@provartesting/provardx-cli 1.5.0-dev.2 → 1.5.1

package/lib/mcp/utils/validationDiff.js

@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/* eslint-disable camelcase */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+const MAX_RUNS = 20;
+const INDEX_FILE = '.runs.json';
+const DEFAULT_ROOT_NAME = '.provardx';
+const VALIDATION_SUBDIR = 'validation';
+// ── Helpers ───────────────────────────────────────────────────────────────────
+/** Stable 8-char hash of a string for use in run IDs. */
+function shortHash(input) {
+    return createHash('sha1').update(input).digest('hex').slice(0, 8);
+}
+/** Build a unique key for a violation so additions/resolutions can be detected. */
+function violationKey(v) {
+    const rule_id = String(v['rule_id'] ?? '');
+    const applies_to = Array.isArray(v['applies_to'])
+        ? v['applies_to'].join(',')
+        : String(v['applies_to'] ?? '');
+    const message = String(v['message'] ?? '');
+    return `${rule_id}||${applies_to}||${message}`;
+}
+function loadIndex(storageDir) {
+    const indexPath = path.join(storageDir, INDEX_FILE);
+    try {
+        return JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
+    }
+    catch {
+        return { runs: [] };
+    }
+}
+function saveIndex(storageDir, index) {
+    const indexPath = path.join(storageDir, INDEX_FILE);
+    fs.writeFileSync(indexPath, JSON.stringify(index, null, 2), 'utf-8');
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Compute a stable 8-char context hash for a tool + context pair. Used to
+ * scope baseline run lookups so that a run_id from context A cannot be diffed
+ * against context B (different project, different suite, different file).
+ */
+export function computeContextHash(toolTag, context) {
+    return shortHash(`${toolTag}|${context}`);
+}
+/**
+ * Resolve the validation storage root for a given tool subdir. Honors the
+ * PROVAR_MCP_VALIDATION_DIR env var when set; otherwise falls back to
+ * `~/.provardx/validation/<subdir>`. The env override is useful for restricted
+ * CI/dev environments where the home directory is read-only or shared.
+ */
+export function resolveValidationDir(subdir) {
+    const override = process.env['PROVAR_MCP_VALIDATION_DIR']?.trim();
+    if (override)
+        return path.join(override, subdir);
+    return path.join(os.homedir(), DEFAULT_ROOT_NAME, VALIDATION_SUBDIR, subdir);
+}
+/** Generate a run ID from a context string (e.g. project path or suite name). */
+export function generateRunId(context) {
+    const rand = Math.random().toString(36).slice(2, 6);
+    return `${Date.now()}-${shortHash(context)}-${rand}`;
+}
+/**
+ * Check whether any prior runs exist in the given storage directory.
+ * Used by calcNextAction to determine the first-run heuristic.
+ */
+export function hasAnyRun(storageDir) {
+    const index = loadIndex(storageDir);
+    return index.runs.length > 0;
+}
+/**
+ * Save the current violations as a new run in the storage directory.
+ * Caps the index at MAX_RUNS by evicting the oldest entry when full.
+ * Returns the generated run_id.
+ *
+ * When `contextHash` is provided, it is recorded alongside the run so that
+ * `loadBaselineViolations` can reject a baseline_run_id whose context does
+ * not match the calling context (prevents cross-context diffs).
+ */
+export function saveRun(storageDir, runId, violations, contextHash) {
+    fs.mkdirSync(storageDir, { recursive: true });
+    const filename = `${runId}.json`;
+    fs.writeFileSync(path.join(storageDir, filename), JSON.stringify(violations), 'utf-8');
+    const index = loadIndex(storageDir);
+    index.runs.push({
+        run_id: runId,
+        timestamp: Date.now(),
+        filename,
+        ...(contextHash ? { context_hash: contextHash } : {}),
+    });
+    // Evict oldest entries when over the cap
+    while (index.runs.length > MAX_RUNS) {
+        const evicted = index.runs.shift();
+        if (evicted) {
+            try {
+                fs.unlinkSync(path.join(storageDir, evicted.filename));
+            }
+            catch {
+                /* best-effort eviction */
+            }
+        }
+    }
+    saveIndex(storageDir, index);
+    return runId;
+}
+/**
+ * Load the violations array for a given baseline run ID.
+ * Returns null if the run is not found in the index (BASELINE_NOT_FOUND).
+ * The filename is looked up from the index only — the run_id itself is never
+ * used to construct a file path, preventing path traversal.
+ *
+ * When `expectedContextHash` is provided, the record's `context_hash` must
+ * match. Records without a `context_hash` (written by older versions before
+ * H3) are treated as a mismatch and are effectively retired within one or
+ * two new runs as the FIFO cap evicts them. This guard prevents diffing a
+ * baseline from a different file/suite/project against the current context.
+ */
+export function loadBaselineViolations(storageDir, baselineRunId, expectedContextHash) {
+    const index = loadIndex(storageDir);
+    const record = index.runs.find((r) => r.run_id === baselineRunId);
+    if (!record)
+        return null;
+    if (expectedContextHash !== undefined && record.context_hash !== expectedContextHash) {
+        return null;
+    }
+    // Use the filename from the index, not the run_id
+    try {
+        const content = fs.readFileSync(path.join(storageDir, record.filename), 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compute the diff between a baseline and current violations array.
+ * Uses (rule_id + applies_to + full message) as the unique key.
+ * Duplicate violations (same key, multiple occurrences) are treated as
+ * distinct entries — each occurrence is counted separately (multiset semantics).
+ */
+export function computeDiff(baseline, current) {
+    // Build multiset counts keyed by violation identity
+    const baselineCounts = new Map();
+    for (const v of baseline) {
+        const key = violationKey(v);
+        const entry = baselineCounts.get(key);
+        if (entry) {
+            entry.count++;
+        }
+        else {
+            baselineCounts.set(key, { count: 1, sample: v });
+        }
+    }
+    const currentCounts = new Map();
+    for (const v of current) {
+        const key = violationKey(v);
+        const entry = currentCounts.get(key);
+        if (entry) {
+            entry.count++;
+        }
+        else {
+            currentCounts.set(key, { count: 1, sample: v });
+        }
+    }
+    const added = [];
+    const resolved = [];
+    let unchanged_count = 0;
+    // Tally additions: occurrences in current that exceed baseline count
+    for (const [key, { count: curr, sample }] of currentCounts) {
+        const base = baselineCounts.get(key)?.count ?? 0;
+        unchanged_count += Math.min(base, curr);
+        const addedCount = curr - base;
+        for (let i = 0; i < addedCount; i++)
+            added.push(sample);
+    }
+    // Tally resolutions: occurrences in baseline that exceed current count
+    for (const [key, { count: base, sample }] of baselineCounts) {
+        const curr = currentCounts.get(key)?.count ?? 0;
+        const resolvedCount = base - Math.min(base, curr);
+        for (let i = 0; i < resolvedCount; i++)
+            resolved.push(sample);
+    }
+    return { added, resolved, unchanged_count };
+}
+//# sourceMappingURL=validationDiff.js.map

package/lib/mcp/utils/validationDiff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validationDiff.js","sourceRoot":"","sources":["../../../src/mcp/utils/validationDiff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8BAA8B;AAC9B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AACtC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAgCvC,iFAAiF;AAEjF,yDAAyD;AACzD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,CAAoB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC,CAAE,CAAC,CAAC,YAAY,CAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,OAAO,KAAK,UAAU,KAAK,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAc,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB,EAAE,KAAgB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACpD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,OAAe;IACjE,OAAO,SAAS,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,UAAkB,EAClB,KAAa,EACb,UAA+B,EAC/B,WAAoB;IAEpB,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAG,GAAG,KAAK,OAAO,CAAC;IACjC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAEvF,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QACd,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,QAAQ;QACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IAEH,yCAAyC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,aAAqB,EACrB,mBAA4B;IAE5B,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,mBAAmB,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,mBAAmB,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAA6B,EAAE,OAA4B;IACrF,oDAAoD;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAwD,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwD,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,qEAAqE;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QACjD,eAAe,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC"}

package/lib/mcp/utils/validationScore.d.ts

@@ -0,0 +1,15 @@
+export type NextAction = 'stop' | 'fix_and_revalidate' | 'inspect_failures';
+/** Fraction of passing tests expressed as 0–100 integer. Returns 0 when total is 0. */
+export declare function calcCompletenessScore(passing: number, total: number): number;
+/**
+ * Recommend what the agent should do next based on the completeness score,
+ * remaining violation count, and whether any prior runs exist on disk.
+ *
+ * - `stop`              → score is 100 AND no violations remain
+ * - `inspect_failures`  → first run (no baseline on disk) — review what's failing before trying to fix
+ * - `fix_and_revalidate`→ subsequent run — agent knows the failure set, should fix and re-run
+ *
+ * The secondary `remainingViolationCount` check prevents `stop` from firing when all
+ * tests pass but quality or best-practice violations are still present.
+ */
+export declare function calcNextAction(score: number, hasBaseline: boolean, remainingViolationCount?: number): NextAction;

package/lib/mcp/utils/validationScore.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/** Fraction of passing tests expressed as 0–100 integer. Returns 0 when total is 0. */
+export function calcCompletenessScore(passing, total) {
+    if (total === 0)
+        return 0;
+    return Math.round((passing / total) * 100);
+}
+/**
+ * Recommend what the agent should do next based on the completeness score,
+ * remaining violation count, and whether any prior runs exist on disk.
+ *
+ * - `stop`              → score is 100 AND no violations remain
+ * - `inspect_failures`  → first run (no baseline on disk) — review what's failing before trying to fix
+ * - `fix_and_revalidate`→ subsequent run — agent knows the failure set, should fix and re-run
+ *
+ * The secondary `remainingViolationCount` check prevents `stop` from firing when all
+ * tests pass but quality or best-practice violations are still present.
+ */
+export function calcNextAction(score, hasBaseline, remainingViolationCount = 0) {
+    if (score === 100 && remainingViolationCount === 0)
+        return 'stop';
+    if (!hasBaseline)
+        return 'inspect_failures';
+    return 'fix_and_revalidate';
+}
+//# sourceMappingURL=validationScore.js.map

package/lib/mcp/utils/validationScore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validationScore.js","sourceRoot":"","sources":["../../../src/mcp/utils/validationScore.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,KAAa;IAClE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,WAAoB,EAAE,uBAAuB,GAAG,CAAC;IAC7F,IAAI,KAAK,KAAK,GAAG,IAAI,uBAAuB,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,CAAC,WAAW;QAAE,OAAO,kBAAkB,CAAC;IAC5C,OAAO,oBAAoB,CAAC;AAC9B,CAAC"}

package/lib/services/auth/credentials.d.ts

@@ -0,0 +1,21 @@
+export interface StoredCredentials {
+    api_key: string;
+    prefix: string;
+    set_at: string;
+    source: 'manual' | 'cognito' | 'salesforce';
+    username?: string;
+    tier?: string;
+    expires_at?: string;
+}
+export declare function getCredentialsPath(): string;
+export declare function readStoredCredentials(): StoredCredentials | null;
+export declare function writeCredentials(key: string, prefix: string, source: StoredCredentials['source'], extra?: {
+    username?: string;
+    tier?: string;
+    expires_at?: string;
+}): void;
+export declare function clearCredentials(): void;
+export declare function resolveApiKey(): string | null;
+export declare const credentialsService: {
+    resolveApiKey: typeof resolveApiKey;
+};

package/lib/services/auth/credentials.js

@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/* eslint-disable camelcase */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const KEY_PREFIX = 'pv_k_';
+export function getCredentialsPath() {
+    return path.join(os.homedir(), '.provar', 'credentials.json');
+}
+export function readStoredCredentials() {
+    try {
+        const p = getCredentialsPath();
+        if (!fs.existsSync(p))
+            return null;
+        const raw = fs.readFileSync(p, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export function writeCredentials(key, prefix, source, extra) {
+    if (!key.startsWith(KEY_PREFIX)) {
+        throw new Error(`Invalid API key format. Keys must start with "${KEY_PREFIX}".`);
+    }
+    const p = getCredentialsPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    const data = {
+        api_key: key,
+        prefix,
+        set_at: new Date().toISOString(),
+        source,
+        ...(extra?.username ? { username: extra.username } : {}),
+        ...(extra?.tier ? { tier: extra.tier } : {}),
+        ...(extra?.expires_at ? { expires_at: extra.expires_at } : {}),
+    };
+    // mode: 0o600 sets permissions atomically on file creation (POSIX).
+    // chmodSync handles re-runs on existing files. Both are no-ops on Windows.
+    fs.writeFileSync(p, JSON.stringify(data, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        fs.chmodSync(p, 0o600);
+    }
+    catch {
+        /* Windows: no file permission model */
+    }
+}
+export function clearCredentials() {
+    const p = getCredentialsPath();
+    try {
+        fs.rmSync(p);
+    }
+    catch (err) {
+        const e = err;
+        if (e.code !== 'ENOENT')
+            throw err;
+        // file did not exist — nothing to clear, not an error
+    }
+}
+export function resolveApiKey() {
+    const envKey = process.env.PROVAR_API_KEY?.trim();
+    if (envKey?.startsWith(KEY_PREFIX))
+        return envKey;
+    const creds = readStoredCredentials();
+    const storedKey = typeof creds?.api_key === 'string' ? creds.api_key.trim() : null;
+    if (storedKey?.startsWith(KEY_PREFIX))
+        return storedKey;
+    return null;
+}
+export const credentialsService = { resolveApiKey };
+//# sourceMappingURL=credentials.js.map

package/lib/services/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/services/auth/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8BAA8B;AAC9B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAAc,EACd,MAAmC,EACnC,KAAiE;IAEjE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iDAAiD,UAAU,IAAI,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;IAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAsB;QAC9B,OAAO,EAAE,GAAG;QACZ,MAAM;QACN,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAChC,MAAM;QACN,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,oEAAoE;IACpE,2EAA2E;IAC3E,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;QACnC,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC;IAClD,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,IAAI,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,aAAa,EAAE,CAAC"}

package/lib/services/auth/loginFlow.d.ts

@@ -0,0 +1,68 @@
+/// <reference types="node" resolution-mode="require"/>
+export declare const CALLBACK_PORTS: number[];
+/**
+ * Generate a PKCE code_verifier / code_challenge pair (S256 method, as required by Cognito).
+ */
+export declare function generatePkce(): {
+    verifier: string;
+    challenge: string;
+};
+/**
+ * Generate a random nonce for OIDC replay-attack prevention.
+ * Required by the OpenID Connect spec when requesting an id_token.
+ */
+export declare function generateNonce(): string;
+/**
+ * Generate a random state value for CSRF protection.
+ * Required by Cognito Managed Login even though it is optional per the OAuth 2.0 spec.
+ */
+export declare function generateState(): string;
+/**
+ * Try each registered callback port in order; return the first that is free.
+ */
+export declare function findAvailablePort(): Promise<number>;
+/**
+ * Return the platform-specific command and argument list for opening a URL
+ * in the system browser. The URL is passed as an argument — never interpolated
+ * into a shell string — to avoid command injection. Exported so tests can
+ * assert the correct command is chosen without actually spawning a process.
+ */
+export declare function getBrowserCommand(url: string, platform?: NodeJS.Platform): {
+    cmd: string;
+    args: string[];
+};
+export declare function openBrowser(url: string): void;
+/**
+ * Spin up a temporary localhost HTTP server that accepts exactly one callback
+ * from Cognito's Hosted UI, extracts the auth code, and shuts down.
+ */
+export declare function listenForCallback(port: number, expectedState?: string): Promise<string>;
+export interface CognitoTokens {
+    access_token: string;
+    id_token: string;
+    token_type: string;
+    expires_in: number;
+}
+/**
+ * Exchange a PKCE auth code for Cognito tokens via the standard token endpoint.
+ * Uses the Authorization Code + PKCE grant — no client secret required.
+ */
+export declare function exchangeCodeForTokens(opts: {
+    code: string;
+    redirectUri: string;
+    clientId: string;
+    verifier: string;
+    tokenEndpoint: string;
+}): Promise<CognitoTokens>;
+/**
+ * The login command calls loginFlowClient.X() so tests can replace properties with stubs.
+ */
+export declare const loginFlowClient: {
+    generatePkce: typeof generatePkce;
+    generateNonce: typeof generateNonce;
+    generateState: typeof generateState;
+    findAvailablePort: typeof findAvailablePort;
+    openBrowser: typeof openBrowser;
+    listenForCallback: (port: number, expectedState?: string) => Promise<string>;
+    exchangeCodeForTokens: typeof exchangeCodeForTokens;
+};

package/lib/services/auth/loginFlow.js

@@ -0,0 +1,216 @@
+/*
+ * Copyright (c) 2024 Provar Limited.
+ * All rights reserved.
+ * Licensed under the BSD 3-Clause license.
+ * For full license text, see LICENSE.md file in the repo root or https://opensource.org/licenses/BSD-3-Clause
+ */
+/* eslint-disable camelcase */
+import crypto from 'node:crypto';
+import http from 'node:http';
+import https from 'node:https';
+import { spawn } from 'node:child_process';
+import { URL } from 'node:url';
+// All three ports must be pre-registered in both the Cognito App Client and the Salesforce External Client Application (SF ECA).
+// Both providers require redirect_uri to exactly match a registered callback URL — no wildcards.
+export const CALLBACK_PORTS = [1717, 7890, 8080];
+// ── PKCE ─────────────────────────────────────────────────────────────────────
+/**
+ * Generate a PKCE code_verifier / code_challenge pair (S256 method, as required by Cognito).
+ */
+export function generatePkce() {
+    const verifier = crypto.randomBytes(32).toString('base64url');
+    const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge };
+}
+/**
+ * Generate a random nonce for OIDC replay-attack prevention.
+ * Required by the OpenID Connect spec when requesting an id_token.
+ */
+export function generateNonce() {
+    return crypto.randomBytes(16).toString('base64url');
+}
+/**
+ * Generate a random state value for CSRF protection.
+ * Required by Cognito Managed Login even though it is optional per the OAuth 2.0 spec.
+ */
+export function generateState() {
+    return crypto.randomBytes(16).toString('base64url');
+}
+// ── Port selection ────────────────────────────────────────────────────────────
+/**
+ * Try each registered callback port in order; return the first that is free.
+ */
+export async function findAvailablePort() {
+    for (const port of CALLBACK_PORTS) {
+        // Sequential by design — we need the first free registered port, not all of them.
+        // eslint-disable-next-line no-await-in-loop
+        if (await isPortFree(port))
+            return port;
+    }
+    throw new Error('Could not bind to any registered callback port (1717, 7890, 8080). ' +
+        'Check that no other process is using these ports and try again.');
+}
+function isPortFree(port) {
+    return new Promise((resolve) => {
+        const probe = http.createServer();
+        probe.once('error', () => resolve(false));
+        probe.listen(port, '127.0.0.1', () => {
+            probe.close(() => resolve(true));
+        });
+    });
+}
+// ── Browser open ──────────────────────────────────────────────────────────────
+/**
+ * Return the platform-specific command and argument list for opening a URL
+ * in the system browser. The URL is passed as an argument — never interpolated
+ * into a shell string — to avoid command injection. Exported so tests can
+ * assert the correct command is chosen without actually spawning a process.
+ */
+export function getBrowserCommand(url, platform = process.platform) {
+    switch (platform) {
+        case 'darwin':
+            return { cmd: 'open', args: [url] };
+        case 'win32':
+            // Pass the URL via $args[0] so it is never interpolated into the -Command
+            // string — avoids quote-breaking and injection risk from special characters.
+            return { cmd: 'powershell.exe', args: ['-NoProfile', '-Command', 'Start-Process $args[0]', '-args', url] };
+        default:
+            return { cmd: 'xdg-open', args: [url] };
+    }
+}
+export function openBrowser(url) {
+    // detached:true + stdio:'ignore' + unref() is the standard Node.js pattern for
+    // fire-and-forget child processes — the event loop will not wait for them to exit.
+    const { cmd, args } = getBrowserCommand(url);
+    const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+    // Suppress unhandled-error crashes if the browser executable is not found.
+    // The login URL is already printed to the terminal so the user can open it manually.
+    child.on('error', () => {
+        /* intentional no-op */
+    });
+    child.unref();
+}
+// ── Localhost callback server ─────────────────────────────────────────────────
+/**
+ * Spin up a temporary localhost HTTP server that accepts exactly one callback
+ * from Cognito's Hosted UI, extracts the auth code, and shuts down.
+ */
+export function listenForCallback(port, expectedState) {
+    return new Promise((resolve, reject) => {
+        // Track open sockets so we can forcibly destroy them on shutdown.
+        // This is a Node 18.0/18.1 fallback for server.closeAllConnections(), which
+        // was added in Node 18.2. Without it a browser that ignores Connection:close
+        // could keep the event loop alive after server.close() returns.
+        const openSockets = new Set();
+        const closeServer = (srv) => {
+            srv.close();
+            if (typeof srv.closeAllConnections === 'function') {
+                srv.closeAllConnections();
+            }
+            else {
+                openSockets.forEach((s) => s.destroy());
+            }
+        };
+        const server = http.createServer((req, res) => {
+            const parsed = new URL(req.url ?? '/', `http://localhost:${port}`);
+            const code = parsed.searchParams.get('code');
+            const error = parsed.searchParams.get('error');
+            const description = parsed.searchParams.get('error_description');
+            const callbackState = parsed.searchParams.get('state');
+            if (expectedState && callbackState !== expectedState) {
+                res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
+                res.end('<html><body style="font-family:sans-serif;padding:2rem;max-width:480px">' +
+                    '<h2 style="color:#c23934">Authentication failed</h2>' +
+                    '<p>Invalid state parameter — possible CSRF attack. Please try again.</p>' +
+                    '</body></html>');
+                closeServer(server);
+                reject(new Error('OAuth callback state mismatch — possible CSRF. Try again.'));
+                return;
+            }
+            // 'Connection: close' tells the browser to close the TCP connection after
+            // this response so server.close() has no lingering keep-alive sockets to
+            // wait for, allowing the Node.js event loop to exit promptly.
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
+            res.end('<html><body style="font-family:sans-serif;padding:2rem;max-width:480px">' +
+                '<h2 style="color:#0070d2">Authentication complete</h2>' +
+                '<p>You can close this tab and return to the terminal.</p>' +
+                '</body></html>');
+            closeServer(server);
+            if (code) {
+                resolve(code);
+            }
+            else {
+                reject(new Error(description ?? error ?? 'No authorisation code received from identity provider'));
+            }
+        });
+        server.on('connection', (socket) => {
+            openSockets.add(socket);
+            socket.once('close', () => openSockets.delete(socket));
+        });
+        server.listen(port, '127.0.0.1');
+        server.on('error', (err) => reject(err));
+    });
+}
+/**
+ * Exchange a PKCE auth code for Cognito tokens via the standard token endpoint.
+ * Uses the Authorization Code + PKCE grant — no client secret required.
+ */
+export async function exchangeCodeForTokens(opts) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: opts.code,
+        redirect_uri: opts.redirectUri,
+        client_id: opts.clientId,
+        code_verifier: opts.verifier,
+    }).toString();
+    const { status, responseBody } = await httpsPost(opts.tokenEndpoint, body, {
+        'Content-Type': 'application/x-www-form-urlencoded',
+    });
+    if (status !== 200) {
+        throw new Error(`Token exchange failed (${status}): ${responseBody}`);
+    }
+    return JSON.parse(responseBody);
+}
+// ── Internal HTTPS helper ─────────────────────────────────────────────────────
+const REQUEST_TIMEOUT_MS = 30000;
+function httpsPost(url, body, headers) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const req = https.request({
+            hostname: parsed.hostname,
+            port: parsed.port || undefined,
+            path: parsed.pathname + parsed.search,
+            method: 'POST',
+            headers: {
+                ...headers,
+                'Content-Length': Buffer.byteLength(body).toString(),
+            },
+        }, (res) => {
+            let data = '';
+            res.on('data', (chunk) => {
+                data += chunk.toString('utf-8');
+            });
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, responseBody: data }));
+        });
+        req.setTimeout(REQUEST_TIMEOUT_MS, () => {
+            req.destroy(new Error(`Token exchange timed out after ${REQUEST_TIMEOUT_MS / 1000}s`));
+        });
+        req.on('error', reject);
+        req.write(body);
+        req.end();
+    });
+}
+// ── Indirection object (sinon-stubbable) ──────────────────────────────────────
+/**
+ * The login command calls loginFlowClient.X() so tests can replace properties with stubs.
+ */
+export const loginFlowClient = {
+    generatePkce,
+    generateNonce,
+    generateState,
+    findAvailablePort,
+    openBrowser,
+    listenForCallback: listenForCallback,
+    exchangeCodeForTokens,
+};
+//# sourceMappingURL=loginFlow.js.map

package/lib/services/auth/loginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../../src/services/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8BAA8B;AAC9B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,iIAAiI;AACjI,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEjD,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,kFAAkF;QAClF,4CAA4C;QAC5C,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,qEAAqE;QACnE,iEAAiE,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACnC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,WAA4B,OAAO,CAAC,QAAQ;IAE5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,OAAO;YACV,0EAA0E;YAC1E,6EAA6E;YAC7E,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7G;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,+EAA+E;IAC/E,mFAAmF;IACnF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAiB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,2EAA2E;IAC3E,qFAAqF;IACrF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,uBAAuB;IACzB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,aAAsB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,kEAAkE;QAClE,4EAA4E;QAC5E,6EAA6E;QAC7E,gEAAgE;QAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,GAAgB,EAAQ,EAAE;YAC7C,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,OAAO,GAAG,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;gBAClD,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAEvD,IAAI,aAAa,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;gBACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxF,GAAG,CAAC,GAAG,CACL,0EAA0E;oBACxE,sDAAsD;oBACtD,0EAA0E;oBAC1E,gBAAgB,CACnB,CAAC;gBACF,WAAW,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,yEAAyE;YACzE,8DAA8D;YAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACxF,GAAG,CAAC,GAAG,CACL,0EAA0E;gBACxE,wDAAwD;gBACxD,2DAA2D;gBAC3D,gBAAgB,CACnB,CAAC;YACF,WAAW,CAAC,MAAM,CAAC,CAAC;YAEpB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,IAAI,uDAAuD,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAkB,EAAE,EAAE;YAC7C,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAM3C;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,aAAa,EAAE,IAAI,CAAC,QAAQ;KAC7B,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE;QACzE,cAAc,EAAE,mCAAmC;KACpD,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,MAAM,YAAY,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAkB,CAAC;AACnD,CAAC;AAED,iFAAiF;AAEjF,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAElC,SAAS,SAAS,CAChB,GAAW,EACX,IAAY,EACZ,OAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACvB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YAC9B,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;aACrD;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC,CACF,CAAC;QACF,GAAG,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,EAAE;YACtC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,kCAAkC,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY;IACZ,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,iBAAiB,EAAE,iBAA8E;IACjG,qBAAqB;CACtB,CAAC"}