[0];
+    if (!entry) {
+        return {
+            ok: false,
+            code: 'E_NOT_FOUND',
+            message: label === undefined
+                ? `No credential found for provider='${provider}'`
+                : `No credential found for provider='${provider}' label='${label}'`,
+            fix: `Run 'cleo auth list' to see active credentials.`,
+            exitCode: 4,
+        };
+    }
+    if (matches.length > 1) {
+        return {
+            ok: false,
+            code: 'E_AMBIGUOUS_LABEL',
+            message: `provider='${provider}' has ${matches.length} credentials: ${matches.map((c) => c.label).join(', ')}`,
+            fix: `Name one: 'cleo logout ${provider} <label>'.`,
+            exitCode: 6,
+        };
+    }
+    // Legacy entries written before the seeder migration lack a `source`
+    // field; the MANUAL_REMOVAL_STEP handles those.
+    const sourceId = entry.source ?? 'manual';
+    const step = isSeederSourceId(sourceId) ? REMOVAL_REGISTRY.find(sourceId) : undefined;
+    if (!step) {
+        return {
+            ok: false,
+            code: 'E_REMOVAL_NOT_REGISTERED',
+            message: `No RemovalStep registered for source='${sourceId}' — cannot safely remove '${provider}/${entry.label}'.`,
+            fix: 'Open an issue: a credential was seeded from an unknown source.',
+            exitCode: 2,
+        };
+    }
+    const stepResult = await step.remove({ provider, label: entry.label });
+    let suppressed = false;
+    if (stepResult.suppress) {
+        addSuppression(provider, step.sourceId);
+        suppressed = true;
+    }
+    const removed = await removeCredential(entry.provider, entry.label);
+    return {
+        ok: true,
+        result: {
+            provider,
+            label: entry.label,
+            source: sourceId,
+            removed,
+            cleaned: stepResult.cleaned,
+            hints: stepResult.hints,
+            suppressed,
+        },
+    };
+}
+//# sourceMappingURL=credential-remove-entry.js.map

package/dist/llm/credential-remove-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-remove-entry.js","sourceRoot":"","sources":["../../src/llm/credential-remove-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,gFAAgF;AAChF,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAiB;IACrE,KAAK;IACL,aAAa,EAAE,qDAAqD;IACpE,WAAW;IACX,WAAW;IACX,YAAY,EAAE,qDAAqD;IACnE,QAAQ;IACR,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,wDAAwD;AACxD,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAmCD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,KAAc;IAEd,MAAM,OAAO,GAAG,CAAC,MAAM,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,qCAAqC,QAAQ,GAAG;gBAClD,CAAC,CAAC,qCAAqC,QAAQ,YAAY,KAAK,GAAG;YACvE,GAAG,EAAE,iDAAiD;YACtD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,aAAa,QAAQ,SAAS,OAAO,CAAC,MAAM,iBAAiB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC9G,GAAG,EAAE,0BAA0B,QAAQ,YAAY;YACnD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,yCAAyC,QAAQ,6BAA6B,QAAQ,IAAI,KAAK,CAAC,KAAK,IAAI;YAClH,GAAG,EAAE,gEAAgE;YACrE,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,QAAQ;YACR,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,UAAU;SACX;KACF,CAAC;AACJ,CAAC"}

package/dist/llm/oauth/device-code.d.ts

@@ -7,14 +7,17 @@
  *   2. Poll the token endpoint every `interval` seconds until the user
  *      approves, the code expires, or a non-recoverable error is returned.
  *
- * ## Provider scope
+ * ## Scope
  *
- * Device-code OAuth is used by **kimi-code** only. Anthropic uses RFC 7636
- * PKCE (see `pkce.ts` and `builtin/anthropic.ts`). The `anthropic` preset
- * was removed in T9326 — PKCE is the canonical Anthropic OAuth path per T9302.
+ * The runner is provider-neutral. Among LLM providers, device-code OAuth is
+ * used by **kimi-code** only; Anthropic uses RFC 7636 PKCE (see `pkce.ts` and
+ * `builtin/anthropic.ts`). The `anthropic` preset was removed in T9326 — PKCE
+ * is the canonical Anthropic OAuth path per T9302. The Cleo Nexus account
+ * login (`cloud/nexus-auth.ts`, T12712) drives the same runner.
  *
  * @module llm/oauth/device-code
  * @task T9321
+ * @task T12712
  * @epic T9261 T-LLM-CRED-CENTRALIZATION
  */
 /**
@@ -52,6 +55,8 @@ export interface DeviceCodeConfig {
      * `anthropic-version`).
      */
     defaultHeaders?: Record<string, string>;
+    /** `fetch` override for tests and custom transports. Defaults to the global `fetch`. */
+    fetch?: (input: string, init?: RequestInit) => Promise<Response>;
 }
 /**
  * Response from the device authorization endpoint (RFC 8628 §3.2).
@@ -149,6 +154,13 @@ export declare function getDeviceCodeConfig(provider: 'kimi-code' | string): Dev
  * @see MoonshotAI/kimi-cli `src/kimi_cli/auth/oauth.py` — protocol reference
  */
 export declare function getKimiCodeDeviceCodeConfig(): DeviceCodeConfig;
+/**
+ * Cap on how long polling runs (seconds), whatever `expires_in` the server
+ * claims: a hostile or broken server cannot keep the CLI polling for days.
+ */
+export declare const MAX_DEVICE_CODE_LIFETIME_SECONDS = 1800;
+/** Default time budget for one token request before it is aborted and retried. */
+export declare const DEVICE_CODE_REQUEST_TIMEOUT_MS = 15000;
 /**
  * Start the device-code OAuth flow.
  *
@@ -164,9 +176,11 @@ export declare function startDeviceCodeFlow(cfg: DeviceCodeConfig): Promise<Devi
  * Poll the token endpoint until the user approves, the code expires, or an
  * unrecoverable error is received (RFC 8628 §3.4).
  *
- * Handles the two recoverable error codes:
+ * Handles the recoverable answers:
  *   - `authorization_pending` — user has not yet approved; continue polling.
- *   - `slow_down` — increase the polling interval by 1 second, then continue.
+ *   - `slow_down` — increase the polling interval by 5 seconds, then continue.
+ *   - HTTP 429 (a rate limiter in front of the endpoint, whose body is not in
+ *     OAuth form) — treated like `slow_down`.
  *
  * Network errors are retried up to `MAX_NETWORK_RETRIES` times before being
  * re-thrown.
@@ -178,6 +192,10 @@ export declare function startDeviceCodeFlow(cfg: DeviceCodeConfig): Promise<Devi
  *   iteration with `(elapsedSeconds, totalExpiresIn)`. Used by the CLI to
  *   print a live progress counter.
  * @param options.signal - Optional `AbortSignal` for cooperative cancellation.
+ * @param options.sleep - Optional wait override (tests); defaults to `setTimeout`.
+ * @param options.requestTimeoutMs - Per-request budget; a request that takes
+ *   longer is aborted and counted as a network error. Default
+ *   {@link DEVICE_CODE_REQUEST_TIMEOUT_MS}.
  *
  * @throws {DeviceCodeTimeoutError} When `expiresIn` is reached without approval.
  * @throws {DeviceCodeAuthError} When the provider returns a non-recoverable error.
@@ -186,5 +204,7 @@ export declare function startDeviceCodeFlow(cfg: DeviceCodeConfig): Promise<Devi
 export declare function pollForToken(cfg: DeviceCodeConfig, startResp: DeviceCodeStartResponse, options?: {
     onPending?: (elapsed: number, expiresIn: number) => void;
     signal?: AbortSignal;
+    sleep?: (ms: number) => Promise<void>;
+    requestTimeoutMs?: number;
 }): Promise<DeviceCodeTokenResponse>;
 //# sourceMappingURL=device-code.d.ts.map

package/dist/llm/oauth/device-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-code.d.ts","sourceRoot":"","sources":["../../../src/llm/oauth/device-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAQ9C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAQrE;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,GAAG,gBAAgB,CAQpF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,IAAI,gBAAgB,CAc9D;AAoCD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmDjG;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,uBAAuB,EAClC,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GACA,OAAO,CAAC,uBAAuB,CAAC,CA0FlC"}
+{"version":3,"file":"device-code.d.ts","sourceRoot":"","sources":["../../../src/llm/oauth/device-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,wFAAwF;IACxF,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAClE;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAQ9C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAQrE;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,GAAG,gBAAgB,CAQpF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,2BAA2B,IAAI,gBAAgB,CAc9D;AASD;;;GAGG;AACH,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAoCrD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmDjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,uBAAuB,EAClC,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GACA,OAAO,CAAC,uBAAuB,CAAC,CAuGlC"}

package/dist/llm/oauth/device-code.js

@@ -7,14 +7,17 @@
  *   2. Poll the token endpoint every `interval` seconds until the user
  *      approves, the code expires, or a non-recoverable error is returned.
  *
- * ## Provider scope
+ * ## Scope
  *
- * Device-code OAuth is used by **kimi-code** only. Anthropic uses RFC 7636
- * PKCE (see `pkce.ts` and `builtin/anthropic.ts`). The `anthropic` preset
- * was removed in T9326 — PKCE is the canonical Anthropic OAuth path per T9302.
+ * The runner is provider-neutral. Among LLM providers, device-code OAuth is
+ * used by **kimi-code** only; Anthropic uses RFC 7636 PKCE (see `pkce.ts` and
+ * `builtin/anthropic.ts`). The `anthropic` preset was removed in T9326 — PKCE
+ * is the canonical Anthropic OAuth path per T9302. The Cleo Nexus account
+ * login (`cloud/nexus-auth.ts`, T12712) drives the same runner.
  *
  * @module llm/oauth/device-code
  * @task T9321
+ * @task T12712
  * @epic T9261 T-LLM-CRED-CENTRALIZATION
  */
 import { extractOAuthErrorDetail } from './pkce.js';
@@ -111,6 +114,13 @@ export function getKimiCodeDeviceCodeConfig() {
 // ---------------------------------------------------------------------------
 /** Maximum number of consecutive network-error retries during polling. */
 const MAX_NETWORK_RETRIES = 3;
+/**
+ * Cap on how long polling runs (seconds), whatever `expires_in` the server
+ * claims: a hostile or broken server cannot keep the CLI polling for days.
+ */
+export const MAX_DEVICE_CODE_LIFETIME_SECONDS = 1800;
+/** Default time budget for one token request before it is aborted and retried. */
+export const DEVICE_CODE_REQUEST_TIMEOUT_MS = 15_000;
 /** Cap on the polling interval (seconds), regardless of `slow_down` growth. */
 const POLL_INTERVAL_CAP_SECONDS = 30;
 /**
@@ -131,6 +141,10 @@ function buildHeaders(cfg) {
 function encodeForm(params) {
     return new URLSearchParams(params).toString();
 }
+/** The config's `fetch`, else the global one. */
+function fetcherFor(cfg) {
+    return cfg.fetch ?? ((input, init) => fetch(input, init));
+}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -148,7 +162,7 @@ export async function startDeviceCodeFlow(cfg) {
     const body = { client_id: cfg.clientId };
     if (cfg.scope)
         body['scope'] = cfg.scope;
-    const resp = await fetch(cfg.deviceCodeUrl, {
+    const resp = await fetcherFor(cfg)(cfg.deviceCodeUrl, {
         method: 'POST',
         headers: buildHeaders(cfg),
         body: encodeForm(body),
@@ -187,9 +201,11 @@ export async function startDeviceCodeFlow(cfg) {
  * Poll the token endpoint until the user approves, the code expires, or an
  * unrecoverable error is received (RFC 8628 §3.4).
  *
- * Handles the two recoverable error codes:
+ * Handles the recoverable answers:
  *   - `authorization_pending` — user has not yet approved; continue polling.
- *   - `slow_down` — increase the polling interval by 1 second, then continue.
+ *   - `slow_down` — increase the polling interval by 5 seconds, then continue.
+ *   - HTTP 429 (a rate limiter in front of the endpoint, whose body is not in
+ *     OAuth form) — treated like `slow_down`.
  *
  * Network errors are retried up to `MAX_NETWORK_RETRIES` times before being
  * re-thrown.
@@ -201,6 +217,10 @@ export async function startDeviceCodeFlow(cfg) {
  *   iteration with `(elapsedSeconds, totalExpiresIn)`. Used by the CLI to
  *   print a live progress counter.
  * @param options.signal - Optional `AbortSignal` for cooperative cancellation.
+ * @param options.sleep - Optional wait override (tests); defaults to `setTimeout`.
+ * @param options.requestTimeoutMs - Per-request budget; a request that takes
+ *   longer is aborted and counted as a network error. Default
+ *   {@link DEVICE_CODE_REQUEST_TIMEOUT_MS}.
  *
  * @throws {DeviceCodeTimeoutError} When `expiresIn` is reached without approval.
  * @throws {DeviceCodeAuthError} When the provider returns a non-recoverable error.
@@ -209,7 +229,11 @@ export async function startDeviceCodeFlow(cfg) {
 export async function pollForToken(cfg, startResp, options) {
     const { deviceCode, expiresIn, interval } = startResp;
     const { onPending, signal } = options ?? {};
-    const deadline = Date.now() + expiresIn * 1000;
+    const sleep = options?.sleep ?? defaultSleep;
+    const doFetch = fetcherFor(cfg);
+    const requestTimeoutMs = options?.requestTimeoutMs ?? DEVICE_CODE_REQUEST_TIMEOUT_MS;
+    const lifetime = Math.min(expiresIn, MAX_DEVICE_CODE_LIFETIME_SECONDS);
+    const deadline = Date.now() + lifetime * 1000;
     let currentInterval = Math.max(1, Math.min(interval, POLL_INTERVAL_CAP_SECONDS));
     let consecutiveNetworkErrors = 0;
     const startedAt = Date.now();
@@ -219,7 +243,7 @@ export async function pollForToken(cfg, startResp, options) {
         }
         let resp;
         try {
-            resp = await fetch(cfg.tokenUrl, {
+            resp = await doFetch(cfg.tokenUrl, {
                 method: 'POST',
                 headers: buildHeaders(cfg),
                 body: encodeForm({
@@ -227,7 +251,9 @@ export async function pollForToken(cfg, startResp, options) {
                     client_id: cfg.clientId,
                     device_code: deviceCode,
                 }),
-                signal,
+                signal: signal
+                    ? AbortSignal.any([signal, AbortSignal.timeout(requestTimeoutMs)])
+                    : AbortSignal.timeout(requestTimeoutMs),
             });
             // Reset retry counter on any HTTP response (even error responses).
             consecutiveNetworkErrors = 0;
@@ -254,6 +280,12 @@ export async function pollForToken(cfg, startResp, options) {
                 tokenType: typeof data['token_type'] === 'string' ? data['token_type'] : 'bearer',
             };
         }
+        // A rate limiter answered, not the OAuth endpoint: back off like slow_down.
+        if (resp.status === 429) {
+            currentInterval = Math.min(currentInterval + 5, POLL_INTERVAL_CAP_SECONDS);
+            await sleep(currentInterval * 1000);
+            continue;
+        }
         // Non-200 — parse the error payload.
         let errorPayload;
         try {
@@ -267,7 +299,7 @@ export async function pollForToken(cfg, startResp, options) {
         const errorDescription = String(errorPayload['error_description'] ?? 'Unknown authorization error');
         if (errorCode === 'authorization_pending') {
             const elapsed = Math.round((Date.now() - startedAt) / 1000);
-            onPending?.(elapsed, expiresIn);
+            onPending?.(elapsed, lifetime);
             await sleep(currentInterval * 1000);
             continue;
         }
@@ -291,7 +323,7 @@ export async function pollForToken(cfg, startResp, options) {
  *
  * @internal
  */
-function sleep(ms) {
+function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //# sourceMappingURL=device-code.js.map

package/dist/llm/oauth/device-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-code.js","sourceRoot":"","sources":["../../../src/llm/oauth/device-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAyFpD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEzB,YAAY,QAAgB,EAAE,OAAe;QAC3C,KAAK,CACH,6CAA6C,OAAO,0CAA0C,QAAQ,GAAG,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YAAY,QAAgB,EAAE,SAAiB,EAAE,WAAmB;QAClE,KAAK,CACH,+CAA+C,QAAQ,MAAM,SAAS,MAAM,WAAW,EAAE,CAC1F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8B;IAChE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,KAAK;QACzD,wEAAwE,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,uBAAuB,CAAC;IAC5E,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,aAAa,EAAE,GAAG,IAAI,iCAAiC;QACvD,QAAQ,EAAE,GAAG,IAAI,kBAAkB;QACnC,kEAAkE;QAClE,sEAAsE;QACtE,yBAAyB;QACzB,QAAQ,EAAE,sCAAsC;QAChD,wEAAwE;QACxE,uEAAuE;QACvE,uDAAuD;KACxD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAqB;IACzC,OAAO;QACL,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,kBAAkB;QAC1B,GAAG,GAAG,CAAC,cAAc;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAA8B;IAChD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAqB;IAC7D,MAAM,IAAI,GAA2B,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,KAAK;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;QAC1B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,CAAC,QAAQ,WAAW,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,CAAC,QAAQ,6BAA6B;YACrE,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,uBAAuB,GAC3B,OAAO,IAAI,CAAC,2BAA2B,CAAC,KAAK,QAAQ;QACnD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB;QACvB,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAqB,EACrB,SAAkC,EAClC,OAGC;IAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;IACtD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACjF,IAAI,wBAAwB,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;gBAC1B,IAAI,EAAE,UAAU,CAAC;oBACf,UAAU,EAAE,8CAA8C;oBAC1D,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,WAAW,EAAE,UAAU;iBACxB,CAAC;gBACF,MAAM;aACP,CAAC,CAAC;YACH,mEAAmE;YACnE,wBAAwB,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wBAAwB,EAAE,CAAC;YAC3B,IAAI,wBAAwB,GAAG,mBAAmB,EAAE,CAAC;gBACnD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,0DAA0D;YAC1D,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;YACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,QAAQ,yCAAyC,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,WAAW;gBACX,YAAY,EAAE,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3F,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ;aAClF,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,YAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,QAAQ,mBAAmB,IAAI,CAAC,MAAM,qBAAqB,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,MAAM,CAC7B,YAAY,CAAC,mBAAmB,CAAC,IAAI,6BAA6B,CACnE,CAAC;QAEF,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5D,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,0DAA0D;YAC1D,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"device-code.js","sourceRoot":"","sources":["../../../src/llm/oauth/device-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AA2FpD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEzB,YAAY,QAAgB,EAAE,OAAe;QAC3C,KAAK,CACH,6CAA6C,OAAO,0CAA0C,QAAQ,GAAG,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,QAAQ,CAAS;IACjB,SAAS,CAAS;IAE3B,YAAY,QAAgB,EAAE,SAAiB,EAAE,WAAmB;QAClE,KAAK,CACH,+CAA+C,QAAQ,MAAM,SAAS,MAAM,WAAW,EAAE,CAC1F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA8B;IAChE,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,KAAK;QACzD,wEAAwE,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,uBAAuB,CAAC;IAC5E,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,aAAa,EAAE,GAAG,IAAI,iCAAiC;QACvD,QAAQ,EAAE,GAAG,IAAI,kBAAkB;QACnC,kEAAkE;QAClE,sEAAsE;QACtE,yBAAyB;QACzB,QAAQ,EAAE,sCAAsC;QAChD,wEAAwE;QACxE,uEAAuE;QACvE,uDAAuD;KACxD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAErD,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAqB;IACzC,OAAO;QACL,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,kBAAkB;QAC1B,GAAG,GAAG,CAAC,cAAc;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAA8B;IAChD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CACjB,GAAqB;IAErB,OAAO,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAqB;IAC7D,MAAM,IAAI,GAA2B,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,KAAK;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;QAC1B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,CAAC,QAAQ,WAAW,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE5D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,CAAC,QAAQ,6BAA6B;YACrE,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,uBAAuB,GAC3B,OAAO,IAAI,CAAC,2BAA2B,CAAC,KAAK,QAAQ;QACnD,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB;QACvB,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAqB,EACrB,SAAkC,EAClC,OAKC;IAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;IACtD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,YAAY,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAEhC,MAAM,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,8BAA8B,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9C,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACjF,IAAI,wBAAwB,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC;gBAC1B,IAAI,EAAE,UAAU,CAAC;oBACf,UAAU,EAAE,8CAA8C;oBAC1D,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,WAAW,EAAE,UAAU;iBACxB,CAAC;gBACF,MAAM,EAAE,MAAM;oBACZ,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBAClE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC1C,CAAC,CAAC;YACH,mEAAmE;YACnE,wBAAwB,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wBAAwB,EAAE,CAAC;YAC3B,IAAI,wBAAwB,GAAG,mBAAmB,EAAE,CAAC;gBACnD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,0DAA0D;YAC1D,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;YACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,QAAQ,yCAAyC,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,WAAW;gBACX,YAAY,EAAE,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3F,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ;aAClF,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,qCAAqC;QACrC,IAAI,YAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,QAAQ,mBAAmB,IAAI,CAAC,MAAM,qBAAqB,CACvF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,MAAM,CAC7B,YAAY,CAAC,mBAAmB,CAAC,IAAI,6BAA6B,CACnE,CAAC;QAEF,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5D,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YAC9B,0DAA0D;YAC1D,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}