@georgedong32/ccs 7.66.0

package/dist/cliproxy/auth/oauth-process.js

@@ -0,0 +1,447 @@
+"use strict";
+/**
+ * OAuth Process Execution for CLIProxyAPI
+ *
+ * Handles the spawning and monitoring of CLIProxy OAuth process.
+ * Separated from oauth-handler.ts for modularity.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeOAuthProcess = exports.extractLikelyAuthFailureFromStderr = void 0;
+const child_process_1 = require("child_process");
+const ui_1 = require("../../utils/ui");
+const process_utils_1 = require("../../utils/process-utils");
+const kiro_import_1 = require("./kiro-import");
+const project_selection_handler_1 = require("../project-selection-handler");
+const environment_detector_1 = require("./environment-detector");
+const token_manager_1 = require("./token-manager");
+const device_code_handler_1 = require("../device-code-handler");
+const management_1 = require("../../management");
+const auth_session_manager_1 = require("../auth-session-manager");
+/**
+ * Handle project selection prompt
+ */
+async function handleProjectSelection(output, state, options, authProcess, log) {
+    const defaultProjectId = (0, project_selection_handler_1.parseDefaultProject)(output) || '';
+    if (state.parsedProjects.length > 0 && !options.isCLI) {
+        log(`Requesting project selection from UI (session: ${state.sessionId})`);
+        const prompt = {
+            sessionId: state.sessionId,
+            provider: options.provider,
+            projects: state.parsedProjects,
+            defaultProjectId,
+            supportsAll: output.includes('ALL'),
+        };
+        try {
+            const selectedId = await (0, project_selection_handler_1.requestProjectSelection)(prompt);
+            const response = selectedId || '';
+            log(`User selected: ${response || '(default)'}`);
+            authProcess.stdin?.write(response + '\n');
+        }
+        catch {
+            log('Project selection failed, using default');
+            authProcess.stdin?.write('\n');
+        }
+    }
+    else {
+        log('CLI mode or no projects, auto-selecting default');
+        authProcess.stdin?.write('\n');
+    }
+}
+/**
+ * Handle stdout data from OAuth process
+ */
+async function handleStdout(output, state, options, authProcess, log) {
+    log(`stdout: ${output.trim()}`);
+    state.accumulatedOutput += output;
+    // H4: Use explicit flow type from OAUTH_FLOW_TYPES instead of null port check
+    const flowType = management_1.OAUTH_FLOW_TYPES[options.provider] || 'authorization_code';
+    const isDeviceCodeFlow = flowType === 'device_code';
+    // Parse project list when available
+    if ((0, project_selection_handler_1.isProjectList)(state.accumulatedOutput) && state.parsedProjects.length === 0) {
+        state.parsedProjects = (0, project_selection_handler_1.parseProjectList)(state.accumulatedOutput);
+        log(`Parsed ${state.parsedProjects.length} projects`);
+    }
+    // Handle project selection prompt (Authorization Code flows only - Device Code has no stdin pipe)
+    if (!isDeviceCodeFlow && !state.projectPromptHandled && (0, project_selection_handler_1.isProjectSelectionPrompt)(output)) {
+        state.projectPromptHandled = true;
+        await handleProjectSelection(output, state, options, authProcess, log);
+    }
+    // Handle Device Code Flow: parse and display user code
+    if (isDeviceCodeFlow && !state.deviceCodeDisplayed) {
+        // Parse device/user code from various formats:
+        // "Enter code: XXXX-YYYY" or "code XXXX-YYYY" or "user code: XXXX-YYYY"
+        const codeMatch = state.accumulatedOutput.match(/(?:enter\s+)?(?:user\s+)?code[:\s]+["']?([A-Z0-9]{4,8}[-\s]?[A-Z0-9]{4,8})["']?/i);
+        const urlMatch = state.accumulatedOutput.match(/(https?:\/\/[^\s]+device[^\s]*)/i);
+        if (codeMatch) {
+            state.userCode = codeMatch[1].toUpperCase();
+            state.deviceCodeDisplayed = true;
+            log(`Parsed device code: ${state.userCode}`);
+            const verificationUrl = urlMatch?.[1] || 'https://github.com/login/device';
+            // Emit device code event for WebSocket broadcast to UI
+            const deviceCodePrompt = {
+                sessionId: state.sessionId,
+                provider: options.provider,
+                userCode: state.userCode,
+                verificationUrl,
+                expiresAt: Date.now() + device_code_handler_1.DEVICE_CODE_TIMEOUT_MS,
+            };
+            device_code_handler_1.deviceCodeEvents.emit('deviceCode:received', deviceCodePrompt);
+            // Display device code prominently in CLI
+            console.log('');
+            console.log('  ╔══════════════════════════════════════════════════════╗');
+            console.log(`  ║  Enter this code: ${state.userCode.padEnd(35)}║`);
+            console.log('  ╚══════════════════════════════════════════════════════╝');
+            console.log('');
+            console.log((0, ui_1.info)(`Open: ${verificationUrl}`));
+            console.log('');
+            // Update step display for device code flow
+            process.stdout.write('\x1b[1A\x1b[2K');
+            (0, environment_detector_1.showStep)(2, 4, 'ok', 'Device code received');
+            (0, environment_detector_1.showStep)(3, 4, 'progress', 'Waiting for authorization...');
+        }
+    }
+    // Detect callback server / browser (for Authorization Code flows only)
+    if (!isDeviceCodeFlow &&
+        !state.browserOpened &&
+        (output.includes('listening') || output.includes('http'))) {
+        process.stdout.write('\x1b[1A\x1b[2K');
+        (0, environment_detector_1.showStep)(2, 4, 'ok', `Callback server listening on port ${options.callbackPort}`);
+        (0, environment_detector_1.showStep)(3, 4, 'progress', 'Opening browser...');
+        state.browserOpened = true;
+    }
+    // Display OAuth URL for all modes (enables VS Code terminal URL detection popup)
+    if (!isDeviceCodeFlow && !state.urlDisplayed) {
+        const urlMatch = output.match(/https?:\/\/[^\s]+/);
+        if (urlMatch) {
+            console.log('');
+            console.log((0, ui_1.info)(`${options.oauthConfig.displayName} OAuth URL:`));
+            console.log(`    ${urlMatch[0]}`);
+            console.log('');
+            state.urlDisplayed = true;
+        }
+    }
+}
+/** Display OAuth URL from stderr if in headless mode */
+function displayUrlFromStderr(output, state, oauthConfig) {
+    const urlMatch = output.match(/https?:\/\/[^\s]+/);
+    if (urlMatch) {
+        console.log('');
+        console.log((0, ui_1.info)(`${oauthConfig.displayName} OAuth URL:`));
+        console.log(`    ${urlMatch[0]}`);
+        console.log('');
+        state.urlDisplayed = true;
+    }
+}
+const ANSI_ESCAPE_REGEX = /\x1b\[[0-9;]*m/g;
+function extractLikelyAuthFailureFromStderr(provider, stderrData) {
+    // Keep this scoped to ghcp to avoid over-classifying other providers.
+    if (provider !== 'ghcp') {
+        return null;
+    }
+    if (!stderrData.trim()) {
+        return null;
+    }
+    const normalizedLines = stderrData
+        .split('\n')
+        .map((line) => line.replace(ANSI_ESCAPE_REGEX, '').trim())
+        .filter(Boolean)
+        .map((line) => {
+        const messageIndex = line.indexOf('msg="');
+        if (messageIndex >= 0) {
+            const message = line
+                .slice(messageIndex + 5)
+                .replace(/"$/, '')
+                .trim();
+            if (message) {
+                return message;
+            }
+        }
+        return line;
+    });
+    const prioritizedPatterns = [
+        /github copilot authentication failed:\s*(.+)/i,
+        /authentication failed:\s*(.+)/i,
+        /failed to verify copilot access[^:]*:\s*(.+)/i,
+        /failed to save auth:\s*(.+)/i,
+    ];
+    for (let i = normalizedLines.length - 1; i >= 0; i--) {
+        const line = normalizedLines[i];
+        for (const pattern of prioritizedPatterns) {
+            const match = line.match(pattern);
+            if (match?.[1]?.trim()) {
+                return match[1].trim().slice(0, 240);
+            }
+        }
+    }
+    return null;
+}
+exports.extractLikelyAuthFailureFromStderr = extractLikelyAuthFailureFromStderr;
+/** Handle token not found after successful process exit */
+async function handleTokenNotFound(provider, callbackPort, tokenDir, nickname, expectedAccountId, verbose, failureReason) {
+    // Kiro-specific: Try auto-import from Kiro IDE
+    if (provider === 'kiro') {
+        console.log('');
+        console.log((0, ui_1.warn)('Callback redirected to Kiro IDE. Attempting to import token...'));
+        const result = await (0, kiro_import_1.tryKiroImport)(tokenDir, verbose);
+        if (result.success) {
+            const providerInfo = result.provider ? ` (Provider: ${result.provider})` : '';
+            console.log((0, ui_1.ok)(`Imported Kiro token from IDE${providerInfo}`));
+            return (0, token_manager_1.registerAccountFromToken)(provider, tokenDir, nickname, verbose, expectedAccountId);
+        }
+        console.log((0, ui_1.fail)(`Auto-import failed: ${result.error}`));
+        console.log('');
+        console.log('To manually import from Kiro IDE:');
+        console.log('  1. Ensure you are logged into Kiro IDE');
+        console.log('  2. Run: ccs kiro --import');
+        return null;
+    }
+    // Default behavior for other providers
+    console.log('');
+    if (failureReason) {
+        // Sanitize internal URLs/paths from failure reason to avoid leaking infrastructure details
+        const sanitizedReason = failureReason
+            .replace(/https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0)[^\s]*/gi, '[internal-url]')
+            .replace(/\/(?:root|home|opt|tmp|var)\/[^\s]*/g, '[path]');
+        console.log((0, ui_1.fail)('Authentication completed but token was not persisted'));
+        console.log(`    ${sanitizedReason}`);
+        console.log('');
+        console.log('This usually means provider-side authorization was accepted,');
+        console.log('but CLIProxy failed a post-auth verification or token save step.');
+        console.log('');
+        console.log(`Try: ccs ${provider} --auth --verbose`);
+        return null;
+    }
+    console.log((0, ui_1.fail)('Token not found after authentication'));
+    console.log('');
+    console.log('The browser showed success but callback was not received.');
+    console.log('');
+    console.log('Common causes:');
+    console.log('  1. OAuth session timed out (sessions expire after ~10 minutes)');
+    console.log('  2. Callback server could not receive the redirect');
+    console.log('  3. Browser did not redirect to localhost properly');
+    if (process.platform === 'win32') {
+        console.log('');
+        console.log('On Windows, this usually means:');
+        console.log('  1. Windows Firewall blocked the callback');
+        console.log('  2. Antivirus software blocked the connection');
+        console.log('');
+        console.log('Try running as Administrator:');
+        console.log(`  netsh advfirewall firewall add rule name="CCS OAuth" dir=in action=allow protocol=TCP localport=${callbackPort}`);
+    }
+    console.log('');
+    console.log('If you copied the OAuth URL to a different browser:');
+    console.log('  - Complete authentication within the timeout window');
+    console.log('  - Ensure you are on the same machine (localhost callback)');
+    console.log('  - Copy the entire URL including all parameters');
+    console.log('');
+    console.log(`Try: ccs ${provider} --auth --verbose`);
+    return null;
+}
+/** Handle process exit with error */
+function handleProcessError(code, state, headless) {
+    console.log('');
+    console.log((0, ui_1.fail)(`CLIProxy auth exited with code ${code}`));
+    if (state.stderrData && !state.urlDisplayed) {
+        console.log(`    ${state.stderrData.trim().split('\n')[0]}`);
+    }
+    if (headless && !state.urlDisplayed) {
+        console.log('');
+        console.log((0, ui_1.info)('No OAuth URL was displayed. Try with --verbose for details.'));
+    }
+}
+/**
+ * Execute OAuth process and wait for completion
+ */
+function executeOAuthProcess(options) {
+    const { provider, binaryPath, args, tokenDir, oauthConfig, callbackPort, headless, verbose, nickname, expectedAccountId, } = options;
+    const log = (msg) => {
+        if (verbose)
+            console.error(`[auth] ${msg}`);
+    };
+    return new Promise((resolve) => {
+        // H4: Use explicit flow type from OAUTH_FLOW_TYPES instead of null port check
+        const flowType = management_1.OAUTH_FLOW_TYPES[provider] || 'authorization_code';
+        const isDeviceCodeFlow = flowType === 'device_code';
+        // H6: TTY detection - only inherit stdin if TTY available (prevents issues in CI/piped scripts)
+        // Device Code flows may need interactive stdin for email/prompts
+        // Authorization Code flows need piped stdin for project selection
+        const stdinMode = isDeviceCodeFlow && process.stdin.isTTY ? 'inherit' : 'pipe';
+        const authProcess = (0, child_process_1.spawn)(binaryPath, args, {
+            stdio: [stdinMode, 'pipe', 'pipe'],
+            env: { ...process.env, CLI_PROXY_AUTH_DIR: tokenDir },
+        });
+        // H7: Mutable ref for stdin keepalive interval (set later, needed in cleanup)
+        let stdinKeepalive = null;
+        // H5: Signal handling - properly kill child process on SIGINT/SIGTERM
+        // H8: Also clear stdinKeepalive interval to prevent memory leak
+        const cleanup = () => {
+            if (stdinKeepalive)
+                clearInterval(stdinKeepalive);
+            if (authProcess && authProcess.exitCode === null) {
+                (0, process_utils_1.killWithEscalation)(authProcess);
+            }
+        };
+        process.on('SIGINT', cleanup);
+        process.on('SIGTERM', cleanup);
+        const state = {
+            stderrData: '',
+            urlDisplayed: false,
+            browserOpened: false,
+            projectPromptHandled: false,
+            accumulatedOutput: '',
+            parsedProjects: [],
+            sessionId: (0, project_selection_handler_1.generateSessionId)(),
+            deviceCodeDisplayed: false,
+            userCode: null,
+        };
+        // Register session for cancellation support
+        (0, auth_session_manager_1.registerAuthSession)(state.sessionId, provider);
+        (0, auth_session_manager_1.attachProcessToSession)(state.sessionId, authProcess);
+        // Listen for external cancel signal
+        const handleCancel = (cancelledSessionId) => {
+            if (cancelledSessionId === state.sessionId && authProcess && authProcess.exitCode === null) {
+                log('Session cancelled externally');
+                (0, process_utils_1.killWithEscalation)(authProcess);
+            }
+        };
+        auth_session_manager_1.authSessionEvents.on('session:cancelled', handleCancel);
+        const startTime = Date.now();
+        // H7: Stdin keepalive for Authorization Code flows
+        // CLIProxyAPIPlus has a 15-second timer that prompts for manual URL paste.
+        // If the user completes browser auth after this timer fires but before the
+        // non-blocking check, the prompt blocks forever on stdin.
+        // Workaround: Send newline every 16s to skip the manual prompt and continue polling.
+        if (!isDeviceCodeFlow && stdinMode === 'pipe') {
+            stdinKeepalive = setInterval(() => {
+                if (authProcess.stdin && !authProcess.stdin.destroyed) {
+                    authProcess.stdin.write('\n');
+                    log('Sent stdin keepalive (skip manual URL prompt)');
+                }
+            }, 16000);
+        }
+        authProcess.stdout?.on('data', async (data) => {
+            await handleStdout(data.toString(), state, options, authProcess, log);
+        });
+        authProcess.stderr?.on('data', (data) => {
+            const output = data.toString();
+            state.stderrData += output;
+            log(`stderr: ${output.trim()}`);
+            if (headless && !state.urlDisplayed) {
+                displayUrlFromStderr(output, state, oauthConfig);
+            }
+        });
+        // Show waiting message after delay
+        setTimeout(() => {
+            if (isDeviceCodeFlow) {
+                // Device Code Flow: show polling message
+                if (!state.deviceCodeDisplayed) {
+                    // Code not yet displayed, show generic waiting message
+                    (0, environment_detector_1.showStep)(3, 4, 'progress', 'Waiting for device code...');
+                }
+                (0, environment_detector_1.showStep)(4, 4, 'progress', 'Polling for authorization...');
+                console.log('');
+                console.log((0, ui_1.info)('Complete the login in your browser. This page will update automatically.'));
+            }
+            else {
+                // Authorization Code Flow: show callback server message
+                if (!state.browserOpened) {
+                    process.stdout.write('\x1b[1A\x1b[2K');
+                    (0, environment_detector_1.showStep)(2, 4, 'ok', `Callback server ready (port ${callbackPort})`);
+                    (0, environment_detector_1.showStep)(3, 4, 'ok', 'Browser opened');
+                    state.browserOpened = true;
+                }
+                (0, environment_detector_1.showStep)(4, 4, 'progress', 'Waiting for OAuth callback...');
+                console.log('');
+                console.log((0, ui_1.info)('Complete the login in your browser. This page will update automatically.'));
+            }
+            if (!verbose)
+                console.log((0, ui_1.info)('If stuck, try: ccs ' + provider + ' --auth --verbose'));
+        }, 2000);
+        // Timeout handling
+        // Device code flows need longer timeout to match CLIProxy binary's polling window (60 attempts × 5s = 300s)
+        const timeoutMs = headless || isDeviceCodeFlow ? 300000 : 120000;
+        const timeout = setTimeout(() => {
+            // H7: Clear stdin keepalive interval
+            if (stdinKeepalive)
+                clearInterval(stdinKeepalive);
+            // H5: Remove signal handlers before killing process
+            process.removeListener('SIGINT', cleanup);
+            process.removeListener('SIGTERM', cleanup);
+            auth_session_manager_1.authSessionEvents.removeListener('session:cancelled', handleCancel);
+            (0, auth_session_manager_1.unregisterAuthSession)(state.sessionId);
+            (0, project_selection_handler_1.cancelProjectSelection)(state.sessionId);
+            (0, process_utils_1.killWithEscalation)(authProcess);
+            console.log('');
+            console.log((0, ui_1.fail)(`OAuth timed out after ${timeoutMs / 60000} minutes`));
+            for (const line of (0, environment_detector_1.getTimeoutTroubleshooting)(provider, callbackPort ?? null)) {
+                console.log(line);
+            }
+            resolve(null);
+        }, timeoutMs);
+        authProcess.on('exit', async (code) => {
+            clearTimeout(timeout);
+            // H7: Clear stdin keepalive interval
+            if (stdinKeepalive)
+                clearInterval(stdinKeepalive);
+            // H5: Remove signal handlers to prevent memory leaks
+            process.removeListener('SIGINT', cleanup);
+            process.removeListener('SIGTERM', cleanup);
+            auth_session_manager_1.authSessionEvents.removeListener('session:cancelled', handleCancel);
+            (0, auth_session_manager_1.unregisterAuthSession)(state.sessionId);
+            (0, project_selection_handler_1.cancelProjectSelection)(state.sessionId);
+            const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
+            if (code === 0) {
+                if ((0, token_manager_1.isAuthenticated)(provider)) {
+                    console.log('');
+                    console.log((0, ui_1.ok)(`Authentication successful (${elapsed}s)`));
+                    // Emit device code completion event for UI
+                    if (isDeviceCodeFlow && state.deviceCodeDisplayed) {
+                        device_code_handler_1.deviceCodeEvents.emit('deviceCode:completed', state.sessionId);
+                    }
+                    resolve((0, token_manager_1.registerAccountFromToken)(provider, tokenDir, nickname, verbose, expectedAccountId));
+                }
+                else {
+                    const failureReason = extractLikelyAuthFailureFromStderr(provider, state.stderrData);
+                    // Emit device code failure event for UI
+                    if (isDeviceCodeFlow && state.deviceCodeDisplayed) {
+                        device_code_handler_1.deviceCodeEvents.emit('deviceCode:failed', {
+                            sessionId: state.sessionId,
+                            error: failureReason || 'Token not found after authentication',
+                        });
+                    }
+                    // Try auto-import for Kiro, show error for others
+                    const account = await handleTokenNotFound(provider, callbackPort, tokenDir, nickname, expectedAccountId, verbose, failureReason || undefined);
+                    resolve(account);
+                }
+            }
+            else {
+                // Emit device code failure event for UI
+                if (isDeviceCodeFlow && state.deviceCodeDisplayed) {
+                    device_code_handler_1.deviceCodeEvents.emit('deviceCode:failed', {
+                        sessionId: state.sessionId,
+                        error: `Auth process exited with code ${code}`,
+                    });
+                }
+                handleProcessError(code, state, headless);
+                resolve(null);
+            }
+        });
+        authProcess.on('error', (error) => {
+            clearTimeout(timeout);
+            // H7: Clear stdin keepalive interval
+            if (stdinKeepalive)
+                clearInterval(stdinKeepalive);
+            // H5: Remove signal handlers to prevent memory leaks
+            process.removeListener('SIGINT', cleanup);
+            process.removeListener('SIGTERM', cleanup);
+            auth_session_manager_1.authSessionEvents.removeListener('session:cancelled', handleCancel);
+            (0, auth_session_manager_1.unregisterAuthSession)(state.sessionId);
+            (0, project_selection_handler_1.cancelProjectSelection)(state.sessionId);
+            console.log('');
+            console.log((0, ui_1.fail)(`Failed to start auth process: ${error.message}`));
+            resolve(null);
+        });
+    });
+}
+exports.executeOAuthProcess = executeOAuthProcess;
+//# sourceMappingURL=oauth-process.js.map

package/dist/cliproxy/auth/oauth-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-process.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/oauth-process.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,iDAAoD;AACpD,uCAAsD;AACtD,6DAA+D;AAC/D,+CAA8C;AAG9C,4EAUsC;AAEtC,iEAA6E;AAC7E,mDAA4E;AAC5E,gEAIgC;AAChC,iDAAoD;AACpD,kEAKiC;AAgCjC;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,KAAmB,EACnB,OAA4B,EAC5B,WAAyB,EACzB,GAA0B;IAE1B,MAAM,gBAAgB,GAAG,IAAA,+CAAmB,EAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAE3D,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtD,GAAG,CAAC,kDAAkD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAE1E,MAAM,MAAM,GAA2B;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,KAAK,CAAC,cAAc;YAC9B,gBAAgB;YAChB,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;SACpC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAA,mDAAuB,EAAC,MAAM,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,UAAU,IAAI,EAAE,CAAC;YAClC,GAAG,CAAC,kBAAkB,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;YACjD,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC/C,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,iDAAiD,CAAC,CAAC;QACvD,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,KAAmB,EACnB,OAA4B,EAC5B,WAAyB,EACzB,GAA0B;IAE1B,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAElC,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,6BAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC;IAC5E,MAAM,gBAAgB,GAAG,QAAQ,KAAK,aAAa,CAAC;IAEpD,oCAAoC;IACpC,IAAI,IAAA,yCAAa,EAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,cAAc,GAAG,IAAA,4CAAgB,EAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACjE,GAAG,CAAC,UAAU,KAAK,CAAC,cAAc,CAAC,MAAM,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,kGAAkG;IAClG,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,IAAA,oDAAwB,EAAC,MAAM,CAAC,EAAE,CAAC;QACzF,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAClC,MAAM,sBAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,uDAAuD;IACvD,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnD,+CAA+C;QAC/C,wEAAwE;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAC7C,kFAAkF,CACnF,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAEnF,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACjC,GAAG,CAAC,uBAAuB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE7C,MAAM,eAAe,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,iCAAiC,CAAC;YAE3E,uDAAuD;YACvD,MAAM,gBAAgB,GAAqB;gBACzC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe;gBACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,4CAAsB;aAC/C,CAAC;YACF,sCAAgB,CAAC,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;YAE/D,yCAAyC;YACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,SAAS,eAAe,EAAE,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,2CAA2C;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACvC,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAC;YAC7C,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,8BAA8B,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IACE,CAAC,gBAAgB;QACjB,CAAC,KAAK,CAAC,aAAa;QACpB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACzD,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvC,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,qCAAqC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAClF,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACjD,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,aAAa,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,oBAAoB,CAC3B,MAAc,EACd,KAAmB,EACnB,WAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,GAAG,WAAW,CAAC,WAAW,aAAa,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,SAAgB,kCAAkC,CAChD,QAA0B,EAC1B,UAAkB;IAElB,sEAAsE;IACtE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,UAAU;SAC/B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SACzD,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI;iBACjB,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC;iBACvB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;iBACjB,IAAI,EAAE,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEL,MAAM,mBAAmB,GAAG;QAC1B,+CAA+C;QAC/C,gCAAgC;QAChC,+CAA+C;QAC/C,8BAA8B;KAC/B,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAjDD,gFAiDC;AAED,2DAA2D;AAC3D,KAAK,UAAU,mBAAmB,CAChC,QAA0B,EAC1B,YAA2B,EAC3B,QAAgB,EAChB,QAA4B,EAC5B,iBAAqC,EACrC,OAAgB,EAChB,aAAsB;IAEtB,+CAA+C;IAC/C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,gEAAgE,CAAC,CAAC,CAAC;QAEpF,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAa,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAA,OAAE,EAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO,IAAA,wCAAwB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,aAAa,EAAE,CAAC;QAClB,2FAA2F;QAC3F,MAAM,eAAe,GAAG,aAAa;aAClC,OAAO,CAAC,0DAA0D,EAAE,gBAAgB,CAAC;aACrF,OAAO,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,sDAAsD,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,eAAe,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,mBAAmB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,sCAAsC,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAEnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CACT,qGAAqG,YAAY,EAAE,CACpH,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,mBAAmB,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qCAAqC;AACrC,SAAS,kBAAkB,CAAC,IAAmB,EAAE,KAAmB,EAAE,QAAiB;IACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,6DAA6D,CAAC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAA4B;IAC9D,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,iBAAiB,GAClB,GAAG,OAAO,CAAC;IAEZ,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QACjD,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,6BAAgB,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC;QACpE,MAAM,gBAAgB,GAAG,QAAQ,KAAK,aAAa,CAAC;QAEpD,gGAAgG;QAChG,iEAAiE;QACjE,kEAAkE;QAClE,MAAM,SAAS,GAAG,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAA,qBAAK,EAAC,UAAU,EAAE,IAAI,EAAE;YAC1C,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;YAClC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE;SACtD,CAAC,CAAC;QAEH,8EAA8E;QAC9E,IAAI,cAAc,GAA0C,IAAI,CAAC;QAEjE,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,cAAc;gBAAE,aAAa,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,WAAW,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACjD,IAAA,kCAAkB,EAAC,WAAW,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAiB;YAC1B,UAAU,EAAE,EAAE;YACd,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,KAAK;YACpB,oBAAoB,EAAE,KAAK;YAC3B,iBAAiB,EAAE,EAAE;YACrB,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,IAAA,6CAAiB,GAAE;YAC9B,mBAAmB,EAAE,KAAK;YAC1B,QAAQ,EAAE,IAAI;SACf,CAAC;QAEF,4CAA4C;QAC5C,IAAA,0CAAmB,EAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAA,6CAAsB,EAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAErD,oCAAoC;QACpC,MAAM,YAAY,GAAG,CAAC,kBAA0B,EAAE,EAAE;YAClD,IAAI,kBAAkB,KAAK,KAAK,CAAC,SAAS,IAAI,WAAW,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC3F,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBACpC,IAAA,kCAAkB,EAAC,WAAW,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QACF,wCAAiB,CAAC,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,mDAAmD;QACnD,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,qFAAqF;QACrF,IAAI,CAAC,gBAAgB,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YAC9C,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;gBAChC,IAAI,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;oBACtD,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC9B,GAAG,CAAC,+CAA+C,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC;QAED,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;YAC3B,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACpC,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,gBAAgB,EAAE,CAAC;gBACrB,yCAAyC;gBACzC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,uDAAuD;oBACvD,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC;gBAC3D,CAAC;gBACD,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,8BAA8B,CAAC,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,IAAA,SAAI,EAAC,0EAA0E,CAAC,CACjF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,wDAAwD;gBACxD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;oBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACvC,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,+BAA+B,YAAY,GAAG,CAAC,CAAC;oBACrE,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;oBACvC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC7B,CAAC;gBACD,IAAA,+BAAQ,EAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAC;gBAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,IAAA,SAAI,EAAC,0EAA0E,CAAC,CACjF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,qBAAqB,GAAG,QAAQ,GAAG,mBAAmB,CAAC,CAAC,CAAC;QAC1F,CAAC,EAAE,IAAI,CAAC,CAAC;QAET,mBAAmB;QACnB,4GAA4G;QAC5G,MAAM,SAAS,GAAG,QAAQ,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,qCAAqC;YACrC,IAAI,cAAc;gBAAE,aAAa,CAAC,cAAc,CAAC,CAAC;YAClD,oDAAoD;YACpD,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3C,wCAAiB,CAAC,cAAc,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YACpE,IAAA,4CAAqB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAA,kDAAsB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxC,IAAA,kCAAkB,EAAC,WAAW,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,yBAAyB,SAAS,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC;YACxE,KAAK,MAAM,IAAI,IAAI,IAAA,gDAAyB,EAAC,QAAQ,EAAE,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC7E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACpC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,qCAAqC;YACrC,IAAI,cAAc;gBAAE,aAAa,CAAC,cAAc,CAAC,CAAC;YAClD,qDAAqD;YACrD,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3C,wCAAiB,CAAC,cAAc,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YACpE,IAAA,4CAAqB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAA,kDAAsB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE7D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,IAAI,IAAA,+BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,IAAA,OAAE,EAAC,8BAA8B,OAAO,IAAI,CAAC,CAAC,CAAC;oBAE3D,2CAA2C;oBAC3C,IAAI,gBAAgB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;wBAClD,sCAAgB,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;oBACjE,CAAC;oBAED,OAAO,CACL,IAAA,wCAAwB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,CACnF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,aAAa,GAAG,kCAAkC,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;oBAErF,wCAAwC;oBACxC,IAAI,gBAAgB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;wBAClD,sCAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE;4BACzC,SAAS,EAAE,KAAK,CAAC,SAAS;4BAC1B,KAAK,EAAE,aAAa,IAAI,sCAAsC;yBAC/D,CAAC,CAAC;oBACL,CAAC;oBAED,kDAAkD;oBAClD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACP,aAAa,IAAI,SAAS,CAC3B,CAAC;oBACF,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,IAAI,gBAAgB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;oBAClD,sCAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE;wBACzC,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,KAAK,EAAE,iCAAiC,IAAI,EAAE;qBAC/C,CAAC,CAAC;gBACL,CAAC;gBAED,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAChC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,qCAAqC;YACrC,IAAI,cAAc;gBAAE,aAAa,CAAC,cAAc,CAAC,CAAC;YAClD,qDAAqD;YACrD,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3C,wCAAiB,CAAC,cAAc,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;YACpE,IAAA,4CAAqB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAA,kDAAsB,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AArOD,kDAqOC"}

package/dist/cliproxy/auth/provider-refreshers/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Provider Token Refreshers
+ *
+ * Exports refresh functions for each OAuth provider.
+ *
+ * Refresh responsibility:
+ * - CCS-managed: gemini (CCS refreshes tokens directly via Google OAuth)
+ * - CLIProxy-delegated: codex, agy, kiro, ghcp, qwen, iflow, kimi
+ *   (CLIProxyAPIPlus handles refresh automatically in background)
+ * - Not implemented: claude
+ */
+import { CLIProxyProvider } from '../../types';
+/** Token refresh result */
+export interface ProviderRefreshResult {
+    success: boolean;
+    error?: string;
+    expiresAt?: number;
+    /** True if refresh is delegated to CLIProxy (not handled by CCS) */
+    delegated?: boolean;
+}
+/**
+ * Check if a provider's token refresh is delegated to CLIProxy
+ */
+export declare function isRefreshDelegated(provider: CLIProxyProvider): boolean;
+/**
+ * Refresh token for a specific provider and account
+ * @param provider Provider to refresh
+ * @param accountId Account ID used to refresh the correct provider token
+ * @returns Refresh result with success status and optional error
+ */
+export declare function refreshToken(provider: CLIProxyProvider, accountId: string): Promise<ProviderRefreshResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/cliproxy/auth/provider-refreshers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/provider-refreshers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQ/C,2BAA2B;AAC3B,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAEtE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}

package/dist/cliproxy/auth/provider-refreshers/index.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Provider Token Refreshers
+ *
+ * Exports refresh functions for each OAuth provider.
+ *
+ * Refresh responsibility:
+ * - CCS-managed: gemini (CCS refreshes tokens directly via Google OAuth)
+ * - CLIProxy-delegated: codex, agy, kiro, ghcp, qwen, iflow, kimi
+ *   (CLIProxyAPIPlus handles refresh automatically in background)
+ * - Not implemented: claude
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshToken = exports.isRefreshDelegated = void 0;
+const account_manager_1 = require("../../account-manager");
+const provider_capabilities_1 = require("../../provider-capabilities");
+const gemini_token_refresh_1 = require("../gemini-token-refresh");
+function assertNever(value) {
+    throw new Error(`Unhandled token refresh ownership: ${String(value)}`);
+}
+/**
+ * Check if a provider's token refresh is delegated to CLIProxy
+ */
+function isRefreshDelegated(provider) {
+    return (0, provider_capabilities_1.isRefreshDelegatedToCLIProxy)(provider);
+}
+exports.isRefreshDelegated = isRefreshDelegated;
+/**
+ * Refresh token for a specific provider and account
+ * @param provider Provider to refresh
+ * @param accountId Account ID used to refresh the correct provider token
+ * @returns Refresh result with success status and optional error
+ */
+async function refreshToken(provider, accountId) {
+    const normalizedAccountId = accountId.trim();
+    if (!normalizedAccountId) {
+        return {
+            success: false,
+            error: 'Account ID is required for token refresh',
+        };
+    }
+    const hasAccount = (0, account_manager_1.getProviderAccounts)(provider).some((account) => account.id === normalizedAccountId);
+    if (!hasAccount) {
+        return {
+            success: false,
+            error: `Account not found for ${provider}: ${normalizedAccountId}`,
+        };
+    }
+    if (provider === 'gemini') {
+        return await refreshGeminiTokenWrapper(normalizedAccountId);
+    }
+    const ownership = (0, provider_capabilities_1.getTokenRefreshOwnership)(provider);
+    switch (ownership) {
+        case 'cliproxy':
+            // CLIProxyAPIPlus handles refresh for these providers automatically.
+            // No action needed from CCS — report success with delegated flag.
+            return { success: true, delegated: true };
+        case 'unsupported':
+        case 'ccs':
+            // Non-gemini CCS-owned refresh paths are not implemented yet.
+            return {
+                success: false,
+                error: `Token refresh not yet implemented for ${provider}`,
+            };
+        default:
+            return assertNever(ownership);
+    }
+}
+exports.refreshToken = refreshToken;
+/**
+ * Wrapper for Gemini token refresh
+ * Converts gemini-token-refresh.ts format to provider-refreshers format
+ */
+async function refreshGeminiTokenWrapper(accountId) {
+    const result = await (0, gemini_token_refresh_1.refreshGeminiToken)(accountId);
+    if (!result.success) {
+        return {
+            success: false,
+            error: result.error,
+        };
+    }
+    return {
+        success: true,
+        expiresAt: result.expiresAt,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/cliproxy/auth/provider-refreshers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/cliproxy/auth/provider-refreshers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAGH,2DAA4D;AAC5D,uEAGqC;AACrC,kEAA6D;AAW7D,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAA0B;IAC3D,OAAO,IAAA,oDAA4B,EAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAFD,gDAEC;AAED;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,QAA0B,EAC1B,SAAiB;IAEjB,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0CAA0C;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,qCAAmB,EAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,mBAAmB,CAChD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,yBAAyB,QAAQ,KAAK,mBAAmB,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,MAAM,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,gDAAwB,EAAC,QAAQ,CAAC,CAAC;IACrD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,qEAAqE;YACrE,kEAAkE;YAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,KAAK,aAAa,CAAC;QACnB,KAAK,KAAK;YACR,8DAA8D;YAC9D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,yCAAyC,QAAQ,EAAE;aAC3D,CAAC;QACJ;YACE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AA1CD,oCA0CC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CAAC,SAAiB;IACxD,MAAM,MAAM,GAAG,MAAM,IAAA,yCAAkB,EAAC,SAAS,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/cliproxy/auth/token-expiry-checker.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Token Expiry Checker
+ *
+ * Inspects token files to determine expiry times and refresh requirements.
+ * Supports expiry_date field with fallback to file modification time.
+ */
+import { CLIProxyProvider } from '../types';
+/** Preemptive refresh time: refresh tokens 45 minutes before expiry */
+export declare const PREEMPTIVE_REFRESH_MINUTES = 45;
+/** Fallback expiry: assume 50 minutes if no expiry_date field */
+export declare const FALLBACK_EXPIRY_MINUTES = 50;
+/** Token expiry information for a single account */
+export interface TokenExpiryInfo {
+    /** Provider name */
+    provider: CLIProxyProvider;
+    /** Account ID */
+    accountId: string;
+    /** Path to token file */
+    tokenFile: string;
+    /** Expiry timestamp (Unix ms) */
+    expiresAt: number;
+    /** Whether token needs refresh (within preemptive window) */
+    needsRefresh: boolean;
+    /** Token file last modified time */
+    lastModified: Date;
+}
+/**
+ * Get token expiry info for a specific account
+ * @returns null if token file doesn't exist or is invalid
+ */
+export declare function getTokenExpiryInfo(provider: CLIProxyProvider, accountId: string): TokenExpiryInfo | null;
+/**
+ * Get token expiry info for all accounts across all providers
+ * @returns Array of token expiry info, excluding invalid tokens
+ */
+export declare function getAllTokenExpiryInfo(): TokenExpiryInfo[];
+//# sourceMappingURL=token-expiry-checker.d.ts.map

package/dist/cliproxy/auth/token-expiry-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-expiry-checker.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/token-expiry-checker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAK5C,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAK1C,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,EAAE,OAAO,CAAC;IACtB,oCAAoC;IACpC,YAAY,EAAE,IAAI,CAAC;CACpB;AAYD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAChB,eAAe,GAAG,IAAI,CA8DxB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,EAAE,CAgBzD"}