@inhuman.tools/harness 0.0.0-stage → 0.2.0

package/dist/providers/auth/authorize.js

@@ -0,0 +1,107 @@
+/**
+ * Browser sign-in owned by the daemon. The loopback listener starts when a
+ * driver asks, parks `harness/open-url` carrying its callback, and closes
+ * when the sign-in settles. Clients only open the URL and answer
+ * `{ kind: "opened" }` (or `{ kind: "text", input }` to paste); none hosts a
+ * listener, so a browser client signs in the same way the TUI does.
+ */
+import { fail, step } from "@inhuman.tools/harness-diagnostics";
+import { listenOAuthLoopback, oauthCallbackFor, withCallbackParam, } from "./loopback.js";
+/** A sign-in nobody finishes must not hold a port forever. */
+export const BROWSER_SIGN_IN_TIMEOUT_MS = 5 * 60_000;
+/** Fixed-port callbacks (ChatGPT's 1455): the live sign-in per `host:port`, so the latest one wins. */
+const holders = new Map();
+/**
+ * Listen, park the authorize URL, settle on the first of: pasted text, the
+ * browser's callback, an error, timeout, abort. A pasted redirect URL carrying
+ * `code` is the callback delivered by hand. The listener is always closed.
+ */
+export async function authorizeInBrowser(ui, opts) {
+    const dialect = oauthCallbackFor(opts.authUrl);
+    const style = { ...dialect, listen: { ...dialect.listen, ...opts.listen } };
+    const stop = new AbortController();
+    let loopback;
+    const key = style.listen.port === 0 ? undefined : `${style.listen.host}:${style.listen.port}`;
+    // Closing here, not in the superseded call's finally: the new listen must find the port free.
+    const supersede = () => {
+        loopback?.close();
+        stop.abort(new DOMException("browser sign-in superseded", "AbortError"));
+    };
+    if (key !== undefined) {
+        holders.get(key)?.();
+        holders.set(key, supersede);
+    }
+    const timer = setTimeout(() => stop.abort(new Error("browser sign-in timed out")), opts.timeoutMs ?? BROWSER_SIGN_IN_TIMEOUT_MS);
+    const forward = () => stop.abort(opts.signal?.reason ?? new DOMException("aborted", "AbortError"));
+    if (opts.signal?.aborted === true)
+        forward();
+    else
+        opts.signal?.addEventListener("abort", forward, { once: true });
+    /** Work that yields to the first stop: abort, supersede, timeout. */
+    const until = async (work) => {
+        let onStop = () => undefined;
+        const stopped = new Promise((_resolve, reject) => {
+            onStop = () => reject(stop.signal.reason);
+            if (stop.signal.aborted)
+                onStop();
+            else
+                stop.signal.addEventListener("abort", onStop, { once: true });
+        });
+        try {
+            return await Promise.race([work, stopped]);
+        }
+        finally {
+            stop.signal.removeEventListener("abort", onStop);
+        }
+    };
+    try {
+        loopback = await listenOAuthLoopback(style.listen);
+        stop.signal.throwIfAborted();
+        const { callbackUrl, wait } = loopback;
+        step(`browser sign-in listen ${callbackUrl}`);
+        const url = withCallbackParam(opts.authUrl, callbackUrl, style.param);
+        const answer = await until(ui(openUrlBody(url, opts.description, opts.paste ?? "")));
+        const pasted = typeof answer.input === "string" ? answer.input.trim() : "";
+        if (pasted !== "") {
+            step(`browser sign-in pasted chars=${pasted.length}`);
+            return pastedAuthorization(pasted, callbackUrl);
+        }
+        const callback = await until(wait);
+        step(`browser sign-in callback code=${callback.code.length} state=${callback.state.length}`);
+        return { code: callback.code, state: callback.state, redirectUri: callbackUrl };
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === "AbortError")
+            step(`browser sign-in ${error.message}`);
+        else
+            fail("browser sign-in", error);
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        opts.signal?.removeEventListener("abort", forward);
+        loopback?.close();
+        if (key !== undefined && holders.get(key) === supersede)
+            holders.delete(key);
+    }
+}
+function pastedAuthorization(pasted, redirectUri) {
+    try {
+        const url = new URL(pasted);
+        const code = url.searchParams.get("code")?.trim() ?? "";
+        if (code !== "")
+            return { code, state: url.searchParams.get("state")?.trim() ?? "", redirectUri };
+    }
+    catch {
+        /* not a URL: the text itself is the paste */
+    }
+    return { pasted };
+}
+function openUrlBody(url, description, paste) {
+    const field = paste === "" ? "" : ` :name ${quote(paste)} :input 'password`;
+    return `(harness/open-url :url ${quote(url)} :description ${quote(description)}${field})`;
+}
+function quote(value) {
+    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', String.raw `\"`)}"`;
+}
+//# sourceMappingURL=authorize.js.map

package/dist/providers/auth/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/providers/auth/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAEhE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,eAAe,CAAC;AAEvB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAsBrD,uGAAuG;AACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAsB,EACtB,IAA6B;IAE7B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,QAAmC,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9F,8FAA8F;IAC9F,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC;IACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,EACxD,IAAI,CAAC,SAAS,IAAI,0BAA0B,CAC7C,CAAC;IACF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IACzG,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;;QACxC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,qEAAqE;IACrE,MAAM,KAAK,GAAG,KAAK,EAAK,IAAgB,EAAc,EAAE;QACtD,IAAI,MAAM,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,EAAE,CAAC;;gBAC7B,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,gCAAgC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,OAAO,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,IAAI,CAAC,mBAAmB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;;YAC/F,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,WAAmB;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,WAAmB,EAAE,KAAa;IAClE,MAAM,KAAK,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC5E,OAAO,0BAA0B,KAAK,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,GAAG,CAAC;AAC5F,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC,GAAG,CAAC;AAC/E,CAAC"}

package/dist/providers/auth/device.d.ts

@@ -0,0 +1,32 @@
+import { type OidcTokens } from "./oidc.js";
+export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+export type DeviceClient = {
+    readonly driver: string;
+    readonly clientId: string;
+    readonly deviceCodeUrl: string;
+    readonly tokenUrl: string;
+    readonly scope: string;
+    readonly extraDevice?: Readonly<Record<string, string>>;
+    readonly fallbackVerificationUri?: string;
+    /** Error-message prefix; defaults to `driver`. */
+    readonly label?: string;
+    /** Floor for poll interval. RFC 8628 default is 5. */
+    readonly minIntervalSec?: number;
+    /** Injected transport; defaults to global `fetch`. */
+    readonly fetch?: typeof fetch;
+};
+export type DeviceAuthorization = {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly verificationUriComplete: string;
+    readonly expiresInSec: number;
+    readonly intervalSec: number;
+};
+export type DevicePollClock = {
+    now(): number;
+    wait(ms: number): Promise<void>;
+};
+export declare function requestDeviceCode(client: DeviceClient): Promise<DeviceAuthorization>;
+export declare function pollDeviceToken(client: DeviceClient, device: Pick<DeviceAuthorization, "deviceCode" | "expiresInSec" | "intervalSec">, clock?: DevicePollClock, signal?: AbortSignal): Promise<OidcTokens>;
+//# sourceMappingURL=device.d.ts.map

package/dist/providers/auth/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../src/providers/auth/device.ts"],"names":[],"mappings":"AAQA,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAEjE,eAAO,MAAM,iBAAiB,iDAAiD,CAAC;AAEhF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,IAAI,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,CAAC;AAWF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgC1F;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,YAAY,GAAG,cAAc,GAAG,aAAa,CAAC,EAChF,KAAK,GAAE,eAA8B,EACrC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAerB"}

package/dist/providers/auth/device.js

@@ -0,0 +1,105 @@
+/**
+ * RFC 8628 device-code grant. Vendor URLs and client ids stay with the
+ * provider; this package only runs the wire dance.
+ */
+import invariant from "tiny-invariant";
+import { postForm } from "./fetch.js";
+import { asNonEmpty, asNonNegativeInt, asPositiveInt, asRecord } from "./json.js";
+import { tokensFromGrantBody } from "./oidc.js";
+export const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const defaultClock = {
+    now: () => Date.now(),
+    wait: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};
+function labelOf(client) {
+    return client.label ?? client.driver;
+}
+export async function requestDeviceCode(client) {
+    const response = await postForm(client.deviceCodeUrl, {
+        client_id: client.clientId,
+        ...(client.scope === "" ? {} : { scope: client.scope }),
+        ...client.extraDevice,
+    }, `${labelOf(client)} device code`, client.fetch);
+    const label = labelOf(client);
+    invariant(response.ok, `${label} device code failed (${response.status})`);
+    const rec = asRecord(await response.json());
+    invariant(rec !== null, `${label} device code returned no body`);
+    const deviceCode = asNonEmpty(rec.device_code);
+    const userCode = asNonEmpty(rec.user_code);
+    invariant(deviceCode !== undefined, `${label} device code returned no device_code`);
+    invariant(userCode !== undefined, `${label} device code returned no user_code`);
+    const verificationUri = asNonEmpty(rec.verification_uri) ?? client.fallbackVerificationUri ?? "";
+    const verificationUriComplete = asNonEmpty(rec.verification_uri_complete) ??
+        (verificationUri === "" ? "" : `${verificationUri}?user_code=${userCode}`);
+    invariant(verificationUriComplete !== "", `${label} device code returned no verification_uri`);
+    return {
+        deviceCode,
+        userCode,
+        verificationUri: verificationUri === "" ? verificationUriComplete : verificationUri,
+        verificationUriComplete,
+        expiresInSec: asPositiveInt(rec.expires_in) ?? 600,
+        intervalSec: asNonNegativeInt(rec.interval) ?? 5,
+    };
+}
+export async function pollDeviceToken(client, device, clock = defaultClock, signal) {
+    const label = labelOf(client);
+    const deadline = clock.now() + device.expiresInSec * 1000;
+    const minIntervalSec = client.minIntervalSec ?? 5;
+    let intervalMs = Math.max(device.intervalSec, minIntervalSec) * 1000;
+    for (;;) {
+        signal?.throwIfAborted();
+        const result = await tryDeviceToken(client, device.deviceCode);
+        if (result.kind === "tokens")
+            return result.tokens;
+        if (result.kind === "denied")
+            throw new Error(`${label} authorization denied`);
+        if (result.kind === "expired")
+            throw new Error(`${label} device code expired`);
+        if (clock.now() >= deadline)
+            throw new Error(`${label} authorization timed out`);
+        if (result.kind === "slow_down")
+            intervalMs += 5_000;
+        await waitOrAbort(clock.wait(intervalMs), signal);
+    }
+}
+async function waitOrAbort(wait, signal) {
+    if (signal === undefined)
+        return wait;
+    signal.throwIfAborted();
+    let onAbort = () => undefined;
+    const aborted = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+    try {
+        await Promise.race([wait, aborted]);
+    }
+    finally {
+        signal.removeEventListener("abort", onAbort);
+    }
+}
+async function tryDeviceToken(client, deviceCode) {
+    const label = labelOf(client);
+    const response = await postForm(client.tokenUrl, {
+        grant_type: DEVICE_CODE_GRANT,
+        device_code: deviceCode,
+        client_id: client.clientId,
+    }, `${label} device token`, client.fetch);
+    const rec = asRecord(await response.json().catch(() => null));
+    if (response.ok) {
+        return { kind: "tokens", tokens: tokensFromGrantBody(rec, label) };
+    }
+    if (response.status === 429)
+        return { kind: "slow_down" };
+    const error = asNonEmpty(rec?.error);
+    if (error === "authorization_pending")
+        return { kind: "pending" };
+    if (error === "slow_down")
+        return { kind: "slow_down" };
+    if (error === "access_denied")
+        return { kind: "denied" };
+    if (error === "expired_token")
+        return { kind: "expired" };
+    throw new Error(`${label} token exchange failed (${response.status}${error === undefined ? "" : ` ${error}`})`);
+}
+//# sourceMappingURL=device.js.map

package/dist/providers/auth/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/providers/auth/device.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,SAAS,MAAM,gBAAgB,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAmB,MAAM,WAAW,CAAC;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAgChF,MAAM,YAAY,GAAoB;IACpC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CAChE,CAAC;AAEF,SAAS,OAAO,CAAC,MAAoB;IACnC,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,MAAM,CAAC,aAAa,EACpB;QACE,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACvD,GAAG,MAAM,CAAC,WAAW;KACtB,EACD,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAChC,MAAM,CAAC,KAAK,CACb,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,wBAAwB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,SAAS,CAAC,GAAG,KAAK,IAAI,EAAE,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3C,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACpF,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;IACjG,MAAM,uBAAuB,GAC3B,UAAU,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACzC,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,eAAe,cAAc,QAAQ,EAAE,CAAC,CAAC;IAC7E,SAAS,CAAC,uBAAuB,KAAK,EAAE,EAAE,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC/F,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,eAAe;QACnF,uBAAuB;QACvB,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG;QAClD,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAoB,EACpB,MAAgF,EAChF,QAAyB,YAAY,EACrC,MAAoB;IAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC1D,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;IAClD,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC;IACrE,SAAS,CAAC;QACR,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;YAAE,UAAU,IAAI,KAAK,CAAC;QACrD,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAmB,EAAE,MAA+B;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,IAAI,OAAO,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAMD,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,UAAkB;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,MAAM,CAAC,QAAQ,EACf;QACE,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,EACD,GAAG,KAAK,eAAe,EACvB,MAAM,CAAC,KAAK,CACb,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,uBAAuB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClE,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACxD,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACzD,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,QAAQ,CAAC,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC;AAClH,CAAC"}

package/dist/providers/auth/fetch.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Undici's TypeError message is "fetch failed" — no URL, no OS/TLS reason.
+ * Wrap at `fetch` so token errors share one line. Local copy so this
+ * package does not import the server barrel.
+ */
+export type FetchFailureOpts = {
+    readonly url: string;
+    readonly method?: string;
+    readonly why?: string;
+};
+export declare const FORM_HEADERS: {
+    readonly accept: "application/json";
+    readonly "content-type": "application/x-www-form-urlencoded";
+};
+export declare function describeFetchLine(opts: FetchFailureOpts, rest: string): string;
+export declare function wrapFetchFailure(error: unknown, opts: FetchFailureOpts): Error;
+export declare function postForm(url: string, body: Record<string, string>, why: string, fetchImpl?: typeof fetch): Promise<Response>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/providers/auth/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../../src/providers/auth/fetch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAIF,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,KAAK,CA6B9E;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/providers/auth/fetch.js

@@ -0,0 +1,59 @@
+const GENERIC_FETCH = /^(?:fetch failed|Failed to fetch)$/i;
+export const FORM_HEADERS = {
+    accept: "application/json",
+    "content-type": "application/x-www-form-urlencoded",
+};
+export function describeFetchLine(opts, rest) {
+    const bits = [opts.why?.trim(), opts.method?.trim().toUpperCase(), opts.url.trim()].filter((bit) => bit != null && bit !== "");
+    const head = bits.join(" ");
+    const tail = rest.trim();
+    return tail === "" ? head : `${head}: ${tail}`;
+}
+export function wrapFetchFailure(error, opts) {
+    const parts = [];
+    const seen = new Set();
+    let node = error;
+    for (let depth = 0; depth < 6 && node != null; depth += 1) {
+        if (seen.has(node))
+            break;
+        seen.add(node);
+        if (typeof node !== "object") {
+            const text = String(node).trim();
+            if (text !== "")
+                parts.push(text);
+            break;
+        }
+        const rec = node;
+        const message = typeof rec.message === "string" ? rec.message.trim() : "";
+        const code = typeof rec.code === "string" ? rec.code.trim() : "";
+        const generic = message === "" || GENERIC_FETCH.test(message);
+        if (generic) {
+            if (rec.cause == null) {
+                const fallback = message === "" ? code : message;
+                if (fallback !== "")
+                    parts.push(fallback);
+            }
+        }
+        else {
+            parts.push(message);
+        }
+        node = rec.cause;
+    }
+    const text = describeFetchLine(opts, parts.join(": "));
+    if (error instanceof Error && error.message === text)
+        return error;
+    return new Error(text, { cause: error });
+}
+export async function postForm(url, body, why, fetchImpl = fetch) {
+    try {
+        return await fetchImpl(url, {
+            method: "POST",
+            headers: FORM_HEADERS,
+            body: new URLSearchParams(body),
+        });
+    }
+    catch (error) {
+        throw wrapFetchFailure(error, { why, method: "POST", url });
+    }
+}
+//# sourceMappingURL=fetch.js.map

package/dist/providers/auth/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../src/providers/auth/fetch.ts"],"names":[],"mappings":"AAWA,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,kBAAkB;IAC1B,cAAc,EAAE,mCAAmC;CAC3C,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAsB,EAAE,IAAY;IACpE,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACxF,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,CAClD,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,IAAsB;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,IAAI,IAAI,GAAY,KAAK,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM;QAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,IAA8D,CAAC;QAC3E,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBACjD,IAAI,QAAQ,KAAK,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,IAA4B,EAC5B,GAAW,EACX,YAA0B,KAAK;IAE/B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/providers/auth/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @inhuman.tools/harness-provider-auth — OAuth/OIDC/PKCE/device-flow/refresh
+ * primitives. Not an OpenAI connection subclass, not a vendor provider, not
+ * a connection registry.
+ */
+export * from "./device.js";
+export { authorizeInBrowser as authorizeInBrowser, BROWSER_SIGN_IN_TIMEOUT_MS as BROWSER_SIGN_IN_TIMEOUT_MS, type BrowserAuthorization as BrowserAuthorization, type BrowserAuthorizeOptions as BrowserAuthorizeOptions, type BrowserAuthorizeUi as BrowserAuthorizeUi, } from "./authorize.js";
+export { accessTokenExpiring as accessTokenExpiring, exchangeOidcCode as exchangeOidcCode, fetchOidcUserinfo as fetchOidcUserinfo, identityFromClaims as identityFromClaims, jwtPayload as jwtPayload, mergeOidcIdentity as mergeOidcIdentity, mintOidcPkce as mintOidcPkce, oidcFromVerifier as oidcFromVerifier, OidcGrantError as OidcGrantError, OIDC_REFRESH_BACKOFF_MS as OIDC_REFRESH_BACKOFF_MS, OIDC_REFRESH_MS as OIDC_REFRESH_MS, OIDC_REFRESH_SKEW_MS as OIDC_REFRESH_SKEW_MS, pkceChallenge as pkceChallenge, refreshOidcToken as refreshOidcToken, secretsFromIdentity as secretsFromIdentity, secretsFromTokens as secretsFromTokens, type OidcIdentity as OidcIdentity, type OidcPkce as OidcPkce, type OidcProfile as OidcProfile, type OidcTokens as OidcTokens, } from "./oidc.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,kBAAkB,IAAI,kBAAkB,EACxC,0BAA0B,IAAI,0BAA0B,EACxD,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,kBAAkB,IAAI,kBAAkB,GAC9C,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,IAAI,mBAAmB,EAC1C,gBAAgB,IAAI,gBAAgB,EACpC,iBAAiB,IAAI,iBAAiB,EACtC,kBAAkB,IAAI,kBAAkB,EACxC,UAAU,IAAI,UAAU,EACxB,iBAAiB,IAAI,iBAAiB,EACtC,YAAY,IAAI,YAAY,EAC5B,gBAAgB,IAAI,gBAAgB,EACpC,cAAc,IAAI,cAAc,EAChC,uBAAuB,IAAI,uBAAuB,EAClD,eAAe,IAAI,eAAe,EAClC,oBAAoB,IAAI,oBAAoB,EAC5C,aAAa,IAAI,aAAa,EAC9B,gBAAgB,IAAI,gBAAgB,EACpC,mBAAmB,IAAI,mBAAmB,EAC1C,iBAAiB,IAAI,iBAAiB,EACtC,KAAK,YAAY,IAAI,YAAY,EACjC,KAAK,QAAQ,IAAI,QAAQ,EACzB,KAAK,WAAW,IAAI,WAAW,EAC/B,KAAK,UAAU,IAAI,UAAU,GAC9B,MAAM,WAAW,CAAC"}

package/dist/providers/auth/index.js

@@ -0,0 +1,9 @@
+/**
+ * @inhuman.tools/harness-provider-auth — OAuth/OIDC/PKCE/device-flow/refresh
+ * primitives. Not an OpenAI connection subclass, not a vendor provider, not
+ * a connection registry.
+ */
+export * from "./device.js";
+export { authorizeInBrowser as authorizeInBrowser, BROWSER_SIGN_IN_TIMEOUT_MS as BROWSER_SIGN_IN_TIMEOUT_MS, } from "./authorize.js";
+export { accessTokenExpiring as accessTokenExpiring, exchangeOidcCode as exchangeOidcCode, fetchOidcUserinfo as fetchOidcUserinfo, identityFromClaims as identityFromClaims, jwtPayload as jwtPayload, mergeOidcIdentity as mergeOidcIdentity, mintOidcPkce as mintOidcPkce, oidcFromVerifier as oidcFromVerifier, OidcGrantError as OidcGrantError, OIDC_REFRESH_BACKOFF_MS as OIDC_REFRESH_BACKOFF_MS, OIDC_REFRESH_MS as OIDC_REFRESH_MS, OIDC_REFRESH_SKEW_MS as OIDC_REFRESH_SKEW_MS, pkceChallenge as pkceChallenge, refreshOidcToken as refreshOidcToken, secretsFromIdentity as secretsFromIdentity, secretsFromTokens as secretsFromTokens, } from "./oidc.js";
+//# sourceMappingURL=index.js.map

package/dist/providers/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/providers/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,kBAAkB,IAAI,kBAAkB,EACxC,0BAA0B,IAAI,0BAA0B,GAIzD,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,IAAI,mBAAmB,EAC1C,gBAAgB,IAAI,gBAAgB,EACpC,iBAAiB,IAAI,iBAAiB,EACtC,kBAAkB,IAAI,kBAAkB,EACxC,UAAU,IAAI,UAAU,EACxB,iBAAiB,IAAI,iBAAiB,EACtC,YAAY,IAAI,YAAY,EAC5B,gBAAgB,IAAI,gBAAgB,EACpC,cAAc,IAAI,cAAc,EAChC,uBAAuB,IAAI,uBAAuB,EAClD,eAAe,IAAI,eAAe,EAClC,oBAAoB,IAAI,oBAAoB,EAC5C,aAAa,IAAI,aAAa,EAC9B,gBAAgB,IAAI,gBAAgB,EACpC,mBAAmB,IAAI,mBAAmB,EAC1C,iBAAiB,IAAI,iBAAiB,GAKvC,MAAM,WAAW,CAAC"}

package/dist/providers/auth/json.d.ts

@@ -0,0 +1,10 @@
+/** Object JSON after `JSON.parse`. Arrays fail. */
+export declare function asRecord(value: unknown): Record<string, unknown> | null;
+/** `JSON.parse` is lib `any`. Public return is `unknown`. */
+export declare function parseJsonUnknown(text: string): unknown;
+export declare function asNonEmpty(value: unknown): string | undefined;
+export declare function asNonNegativeInt(value: unknown): number | undefined;
+export declare function asPositiveInt(value: unknown): number | undefined;
+/** Token `expires_in`; missing/invalid becomes 3600. */
+export declare function asExpiresIn(value: unknown): number;
+//# sourceMappingURL=json.d.ts.map

package/dist/providers/auth/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../src/providers/auth/json.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGvE;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAInE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAElD"}

package/dist/providers/auth/json.js

@@ -0,0 +1,28 @@
+/** Object JSON after `JSON.parse`. Arrays fail. */
+export function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+/** `JSON.parse` is lib `any`. Public return is `unknown`. */
+export function parseJsonUnknown(text) {
+    return JSON.parse(text);
+}
+export function asNonEmpty(value) {
+    return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
+}
+export function asNonNegativeInt(value) {
+    const n = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
+    if (!Number.isFinite(n) || n < 0)
+        return undefined;
+    return Math.trunc(n);
+}
+export function asPositiveInt(value) {
+    const n = asNonNegativeInt(value);
+    return n !== undefined && n > 0 ? n : undefined;
+}
+/** Token `expires_in`; missing/invalid becomes 3600. */
+export function asExpiresIn(value) {
+    return asPositiveInt(value) ?? 3600;
+}
+//# sourceMappingURL=json.js.map

package/dist/providers/auth/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/providers/auth/json.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACrG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC"}

package/dist/providers/auth/loopback.d.ts

@@ -0,0 +1,24 @@
+export type OAuthLoopbackListen = {
+    readonly host?: string;
+    readonly port?: number;
+    readonly path?: string;
+};
+/** Injectable listen. `typeof listenOAuthLoopback` makes `opts` optional because of `= {}`. */
+export type ListenOAuthLoopback = (opts: OAuthLoopbackListen) => Promise<OAuthLoopback>;
+export type OAuthCallback = {
+    readonly code: string;
+    readonly state: string;
+};
+export type OAuthLoopback = {
+    readonly callbackUrl: string;
+    readonly wait: Promise<OAuthCallback>;
+    close(): void;
+};
+export type OAuthCallbackStyle = {
+    readonly param: "callback_url" | "redirect_uri";
+    readonly listen: Required<OAuthLoopbackListen>;
+};
+export declare function oauthCallbackFor(authUrl: string): OAuthCallbackStyle;
+export declare function withCallbackParam(authUrl: string, callbackUrl: string, param: "callback_url" | "redirect_uri"): string;
+export declare function listenOAuthLoopback(opts?: OAuthLoopbackListen): Promise<OAuthLoopback>;
+//# sourceMappingURL=loopback.d.ts.map

package/dist/providers/auth/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../../src/providers/auth/loopback.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAExF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;CAChD,CAAC;AAQF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAiBpE;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,cAAc,GAAG,cAAc,GACrC,MAAM,CAIR;AAED,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CA2EhG"}

package/dist/providers/auth/loopback.js

@@ -0,0 +1,123 @@
+/**
+ * Localhost OAuth callback for PKCE. The daemon owns it ({@link authorizeInBrowser}
+ * starts one per sign-in); no client hosts a listener.
+ *
+ * Only the configured path with `code` or `error` settles. Browsers request
+ * icons and other paths in parallel; those must not abort the waiter —
+ * otherwise the HTML says Connected while the parked RPC never gets `ui/resolve`.
+ *
+ * OpenRouter takes `callback_url` on a random 127.0.0.1 port. OIDC (Grok,
+ * ChatGPT) takes `redirect_uri`. ChatGPT's public client is registered at
+ * localhost:1455/auth/callback.
+ * BIND_ADVERTISE: listen on 127.0.0.1 while advertising localhost —
+ * Node IPv6 `localhost` bind would miss the public client.
+ */
+import { createServer } from "node:http";
+import { fail, step } from "@inhuman.tools/harness-diagnostics";
+const DEFAULT_LISTEN = {
+    host: "127.0.0.1",
+    port: 0,
+    path: "/callback",
+};
+export function oauthCallbackFor(authUrl) {
+    let host;
+    try {
+        host = new URL(authUrl).host;
+    }
+    catch {
+        host = "";
+    }
+    if (host === "openrouter.ai" || host === "www.openrouter.ai") {
+        return { param: "callback_url", listen: { ...DEFAULT_LISTEN } };
+    }
+    if (host === "auth.openai.com") {
+        return {
+            param: "redirect_uri",
+            listen: { host: "localhost", port: 1455, path: "/auth/callback" },
+        };
+    }
+    return { param: "redirect_uri", listen: { ...DEFAULT_LISTEN } };
+}
+export function withCallbackParam(authUrl, callbackUrl, param) {
+    const url = new URL(authUrl);
+    url.searchParams.set(param, callbackUrl);
+    return url.toString();
+}
+export async function listenOAuthLoopback(opts = {}) {
+    const host = opts.host ?? DEFAULT_LISTEN.host;
+    const port = opts.port ?? DEFAULT_LISTEN.port;
+    const path = opts.path ?? DEFAULT_LISTEN.path;
+    const server = createServer();
+    const wait = new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (error, callback) => {
+            if (settled)
+                return;
+            settled = true;
+            if (error === null) {
+                resolve(callback ?? { code: "", state: "" });
+            }
+            else {
+                reject(error);
+            }
+            server.close();
+        };
+        server.on("request", (req, res) => {
+            let parsed;
+            try {
+                parsed = new URL(req.url ?? "/", "http://127.0.0.1");
+            }
+            catch {
+                res.writeHead(400).end();
+                return;
+            }
+            if (parsed.pathname !== path) {
+                res.writeHead(204).end();
+                return;
+            }
+            const code = parsed.searchParams.get("code")?.trim() ?? "";
+            const state = parsed.searchParams.get("state")?.trim() ?? "";
+            const error = parsed.searchParams.get("error")?.trim() ?? "";
+            if (code !== "") {
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end("<!doctype html><p>Connected. You can close this window.</p>");
+                step(`oauth loopback code=${code.length} state=${state.length}`);
+                settle(null, { code, state });
+                return;
+            }
+            if (error !== "") {
+                res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                res.end("<!doctype html><p>Authorization did not complete. You can close this window.</p>");
+                fail("oauth loopback", error);
+                settle(new Error(error));
+                return;
+            }
+            step(`oauth loopback ignore ${parsed.pathname}`);
+            res.writeHead(204).end();
+        });
+        server.on("error", (error) => {
+            fail("oauth loopback server", error);
+            settle(error);
+        });
+    });
+    // A failed listen rejects `wait` too; nobody awaits it yet and the daemon must not die on it.
+    wait.catch(() => undefined);
+    await new Promise((resolve, reject) => {
+        server.listen(port, host === "localhost" ? "127.0.0.1" : host, () => resolve());
+        server.once("error", reject);
+    });
+    const address = server.address();
+    if (typeof address !== "object" || address === null) {
+        server.close();
+        throw new Error("oauth loopback: no address");
+    }
+    const advertisedHost = host === "localhost" ? "localhost" : "127.0.0.1";
+    return {
+        callbackUrl: `http://${advertisedHost}:${address.port}${path}`,
+        wait,
+        close: () => {
+            server.close();
+        },
+    };
+}
+//# sourceMappingURL=loopback.js.map

package/dist/providers/auth/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../../src/providers/auth/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AA2BhE,MAAM,cAAc,GAAkC;IACpD,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,WAAW;CAClB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE;SAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,WAAmB,EACnB,KAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B,EAAE;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,QAAwB,EAAQ,EAAE;YACrE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7D,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBACvE,IAAI,CAAC,uBAAuB,IAAI,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;gBAC5F,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,yBAAyB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,OAAO;QACL,WAAW,EAAE,UAAU,cAAc,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,EAAE;QAC9D,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}