@hyperstar/mcp 0.1.0

package/README.md

@@ -0,0 +1,186 @@
+# @hyperstar/mcp
+
+`@hyperstar/mcp` is the local stdio MCP server for Hyperstar headless
+workflows. It exposes scoped creator search, campaign roster, bulk email, and
+inbox tools for MCP clients using either a service-account key or local browser
+CLI login.
+
+## Install
+
+After `@hyperstar/mcp` is published to npm:
+
+```sh
+npx -y --package @hyperstar/mcp hyperstar-mcp
+```
+
+The package exposes two binaries:
+
+- `hyperstar-mcp`: the stdio MCP server.
+- `hyperstar`: the local login and workspace helper CLI.
+
+Because the package exposes multiple binaries, use the explicit
+`--package @hyperstar/mcp hyperstar-mcp` form instead of bare
+`npx -y @hyperstar/mcp` in MCP client configs.
+
+For a one-off browser login without a global install:
+
+```sh
+npx -y --package @hyperstar/mcp hyperstar login
+npx -y --package @hyperstar/mcp hyperstar workspaces list --json
+npx -y --package @hyperstar/mcp hyperstar workspaces use org_123
+```
+
+Before the first npm publish, dev e2e should use a local pack:
+
+```sh
+cd projects/hyperstar-mcp
+npm pack --dry-run
+npm pack
+npx -y --package ./hyperstar-mcp-0.1.0.tgz hyperstar-mcp
+npx -y --package ./hyperstar-mcp-0.1.0.tgz hyperstar login
+npx -y --package ./hyperstar-mcp-0.1.0.tgz hyperstar workspaces list --json
+npx -y --package ./hyperstar-mcp-0.1.0.tgz hyperstar workspaces use org_123
+```
+
+The first public scoped publish must use public access. This package sets
+`publishConfig.access=public`, so `npm publish` is sufficient once npm
+credentials are configured.
+
+## MCP client config
+
+Service-account auth is the simplest non-interactive setup. Configure the MCP
+server with a Hyperstar Product API base URL and service-account API key:
+
+```json
+{
+  "mcpServers": {
+    "hyperstar": {
+      "command": "npx",
+      "args": ["-y", "--package", "@hyperstar/mcp", "hyperstar-mcp"],
+      "env": {
+        "HYPERSTAR_API_BASE_URL": "https://api.hyperstar.example",
+        "HYPERSTAR_API_KEY": "hstar_test_public-prefix.secret"
+      }
+    }
+  }
+}
+```
+
+Create API keys in the dashboard from Team -> API keys. Use the headless
+workflow preset. Enable inbox write only for agents that are allowed to send
+inbox replies.
+
+When `HYPERSTAR_API_KEY` is omitted, the server falls back to the local browser
+login state created by the `hyperstar` CLI:
+
+```json
+{
+  "mcpServers": {
+    "hyperstar": {
+      "command": "npx",
+      "args": ["-y", "--package", "@hyperstar/mcp", "hyperstar-mcp"],
+      "env": {
+        "HYPERSTAR_API_BASE_URL": "https://autopilot.dev.hyper-star.org",
+        "HYPERSTAR_APP_BASE_URL": "https://app.dev.hyper-star.org"
+      }
+    }
+  }
+}
+```
+
+Local browser login stores tokens under the OS config directory and the selected
+workspace in the same auth state file. Run `hyperstar login`, then either select
+a workspace with `hyperstar workspaces use <organization_id>` or use the MCP
+`list_workspaces` and `select_workspace` tools. Service-account mode is already
+workspace-scoped, so `get_hyperstar_workflow_guide` omits `select_workspace`
+when `HYPERSTAR_API_KEY` is used. For non-production login, set matching
+`HYPERSTAR_API_BASE_URL` and `HYPERSTAR_APP_BASE_URL`; the CLI maps the standard
+dev API origin to the dev app automatically, while custom API origins must
+provide an explicit app base URL. `HYPERSTAR_API_KEY` takes precedence over local
+CLI auth when both are present.
+
+## Tools
+
+- `hyperstar_whoami`
+- `list_workspaces`
+- `select_workspace`
+- `get_hyperstar_workflow_guide`
+- `search_creators`
+- `get_search_results`
+- `save_search_results_to_campaign`
+- `list_campaign_creators`
+- `check_bulk_email_readiness`
+- `start_bulk_email`
+- `get_bulk_email_job`
+- `list_inbox_threads`
+- `get_inbox_aggregates`
+- `update_inbox_thread_state`
+- `send_inbox_reply`
+
+## Development
+
+```sh
+npm install
+npm test
+npm run build
+```
+
+## Examples
+
+Search creators:
+
+```json
+{
+  "tool": "search_creators",
+  "arguments": {
+    "kind": "semantic",
+    "platform": "tiktok",
+    "region": "US",
+    "query": "ceramic mug reviewers",
+    "limit": 25
+  }
+}
+```
+
+Save search results to a campaign roster:
+
+```json
+{
+  "tool": "save_search_results_to_campaign",
+  "arguments": {
+    "campaign_id": 123,
+    "search_id": "550e8400-e29b-41d4-a716-446655440000",
+    "limit": 100
+  }
+}
+```
+
+Start a bulk email job. This performs a real send:
+
+```json
+{
+  "tool": "start_bulk_email",
+  "arguments": {
+    "campaign_id": 123,
+    "subject": "Partnership idea",
+    "body_text": "Hi, we would like to introduce our new campaign.",
+    "campaign_creator_ids": [7, 8],
+    "idempotency_key": "campaign-123-intro-2026-07-09"
+  }
+}
+```
+
+Reply to an inbox thread. This performs a real send:
+
+```json
+{
+  "tool": "send_inbox_reply",
+  "arguments": {
+    "platform": "tiktok",
+    "thread_id": 456,
+    "subject": "Re: Partnership idea",
+    "body_text": "Thanks for the reply. Here are the next details.",
+    "idempotency_key": "thread-456-reply-2026-07-09"
+  }
+}
+```

package/dist/auth/cli-auth-client.d.ts

@@ -0,0 +1,48 @@
+import type { CliAuthState, CliAuthStateStore } from "./cli-auth-state.js";
+import type { PkcePair } from "./pkce.js";
+export declare const CLI_CLIENT_ID = "hyperstar-local-agent";
+export type Fetcher = (input: URL, init: RequestInit) => Promise<Response>;
+export type CliTokenPair = {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly accessTokenExpiresAt: string;
+};
+export type Workspace = {
+    readonly organization_id: string;
+    readonly name?: string;
+};
+export type WorkspaceList = {
+    readonly workspaces: readonly Workspace[];
+};
+export type CliAuthClient = {
+    readonly buildAuthorizeUrl: (callbackUrl: string, pkce: PkcePair, state: string) => URL;
+    readonly exchangeCode: (code: string, verifier: string, redirectUri: string) => Promise<CliTokenPair>;
+    readonly refresh: (refreshToken: string) => Promise<CliTokenPair>;
+    readonly logout: (refreshToken: string) => Promise<void>;
+    readonly listWorkspaces: (accessToken: string) => Promise<WorkspaceList>;
+};
+export type CliAccessTokenProvider = {
+    readonly getAccessToken: () => Promise<string>;
+    readonly refreshAccessToken?: () => Promise<string>;
+};
+export type CliAuthClientOptions = {
+    readonly apiBaseUrl: string;
+    readonly appBaseUrl: string;
+    readonly fetcher?: Fetcher | undefined;
+    readonly now?: (() => Date) | undefined;
+};
+/** Create a client for the backend CLI auth routes. */
+export declare function createCliAuthClient(options: CliAuthClientOptions): CliAuthClient;
+export type StoredCliAccessTokenProviderOptions = {
+    readonly store: CliAuthStateStore;
+    readonly client: CliAuthClient;
+    readonly now?: (() => Date) | undefined;
+};
+/** Create an access-token provider that refreshes expired persisted CLI tokens. */
+export declare function createStoredCliAccessTokenProvider(options: StoredCliAccessTokenProviderOptions): CliAccessTokenProvider;
+/** Convert a token pair into persisted CLI auth state. */
+export declare function tokenPairToAuthState(tokenPair: CliTokenPair, options: {
+    readonly apiBaseUrl: string;
+    readonly appBaseUrl: string;
+    readonly previousState?: CliAuthState | null;
+}): CliAuthState;

package/dist/auth/cli-auth-client.js

@@ -0,0 +1,214 @@
+export const CLI_CLIENT_ID = "hyperstar-local-agent";
+/** Create a client for the backend CLI auth routes. */
+export function createCliAuthClient(options) {
+    const fetcher = options.fetcher ?? fetch;
+    const now = options.now ?? (() => new Date());
+    return {
+        buildAuthorizeUrl: (callbackUrl, pkce, state) => buildAuthorizeUrl(options.appBaseUrl, callbackUrl, pkce, state),
+        exchangeCode: async (code, verifier, redirectUri) => requestToken(fetcher, options.apiBaseUrl, now, {
+            code,
+            code_verifier: verifier,
+            client_id: CLI_CLIENT_ID,
+            redirect_uri: redirectUri,
+        }),
+        refresh: async (refreshToken) => requestRefresh(fetcher, options.apiBaseUrl, now, {
+            refresh_token: refreshToken,
+        }),
+        logout: async (refreshToken) => {
+            const response = await fetcher(buildApiUrl(options.apiBaseUrl, "/api/v1/cli-auth/logout"), {
+                method: "POST",
+                headers: {
+                    accept: "application/json",
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({ refresh_token: refreshToken }),
+            });
+            if (!response.ok) {
+                throw new Error(`Hyperstar logout failed with status ${response.status}`);
+            }
+        },
+        listWorkspaces: async (accessToken) => {
+            const response = await fetcher(buildApiUrl(options.apiBaseUrl, "/v1/workspaces"), {
+                method: "GET",
+                headers: {
+                    accept: "application/json",
+                    Authorization: `Bearer ${accessToken}`,
+                },
+            });
+            const payload = await readJson(response);
+            if (!response.ok) {
+                throw new Error(`Hyperstar workspace request failed with status ${response.status}`);
+            }
+            return parseWorkspaceList(payload);
+        },
+    };
+}
+/** Create an access-token provider that refreshes expired persisted CLI tokens. */
+export function createStoredCliAccessTokenProvider(options) {
+    let pendingRefresh = null;
+    const runExclusiveRefresh = (force) => {
+        if (pendingRefresh !== null) {
+            return pendingRefresh;
+        }
+        pendingRefresh = readOrRefreshAccessToken(options, force).finally(() => {
+            pendingRefresh = null;
+        });
+        return pendingRefresh;
+    };
+    return {
+        getAccessToken: async () => runExclusiveRefresh(false),
+        refreshAccessToken: async () => runExclusiveRefresh(true),
+    };
+}
+/** Read a valid access token or refresh persisted CLI auth state. */
+async function readOrRefreshAccessToken(options, forceRefresh) {
+    return options.store.withExclusiveLock(() => readOrRefreshAccessTokenLocked(options, forceRefresh));
+}
+/** Read or refresh persisted CLI auth state while holding the store lock. */
+async function readOrRefreshAccessTokenLocked(options, forceRefresh) {
+    const now = options.now ?? (() => new Date());
+    const state = await options.store.read();
+    if (state === null) {
+        throw new Error("Run `hyperstar login` or set HYPERSTAR_API_KEY");
+    }
+    if (!forceRefresh && !isNearExpiry(state.accessTokenExpiresAt, now())) {
+        return state.accessToken;
+    }
+    return refreshAndStore(options, state);
+}
+/** Build the browser authorization URL for local CLI login. */
+function buildAuthorizeUrl(appBaseUrl, callbackUrl, pkce, state) {
+    const url = new URL("/cli/authorize", `${appBaseUrl}/`);
+    url.searchParams.set("client_id", CLI_CLIENT_ID);
+    url.searchParams.set("redirect_uri", callbackUrl);
+    url.searchParams.set("code_challenge", pkce.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", state);
+    return url;
+}
+/** Exchange an authorization or refresh grant for CLI tokens. */
+async function requestToken(fetcher, apiBaseUrl, now, body) {
+    const response = await fetcher(buildApiUrl(apiBaseUrl, "/api/v1/cli-auth/token"), {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json",
+        },
+        body: JSON.stringify(body),
+    });
+    const payload = await readJson(response);
+    if (!response.ok) {
+        throw new Error(`Hyperstar token request failed with status ${response.status}`);
+    }
+    return parseTokenPair(payload, now);
+}
+/** Rotate a refresh token using the backend refresh route. */
+async function requestRefresh(fetcher, apiBaseUrl, now, body) {
+    const response = await fetcher(buildApiUrl(apiBaseUrl, "/api/v1/cli-auth/refresh"), {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json",
+        },
+        body: JSON.stringify(body),
+    });
+    const payload = await readJson(response);
+    if (!response.ok) {
+        throw new Error(`Hyperstar refresh request failed with status ${response.status}`);
+    }
+    return parseTokenPair(payload, now);
+}
+/** Build a root-relative API URL. */
+function buildApiUrl(apiBaseUrl, path) {
+    return new URL(path, `${apiBaseUrl}/`);
+}
+/** Parse response JSON, preserving empty bodies as null. */
+async function readJson(response) {
+    const text = await response.text();
+    if (text.trim().length === 0) {
+        return null;
+    }
+    return JSON.parse(text);
+}
+/** Parse backend token payloads into local camelCase state. */
+function parseTokenPair(payload, now) {
+    if (typeof payload === "object" &&
+        payload !== null &&
+        "access_token" in payload &&
+        "refresh_token" in payload &&
+        "expires_in" in payload &&
+        typeof payload.access_token === "string" &&
+        typeof payload.refresh_token === "string" &&
+        typeof payload.expires_in === "number" &&
+        Number.isFinite(payload.expires_in) &&
+        payload.expires_in > 0) {
+        return {
+            accessToken: payload.access_token,
+            refreshToken: payload.refresh_token,
+            accessTokenExpiresAt: new Date(now().getTime() + payload.expires_in * 1_000).toISOString(),
+        };
+    }
+    throw new Error("Hyperstar token response was invalid");
+}
+/** Refresh an expired access token and persist the rotated token pair. */
+async function refreshAndStore(options, state) {
+    const tokenPair = await options.client.refresh(state.refreshToken);
+    await options.store.write({
+        ...state,
+        accessToken: tokenPair.accessToken,
+        refreshToken: tokenPair.refreshToken,
+        accessTokenExpiresAt: tokenPair.accessTokenExpiresAt,
+    });
+    return tokenPair.accessToken;
+}
+/** Parse backend workspace list payloads. */
+function parseWorkspaceList(payload) {
+    if (typeof payload === "object" &&
+        payload !== null &&
+        "workspaces" in payload &&
+        Array.isArray(payload.workspaces)) {
+        return {
+            workspaces: payload.workspaces.map(parseWorkspace),
+        };
+    }
+    throw new Error("Hyperstar workspace response was invalid");
+}
+/** Parse one workspace record from the backend. */
+function parseWorkspace(payload) {
+    if (typeof payload === "object" &&
+        payload !== null &&
+        "organization_id" in payload &&
+        typeof payload.organization_id === "string") {
+        return {
+            organization_id: payload.organization_id,
+            ...("name" in payload && typeof payload.name === "string"
+                ? { name: payload.name }
+                : {}),
+        };
+    }
+    throw new Error("Hyperstar workspace response was invalid");
+}
+/** Return true when a token expires within the refresh window. */
+function isNearExpiry(expiresAt, now) {
+    const expiresAtMs = Date.parse(expiresAt);
+    if (Number.isNaN(expiresAtMs)) {
+        return true;
+    }
+    return expiresAtMs - now.getTime() <= 60_000;
+}
+/** Convert a token pair into persisted CLI auth state. */
+export function tokenPairToAuthState(tokenPair, options) {
+    return {
+        apiBaseUrl: options.apiBaseUrl,
+        appBaseUrl: options.appBaseUrl,
+        refreshToken: tokenPair.refreshToken,
+        accessToken: tokenPair.accessToken,
+        accessTokenExpiresAt: tokenPair.accessTokenExpiresAt,
+        ...(options.previousState?.selectedOrganizationId === undefined
+            ? {}
+            : {
+                selectedOrganizationId: options.previousState.selectedOrganizationId,
+            }),
+    };
+}
+//# sourceMappingURL=cli-auth-client.js.map

package/dist/auth/cli-auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth-client.js","sourceRoot":"","sources":["../../src/auth/cli-auth-client.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AA+CrD,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,OAAO;QACL,iBAAiB,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9C,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC;QACjE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAClD,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7C,IAAI;YACJ,aAAa,EAAE,QAAQ;YACvB,SAAS,EAAE,aAAa;YACxB,YAAY,EAAE,WAAW;SAC1B,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC9B,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE;YAC/C,aAAa,EAAE,YAAY;SAC5B,CAAC;QACJ,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAC1D;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;aACtD,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACjD;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;iBACvC;aACF,CACF,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,kDAAkD,QAAQ,CAAC,MAAM,EAAE,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,mFAAmF;AACnF,MAAM,UAAU,kCAAkC,CAChD,OAA4C;IAE5C,IAAI,cAAc,GAA2B,IAAI,CAAC;IAElD,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAmB,EAAE;QAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,cAAc,GAAG,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACrE,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO;QACL,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;QACtD,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,wBAAwB,CACrC,OAA4C,EAC5C,YAAqB;IAErB,OAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAC1C,8BAA8B,CAAC,OAAO,EAAE,YAAY,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,8BAA8B,CAC3C,OAA4C,EAC5C,YAAqB;IAErB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IAED,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,+DAA+D;AAC/D,SAAS,iBAAiB,CACxB,UAAkB,EAClB,WAAmB,EACnB,IAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,UAAkB,EAClB,GAAe,EACf,IAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,WAAW,CAAC,UAAU,EAAE,wBAAwB,CAAC,EACjD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,CAAC,MAAM,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,UAAkB,EAClB,GAAe,EACf,IAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,WAAW,CAAC,UAAU,EAAE,0BAA0B,CAAC,EACnD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,QAAQ,CAAC,MAAM,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,qCAAqC;AACrC,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAY;IACnD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;AACrC,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CAAC,OAAgB,EAAE,GAAe;IACvD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,cAAc,IAAI,OAAO;QACzB,eAAe,IAAI,OAAO;QAC1B,YAAY,IAAI,OAAO;QACvB,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QACxC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;QACnC,OAAO,CAAC,UAAU,GAAG,CAAC,EACtB,CAAC;QACD,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,YAAY,EAAE,OAAO,CAAC,aAAa;YACnC,oBAAoB,EAAE,IAAI,IAAI,CAC5B,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,KAAK,CAC7C,CAAC,WAAW,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,eAAe,CAC5B,OAA4C,EAC5C,KAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACxB,GAAG,KAAK;QACR,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;KACrD,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,WAAW,CAAC;AAC/B,CAAC;AAED,6CAA6C;AAC7C,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,YAAY,IAAI,OAAO;QACvB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EACjC,CAAC;QACD,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;SACnD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,mDAAmD;AACnD,SAAS,cAAc,CAAC,OAAgB;IACtC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,iBAAiB,IAAI,OAAO;QAC5B,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAC3C,CAAC;QACD,OAAO;YACL,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,GAAG,CAAC,MAAM,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBACvD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;gBACxB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,SAAiB,EAAE,GAAS;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC;AAC/C,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,oBAAoB,CAClC,SAAuB,EACvB,OAIC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,sBAAsB,KAAK,SAAS;YAC7D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,sBAAsB,EAAE,OAAO,CAAC,aAAa,CAAC,sBAAsB;aACrE,CAAC;KACP,CAAC;AACJ,CAAC"}

package/dist/auth/cli-auth-state.d.ts

@@ -0,0 +1,26 @@
+export type CliAuthState = {
+    readonly apiBaseUrl: string;
+    readonly appBaseUrl: string;
+    readonly refreshToken: string;
+    readonly accessToken: string;
+    readonly accessTokenExpiresAt: string;
+    readonly selectedOrganizationId?: string;
+};
+export type AuthStatePathOptions = {
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly platform?: NodeJS.Platform;
+    readonly homedir?: () => string;
+};
+export type CliAuthStateStore = {
+    readonly pathOptions: AuthStatePathOptions;
+    readonly path: string;
+    readonly read: () => Promise<CliAuthState | null>;
+    readonly readSync: () => CliAuthState | null;
+    readonly write: (state: CliAuthState) => Promise<void>;
+    readonly clear: () => Promise<void>;
+    readonly withExclusiveLock: <T>(action: () => Promise<T>) => Promise<T>;
+};
+/** Resolve the local CLI auth state path for the current OS conventions. */
+export declare function resolveAuthStatePath(options?: AuthStatePathOptions): string;
+/** Create a file-backed CLI auth state store. */
+export declare function createFileCliAuthStateStore(options?: AuthStatePathOptions): CliAuthStateStore;

package/dist/auth/cli-auth-state.js

@@ -0,0 +1,176 @@
+import { existsSync, readFileSync } from "node:fs";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { homedir as defaultHomedir } from "node:os";
+import { dirname, join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+const STALE_LOCK_MS = 60_000;
+const LOCK_HEARTBEAT_MS = 5_000;
+/** Resolve the local CLI auth state path for the current OS conventions. */
+export function resolveAuthStatePath(options = {}) {
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const homedir = options.homedir ?? defaultHomedir;
+    if (platform === "win32") {
+        return join(env.APPDATA ?? join(homedir(), "AppData", "Roaming"), "Hyperstar", "auth.json");
+    }
+    return join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "hyperstar", "auth.json");
+}
+/** Create a file-backed CLI auth state store. */
+export function createFileCliAuthStateStore(options = {}) {
+    const path = resolveAuthStatePath(options);
+    return {
+        pathOptions: options,
+        path,
+        read: async () => readAuthState(path),
+        readSync: () => readAuthStateSync(path),
+        write: async (state) => writeAuthState(path, state),
+        clear: async () => {
+            await rm(path, { force: true });
+        },
+        withExclusiveLock: async (action) => withAuthStateLock(path, action),
+    };
+}
+/** Read auth state JSON from disk. */
+async function readAuthState(path) {
+    try {
+        return parseAuthState(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            return null;
+        }
+        throw error;
+    }
+}
+/** Read auth state JSON synchronously for process startup configuration. */
+function readAuthStateSync(path) {
+    if (!existsSync(path)) {
+        return null;
+    }
+    return parseAuthState(readFileSync(path, "utf8"));
+}
+/** Write auth state JSON with restrictive permissions where the OS supports it. */
+async function writeAuthState(path, state) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    if (process.platform !== "win32") {
+        await chmod(tempPath, 0o600);
+    }
+    await rename(tempPath, path);
+}
+/** Parse and minimally validate persisted auth state. */
+function parseAuthState(raw) {
+    const value = JSON.parse(raw);
+    if (typeof value.apiBaseUrl !== "string" ||
+        typeof value.appBaseUrl !== "string" ||
+        typeof value.refreshToken !== "string" ||
+        typeof value.accessToken !== "string" ||
+        typeof value.accessTokenExpiresAt !== "string") {
+        throw new Error("Hyperstar auth state is invalid; run `hyperstar login` again");
+    }
+    return {
+        apiBaseUrl: value.apiBaseUrl,
+        appBaseUrl: value.appBaseUrl,
+        refreshToken: value.refreshToken,
+        accessToken: value.accessToken,
+        accessTokenExpiresAt: value.accessTokenExpiresAt,
+        ...(typeof value.selectedOrganizationId === "string"
+            ? { selectedOrganizationId: value.selectedOrganizationId }
+            : {}),
+    };
+}
+/** Return true when a filesystem error is an ENOENT. */
+function isNotFoundError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+/** Run an auth-state operation under a filesystem lock shared by CLI processes. */
+async function withAuthStateLock(path, action) {
+    const release = await acquireAuthStateLock(`${path}.lock`);
+    try {
+        return await action();
+    }
+    finally {
+        await release();
+    }
+}
+/** Acquire a directory lock using atomic mkdir. */
+async function acquireAuthStateLock(lockPath) {
+    const startedAt = Date.now();
+    await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+    while (true) {
+        try {
+            await mkdir(lockPath, { mode: 0o700 });
+            return await holdAuthStateLock(lockPath);
+        }
+        catch (error) {
+            if (!isAlreadyExistsError(error) || Date.now() - startedAt > 10_000) {
+                throw new Error("Timed out waiting for Hyperstar auth state lock");
+            }
+            await removeStaleAuthStateLock(lockPath);
+            await sleep(25);
+        }
+    }
+}
+/** Write owner metadata and keep the lock heartbeat fresh until release. */
+async function holdAuthStateLock(lockPath) {
+    await writeLockHeartbeat(lockPath);
+    const heartbeat = setInterval(() => {
+        void writeLockHeartbeat(lockPath).catch(() => undefined);
+    }, LOCK_HEARTBEAT_MS);
+    return async () => {
+        clearInterval(heartbeat);
+        await rm(lockPath, { force: true, recursive: true });
+    };
+}
+/** Refresh the lock heartbeat file used to distinguish live and stale locks. */
+async function writeLockHeartbeat(lockPath) {
+    await writeFile(join(lockPath, "owner.json"), `${JSON.stringify({ pid: process.pid, updated_at: new Date().toISOString() })}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+/** Remove lock directories old enough to have been left by a killed process. */
+async function removeStaleAuthStateLock(lockPath) {
+    try {
+        const heartbeatStat = await stat(join(lockPath, "owner.json"));
+        if (Date.now() - heartbeatStat.mtimeMs >= STALE_LOCK_MS) {
+            await rm(lockPath, { force: true, recursive: true });
+        }
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            await removeLockDirectoryIfStale(lockPath);
+            return;
+        }
+        throw error;
+    }
+}
+/** Remove a lock directory only when it still exists and is stale. */
+async function removeLockDirectoryIfStale(lockPath) {
+    try {
+        const lockStat = await stat(lockPath);
+        if (Date.now() - lockStat.mtimeMs >= STALE_LOCK_MS) {
+            await rm(lockPath, { force: true, recursive: true });
+        }
+    }
+    catch (error) {
+        if (!isNotFoundError(error)) {
+            throw error;
+        }
+    }
+}
+/** Return true when a filesystem error means the lock already exists. */
+function isAlreadyExistsError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "EEXIST");
+}
+//# sourceMappingURL=cli-auth-state.js.map

package/dist/auth/cli-auth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth-state.js","sourceRoot":"","sources":["../../src/auth/cli-auth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACL,KAAK,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,EAAE,EACF,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AA2BhC,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAElD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EACpD,WAAW,EACX,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CACT,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EACjD,WAAW,EACX,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,2BAA2B,CACzC,UAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,IAAI;QACJ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACvC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;QACnD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,sCAAsC;AACtC,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,KAAmB;IAEnB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC5D,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,yDAAyD;AACzD,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACvD,IACE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,GAAG,CAAC,OAAO,KAAK,CAAC,sBAAsB,KAAK,QAAQ;YAClD,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE;YAC1D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,iBAAiB,CAC9B,IAAY,EACZ,MAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,KAAK,UAAU,oBAAoB,CACjC,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjE,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,OAAO,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,iBAAiB,CAC9B,QAAgB;IAEhB,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,KAAK,kBAAkB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACtB,OAAO,KAAK,IAAI,EAAE;QAChB,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,MAAM,SAAS,CACb,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC5B,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EACjF;QACE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,wBAAwB,CAAC,QAAgB;IACtD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACxD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACnD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB,CAAC;AACJ,CAAC"}