@provos/ironcurtain 0.8.0 → 0.9.1

package/dist/auth/oauth-token-provider.js

@@ -0,0 +1,159 @@
+/**
+ * Runtime OAuth token provider with transparent refresh.
+ *
+ * Provides valid access tokens for a specific OAuth provider, handling
+ * token expiry detection and refresh with deduplication. Follows the
+ * re-read-before-refresh pattern from OAuthTokenManager to coordinate
+ * with other processes that may refresh concurrently.
+ */
+import { existsSync } from 'node:fs';
+import { getOAuthTokenPath } from '../config/paths.js';
+import { fetchWithTimeout, safeResponseJson } from './oauth-flow.js';
+import { loadOAuthToken, saveOAuthToken, isTokenExpired } from './oauth-token-store.js';
+// ---------------------------------------------------------------------------
+// Error
+// ---------------------------------------------------------------------------
+export class OAuthTokenExpiredError extends Error {
+    providerId;
+    constructor(providerId, message, options) {
+        super(message ??
+            `OAuth token for "${providerId}" has expired and could not be refreshed. Run 'ironcurtain auth ${providerId}' to re-authorize.`, options);
+        this.providerId = providerId;
+        this.name = 'OAuthTokenExpiredError';
+    }
+}
+/**
+ * Exchanges a refresh token for a new access token.
+ * Returns the updated StoredOAuthToken, preserving the original refresh token
+ * if the provider does not issue a new one.
+ */
+async function refreshAccessToken(provider, clientCredentials, currentToken) {
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: clientCredentials.clientId,
+        client_secret: clientCredentials.clientSecret,
+        refresh_token: currentToken.refreshToken,
+    });
+    const REFRESH_TIMEOUT_MS = 30_000;
+    let response;
+    try {
+        response = await fetchWithTimeout(provider.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        }, REFRESH_TIMEOUT_MS);
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            throw new OAuthTokenExpiredError(provider.id, `Token refresh timed out for "${provider.id}". Run 'ironcurtain auth ${provider.id}' to re-authorize.`, { cause: err });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const text = await response.text();
+        throw new OAuthTokenExpiredError(provider.id, `Token refresh failed for "${provider.id}" (${response.status}): ${text}. Run 'ironcurtain auth ${provider.id}' to re-authorize.`);
+    }
+    let data;
+    try {
+        data = (await safeResponseJson(response));
+    }
+    catch (err) {
+        throw new OAuthTokenExpiredError(provider.id, `Token refresh returned non-JSON response for "${provider.id}". Run 'ironcurtain auth ${provider.id}' to re-authorize.`, { cause: err });
+    }
+    if (!data.access_token) {
+        throw new OAuthTokenExpiredError(provider.id, `Token refresh response missing access_token for "${provider.id}". Run 'ironcurtain auth ${provider.id}' to re-authorize.`);
+    }
+    if (!data.expires_in || data.expires_in <= 0) {
+        throw new OAuthTokenExpiredError(provider.id, `Token refresh response missing expires_in for "${provider.id}". Run 'ironcurtain auth ${provider.id}' to re-authorize.`);
+    }
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token ?? currentToken.refreshToken,
+        expiresAt,
+        scopes: data.scope ? data.scope.split(' ') : [...currentToken.scopes],
+    };
+}
+// ---------------------------------------------------------------------------
+// OAuthTokenProvider
+// ---------------------------------------------------------------------------
+/**
+ * Provides valid access tokens for a specific OAuth provider at runtime.
+ * Handles transparent refresh with deduplication (single in-flight refresh).
+ */
+export class OAuthTokenProvider {
+    provider;
+    clientCredentials;
+    inflightRefresh = null;
+    constructor(provider, clientCredentials) {
+        this.provider = provider;
+        this.clientCredentials = clientCredentials;
+    }
+    /**
+     * Returns a valid access token, refreshing if near expiry.
+     * Uses the re-read-before-refresh pattern: checks if another process
+     * already refreshed the token before attempting our own refresh.
+     */
+    async getValidAccessToken() {
+        const token = loadOAuthToken(this.provider.id);
+        if (!token) {
+            throw new OAuthTokenExpiredError(this.provider.id, `No stored token for "${this.provider.id}". Run 'ironcurtain auth ${this.provider.id}' to authorize.`);
+        }
+        if (!isTokenExpired(token)) {
+            return token.accessToken;
+        }
+        return this.doRefresh();
+    }
+    /**
+     * Forces a token refresh regardless of current expiry.
+     * Used by the TokenFileRefresher which has a more aggressive threshold
+     * (10 min) than the normal getValidAccessToken (5 min).
+     */
+    async forceRefresh() {
+        return this.doRefresh(true);
+    }
+    /** Returns true if a token file exists for this provider. */
+    isAuthorized() {
+        return existsSync(getOAuthTokenPath(this.provider.id));
+    }
+    /** Returns the scopes granted during the last authorization flow. */
+    getGrantedScopes() {
+        const token = loadOAuthToken(this.provider.id);
+        return token?.scopes ?? [];
+    }
+    /**
+     * Core refresh with deduplication. Concurrent callers share a single
+     * in-flight refresh promise.
+     */
+    doRefresh(force = false) {
+        if (this.inflightRefresh) {
+            return this.inflightRefresh;
+        }
+        this.inflightRefresh = this.executeRefresh(force).finally(() => {
+            this.inflightRefresh = null;
+        });
+        return this.inflightRefresh;
+    }
+    /**
+     * Re-read-before-refresh pattern: another process may have already
+     * refreshed the token since our initial check.
+     *
+     * When force=true, skips the early return so the token is always
+     * refreshed via the provider's token endpoint.
+     */
+    async executeRefresh(force = false) {
+        // Re-read from disk -- another process may have refreshed already
+        const reread = loadOAuthToken(this.provider.id);
+        if (!force && reread && !isTokenExpired(reread)) {
+            return reread.accessToken;
+        }
+        // The re-read returned an expired token (or null if the file was deleted)
+        if (!reread) {
+            throw new OAuthTokenExpiredError(this.provider.id);
+        }
+        const refreshed = await refreshAccessToken(this.provider, this.clientCredentials, reread);
+        saveOAuthToken(this.provider.id, refreshed);
+        return refreshed.accessToken;
+    }
+}
+//# sourceMappingURL=oauth-token-provider.js.map

package/dist/auth/oauth-token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-token-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExF,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IADlB,YACkB,UAAkB,EAClC,OAAgB,EAChB,OAAsB;QAEtB,KAAK,CACH,OAAO;YACL,oBAAoB,UAAU,mEAAmE,UAAU,oBAAoB,EACjI,OAAO,CACR,CAAC;QARc,eAAU,GAAV,UAAU,CAAQ;QASlC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAaD;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAC/B,QAA6B,EAC7B,iBAAyC,EACzC,YAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,iBAAiB,CAAC,QAAQ;QACrC,aAAa,EAAE,iBAAiB,CAAC,YAAY;QAC7C,aAAa,EAAE,YAAY,CAAC,YAAY;KACzC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC;IAClC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAC/B,QAAQ,CAAC,QAAQ,EACjB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,EACD,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,sBAAsB,CAC9B,QAAQ,CAAC,EAAE,EACX,gCAAgC,QAAQ,CAAC,EAAE,4BAA4B,QAAQ,CAAC,EAAE,oBAAoB,EACtG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAC9B,QAAQ,CAAC,EAAE,EACX,6BAA6B,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,MAAM,MAAM,IAAI,2BAA2B,QAAQ,CAAC,EAAE,oBAAoB,CAClI,CAAC;IACJ,CAAC;IAED,IAAI,IAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAyB,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAC9B,QAAQ,CAAC,EAAE,EACX,iDAAiD,QAAQ,CAAC,EAAE,4BAA4B,QAAQ,CAAC,EAAE,oBAAoB,EACvH,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,sBAAsB,CAC9B,QAAQ,CAAC,EAAE,EACX,oDAAoD,QAAQ,CAAC,EAAE,4BAA4B,QAAQ,CAAC,EAAE,oBAAoB,CAC3H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,sBAAsB,CAC9B,QAAQ,CAAC,EAAE,EACX,kDAAkD,QAAQ,CAAC,EAAE,4BAA4B,QAAQ,CAAC,EAAE,oBAAoB,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IAEtD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,YAAY;QAC7D,SAAS;QACT,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACZ,QAAQ,CAAsB;IAC9B,iBAAiB,CAAyB;IACnD,eAAe,GAA2B,IAAI,CAAC;IAEvD,YAAY,QAA6B,EAAE,iBAAyC;QAClF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB;QACvB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,sBAAsB,CAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAChB,wBAAwB,IAAI,CAAC,QAAQ,CAAC,EAAE,4BAA4B,IAAI,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CACtG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,6DAA6D;IAC7D,YAAY;QACV,OAAO,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,qEAAqE;IACrE,gBAAgB;QACd,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,KAAK,GAAG,KAAK;QAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,cAAc,CAAC,KAAK,GAAG,KAAK;QACxC,kEAAkE;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC1F,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,SAAS,CAAC,WAAW,CAAC;IAC/B,CAAC;CACF"}

package/dist/auth/oauth-token-store.d.ts

@@ -0,0 +1,30 @@
+/**
+ * OAuth token persistence for third-party providers.
+ *
+ * Stores tokens as JSON files in ~/.ironcurtain/oauth/{providerId}.json
+ * with owner-only (0o600) permissions, following the same pattern as
+ * saveOAuthCredentials in src/docker/oauth-credentials.ts.
+ */
+import type { StoredOAuthToken } from './oauth-provider.js';
+/**
+ * Loads a stored OAuth token for a provider.
+ * Returns null if no token file exists.
+ * Throws if the file exists but contains invalid JSON or is missing required fields.
+ */
+export declare function loadOAuthToken(providerId: string): StoredOAuthToken | null;
+/**
+ * Saves an OAuth token for a provider.
+ * Creates the oauth directory if it does not exist.
+ * Sets file permissions to 0o600 (owner-only read/write).
+ */
+export declare function saveOAuthToken(providerId: string, token: StoredOAuthToken): void;
+/**
+ * Deletes a stored OAuth token for a provider.
+ * No-op if the file does not exist.
+ */
+export declare function deleteOAuthToken(providerId: string): void;
+/**
+ * Checks whether a stored token is expired or near expiry.
+ * Returns true if fewer than 5 minutes of validity remain.
+ */
+export declare function isTokenExpired(token: StoredOAuthToken): boolean;

package/dist/auth/oauth-token-store.js

@@ -0,0 +1,93 @@
+/**
+ * OAuth token persistence for third-party providers.
+ *
+ * Stores tokens as JSON files in ~/.ironcurtain/oauth/{providerId}.json
+ * with owner-only (0o600) permissions, following the same pattern as
+ * saveOAuthCredentials in src/docker/oauth-credentials.ts.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { getOAuthDir, getOAuthTokenPath } from '../config/paths.js';
+/** 5-minute buffer before expiry, matching OAuthTokenManager convention. */
+const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
+/**
+ * Loads a stored OAuth token for a provider.
+ * Returns null if no token file exists.
+ * Throws if the file exists but contains invalid JSON or is missing required fields.
+ */
+export function loadOAuthToken(providerId) {
+    const tokenPath = getOAuthTokenPath(providerId);
+    if (!existsSync(tokenPath)) {
+        return null;
+    }
+    const raw = readFileSync(tokenPath, 'utf-8');
+    const parsed = parseTokenJson(raw, tokenPath);
+    return validateTokenShape(parsed, tokenPath);
+}
+/**
+ * Saves an OAuth token for a provider.
+ * Creates the oauth directory if it does not exist.
+ * Sets file permissions to 0o600 (owner-only read/write).
+ */
+export function saveOAuthToken(providerId, token) {
+    const dir = getOAuthDir();
+    mkdirSync(dir, { recursive: true });
+    const tokenPath = getOAuthTokenPath(providerId);
+    writeFileSync(tokenPath, JSON.stringify(token, null, 2) + '\n', { mode: 0o600 });
+    // chmod after write -- writeFileSync's mode only applies when creating new files;
+    // existing files with broader permissions need an explicit chmod.
+    chmodSync(tokenPath, 0o600);
+}
+/**
+ * Deletes a stored OAuth token for a provider.
+ * No-op if the file does not exist.
+ */
+export function deleteOAuthToken(providerId) {
+    const tokenPath = getOAuthTokenPath(providerId);
+    if (existsSync(tokenPath)) {
+        unlinkSync(tokenPath);
+    }
+}
+/**
+ * Checks whether a stored token is expired or near expiry.
+ * Returns true if fewer than 5 minutes of validity remain.
+ */
+export function isTokenExpired(token) {
+    return Date.now() + TOKEN_EXPIRY_BUFFER_MS >= token.expiresAt;
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function parseTokenJson(raw, filePath) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON in ${filePath}: ${message}`, { cause: err });
+    }
+}
+function validateTokenShape(parsed, filePath) {
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`Invalid token format in ${filePath}: expected a JSON object`);
+    }
+    const obj = parsed;
+    if (typeof obj.accessToken !== 'string' || obj.accessToken.length === 0) {
+        throw new Error(`Missing or empty accessToken in ${filePath}`);
+    }
+    if (typeof obj.refreshToken !== 'string' || obj.refreshToken.length === 0) {
+        throw new Error(`Missing or empty refreshToken in ${filePath}`);
+    }
+    if (typeof obj.expiresAt !== 'number' || !Number.isFinite(obj.expiresAt)) {
+        throw new Error(`Missing or invalid expiresAt in ${filePath}`);
+    }
+    if (!Array.isArray(obj.scopes) || !obj.scopes.every((s) => typeof s === 'string')) {
+        throw new Error(`Missing or invalid scopes in ${filePath}`);
+    }
+    return {
+        accessToken: obj.accessToken,
+        refreshToken: obj.refreshToken,
+        expiresAt: obj.expiresAt,
+        scopes: obj.scopes,
+    };
+}
+//# sourceMappingURL=oauth-token-store.js.map

package/dist/auth/oauth-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-store.js","sourceRoot":"","sources":["../../src/auth/oauth-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGpE,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9C,OAAO,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAuB;IACxE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAChD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,kFAAkF;IAClF,kEAAkE;IAClE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,IAAI,KAAK,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,cAAc,CAAC,GAAW,EAAE,QAAgB;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,KAAK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe,EAAE,QAAgB;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,0BAA0B,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC"}

package/dist/auth/providers/google-scopes.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Google OAuth scope definitions and interactive scope picker.
+ *
+ * Provides a registry of Google Workspace scopes grouped by service,
+ * a `groupMultiselect` picker for interactive authorization, and a
+ * short-name resolver for the `--scopes` CLI flag.
+ */
+export interface GoogleScopeEntry {
+    /** Short name used in --scopes flag (e.g. "gmail.send") */
+    readonly shortName: string;
+    /** Full OAuth scope URL */
+    readonly fullScope: string;
+    /** Human-readable label for the picker */
+    readonly label: string;
+    /** Display group name (e.g. "Gmail") */
+    readonly group: string;
+    /** Access level hint shown in the picker (e.g. "read-only") */
+    readonly access: string;
+    /** Whether this scope is selected by default */
+    readonly isDefault: boolean;
+}
+export declare const GOOGLE_SCOPES: readonly GoogleScopeEntry[];
+/**
+ * Shows a grouped multi-select checkbox UI for Google OAuth scopes.
+ *
+ * Pre-selects `existingScopes` if non-empty, otherwise falls back to defaults.
+ * Returns the selected full scope URLs, or the cancel symbol if the user aborts.
+ */
+export declare function promptGoogleScopes(existingScopes: readonly string[]): Promise<readonly string[] | symbol>;
+/**
+ * Maps short scope names (e.g. "gmail.send") to full OAuth URLs.
+ * Passes through values that are already full URLs unchanged.
+ * Throws on unrecognized short names.
+ */
+export declare function resolveGoogleShortScopes(shortNames: readonly string[]): readonly string[];

package/dist/auth/providers/google-scopes.js

@@ -0,0 +1,183 @@
+/**
+ * Google OAuth scope definitions and interactive scope picker.
+ *
+ * Provides a registry of Google Workspace scopes grouped by service,
+ * a `groupMultiselect` picker for interactive authorization, and a
+ * short-name resolver for the `--scopes` CLI flag.
+ */
+import { groupMultiselect, isCancel } from '@clack/prompts';
+const SCOPE_BASE = 'https://www.googleapis.com/auth';
+export const GOOGLE_SCOPES = [
+    // Gmail
+    {
+        shortName: 'gmail.readonly',
+        fullScope: `${SCOPE_BASE}/gmail.readonly`,
+        label: 'Gmail (read)',
+        group: 'Gmail',
+        access: 'read-only',
+        isDefault: true,
+    },
+    {
+        shortName: 'gmail.send',
+        fullScope: `${SCOPE_BASE}/gmail.send`,
+        label: 'Gmail (send)',
+        group: 'Gmail',
+        access: 'write -- send emails',
+        isDefault: false,
+    },
+    {
+        shortName: 'gmail.modify',
+        fullScope: `${SCOPE_BASE}/gmail.modify`,
+        label: 'Gmail (modify)',
+        group: 'Gmail',
+        access: 'write -- read, send, delete, manage labels',
+        isDefault: false,
+    },
+    {
+        shortName: 'gmail.compose',
+        fullScope: `${SCOPE_BASE}/gmail.compose`,
+        label: 'Gmail (compose)',
+        group: 'Gmail',
+        access: 'write -- create & modify drafts',
+        isDefault: false,
+    },
+    {
+        shortName: 'gmail.labels',
+        fullScope: `${SCOPE_BASE}/gmail.labels`,
+        label: 'Gmail (labels)',
+        group: 'Gmail',
+        access: 'write -- create, update & delete labels',
+        isDefault: false,
+    },
+    // Calendar
+    {
+        shortName: 'calendar.readonly',
+        fullScope: `${SCOPE_BASE}/calendar.readonly`,
+        label: 'Calendar (read)',
+        group: 'Google Calendar',
+        access: 'read-only',
+        isDefault: true,
+    },
+    {
+        shortName: 'calendar.events',
+        fullScope: `${SCOPE_BASE}/calendar.events`,
+        label: 'Calendar (events)',
+        group: 'Google Calendar',
+        access: 'write -- create & modify events',
+        isDefault: false,
+    },
+    // Drive
+    {
+        shortName: 'drive.readonly',
+        fullScope: `${SCOPE_BASE}/drive.readonly`,
+        label: 'Drive (read)',
+        group: 'Google Drive',
+        access: 'read-only',
+        isDefault: true,
+    },
+    {
+        shortName: 'drive.file',
+        fullScope: `${SCOPE_BASE}/drive.file`,
+        label: 'Drive (per-file)',
+        group: 'Google Drive',
+        access: 'write -- files created or opened by the app',
+        isDefault: false,
+    },
+    // Docs
+    {
+        shortName: 'documents',
+        fullScope: `${SCOPE_BASE}/documents`,
+        label: 'Docs (read/write)',
+        group: 'Google Docs',
+        access: 'write -- read & edit documents',
+        isDefault: false,
+    },
+    // Sheets
+    {
+        shortName: 'spreadsheets',
+        fullScope: `${SCOPE_BASE}/spreadsheets`,
+        label: 'Sheets (read/write)',
+        group: 'Google Sheets',
+        access: 'write -- read & edit spreadsheets',
+        isDefault: false,
+    },
+    // Slides
+    {
+        shortName: 'presentations',
+        fullScope: `${SCOPE_BASE}/presentations`,
+        label: 'Slides (read/write)',
+        group: 'Google Slides',
+        access: 'write -- read & edit presentations',
+        isDefault: false,
+    },
+];
+// ---------------------------------------------------------------------------
+// Lookup indices (built once)
+// ---------------------------------------------------------------------------
+const shortNameToScope = new Map(GOOGLE_SCOPES.map((s) => [s.shortName, s.fullScope]));
+const fullScopeToEntry = new Map(GOOGLE_SCOPES.map((s) => [s.fullScope, s]));
+// ---------------------------------------------------------------------------
+// Interactive scope picker
+// ---------------------------------------------------------------------------
+/**
+ * Shows a grouped multi-select checkbox UI for Google OAuth scopes.
+ *
+ * Pre-selects `existingScopes` if non-empty, otherwise falls back to defaults.
+ * Returns the selected full scope URLs, or the cancel symbol if the user aborts.
+ */
+export async function promptGoogleScopes(existingScopes) {
+    const initialValues = existingScopes.length > 0
+        ? existingScopes.filter((s) => fullScopeToEntry.has(s))
+        : GOOGLE_SCOPES.filter((s) => s.isDefault).map((s) => s.fullScope);
+    const groups = buildGroupOptions();
+    const result = await groupMultiselect({
+        message: 'Select Google Workspace scopes to authorize:',
+        options: groups,
+        initialValues,
+    });
+    if (isCancel(result)) {
+        return result;
+    }
+    return result;
+}
+/**
+ * Builds the `Record<string, Option[]>` structure expected by `groupMultiselect`.
+ */
+function buildGroupOptions() {
+    const groups = new Map();
+    for (const entry of GOOGLE_SCOPES) {
+        let group = groups.get(entry.group);
+        if (!group) {
+            group = [];
+            groups.set(entry.group, group);
+        }
+        group.push({
+            value: entry.fullScope,
+            label: entry.label,
+            hint: entry.access,
+        });
+    }
+    return Object.fromEntries(groups);
+}
+// ---------------------------------------------------------------------------
+// Short-name resolver (for --scopes flag)
+// ---------------------------------------------------------------------------
+/**
+ * Maps short scope names (e.g. "gmail.send") to full OAuth URLs.
+ * Passes through values that are already full URLs unchanged.
+ * Throws on unrecognized short names.
+ */
+export function resolveGoogleShortScopes(shortNames) {
+    return shortNames.map((name) => {
+        if (name.startsWith('https://')) {
+            return name;
+        }
+        const full = shortNameToScope.get(name);
+        if (!full) {
+            const known = GOOGLE_SCOPES.map((s) => s.shortName).join(', ');
+            throw new Error(`Unknown Google scope "${name}". Known scopes: ${known}`);
+        }
+        return full;
+    });
+}
+//# sourceMappingURL=google-scopes.js.map

package/dist/auth/providers/google-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-scopes.js","sourceRoot":"","sources":["../../../src/auth/providers/google-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAqB5D,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD,MAAM,CAAC,MAAM,aAAa,GAAgC;IACxD,QAAQ;IACR;QACE,SAAS,EAAE,gBAAgB;QAC3B,SAAS,EAAE,GAAG,UAAU,iBAAiB;QACzC,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;KAChB;IACD;QACE,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,GAAG,UAAU,aAAa;QACrC,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,sBAAsB;QAC9B,SAAS,EAAE,KAAK;KACjB;IACD;QACE,SAAS,EAAE,cAAc;QACzB,SAAS,EAAE,GAAG,UAAU,eAAe;QACvC,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,4CAA4C;QACpD,SAAS,EAAE,KAAK;KACjB;IACD;QACE,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE,GAAG,UAAU,gBAAgB;QACxC,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,iCAAiC;QACzC,SAAS,EAAE,KAAK;KACjB;IACD;QACE,SAAS,EAAE,cAAc;QACzB,SAAS,EAAE,GAAG,UAAU,eAAe;QACvC,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,yCAAyC;QACjD,SAAS,EAAE,KAAK;KACjB;IAED,WAAW;IACX;QACE,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,GAAG,UAAU,oBAAoB;QAC5C,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;KAChB;IACD;QACE,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,GAAG,UAAU,kBAAkB;QAC1C,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,iCAAiC;QACzC,SAAS,EAAE,KAAK;KACjB;IAED,QAAQ;IACR;QACE,SAAS,EAAE,gBAAgB;QAC3B,SAAS,EAAE,GAAG,UAAU,iBAAiB;QACzC,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,IAAI;KAChB;IACD;QACE,SAAS,EAAE,YAAY;QACvB,SAAS,EAAE,GAAG,UAAU,aAAa;QACrC,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,6CAA6C;QACrD,SAAS,EAAE,KAAK;KACjB;IAED,OAAO;IACP;QACE,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,GAAG,UAAU,YAAY;QACpC,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,gCAAgC;QACxC,SAAS,EAAE,KAAK;KACjB;IAED,SAAS;IACT;QACE,SAAS,EAAE,cAAc;QACzB,SAAS,EAAE,GAAG,UAAU,eAAe;QACvC,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,mCAAmC;QAC3C,SAAS,EAAE,KAAK;KACjB;IAED,SAAS;IACT;QACE,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE,GAAG,UAAU,gBAAgB;QACxC,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,oCAAoC;QAC5C,SAAS,EAAE,KAAK;KACjB;CACF,CAAC;AAEF,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAiB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEvG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAA2B,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvG,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,cAAiC;IACxE,MAAM,aAAa,GACjB,cAAc,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAS;QAC5C,OAAO,EAAE,8CAA8C;QACvD,OAAO,EAAE,MAAM;QACf,aAAa;KACd,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4D,CAAC;IAEnF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,KAAK,CAAC,SAAS;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAA6B;IACpE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,oBAAoB,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/providers/google.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthProviderConfig } from '../oauth-provider.js';
+export declare const googleOAuthProvider: OAuthProviderConfig;

package/dist/auth/providers/google.js

@@ -0,0 +1,28 @@
+import { promptGoogleScopes, resolveGoogleShortScopes } from './google-scopes.js';
+export const googleOAuthProvider = {
+    id: 'google',
+    displayName: 'Google Workspace',
+    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+    defaultScopes: [
+        'https://www.googleapis.com/auth/gmail.readonly',
+        'https://www.googleapis.com/auth/calendar.readonly',
+        'https://www.googleapis.com/auth/drive.readonly',
+    ],
+    callbackPath: '/callback',
+    usePkce: true,
+    serverNames: ['google-workspace'],
+    tokenEnvVar: 'GOOGLE_ACCESS_TOKEN',
+    refreshTokenEnvVar: 'GOOGLE_REFRESH_TOKEN',
+    clientIdEnvVar: 'GOOGLE_CLIENT_ID',
+    clientSecretEnvVar: 'GOOGLE_CLIENT_SECRET',
+    credentialsFilename: 'google-credentials.json',
+    revocationUrl: 'https://oauth2.googleapis.com/revoke',
+    extraAuthParams: { access_type: 'offline', prompt: 'consent', include_granted_scopes: 'true' },
+    scopePicker: promptGoogleScopes,
+    resolveShortScopes: resolveGoogleShortScopes,
+    nonDefaultScopeWarning: 'Make sure these scopes are enabled in your Google Cloud\n' +
+        "project's OAuth consent screen before proceeding.\n" +
+        'See: APIs & Services > OAuth consent screen > Scopes',
+};
+//# sourceMappingURL=google.js.map

package/dist/auth/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/auth/providers/google.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,CAAC,MAAM,mBAAmB,GAAwB;IACtD,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,kBAAkB;IAC/B,gBAAgB,EAAE,8CAA8C;IAChE,QAAQ,EAAE,qCAAqC;IAC/C,aAAa,EAAE;QACb,gDAAgD;QAChD,mDAAmD;QACnD,gDAAgD;KACjD;IACD,YAAY,EAAE,WAAW;IACzB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,CAAC,kBAAkB,CAAC;IACjC,WAAW,EAAE,qBAAqB;IAClC,kBAAkB,EAAE,sBAAsB;IAC1C,cAAc,EAAE,kBAAkB;IAClC,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,yBAAyB;IAC9C,aAAa,EAAE,sCAAsC;IACrD,eAAe,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE;IAC9F,WAAW,EAAE,kBAAkB;IAC/B,kBAAkB,EAAE,wBAAwB;IAC5C,sBAAsB,EACpB,2DAA2D;QAC3D,qDAAqD;QACrD,sDAAsD;CACzD,CAAC"}

package/dist/cli.js

@@ -23,6 +23,7 @@ const topLevelSpec = {
         { name: 'escalation-listener', description: 'Aggregate escalation notifications from PTY sessions' },
         { name: 'bot', description: "Alias for 'daemon' (backward compatible)" },
         { name: 'persona', description: 'Manage personas (named policy profiles)' },
+        { name: 'auth', description: 'Manage OAuth providers (import credentials, authorize, revoke)' },
         { name: 'setup', description: 'Run the first-start wizard (always runs)' },
         { name: 'setup-signal', description: 'Interactive Signal transport onboarding' },
         { name: 'annotate-tools', description: 'Classify MCP tool arguments via LLM' },
@@ -112,6 +113,11 @@ switch (subcommand) {
         await personaMain(process.argv.slice(3));
         break;
     }
+    case 'auth': {
+        const { runAuthCommand } = await import('./auth/auth-command.js');
+        await runAuthCommand(process.argv.slice(3));
+        break;
+    }
     case 'setup': {
         const { runFirstStart } = await import('./config/first-start.js');
         await runFirstStart();

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAC9E,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,aAAa,EAAoB,MAAM,eAAe,CAAC;AAExF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,UAAU;IACjB,oFAAoF;IACpF,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAwB,CAAC;IACtF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,YAAY,GAAgB;IAChC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,CAAC,iCAAiC,CAAC;IAC1C,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACnF,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;QAC/D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACzF,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,sDAAsD,EAAE;QACpG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0CAA0C,EAAE;QACxE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAC3E,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,gEAAgE,EAAE;QAC/F,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;QAC1E,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE;QAChF,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAC9E,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,oDAAoD,EAAE;QAC7F,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAChG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACnE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE;KACxD;IACD,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;QACnE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE;KACpE;IACD,QAAQ,EAAE;QACR,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,6EAA6E;QAC7E,sEAAsE;QACtE,2DAA2D;QAC3D,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;KACzE;CACF,CAAC;AAEF,MAAM,eAAe,GAAgB;IACnC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,yCAAyC;IACtD,KAAK,EAAE,CAAC,oCAAoC,CAAC;IAC7C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;CACjF,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;KACzC;IACD,gBAAgB,EAAE,IAAI;IACtB,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC,+EAA+E;AAC/E,wEAAwE;AACxE,gDAAgD;AAChD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;IACzC,aAAa,CAAC,YAAY,CAAC,CAAC;IAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,QAAQ,UAAU,EAAE,CAAC;IACnB,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,eAAe,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACvE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,EAAE,CAAC;QACzB,MAAM;IACR,CAAC;IACD,KAAK,SAAS,CAAC,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM;IACR,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,CAAC;QACZ,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAClE,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM;IACR,CAAC;IACD,KAAK,OAAO,CAAC,CAAC,CAAC;QACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM;IACR,CAAC;IACD,KAAK,QAAQ,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC5D,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAA2B,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,kDAAkD;YAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;IACR,CAAC;IACD,KAAK,KAAK,CAAC,CAAC,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM;IACR,CAAC;IACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,MAAM,YAAY,EAAE,CAAC;QACrB,MAAM;IACR,CAAC;IACD,KAAK,cAAc,CAAC,CAAC,CAAC;QACpB,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;YAAE,MAAM;QAChH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAClC,MAAM;IACR,CAAC;IACD;QACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}