@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/src/commands/org/login-web.js

@@ -0,0 +1,419 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loginWebCommand = void 0;
+exports.generatePkcePair = generatePkcePair;
+exports.isLoopbackInstanceUrl = isLoopbackInstanceUrl;
+exports.isPlainHttpInstanceUrl = isPlainHttpInstanceUrl;
+const commander_1 = require("commander");
+const crypto = __importStar(require("crypto"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const logger_1 = require("../../utils/logger");
+const spinner_1 = require("../../utils/spinner");
+const auth_store_1 = require("../../services/auth-store");
+const error_handler_1 = require("../../utils/error-handler");
+const config_1 = require("../../services/config");
+const DEFAULT_AUTHORIZE_PATHS = ['/oauth/authorize', '/oauth2/authorize', '/services/oauth2/authorize'];
+const DEFAULT_TOKEN_PATHS = ['/oauth/token', '/oauth2/token', '/services/oauth2/token'];
+const DEFAULT_NEXUSCLAW_CLI_CLIENT_ID = 'nexusclaw-cli';
+const PROVIDER_PRESETS = {
+    auto: {
+        authorizePaths: DEFAULT_AUTHORIZE_PATHS,
+        tokenPaths: DEFAULT_TOKEN_PATHS,
+        defaultScope: '',
+    },
+    nexusclaw: {
+        authorizePaths: ['/oauth/authorize'],
+        tokenPaths: ['/oauth/token'],
+        defaultScope: 'read:accounts',
+    },
+    salesforce: {
+        authorizePaths: ['/services/oauth2/authorize'],
+        tokenPaths: ['/services/oauth2/token'],
+        defaultScope: '',
+    },
+};
+function isSalesforceAuthorizePath(authorizePath) {
+    return authorizePath.startsWith('/services/oauth2/authorize');
+}
+function generatePkcePair() {
+    const verifier = crypto.randomBytes(32).toString('base64url');
+    const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge, method: 'S256' };
+}
+function isLoopbackInstanceUrl(instanceUrl) {
+    try {
+        const parsed = new URL(instanceUrl);
+        return ['localhost', '127.0.0.1', '::1', '[::1]'].includes(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function isPlainHttpInstanceUrl(instanceUrl) {
+    try {
+        return new URL(instanceUrl).protocol === 'http:';
+    }
+    catch {
+        return false;
+    }
+}
+function getScopeForFlow(opts) {
+    if (opts.scope && opts.scope.trim()) {
+        return opts.scope.trim();
+    }
+    if (opts.provider === 'nexusclaw') {
+        return 'read:accounts';
+    }
+    if (opts.provider === 'salesforce') {
+        return '';
+    }
+    return isSalesforceAuthorizePath(opts.authorizePath) ? '' : 'read:accounts';
+}
+exports.loginWebCommand = new commander_1.Command('login-web')
+    .description('Login via browser OAuth flow')
+    .option('-a, --alias <alias>', 'Alias for the org', 'default')
+    .option('-r, --instance-url <url>', 'Instance URL', (0, config_1.getBaseUrl)())
+    .option('--client-id <clientId>', 'OAuth client ID (advanced; defaults to built-in NexusClaw CLI client)', process.env.NEXUS_OAUTH2_CLIENT_ID || process.env.OAUTH2_CLIENT_ID)
+    .option('--client-secret <clientSecret>', 'OAuth client secret (optional)', process.env.NEXUS_OAUTH2_CLIENT_SECRET || process.env.OAUTH2_CLIENT_SECRET)
+    .option('--scope <scope>', 'OAuth scope (optional)')
+    .option('--provider <provider>', 'Auth provider preset: auto | nexusclaw | salesforce', 'auto')
+    .option('--authorize-path <path>', 'OAuth authorization endpoint path')
+    .option('--token-path <path>', 'OAuth token endpoint path')
+    .action((0, error_handler_1.withErrorHandler)(async (opts) => {
+    const spinner = (0, spinner_1.createSpinner)('Waiting for browser authentication...');
+    const port = 1717;
+    const redirectUri = `http://localhost:${port}/callback`;
+    const state = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+    const pkce = generatePkcePair();
+    const instanceIsLoopback = isLoopbackInstanceUrl(opts.instanceUrl);
+    const instanceIsPlainHttp = isPlainHttpInstanceUrl(opts.instanceUrl);
+    const allowLocalhostLogin = process.env.NEXUS_CLI_ALLOW_LOCALHOST_LOGIN === '1'
+        || process.env.NEXUS_CLI_ALLOW_LOCALHOST_LOGIN === 'true';
+    if (instanceIsLoopback && !allowLocalhostLogin) {
+        logger_1.logger.warn(`Instance URL "${opts.instanceUrl}" is a loopback address and is only reachable from this machine. ` +
+            'For LAN/cross-machine login run: nexus org login-web --instance-url http://<lan-host>:<port> --alias <alias>. ' +
+            'Set NEXUS_CLI_ALLOW_LOCALHOST_LOGIN=1 to silence this warning for local dev.');
+    }
+    if (!instanceIsLoopback && instanceIsPlainHttp) {
+        logger_1.logger.warn(`Instance URL "${opts.instanceUrl}" uses plain HTTP. LAN/intranet dev over HTTP is supported, ` +
+            'but the OAuth access token will traverse the network in cleartext. Use HTTPS for anything beyond a trusted LAN.');
+    }
+    const provider = (opts.provider || 'auto').toLowerCase();
+    if (!['auto', 'nexusclaw', 'salesforce'].includes(provider)) {
+        throw new Error('Invalid --provider value. Supported values: auto, nexusclaw, salesforce.');
+    }
+    const clientId = opts.clientId || DEFAULT_NEXUSCLAW_CLI_CLIENT_ID;
+    const providerPreset = PROVIDER_PRESETS[provider];
+    const authorizeCandidates = provider === 'auto'
+        ? Array.from(new Set([opts.authorizePath || DEFAULT_AUTHORIZE_PATHS[0], ...providerPreset.authorizePaths]))
+        : Array.from(new Set([opts.authorizePath || providerPreset.authorizePaths[0], ...providerPreset.authorizePaths]));
+    const tokenCandidates = provider === 'auto'
+        ? Array.from(new Set([opts.tokenPath || DEFAULT_TOKEN_PATHS[0], ...providerPreset.tokenPaths]))
+        : Array.from(new Set([opts.tokenPath || providerPreset.tokenPaths[0], ...providerPreset.tokenPaths]));
+    const requestedScope = (opts.scope || '').trim();
+    const discoverScope = requestedScope || providerPreset.defaultScope;
+    const authorizePath = await discoverOAuthAuthorizePath(opts.instanceUrl, authorizeCandidates, {
+        state,
+        redirectUri,
+        scope: discoverScope,
+        clientId,
+        responseType: 'code',
+    });
+    const effectiveScope = getScopeForFlow({
+        provider,
+        scope: requestedScope,
+        authorizePath,
+    });
+    const server = http.createServer(async (req, res) => {
+        const clearAuthTimer = () => {
+            clearTimeout(authTimeout);
+        };
+        const url = new URL(req.url || '/', `http://localhost:${port}`);
+        const token = url.searchParams.get('access_token');
+        const refresh = url.searchParams.get('refresh_token');
+        const username = url.searchParams.get('username') || '';
+        const orgId = url.searchParams.get('org_id') || '';
+        const code = url.searchParams.get('code');
+        const oauthError = url.searchParams.get('error');
+        const oauthErrorDescription = url.searchParams.get('error_description');
+        const callbackState = url.searchParams.get('state');
+        const expiresIn = parseInt(url.searchParams.get('expires_in') || '3600', 10);
+        const fail = (message) => {
+            clearAuthTimer();
+            res.writeHead(400, { 'Content-Type': 'text/html' });
+            res.end(`<html><body><h2>Authentication failed: ${message}</h2></body></html>`);
+            spinner.fail(message);
+            server.close();
+        };
+        const success = (data) => {
+            (0, auth_store_1.saveCredential)({
+                alias: opts.alias,
+                instanceUrl: opts.instanceUrl,
+                accessToken: data.accessToken,
+                refreshToken: data.refreshToken,
+                username: data.username,
+                orgId: data.orgId,
+                clientId: data.clientId,
+                scope: data.scope,
+                loginType: 'oauth-web',
+                expiresAt: Date.now() + (data.expiresIn || expiresIn) * 1000,
+                isDefault: true,
+            });
+            (0, auth_store_1.setDefaultOrg)(opts.alias);
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end('<html><body><h2>Authentication successful. You can close this window.</h2></body></html>');
+            clearAuthTimer();
+            spinner.succeed(`Logged in as ${data.username} (alias: ${opts.alias})`);
+            server.close();
+        };
+        if (callbackState && callbackState !== state) {
+            fail('Authorization state mismatch');
+            return;
+        }
+        if (oauthError) {
+            fail(oauthErrorDescription || oauthError);
+            return;
+        }
+        if (code) {
+            try {
+                const tokenData = await exchangeAuthorizationCode(opts.instanceUrl, code, clientId, opts.clientSecret, redirectUri, tokenCandidates, pkce.verifier);
+                if (tokenData.error || !tokenData.access_token) {
+                    fail(tokenData.error_description || tokenData.error || 'Failed to exchange authorization code');
+                    return;
+                }
+                const claims = decodeJwtClaims(tokenData.access_token);
+                const loginUsername = tokenData.username || claims?.sub || username || 'unknown';
+                const loginOrgId = tokenData.org_id || claims?.workspaceId || orgId || '';
+                success({
+                    accessToken: tokenData.access_token,
+                    refreshToken: tokenData.refresh_token,
+                    username: loginUsername,
+                    orgId: loginOrgId,
+                    clientId,
+                    scope: tokenData.scope || effectiveScope,
+                    expiresIn: tokenData.expires_in,
+                });
+            }
+            catch (error) {
+                fail(error instanceof Error ? error.message : 'Failed to exchange authorization code');
+            }
+            return;
+        }
+        if (token) {
+            const claims = decodeJwtClaims(token);
+            const loginUsername = username || claims?.sub || 'unknown';
+            const loginOrgId = orgId || claims?.workspaceId || '';
+            success({
+                accessToken: token,
+                refreshToken: refresh || undefined,
+                username: loginUsername,
+                orgId: loginOrgId,
+                scope: effectiveScope,
+                expiresIn,
+            });
+        }
+        else {
+            fail('Missing access_token and authorization_code');
+        }
+    });
+    server.listen(port, () => {
+        spinner.start();
+        const authUrl = new URL(authorizePath, opts.instanceUrl);
+        authUrl.searchParams.set('response_type', 'code');
+        authUrl.searchParams.set('redirect_uri', redirectUri);
+        if (effectiveScope) {
+            authUrl.searchParams.set('scope', effectiveScope);
+        }
+        authUrl.searchParams.set('state', state);
+        authUrl.searchParams.set('client_id', clientId);
+        authUrl.searchParams.set('code_challenge', pkce.challenge);
+        authUrl.searchParams.set('code_challenge_method', pkce.method);
+        logger_1.logger.info(`Open this URL in your browser:\n  ${authUrl}`);
+        const { exec } = require('child_process');
+        const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+        exec(`${cmd} "${authUrl}"`);
+    });
+    const authTimeout = setTimeout(() => {
+        spinner.fail('Authentication timed out');
+        server.close();
+        process.exit(1);
+    }, 120000);
+}));
+async function exchangeAuthorizationCode(instanceUrl, code, clientId, clientSecret, redirectUri, tokenEndpointPaths, codeVerifier) {
+    const payload = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        client_id: clientId,
+        redirect_uri: redirectUri,
+    });
+    if (clientSecret) {
+        payload.set('client_secret', clientSecret);
+    }
+    if (codeVerifier) {
+        payload.set('code_verifier', codeVerifier);
+    }
+    let lastError;
+    for (const tokenPath of tokenEndpointPaths) {
+        const response = await postOAuthToken(instanceUrl, tokenPath, payload);
+        const statusCode = response.statusCode || 0;
+        if (statusCode === 404) {
+            lastError = `not found: ${tokenPath}`;
+            continue;
+        }
+        if (response.parseError) {
+            if (statusCode >= 200 && statusCode < 300) {
+                lastError = response.parseError;
+                continue;
+            }
+            lastError = `${response.parseError} (${tokenPath})`;
+            break;
+        }
+        if (statusCode >= 200 && statusCode < 300) {
+            return response.data;
+        }
+        if (response.data?.error || response.data?.error_description) {
+            return response.data;
+        }
+        lastError = `HTTP ${statusCode}: ${tokenPath}`;
+        continue;
+    }
+    throw new Error(lastError
+        ? `OAuth token endpoint exchange failed (${lastError})`
+        : `OAuth token endpoint not found. Tried: ${tokenEndpointPaths.join(', ')}`);
+}
+function decodeJwtClaims(token) {
+    const segments = token.split('.');
+    if (segments.length !== 3) {
+        return null;
+    }
+    try {
+        const payloadSegment = segments[1]
+            .replace(/-/g, '+')
+            .replace(/_/g, '/')
+            .padEnd(Math.ceil(segments[1].length / 4) * 4, '=');
+        const payload = Buffer.from(payloadSegment, 'base64').toString('utf-8');
+        return JSON.parse(payload);
+    }
+    catch {
+        return null;
+    }
+}
+function postOAuthToken(instanceUrl, tokenPath, payload) {
+    return new Promise((resolve) => {
+        const tokenUrl = new URL(tokenPath, instanceUrl);
+        const isHttps = tokenUrl.protocol === 'https:';
+        const transport = isHttps ? https : http;
+        const req = transport.request({
+            method: 'POST',
+            hostname: tokenUrl.hostname,
+            port: tokenUrl.port || (isHttps ? 443 : 80),
+            path: `${tokenUrl.pathname}${tokenUrl.search}`,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+            res.on('end', () => {
+                try {
+                    const parsed = data ? JSON.parse(data) : {};
+                    resolve({
+                        statusCode: res.statusCode || 0,
+                        data: parsed,
+                    });
+                }
+                catch {
+                    resolve({
+                        statusCode: res.statusCode || 0,
+                        data: {},
+                        parseError: `Invalid token response format (${tokenPath})`,
+                    });
+                }
+            });
+        });
+        req.on('error', () => {
+            resolve({
+                statusCode: 0,
+                data: {},
+                parseError: `Network error when request token endpoint (${tokenPath})`,
+            });
+        });
+        req.write(payload.toString());
+        req.end();
+    });
+}
+async function discoverOAuthAuthorizePath(instanceUrl, candidatePaths, query) {
+    for (const authorizePath of candidatePaths) {
+        const statusCode = await probeAuthorizePath(instanceUrl, authorizePath, query);
+        if (statusCode !== 404) {
+            return authorizePath;
+        }
+    }
+    throw new Error(`OAuth authorize endpoint not found. Tried: ${candidatePaths.join(', ')}`);
+}
+async function probeAuthorizePath(instanceUrl, authorizePath, query) {
+    return new Promise((resolve) => {
+        const authorizeUrl = new URL(authorizePath, instanceUrl);
+        authorizeUrl.searchParams.set('response_type', query.responseType);
+        authorizeUrl.searchParams.set('redirect_uri', query.redirectUri);
+        if (query.scope) {
+            authorizeUrl.searchParams.set('scope', query.scope);
+        }
+        authorizeUrl.searchParams.set('state', query.state);
+        authorizeUrl.searchParams.set('client_id', query.clientId);
+        const isHttps = authorizeUrl.protocol === 'https:';
+        const transport = isHttps ? https : http;
+        const req = transport.request({
+            method: 'GET',
+            hostname: authorizeUrl.hostname,
+            port: authorizeUrl.port || (isHttps ? 443 : 80),
+            path: `${authorizeUrl.pathname}${authorizeUrl.search}`,
+        }, (res) => {
+            res.resume();
+            res.on('end', () => {
+                resolve(res.statusCode || 0);
+            });
+        });
+        req.on('error', () => {
+            resolve(404);
+        });
+        req.end();
+    });
+}
+//# sourceMappingURL=login-web.js.map

package/dist/nexus-cli/src/commands/org/login-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-web.js","sourceRoot":"","sources":["../../../../../src/commands/org/login-web.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsEA,4CAIC;AAOD,sDASC;AAQD,wDAMC;AAxGD,yCAAoC;AACpC,+CAAiC;AACjC,2CAA6B;AAC7B,6CAA+B;AAC/B,+CAA4C;AAC5C,iDAAoD;AACpD,0DAA0E;AAC1E,6DAA6D;AAC7D,kDAAmD;AAkBnD,MAAM,uBAAuB,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;AACxG,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACxF,MAAM,+BAA+B,GAAG,eAAe,CAAC;AAUxD,MAAM,gBAAgB,GAA+C;IACnE,IAAI,EAAE;QACJ,cAAc,EAAE,uBAAuB;QACvC,UAAU,EAAE,mBAAmB;QAC/B,YAAY,EAAE,EAAE;KACjB;IACD,SAAS,EAAE;QACT,cAAc,EAAE,CAAC,kBAAkB,CAAC;QACpC,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,eAAe;KAC9B;IACD,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,4BAA4B,CAAC;QAC9C,UAAU,EAAE,CAAC,wBAAwB,CAAC;QACtC,YAAY,EAAE,EAAE;KACjB;CACF,CAAC;AAEF,SAAS,yBAAyB,CAAC,aAAqB;IACtD,OAAO,aAAa,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAChE,CAAC;AAYD,SAAgB,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAOD,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAGpC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAyE;IAChG,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;AAC9E,CAAC;AAKY,QAAA,eAAe,GAAG,IAAI,mBAAO,CAAC,WAAW,CAAC;KACpD,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,SAAS,CAAC;KAC7D,MAAM,CAAC,0BAA0B,EAAE,cAAc,EAAE,IAAA,mBAAU,GAAE,CAAC;KAChE,MAAM,CACL,wBAAwB,EACxB,uEAAuE,EACvE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CACnE;KACA,MAAM,CACL,gCAAgC,EAChC,gCAAgC,EAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAC3E;KACA,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;KACnD,MAAM,CACL,uBAAuB,EACvB,qDAAqD,EACrD,MAAM,CACP;KACA,MAAM,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;KACtE,MAAM,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;KAC1D,MAAM,CACL,IAAA,gCAAgB,EAAC,KAAK,EAAE,IASvB,EAAE,EAAE;IACH,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,uCAAuC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAGlF,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAQhC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;WAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,MAAM,CAAC;IAC5D,IAAI,kBAAkB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,eAAM,CAAC,IAAI,CACT,iBAAiB,IAAI,CAAC,WAAW,mEAAmE;YAClG,gHAAgH;YAChH,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,IAAI,mBAAmB,EAAE,CAAC;QAC/C,eAAM,CAAC,IAAI,CACT,iBAAiB,IAAI,CAAC,WAAW,8DAA8D;YAC7F,iHAAiH,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,WAAW,EAAmB,CAAC;IAC1E,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,+BAA+B,CAAC;IAElE,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,QAAQ,KAAK,MAAM;QAC7C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3G,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,eAAe,GAAG,QAAQ,KAAK,MAAM;QACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,aAAa,GAAG,cAAc,IAAI,cAAc,CAAC,YAAY,CAAC;IACpE,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE;QAC5F,KAAK;QACL,WAAW;QACX,KAAK,EAAE,aAAa;QACpB,QAAQ;QACR,YAAY,EAAE,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,eAAe,CAAC;QACrC,QAAQ;QACR,KAAK,EAAE,cAAc;QACrB,aAAa;KACd,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,YAAY,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,qBAAqB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAE7E,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;YAC/B,cAAc,EAAE,CAAC;YACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,0CAA0C,OAAO,qBAAqB,CAAC,CAAC;YAChF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,IAQhB,EAAE,EAAE;YACH,IAAA,2BAAc,EAAC;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,WAAW;gBACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,GAAG,IAAI;gBAC5D,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAA,0BAAa,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAE1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;YACpG,cAAc,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,aAAa,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,IAAI,UAAU,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,IAAI,CAAC,WAAW,EAChB,IAAI,EACJ,QAAQ,EACR,IAAI,CAAC,YAAY,EACjB,WAAW,EACX,eAAe,EACf,IAAI,CAAC,QAAQ,CACd,CAAC;gBAEF,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;oBAC/C,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,IAAI,uCAAuC,CAAC,CAAC;oBAChG,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,IAAI,MAAM,EAAE,GAAG,IAAI,QAAQ,IAAI,SAAS,CAAC;gBACjF,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,IAAI,MAAM,EAAE,WAAW,IAAI,KAAK,IAAI,EAAE,CAAC;gBAE1E,OAAO,CAAC;oBACN,WAAW,EAAE,SAAS,CAAC,YAAY;oBACnC,YAAY,EAAE,SAAS,CAAC,aAAa;oBACrC,QAAQ,EAAE,aAAa;oBACvB,KAAK,EAAE,UAAU;oBACjB,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,cAAc;oBACxC,SAAS,EAAE,SAAS,CAAC,UAAU;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;YACzF,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,aAAa,GAAG,QAAQ,IAAI,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC;YAC3D,MAAM,UAAU,GAAG,KAAK,IAAI,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;YAEtD,OAAO,CAAC;gBACN,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,OAAO,IAAI,SAAS;gBAClC,QAAQ,EAAE,aAAa;gBACvB,KAAK,EAAE,UAAU;gBACjB,KAAK,EAAE,cAAc;gBACrB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEhD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,eAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAG5D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACzG,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAGH,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE;QAClC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CACH,CAAC;AAEJ,KAAK,UAAU,yBAAyB,CACtC,WAAmB,EACnB,IAAY,EACZ,QAAgB,EAChB,YAAgC,EAChC,WAAmB,EACnB,kBAA4B,EAC5B,YAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC;QAClC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IAGD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;QAE5C,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,SAAS,GAAG,cAAc,SAAS,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;gBAC1C,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;gBAChC,SAAS;YACX,CAAC;YAED,SAAS,GAAG,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS,GAAG,CAAC;YACpD,MAAM;QACR,CAAC;QAED,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,SAAS,GAAG,QAAQ,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/C,SAAS;IAEX,CAAC;IAED,MAAM,IAAI,KAAK,CACb,SAAS;QACP,CAAC,CAAC,yCAAyC,SAAS,GAAG;QACvD,CAAC,CAAC,0CAA0C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC;aAC/B,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;aAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,SAAS,cAAc,CACrB,WAAmB,EACnB,SAAiB,EACjB,OAAwB;IAExB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE;YAC9C,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;SACF,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC;wBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBAC/B,IAAI,EAAE,MAA4B;qBACnC,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC;wBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;wBAC/B,IAAI,EAAE,EAAE;wBACR,UAAU,EAAE,kCAAkC,SAAS,GAAG;qBAC3D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI,EAAE,EAAE;gBACR,UAAU,EAAE,8CAA8C,SAAS,GAAG;aACvE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,WAAmB,EACnB,cAAwB,EACxB,KAMC;IAED,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAC/E,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8CAA8C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,aAAqB,EACrB,KAMC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACzD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QACD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE3D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,GAAG,YAAY,CAAC,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE;SACvD,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/nexus-cli/src/commands/org/login-web.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/nexus-cli/src/commands/org/login-web.test.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const crypto = __importStar(require("crypto"));
+const node_test_1 = __importDefault(require("node:test"));
+const login_web_1 = require("./login-web");
+(0, node_test_1.default)('generatePkcePair produces an S256 verifier/challenge that satisfies RFC 7636', () => {
+    const { verifier, challenge, method } = (0, login_web_1.generatePkcePair)();
+    strict_1.default.equal(method, 'S256');
+    strict_1.default.ok(verifier.length >= 43 && verifier.length <= 128, 'verifier length out of range');
+    const expected = crypto.createHash('sha256').update(verifier).digest('base64url');
+    strict_1.default.equal(challenge, expected);
+    const second = (0, login_web_1.generatePkcePair)();
+    strict_1.default.notEqual(verifier, second.verifier);
+});
+(0, node_test_1.default)('isLoopbackInstanceUrl classifies loopback vs LAN vs public hosts', () => {
+    strict_1.default.equal((0, login_web_1.isLoopbackInstanceUrl)('http://localhost:8000'), true);
+    strict_1.default.equal((0, login_web_1.isLoopbackInstanceUrl)('http://127.0.0.1:8000'), true);
+    strict_1.default.equal((0, login_web_1.isLoopbackInstanceUrl)('http://[::1]:8000'), true);
+    strict_1.default.equal((0, login_web_1.isLoopbackInstanceUrl)('http://192.168.1.50:8000'), false, 'LAN host is not loopback');
+    strict_1.default.equal((0, login_web_1.isLoopbackInstanceUrl)('https://cli.nexusclaw.example'), false);
+    strict_1.default.equal((0, login_web_1.isLoopbackInstanceUrl)('not-a-url'), false, 'malformed input returns false');
+});
+(0, node_test_1.default)('isPlainHttpInstanceUrl flags cleartext HTTP (LAN dev) while accepting HTTPS', () => {
+    strict_1.default.equal((0, login_web_1.isPlainHttpInstanceUrl)('http://192.168.1.50:8000'), true, 'LAN over HTTP is plain');
+    strict_1.default.equal((0, login_web_1.isPlainHttpInstanceUrl)('http://localhost:8000'), true);
+    strict_1.default.equal((0, login_web_1.isPlainHttpInstanceUrl)('https://cli.nexusclaw.example'), false);
+    strict_1.default.equal((0, login_web_1.isPlainHttpInstanceUrl)('not-a-url'), false);
+});
+//# sourceMappingURL=login-web.test.js.map

package/dist/nexus-cli/src/commands/org/login-web.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-web.test.js","sourceRoot":"","sources":["../../../../../src/commands/org/login-web.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gEAAwC;AACxC,+CAAiC;AACjC,0DAA6B;AAC7B,2CAIqB;AAGrB,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAA,4BAAgB,GAAE,CAAC;IAG3D,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG7B,gBAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAG3F,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClF,gBAAM,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAGlC,MAAM,MAAM,GAAG,IAAA,4BAAgB,GAAE,CAAC;IAClC,gBAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAGH,IAAA,mBAAI,EAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,gBAAM,CAAC,KAAK,CAAC,IAAA,iCAAqB,EAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,iCAAqB,EAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,iCAAqB,EAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,gBAAM,CAAC,KAAK,CAAC,IAAA,iCAAqB,EAAC,0BAA0B,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACnG,gBAAM,CAAC,KAAK,CAAC,IAAA,iCAAqB,EAAC,+BAA+B,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,gBAAM,CAAC,KAAK,CAAC,IAAA,iCAAqB,EAAC,WAAW,CAAC,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAGH,IAAA,mBAAI,EAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,gBAAM,CAAC,KAAK,CAAC,IAAA,kCAAsB,EAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACjG,gBAAM,CAAC,KAAK,CAAC,IAAA,kCAAsB,EAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,gBAAM,CAAC,KAAK,CAAC,IAAA,kCAAsB,EAAC,+BAA+B,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,gBAAM,CAAC,KAAK,CAAC,IAAA,kCAAsB,EAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC"}

package/dist/nexus-cli/src/commands/org/logout.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const logoutCommand: Command;

package/dist/nexus-cli/src/commands/org/logout.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logoutCommand = void 0;
+const commander_1 = require("commander");
+const auth_store_1 = require("../../services/auth-store");
+const logger_1 = require("../../utils/logger");
+exports.logoutCommand = new commander_1.Command('logout')
+    .description('Remove org credentials')
+    .requiredOption('-o, --target-org <alias>', 'Org alias to remove')
+    .action((opts) => {
+    const target = (0, auth_store_1.loadCredential)(opts.targetOrg);
+    if ((0, auth_store_1.removeCredential)(opts.targetOrg)) {
+        if (target?.isDefault) {
+            const remaining = (0, auth_store_1.listCredentials)();
+            if (remaining.length > 0) {
+                (0, auth_store_1.setDefaultOrg)(remaining[0].alias);
+            }
+        }
+        logger_1.logger.success(`Removed credentials for: ${opts.targetOrg}`);
+    }
+    else {
+        logger_1.logger.error(`Org "${opts.targetOrg}" not found.`);
+        process.exit(1);
+    }
+});
+//# sourceMappingURL=logout.js.map

package/dist/nexus-cli/src/commands/org/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../../../src/commands/org/logout.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,0DAA6G;AAC7G,+CAA4C;AAK/B,QAAA,aAAa,GAAG,IAAI,mBAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,wBAAwB,CAAC;KACrC,cAAc,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;KACjE,MAAM,CAAC,CAAC,IAA2B,EAAE,EAAE;IACtC,MAAM,MAAM,GAAG,IAAA,2BAAc,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,IAAA,6BAAgB,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,IAAA,4BAAe,GAAE,CAAC;YACpC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAA,0BAAa,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,eAAM,CAAC,OAAO,CAAC,4BAA4B,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,eAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,cAAc,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/nexus-cli/src/commands/org/open.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const openCommand: Command;
+export declare function registerOpenCommand(org: Command): void;

package/dist/nexus-cli/src/commands/org/open.js

@@ -0,0 +1,73 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openCommand = void 0;
+exports.registerOpenCommand = registerOpenCommand;
+const commander_1 = require("commander");
+const auth_store_1 = require("../../services/auth-store");
+const logger_1 = require("../../utils/logger");
+const error_handler_1 = require("../../utils/error-handler");
+exports.openCommand = new commander_1.Command('open')
+    .description('Open the target org in the browser')
+    .option('-o, --target-org <alias>', 'Target org alias')
+    .option('-p, --path <urlPath>', 'URL path to navigate to after login', '/')
+    .option('--url-only', 'Print the login URL without opening the browser')
+    .action((0, error_handler_1.withErrorHandler)(async (opts) => {
+    const cred = opts.targetOrg
+        ? (0, auth_store_1.loadCredential)(opts.targetOrg)
+        : (0, auth_store_1.getDefaultCredential)();
+    if (!cred) {
+        const target = opts.targetOrg || 'default';
+        logger_1.logger.error(`Error: No valid token for org '${target}'. Please run 'nexus org login-web' or 'nexus org login-jwt' to authenticate.`);
+        process.exit(1);
+    }
+    if (cred.expiresAt && cred.expiresAt <= Date.now()) {
+        logger_1.logger.error(`Error: No valid token for org '${cred.alias}'. Please run 'nexus org login-web' or 'nexus org login-jwt' to authenticate.`);
+        process.exit(1);
+    }
+    const redirectPath = opts.path.startsWith('/') ? opts.path : `/${opts.path}`;
+    const url = `${cred.instanceUrl}/auth/cli-session?token=${encodeURIComponent(cred.accessToken)}&redirect=${encodeURIComponent(redirectPath)}`;
+    if (opts.urlOnly) {
+        console.log(url);
+        return;
+    }
+    const open = await Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
+    await open(url);
+    logger_1.logger.success(`Opening ${cred.alias} in browser...`);
+}));
+function registerOpenCommand(org) {
+    org.addCommand(exports.openCommand);
+}
+//# sourceMappingURL=open.js.map

package/dist/nexus-cli/src/commands/org/open.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open.js","sourceRoot":"","sources":["../../../../../src/commands/org/open.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,kDAEC;AA3DD,yCAAoC;AACpC,0DAAiF;AACjF,+CAA4C;AAC5C,6DAA6D;AAOhD,QAAA,WAAW,GAAG,IAAI,mBAAO,CAAC,MAAM,CAAC;KAC3C,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;KACtD,MAAM,CAAC,sBAAsB,EAAE,qCAAqC,EAAE,GAAG,CAAC;KAC1E,MAAM,CAAC,YAAY,EAAE,iDAAiD,CAAC;KACvE,MAAM,CACL,IAAA,gCAAgB,EAAC,KAAK,EAAE,IAA6D,EAAE,EAAE;IAEvF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS;QACzB,CAAC,CAAC,IAAA,2BAAc,EAAC,IAAI,CAAC,SAAS,CAAC;QAChC,CAAC,CAAC,IAAA,iCAAoB,GAAE,CAAC;IAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;QAC3C,eAAM,CAAC,KAAK,CACV,kCAAkC,MAAM,+EAA+E,CACxH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAGD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,eAAM,CAAC,KAAK,CACV,kCAAkC,IAAI,CAAC,KAAK,+EAA+E,CAC5H,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAGD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,2BAA2B,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IAE9I,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IAGD,MAAM,IAAI,GAAG,MAAM,kDAAO,MAAM,IAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,eAAM,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,gBAAgB,CAAC,CAAC;AACxD,CAAC,CAAC,CACH,CAAC;AAKJ,SAAgB,mBAAmB,CAAC,GAAY;IAC9C,GAAG,CAAC,UAAU,CAAC,mBAAW,CAAC,CAAC;AAC9B,CAAC"}

package/dist/nexus-cli/src/commands/package/deprecate.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const packageDeprecateCommand: Command;