npm - @moxxy/plugin-oauth - Versions diffs - 0.26.0 → 0.28.0 - Mend

@moxxy/plugin-oauth 0.26.0 → 0.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/tools.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"~~AACA~~,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAmBtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;~~AAWD~~,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,~~gCAuK1D~~;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,~~gCAkEzD~~;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,~~gCActD~~"}
1	+ {"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAmBtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAoBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,gCAqL1D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,gCA+EzD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,gCAqBtD"}

package/dist/tools.js CHANGED Viewed

@@ -1,9 +1,18 @@
 import { defineTool, MoxxyError, z } from '@moxxy/sdk';
+import { moxxyPath } from '@moxxy/sdk/server';
 import { buildAuthUrl, runAuthorizationCodeFlow, runDeviceCodeFlow, } from './flow.js';
 import { generateCodeVerifier, generateState } from './pkce.js';
 import { clearStoredCreds, isExpired, readStoredCreds, storeTokenSet, validateProvider, } from './storage.js';
 import { withCredentialLock } from './credential-lock.js';
 import { refreshAndStore } from './ensure-fresh.js';
+/**
+ * Capability surface of the vault-backed credential store these tools share:
+ * the encrypted vault file and the cached master key, including their
+ * atomic-write `.tmp` siblings. A locked vault's first open() reads the
+ * passphrase env var and can block indefinitely on an interactive passphrase
+ * prompt — hence no timeMs on any of these tools.
+ */
+const VAULT_FS_GLOBS = [`${moxxyPath('vault.json')}*`, `${moxxyPath('vault.key')}*`];
 const providerNameField = z
     .string()
     .min(1)
@@ -73,6 +82,20 @@ export function buildOauthAuthorizeTool(deps) {
                 'host where the loopback server is reachable.'),
         }),
         permission: { action: 'prompt' },
+        // Provider endpoints (authUrl / tokenUrl / deviceUrl) are model-supplied
+        // per call and loopback mode binds a localhost callback server, so the net
+        // surface is genuinely dynamic. The browser is launched via the platform
+        // opener (ComSpec is read for the win32 `cmd /c start` shim). The flow
+        // enforces its own deadline (loopback: 5 min; device: the code's expiry).
+        isolation: {
+            capabilities: {
+                subprocess: true,
+                commands: ['open', 'xdg-open', 'cmd.exe'],
+                net: { mode: 'any' },
+                fs: { read: VAULT_FS_GLOBS, write: VAULT_FS_GLOBS },
+                env: ['MOXXY_VAULT_PASSPHRASE', 'ComSpec'],
+            },
+        },
         async handler(input, ctx) {
             validateProvider(input.provider);
             const mode = input.mode ?? 'loopback';
@@ -185,6 +208,19 @@ export function buildOauthGetTokenTool(deps) {
                 'subprocess) that needs to mint its own access tokens.'),
         }),
         permission: { action: 'prompt' },
+        // Refresh POSTs go to the token endpoint persisted at authorize time —
+        // arbitrary per provider, so a static allowlist can't cover it. Rotation
+        // is serialized through the on-disk credential lock under ~/.moxxy/locks.
+        isolation: {
+            capabilities: {
+                net: { mode: 'any' },
+                fs: {
+                    read: [...VAULT_FS_GLOBS, `${moxxyPath('locks')}/**`],
+                    write: [...VAULT_FS_GLOBS, `${moxxyPath('locks')}/**`],
+                },
+                env: ['MOXXY_VAULT_PASSPHRASE'],
+            },
+        },
         async handler({ provider, forceRefresh, includeRefresh }, _ctx) {
             const stored = await readStoredCreds(deps.vault, provider);
             if (!stored) {
@@ -235,6 +271,13 @@ export function buildOauthClearTool(deps) {
             'the grant or re-do the flow with different scopes.',
         inputSchema: z.object({ provider: providerNameField }),
         permission: { action: 'prompt' },
+        isolation: {
+            capabilities: {
+                net: { mode: 'none' },
+                fs: { read: VAULT_FS_GLOBS, write: VAULT_FS_GLOBS },
+                env: ['MOXXY_VAULT_PASSPHRASE'],
+            },
+        },
         async handler({ provider }) {
             const removed = await clearStoredCreds(deps.vault, provider);
             return { ok: true, provider, removedKeys: removed };

package/dist/tools.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,GAGlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAMtE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,QAAQ,CACP,4EAA4E;IAC1E,iEAAiE,CACpE,CAAC;AAEJ,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,gEAAgE;YAChE,wEAAwE;YACxE,0EAA0E;QAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CACP,oEAAoE;gBAClE,mDAAmD,CACtD;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,CAAC,mEAAmE,CAAC;YAChF,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CACP,yEAAyE;gBACvE,gDAAgD,CACnD;YACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6GAA6G,CAAC;YAC1H,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,CAAC;iBACJ,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CACP,mEAAmE;gBACjE,mEAAmE;gBACnE,mEAAmE,CACtE;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,GAAG,CAAC,KAAK,CAAC;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,8FAA8F,CAAC;YAC3G,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,mDAAmD,CAAC;YAChE,eAAe,EAAE,CAAC;iBACf,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CACP,2FAA2F;gBACzF,0DAA0D,CAC7D;YACH,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,qEAAqE;gBACnE,qEAAqE;gBACrE,8CAA8C,CACjD;SACJ,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;YACtB,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC;YAEtC,IAAI,MAAgB,CAAC;YACrB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,UAAU,CAAC;wBACnB,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,oFAAoF;qBAC9F,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,QAAQ,EAAE,CAAC,IAAkB,EAAE,EAAE;wBAC/B,4DAA4D;wBAC5D,4DAA4D;wBAC5D,qDAAqD;wBACrD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;4BAC1D,eAAe,EAAE,IAAI,CAAC,eAAe;4BACrC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAClG,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,YAAY,EAAE,IAAI,CAAC,SAAS;yBAC7B,CAAC,CAAC;wBACH,uDAAuD;wBACvD,qDAAqD;wBACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,IAAI,CAAC,eAAe,oBAAoB,IAAI,CAAC,QAAQ,IAAI;4BACnE,CAAC,IAAI,CAAC,uBAAuB;gCAC3B,CAAC,CAAC,yBAAyB,IAAI,CAAC,uBAAuB,KAAK;gCAC5D,CAAC,CAAC,EAAE,CAAC;4BACP,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,QAAQ,CAC/D,CAAC;oBACJ,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,IAAI,UAAU,CAAC;wBACnB,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,6EAA6E;qBACvF,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,oDAAoD;oBACpD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;oBACxC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;oBAC9B,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;oBACjD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;oBACxC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC;oBAC/C,MAAM,GAAG,GAAG,YAAY,CAAC;wBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,WAAW,EAAE,oBAAoB,IAAI,GAAG,IAAI,EAAE;wBAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,aAAa,EAAE,SAAS;wBACxB,KAAK;wBACL,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7E,CAAC,CAAC;oBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,MAAM,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,GAAG,MAAM,wBAAwB,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;wBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/D,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YAEH,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAmB;IACxD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,oEAAoE;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;QACnD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,iBAAiB;YAC3B,YAAY,EAAE,CAAC;iBACZ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,uDAAuD,CAAC;YACpE,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,mEAAmE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,uDAAuD,CAC1D;SACJ,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,IAAI;YAC5D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAAC;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,oCAAoC,QAAQ,+BAA+B;oBACpF,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;oBAChD,aAAa,EAAE,IAAI;oBACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC;gBACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACtF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,gBAAgB,CAAC,EAAE,CAAC;oBACxE,OAAO,OAAO,CAAC,QAAQ,CAAC;gBAC1B,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;gBACzF,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACvC,aAAa,EAAE,IAAI;gBACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,uEAAuE;YACvE,uEAAuE;YACvE,oDAAoD;QACtD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACtD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACtD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO;QACL,QAAQ;QACR,mBAAmB,EAAE,GAAG,EAAE,CACxB,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,oBAAoB,QAAQ,mEAAmE;YACxG,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB,CAAC;QACJ,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;QAChC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAA8D,EAAE;IAEhE,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,eAAe,EAAE,MAAM,CAAC,YAAY,KAAK,SAAS;QAClD,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,GAAG,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC7F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,iBAAiB,GAGlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAMtE;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;AAErF,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,QAAQ,CACP,4EAA4E;IAC1E,iEAAiE,CACpE,CAAC;AAEJ,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,gEAAgE;YAChE,wEAAwE;YACxE,0EAA0E;QAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CACP,oEAAoE;gBAClE,mDAAmD,CACtD;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,CAAC,mEAAmE,CAAC;YAChF,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,QAAQ,CACP,yEAAyE;gBACvE,gDAAgD,CACnD;YACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,6GAA6G,CAAC;YAC1H,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,CAAC;iBACJ,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CACP,mEAAmE;gBACjE,mEAAmE;gBACnE,mEAAmE,CACtE;YACH,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,QAAQ,EAAE;iBACV,GAAG,CAAC,KAAK,CAAC;iBACV,QAAQ,EAAE;iBACV,QAAQ,CAAC,8FAA8F,CAAC;YAC3G,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,mDAAmD,CAAC;YAChE,eAAe,EAAE,CAAC;iBACf,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CACP,2FAA2F;gBACzF,0DAA0D,CAC7D;YACH,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,qEAAqE;gBACnE,qEAAqE;gBACrE,8CAA8C,CACjD;SACJ,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,SAAS,EAAE;YACT,YAAY,EAAE;gBACZ,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;gBACzC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpB,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE;gBACnD,GAAG,EAAE,CAAC,wBAAwB,EAAE,SAAS,CAAC;aAC3C;SACF;QACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;YACtB,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC;YAEtC,IAAI,MAAgB,CAAC;YACrB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,UAAU,CAAC;wBACnB,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,oFAAoF;qBAC9F,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,QAAQ,EAAE,CAAC,IAAkB,EAAE,EAAE;wBAC/B,4DAA4D;wBAC5D,4DAA4D;wBAC5D,qDAAqD;wBACrD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;4BAC1D,eAAe,EAAE,IAAI,CAAC,eAAe;4BACrC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAClG,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,YAAY,EAAE,IAAI,CAAC,SAAS;yBAC7B,CAAC,CAAC;wBACH,uDAAuD;wBACvD,qDAAqD;wBACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,IAAI,CAAC,eAAe,oBAAoB,IAAI,CAAC,QAAQ,IAAI;4BACnE,CAAC,IAAI,CAAC,uBAAuB;gCAC3B,CAAC,CAAC,yBAAyB,IAAI,CAAC,uBAAuB,KAAK;gCAC5D,CAAC,CAAC,EAAE,CAAC;4BACP,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,QAAQ,CAC/D,CAAC;oBACJ,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,IAAI,UAAU,CAAC;wBACnB,IAAI,EAAE,YAAY;wBAClB,OAAO,EAAE,6EAA6E;qBACvF,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,oDAAoD;oBACpD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;oBACxC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;oBAC9B,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;oBAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;oBACjD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;oBACxC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC;oBAC/C,MAAM,GAAG,GAAG,YAAY,CAAC;wBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,WAAW,EAAE,oBAAoB,IAAI,GAAG,IAAI,EAAE;wBAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,aAAa,EAAE,SAAS;wBACxB,KAAK;wBACL,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7E,CAAC,CAAC;oBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,MAAM,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,GAAG,MAAM,wBAAwB,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;wBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/D,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YAEH,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAmB;IACxD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,oEAAoE;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;QACnD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,iBAAiB;YAC3B,YAAY,EAAE,CAAC;iBACZ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,uDAAuD,CAAC;YACpE,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,mEAAmE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,uDAAuD,CAC1D;SACJ,CAAC;QACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,SAAS,EAAE;YACT,YAAY,EAAE;gBACZ,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpB,EAAE,EAAE;oBACF,IAAI,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;oBACrD,KAAK,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;iBACvD;gBACD,GAAG,EAAE,CAAC,wBAAwB,CAAC;aAChC;SACF;QACD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,IAAI;YAC5D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAAC;oBACnB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,oCAAoC,QAAQ,+BAA+B;oBACpF,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;oBAChD,aAAa,EAAE,IAAI;oBACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,kEAAkE;gBAClE,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC;gBACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACtF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,gBAAgB,CAAC,EAAE,CAAC;oBACxE,OAAO,OAAO,CAAC,QAAQ,CAAC;gBAC1B,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;gBACzF,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACvC,aAAa,EAAE,IAAI;gBACnB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,uEAAuE;YACvE,uEAAuE;YACvE,oDAAoD;QACtD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACtD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChC,SAAS,EAAE;YACT,YAAY,EAAE;gBACZ,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACrB,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE;gBACnD,GAAG,EAAE,CAAC,wBAAwB,CAAC;aAChC;SACF;QACD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACtD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO;QACL,QAAQ;QACR,mBAAmB,EAAE,GAAG,EAAE,CACxB,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,oBAAoB,QAAQ,mEAAmE;YACxG,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB,CAAC;QACJ,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG;QAChC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,MAAgB,EAChB,OAA8D,EAAE;IAEhE,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;QACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,eAAe,EAAE,MAAM,CAAC,YAAY,KAAK,SAAS;QAClD,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,GAAG,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC7F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@moxxy/plugin-oauth",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Generic OAuth 2.0 + PKCE client. Loopback callback server, vault-backed token storage, refresh helpers. Bundled skills for Google Workspace + arbitrary providers.",
   "keywords": [
     "moxxy",
@@ -54,15 +54,15 @@
   },
   "dependencies": {
     "zod": "^3.24.0",
-    "@moxxy/sdk": "0.26.0",
-    "@moxxy/plugin-vault": "0.26.0"
+    "@moxxy/sdk": "0.28.0",
+    "@moxxy/plugin-vault": "0.28.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
     "typescript": "^5.7.3",
     "vitest": "^2.1.8",
-    "@moxxy/tsconfig": "0.0.0",
-    "@moxxy/vitest-preset": "0.0.0"
+    "@moxxy/vitest-preset": "0.0.0",
+    "@moxxy/tsconfig": "0.0.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/tools.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import { defineTool, MoxxyError, z } from '@moxxy/sdk';
+import { moxxyPath } from '@moxxy/sdk/server';
 import type { VaultStore } from '@moxxy/plugin-vault';
 import {
   buildAuthUrl,
@@ -22,6 +23,15 @@ export interface OAuthToolDeps {
   readonly vault: VaultStore;
 }
+/**
+ * Capability surface of the vault-backed credential store these tools share:
+ * the encrypted vault file and the cached master key, including their
+ * atomic-write `.tmp` siblings. A locked vault's first open() reads the
+ * passphrase env var and can block indefinitely on an interactive passphrase
+ * prompt — hence no timeMs on any of these tools.
+ */
+const VAULT_FS_GLOBS = [`${moxxyPath('vault.json')}*`, `${moxxyPath('vault.key')}*`];
 const providerNameField = z
   .string()
   .min(1)
@@ -105,6 +115,20 @@ export function buildOauthAuthorizeTool(deps: OAuthToolDeps) {
         ),
     }),
     permission: { action: 'prompt' },
+    // Provider endpoints (authUrl / tokenUrl / deviceUrl) are model-supplied
+    // per call and loopback mode binds a localhost callback server, so the net
+    // surface is genuinely dynamic. The browser is launched via the platform
+    // opener (ComSpec is read for the win32 `cmd /c start` shim). The flow
+    // enforces its own deadline (loopback: 5 min; device: the code's expiry).
+    isolation: {
+      capabilities: {
+        subprocess: true,
+        commands: ['open', 'xdg-open', 'cmd.exe'],
+        net: { mode: 'any' },
+        fs: { read: VAULT_FS_GLOBS, write: VAULT_FS_GLOBS },
+        env: ['MOXXY_VAULT_PASSPHRASE', 'ComSpec'],
+      },
+    },
     async handler(input, ctx) {
       validateProvider(input.provider);
       const mode = input.mode ?? 'loopback';
@@ -225,6 +249,19 @@ export function buildOauthGetTokenTool(deps: OAuthToolDeps) {
         ),
     }),
     permission: { action: 'prompt' },
+    // Refresh POSTs go to the token endpoint persisted at authorize time —
+    // arbitrary per provider, so a static allowlist can't cover it. Rotation
+    // is serialized through the on-disk credential lock under ~/.moxxy/locks.
+    isolation: {
+      capabilities: {
+        net: { mode: 'any' },
+        fs: {
+          read: [...VAULT_FS_GLOBS, `${moxxyPath('locks')}/**`],
+          write: [...VAULT_FS_GLOBS, `${moxxyPath('locks')}/**`],
+        },
+        env: ['MOXXY_VAULT_PASSPHRASE'],
+      },
+    },
     async handler({ provider, forceRefresh, includeRefresh }, _ctx) {
       const stored = await readStoredCreds(deps.vault, provider);
       if (!stored) {
@@ -277,6 +314,13 @@ export function buildOauthClearTool(deps: OAuthToolDeps) {
       'the grant or re-do the flow with different scopes.',
     inputSchema: z.object({ provider: providerNameField }),
     permission: { action: 'prompt' },
+    isolation: {
+      capabilities: {
+        net: { mode: 'none' },
+        fs: { read: VAULT_FS_GLOBS, write: VAULT_FS_GLOBS },
+        env: ['MOXXY_VAULT_PASSPHRASE'],
+      },
+    },
     async handler({ provider }) {
       const removed = await clearStoredCreds(deps.vault, provider);
       return { ok: true, provider, removedKeys: removed };