@puffle/cookiejar 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DevelopIQ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,129 @@
+# cookiejar
+
+**Local-only cookie bundles for coding agents.**
+
+You are already logged into GitHub, Linear, Notion, your admin panels. Your agent is not, and half of
+those things have no MCP server. cookiejar lets you pick the exact cookies you are willing to share,
+group them into a **bundle**, and hand that bundle to an agent with a revocable token — without the
+agent (or anyone else) getting a copy of your whole browser.
+
+```
+   browsers                cookiejar                     agents
+┌──────────────┐      ┌──────────────────┐        ┌────────────────────┐
+│ Chrome       │      │  ~/.cookiejar    │        │  Devin / Claude    │
+│ Safari       │─────▶│  bundles, tokens │◀──MCP──│  Codex / curl      │
+│ Firefox …    │ live │  (encrypted)     │  HTTP  │                    │
+└──────────────┘ read └──────────────────┘        └────────────────────┘
+             everything stays on 127.0.0.1
+```
+
+- **Local only.** No account, no cloud, no telemetry. The server binds to `127.0.0.1` and the only
+  outbound requests it ever makes are the ones an agent explicitly proxies.
+- **Password protected.** Bundle definitions live in `~/.cookiejar/vault.json`, encrypted with
+  scrypt + AES-256-GCM. Agent tokens only work while the jar is unlocked.
+- **Values are never stored.** A bundle records *which* cookies to use. The values are read live from
+  the browser on every access, so re-logging in the browser is all it takes to refresh an agent, and a
+  stolen vault file leaks nothing but bundle names.
+- **Per-bundle tokens.** Expiry, revocation, an access counter, and an append-only audit log. A token
+  can be marked *proxy only*, so the agent can make authenticated requests but never sees a cookie.
+
+## Install
+
+Requires Node 22.5+ (for the built-in SQLite reader).
+
+```bash
+npm install -g @puffle/cookiejar
+cookiejar ui --open
+```
+
+Or from source:
+
+```bash
+git clone https://github.com/DevelopIQ-ai/cookiejar
+cd cookiejar
+npm install && npm run build
+node dist/cli.js ui --open
+```
+
+Open http://127.0.0.1:4088, choose a master password, and pick your cookies.
+
+## Using a bundle from an agent
+
+Issue a token in **Bundles → Agent access**, then give the agent one of these.
+
+**MCP (Devin, Claude Code, Cursor, Codex …)**
+
+```json
+{
+  "mcpServers": {
+    "cookiejar-ticket-triage": {
+      "command": "npx",
+      "args": ["-y", "@puffle/cookiejar", "mcp"],
+      "env": { "COOKIEJAR_TOKEN": "cjr_…" }
+    }
+  }
+}
+```
+
+Tools: `describe_bundle`, `get_cookie_header`, `export_cookies`, `http_request`.
+
+**CLI**
+
+```bash
+export COOKIEJAR_TOKEN=cjr_…
+cookiejar export --format netscape --out cookies.txt   # curl -b cookies.txt …
+cookiejar export --format storage-state                # Playwright / Puppeteer
+cookiejar header --url-target https://linear.app/team  # a single Cookie header
+```
+
+**HTTP** (the daemon, `Authorization: Bearer cjr_…`)
+
+| Endpoint | Purpose |
+| --- | --- |
+| `GET /agent/bundle` | Name, hosts, permissions — no secrets |
+| `GET /agent/cookies?format=netscape\|storage-state\|json` | The jar |
+| `GET /agent/cookies?format=header&url=…` | One `Cookie` header |
+| `POST /agent/fetch` | Proxy a request with the bundle's cookies attached |
+
+`POST /agent/fetch` is the safest option: cookies never leave the machine, and the request is refused
+unless the target host is one the bundle actually holds cookies for.
+
+## Browser support
+
+| Browser | macOS | Linux | Notes |
+| --- | --- | --- | --- |
+| Chrome, Chromium, Brave, Edge, Arc | ✅ | ✅ | Key from the login Keychain / keyring |
+| Firefox | ✅ | ✅ | Plaintext store |
+| Safari | ✅ | — | Needs **Full Disk Access** for your terminal |
+| Windows Chromium | — | — | App-bound (`v20`) cookies are not supported yet |
+
+`cookiejar doctor` prints what can and cannot be read on this machine, and why.
+
+Browsers hold a lock on their cookie stores, so cookiejar reads from a temporary copy (including the
+WAL) and never writes to them.
+
+## Security model
+
+- The vault protects bundle *definitions*, not cookie values — values live in your browser only.
+- An agent token is worth exactly one bundle, only while the app is unlocked, and only until you hit
+  **Revoke** (or the jar auto-locks after 30 idle minutes).
+- Every access is appended to `~/.cookiejar/audit.log` with the bundle, token label, and what was
+  asked for. Values are never logged.
+- Prefer *proxy only* tokens and per-site bundles. Cookies are bearer credentials: anything you put in
+  a bundle, the agent can act as you with.
+- `Set-Cookie` responses from proxied requests are dropped, so an agent cannot rewrite your session.
+
+## Development
+
+```bash
+npm run dev            # daemon with tsx
+npm --prefix ui run dev   # Vite UI on :4089, proxying the daemon
+npm test               # node:test, includes an end-to-end daemon test
+npm run lint && npm run typecheck
+node scripts/seed-demo-profile.mjs /tmp/cookiejar-demo   # fake browser data for UI work
+```
+
+Layout: `src/core` (crypto, vault, browser readers, bundle resolution), `src/server` (local HTTP API),
+`src/mcp` (stdio MCP server), `ui` (React app), `test`.
+
+MIT licensed. Issues and PRs welcome.

package/dist/cli.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { startServer } from './server/index.js';
+import { runMcpServer } from './mcp/server.js';
+import { readAllProfiles } from './core/browsers/index.js';
+import { bareDomain } from './core/bundles.js';
+// node:sqlite is how we read cookie stores; its experimental banner is noise here.
+process.removeAllListeners('warning');
+process.on('warning', (warning) => {
+    if (warning.name !== 'ExperimentalWarning')
+        console.warn(`${warning.name}: ${warning.message}`);
+});
+const DEFAULT_PORT = Number(process.env.COOKIEJAR_PORT ?? 4088);
+const DEFAULT_URL = process.env.COOKIEJAR_URL ?? `http://127.0.0.1:${DEFAULT_PORT}`;
+function parseArgs(argv) {
+    const flags = new Map();
+    const [command = 'ui', ...rest] = argv;
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (!arg.startsWith('--'))
+            continue;
+        const [name, inline] = arg.slice(2).split('=', 2);
+        if (inline !== undefined)
+            flags.set(name, inline);
+        else if (rest[i + 1] && !rest[i + 1].startsWith('--'))
+            flags.set(name, rest[++i]);
+        else
+            flags.set(name, true);
+    }
+    return { command, flags };
+}
+const flagString = (args, name, fallback) => {
+    const value = args.flags.get(name);
+    return typeof value === 'string' ? value : fallback;
+};
+function openBrowser(url) {
+    const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'explorer' : 'xdg-open';
+    execFile(opener, [url], () => {
+        // Opening a browser is a convenience; the URL is printed regardless.
+    });
+}
+function uiDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    for (const candidate of [path.join(here, 'ui'), path.join(here, '..', 'ui', 'dist'), path.join(here, '..', 'dist', 'ui')]) {
+        if (fs.existsSync(path.join(candidate, 'index.html')))
+            return candidate;
+    }
+    return path.join(here, 'ui');
+}
+function requireToken(args) {
+    const token = flagString(args, 'token') ?? process.env.COOKIEJAR_TOKEN;
+    if (!token) {
+        console.error('A bundle token is required. Pass --token or set COOKIEJAR_TOKEN.');
+        process.exit(2);
+    }
+    return token;
+}
+async function agentGet(args, path) {
+    const base = flagString(args, 'url', DEFAULT_URL);
+    const response = await fetch(new URL(path, base), { headers: { authorization: `Bearer ${requireToken(args)}` } });
+    const text = await response.text();
+    if (!response.ok) {
+        console.error(text);
+        process.exit(1);
+    }
+    return text;
+}
+const HELP = `cookiejar — local-only cookie bundles for coding agents
+
+Usage:
+  cookiejar ui [--port ${DEFAULT_PORT}] [--open] [--auto-lock <minutes>]
+      Start the local app (127.0.0.1 only) to manage cookies and bundles.
+
+  cookiejar mcp [--token <token>] [--url ${DEFAULT_URL}]
+      Speak MCP over stdio so an agent can use one bundle. Token via
+      --token or COOKIEJAR_TOKEN.
+
+  cookiejar export [--format netscape|storage-state|json] [--out <file>]
+      Write a bundle's cookies to a jar file.
+
+  cookiejar header --url-target <url>
+      Print the Cookie header for a URL covered by the bundle.
+
+  cookiejar doctor
+      Show which browser profiles cookiejar can read on this machine.
+`;
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    switch (args.command) {
+        case 'ui': {
+            const port = Number(flagString(args, 'port', String(DEFAULT_PORT)));
+            const autoLock = Number(flagString(args, 'auto-lock', '30'));
+            const { url } = await startServer({ port, uiDir: uiDir(), autoLockMinutes: autoLock });
+            console.log(`cookiejar is running at ${url}`);
+            console.log(`vault: ${process.env.COOKIEJAR_HOME ?? '~/.cookiejar'}  ·  auto-lock: ${autoLock || 'off'}`);
+            if (args.flags.get('open'))
+                openBrowser(url);
+            return;
+        }
+        case 'mcp': {
+            runMcpServer({ daemonUrl: flagString(args, 'url', DEFAULT_URL), token: requireToken(args) });
+            return;
+        }
+        case 'export': {
+            const format = flagString(args, 'format', 'netscape');
+            const body = await agentGet(args, `/agent/cookies?format=${encodeURIComponent(format)}`);
+            const out = flagString(args, 'out');
+            if (out) {
+                fs.writeFileSync(out, body, { mode: 0o600 });
+                console.log(`wrote ${out}`);
+            }
+            else {
+                process.stdout.write(body);
+            }
+            return;
+        }
+        case 'header': {
+            const target = flagString(args, 'url-target');
+            if (!target) {
+                console.error('--url-target <url> is required');
+                process.exit(2);
+            }
+            const body = await agentGet(args, `/agent/cookies?format=header&url=${encodeURIComponent(target)}`);
+            console.log(JSON.parse(body).cookie);
+            return;
+        }
+        case 'doctor': {
+            const reads = readAllProfiles();
+            if (reads.length === 0)
+                console.log('No browser profiles found.');
+            for (const read of reads) {
+                const sites = new Set(read.cookies.map((c) => bareDomain(c.domain))).size;
+                console.log(read.error
+                    ? `✗ ${read.profile.label} (${read.profile.id})\n    ${read.error}`
+                    : `✓ ${read.profile.label} (${read.profile.id}) — ${read.cookies.length} cookies across ${sites} sites`);
+            }
+            return;
+        }
+        default:
+            console.log(HELP);
+            process.exit(args.command === 'help' || args.command === '--help' ? 0 : 2);
+    }
+}
+void main().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,mFAAmF;AACnF,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACtC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;IAChC,IAAI,OAAO,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAClG,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,oBAAoB,YAAY,EAAE,CAAC;AAOpF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aAC7C,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;;YAC7E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAU,EAAE,IAAY,EAAE,QAAiB,EAAsB,EAAE;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC,CAAC;AAEF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/G,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE;QAC3B,qEAAqE;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK;IACZ,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1H,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,IAAU;IAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG;;;yBAGY,YAAY;;;2CAGM,WAAW;;;;;;;;;;;;CAYrD,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvF,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,cAAc,mBAAmB,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;YAC1G,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,YAAY,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAE,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAE,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,yBAAyB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,GAAG,EAAE,CAAC;gBACR,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,oCAAoC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC,MAAM,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAClE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1E,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,KAAK;oBACR,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACnE,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,mBAAmB,KAAK,QAAQ,CAC1G,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD;YACE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACnC,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/core/access.js

@@ -0,0 +1,39 @@
+import { audit } from './audit.js';
+import { tokenMatches } from './crypto.js';
+export class AccessDeniedError extends Error {
+}
+/**
+ * Resolves a bearer token to the bundle it unlocks. Requires the vault to be
+ * unlocked: agent tokens are useless while the jar is closed.
+ */
+export function authorize(vault, token) {
+    if (!token)
+        throw new AccessDeniedError('missing bundle token');
+    if (!vault.unlocked)
+        throw new AccessDeniedError('cookiejar is locked; unlock it in the app first');
+    const now = Date.now() / 1000;
+    for (const bundle of vault.read().bundles) {
+        for (const grant of bundle.grants) {
+            if (!tokenMatches(token, grant.tokenHash))
+                continue;
+            if (grant.revokedAt)
+                throw new AccessDeniedError('this token was revoked');
+            if (grant.expiresAt && grant.expiresAt < now)
+                throw new AccessDeniedError('this token has expired');
+            return { bundle, grant };
+        }
+    }
+    throw new AccessDeniedError('unknown bundle token');
+}
+export function noteUse(vault, grantee, event, detail) {
+    vault.write((data) => {
+        const bundle = data.bundles.find((b) => b.id === grantee.bundle.id);
+        const grant = bundle?.grants.find((g) => g.tokenHash === grantee.grant.tokenHash);
+        if (!grant)
+            return;
+        grant.lastUsedAt = new Date().toISOString();
+        grant.useCount += 1;
+    });
+    audit({ event, bundleId: grantee.bundle.id, grantLabel: grantee.grant.label, detail });
+}
+//# sourceMappingURL=access.js.map

package/dist/core/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/core/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAO/C;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAY,EAAE,KAAyB;IAC/D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,iDAAiD,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpD,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;gBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACpG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAY,EAAE,OAAgB,EAAE,KAAqC,EAAE,MAAe;IAC5G,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/core/audit.js

@@ -0,0 +1,26 @@
+import fs from 'node:fs';
+import { auditPath, ensureConfigDir } from './paths.js';
+/** Append-only local log of every access. Cookie values are never recorded. */
+export function audit(entry) {
+    ensureConfigDir();
+    fs.appendFileSync(auditPath(), `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, { mode: 0o600 });
+}
+export function readAudit(limit = 200) {
+    if (!fs.existsSync(auditPath()))
+        return [];
+    return fs
+        .readFileSync(auditPath(), 'utf8')
+        .split('\n')
+        .filter(Boolean)
+        .slice(-limit)
+        .reverse()
+        .flatMap((line) => {
+        try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/core/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/core/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGxD,+EAA+E;AAC/E,MAAM,UAAU,KAAK,CAAC,KAA6B;IACjD,eAAe,EAAE,CAAC;IAClB,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAK,GAAG,GAAG;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,EAAE;SACN,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC;SACjC,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,KAAK,CAAC,CAAC,KAAK,CAAC;SACb,OAAO,EAAE;SACT,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/core/browsers/chromium.js

@@ -0,0 +1,241 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { webkitToUnix, withCookieDb } from './sqlite.js';
+const FLAVOURS = [
+    {
+        browser: 'chrome',
+        label: 'Chrome',
+        dirs: { darwin: 'Library/Application Support/Google/Chrome', linux: '.config/google-chrome' },
+        keychainService: 'Chrome Safe Storage',
+        linuxKeyringApp: 'chrome',
+    },
+    {
+        browser: 'chrome-beta',
+        label: 'Chrome Beta',
+        dirs: { darwin: 'Library/Application Support/Google/Chrome Beta', linux: '.config/google-chrome-beta' },
+        keychainService: 'Chrome Safe Storage',
+        linuxKeyringApp: 'chrome',
+    },
+    {
+        browser: 'chromium',
+        label: 'Chromium',
+        dirs: { darwin: 'Library/Application Support/Chromium', linux: '.config/chromium' },
+        keychainService: 'Chromium Safe Storage',
+        linuxKeyringApp: 'chromium',
+    },
+    {
+        browser: 'brave',
+        label: 'Brave',
+        dirs: {
+            darwin: 'Library/Application Support/BraveSoftware/Brave-Browser',
+            linux: '.config/BraveSoftware/Brave-Browser',
+        },
+        keychainService: 'Brave Safe Storage',
+        linuxKeyringApp: 'brave',
+    },
+    {
+        browser: 'edge',
+        label: 'Edge',
+        dirs: { darwin: 'Library/Application Support/Microsoft Edge', linux: '.config/microsoft-edge' },
+        keychainService: 'Microsoft Edge Safe Storage',
+        linuxKeyringApp: 'chromium',
+    },
+    {
+        browser: 'arc',
+        label: 'Arc',
+        dirs: { darwin: 'Library/Application Support/Arc/User Data' },
+        keychainService: 'Arc Safe Storage',
+        linuxKeyringApp: 'chromium',
+    },
+];
+function userDataDir(flavour) {
+    const rel = process.platform === 'darwin' ? flavour.dirs.darwin : flavour.dirs.linux;
+    if (!rel)
+        return null;
+    const dir = path.join(os.homedir(), rel);
+    return fs.existsSync(dir) ? dir : null;
+}
+function profileNames(userDir) {
+    const names = new Map();
+    try {
+        const state = JSON.parse(fs.readFileSync(path.join(userDir, 'Local State'), 'utf8'));
+        for (const [dir, info] of Object.entries(state.profile?.info_cache ?? {})) {
+            if (info.name)
+                names.set(dir, info.name);
+        }
+    }
+    catch {
+        // A missing or half-written Local State just costs us pretty profile names.
+    }
+    return names;
+}
+export function discoverChromiumProfiles() {
+    const profiles = [];
+    for (const flavour of FLAVOURS) {
+        const userDir = userDataDir(flavour);
+        if (!userDir)
+            continue;
+        const pretty = profileNames(userDir);
+        for (const entry of fs.readdirSync(userDir, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const cookies = [
+                path.join(userDir, entry.name, 'Cookies'),
+                path.join(userDir, entry.name, 'Network', 'Cookies'),
+            ].find((p) => fs.existsSync(p));
+            if (!cookies)
+                continue;
+            profiles.push({
+                browser: flavour.browser,
+                id: `${flavour.browser}:${entry.name}`,
+                label: `${flavour.label} — ${pretty.get(entry.name) ?? entry.name}`,
+                path: cookies,
+            });
+        }
+    }
+    return profiles;
+}
+function keychainPassword(service) {
+    try {
+        return execFileSync('security', ['find-generic-password', '-w', '-s', service], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function linuxKeyringPassword(app) {
+    for (const args of [
+        ['lookup', 'application', app],
+        ['lookup', 'application', 'chrome'],
+    ]) {
+        try {
+            const out = execFileSync('secret-tool', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+            if (out)
+                return out.trim();
+        }
+        catch {
+            // secret-tool missing or the entry is absent; fall through to "peanuts".
+        }
+    }
+    return null;
+}
+/** Chromium derives its AES key from a password with fixed, published parameters. */
+function legacyKey(password, iterations) {
+    return crypto.pbkdf2Sync(password, 'saltysalt', iterations, 16, 'sha1');
+}
+function keyringFor(flavour) {
+    if (process.platform === 'darwin') {
+        const password = keychainPassword(flavour.keychainService);
+        return { cbcKeys: password ? [legacyKey(password, 1003)] : [], gcmKey: null };
+    }
+    const keys = [legacyKey('peanuts', 1)];
+    const fromKeyring = linuxKeyringPassword(flavour.linuxKeyringApp);
+    if (fromKeyring)
+        keys.unshift(legacyKey(fromKeyring, 1));
+    return { cbcKeys: keys, gcmKey: null };
+}
+export class UnavailableKeyError extends Error {
+}
+/**
+ * Recent Chrome versions bind a cookie to its host by prefixing the plaintext
+ * with sha256(host_key), so strip that prefix when it is really there.
+ */
+function stripDomainPrefix(plaintext, host) {
+    if (plaintext.length <= 32)
+        return plaintext;
+    const prefix = plaintext.subarray(0, 32);
+    for (const candidate of host ? [host, host.replace(/^\./, '')] : []) {
+        if (crypto.createHash('sha256').update(candidate).digest().equals(prefix))
+            return plaintext.subarray(32);
+    }
+    // Unknown hash: fall back to "a value would not contain control bytes".
+    return prefix.some((byte) => byte < 0x20) ? plaintext.subarray(32) : plaintext;
+}
+function decryptCbc(blob, key, host) {
+    const iv = Buffer.alloc(16, 0x20);
+    const decipher = crypto.createDecipheriv('aes-128-cbc', key, iv);
+    const out = Buffer.concat([decipher.update(blob), decipher.final()]);
+    return stripDomainPrefix(out, host).toString('utf8');
+}
+function decryptGcm(blob, key, host) {
+    const nonce = blob.subarray(0, 12);
+    const tag = blob.subarray(blob.length - 16);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+    decipher.setAuthTag(tag);
+    const out = Buffer.concat([decipher.update(blob.subarray(12, blob.length - 16)), decipher.final()]);
+    return stripDomainPrefix(out, host).toString('utf8');
+}
+export function decryptChromiumValue(encrypted, plain, keyring, host) {
+    if (plain)
+        return plain;
+    if (encrypted.length === 0)
+        return '';
+    const version = encrypted.subarray(0, 3).toString('latin1');
+    const body = encrypted.subarray(3);
+    if (version === 'v20') {
+        // App-bound encryption (Windows only); the key lives behind an elevation service.
+        throw new UnavailableKeyError('app-bound encrypted cookie (v20) is not supported');
+    }
+    if (version === 'v10' || version === 'v11') {
+        if (keyring.gcmKey)
+            return decryptGcm(body, keyring.gcmKey, host);
+        let lastError;
+        for (const key of keyring.cbcKeys) {
+            try {
+                return decryptCbc(body, key, host);
+            }
+            catch (error) {
+                lastError = error;
+            }
+        }
+        if (keyring.cbcKeys.length === 0)
+            throw new UnavailableKeyError('no decryption key available for this browser');
+        throw lastError instanceof Error ? lastError : new Error('failed to decrypt cookie');
+    }
+    return encrypted.toString('utf8');
+}
+const sameSiteFromChromium = (value) => value === 0 ? 'None' : value === 1 ? 'Lax' : value === 2 ? 'Strict' : 'Unspecified';
+export function readChromiumCookies(profile) {
+    const flavour = FLAVOURS.find((f) => f.browser === profile.browser);
+    if (!flavour)
+        throw new Error(`unknown chromium flavour: ${profile.browser}`);
+    const keyring = keyringFor(flavour);
+    return withCookieDb(profile.path, (db) => {
+        const statement = db.prepare(`SELECT host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite
+       FROM cookies ORDER BY host_key, name`);
+        // Chromium expiry timestamps overflow a JS number, so read integers as BigInt.
+        statement.setReadBigInts(true);
+        const rows = statement.all();
+        const cookies = [];
+        for (const row of rows) {
+            const encrypted = row.encrypted_value instanceof Uint8Array ? Buffer.from(row.encrypted_value) : Buffer.alloc(0);
+            let value;
+            try {
+                value = decryptChromiumValue(encrypted, String(row.value ?? ''), keyring, String(row.host_key ?? ''));
+            }
+            catch {
+                continue; // Skip cookies we cannot read rather than failing the whole profile.
+            }
+            cookies.push({
+                name: String(row.name),
+                value,
+                domain: String(row.host_key),
+                path: String(row.path ?? '/'),
+                expires: webkitToUnix(row.expires_utc),
+                secure: Boolean(row.is_secure),
+                httpOnly: Boolean(row.is_httponly),
+                sameSite: sameSiteFromChromium(Number(row.samesite ?? -1)),
+                profileId: profile.id,
+                browser: profile.browser,
+            });
+        }
+        return cookies;
+    });
+}
+//# sourceMappingURL=chromium.js.map

package/dist/core/browsers/chromium.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chromium.js","sourceRoot":"","sources":["../../../src/core/browsers/chromium.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAczD,MAAM,QAAQ,GAAsB;IAClC;QACE,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE,KAAK,EAAE,uBAAuB,EAAE;QAC7F,eAAe,EAAE,qBAAqB;QACtC,eAAe,EAAE,QAAQ;KAC1B;IACD;QACE,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,EAAE,MAAM,EAAE,gDAAgD,EAAE,KAAK,EAAE,4BAA4B,EAAE;QACvG,eAAe,EAAE,qBAAqB;QACtC,eAAe,EAAE,QAAQ;KAC1B;IACD;QACE,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,KAAK,EAAE,kBAAkB,EAAE;QACnF,eAAe,EAAE,uBAAuB;QACxC,eAAe,EAAE,UAAU;KAC5B;IACD;QACE,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,OAAO;QACd,IAAI,EAAE;YACJ,MAAM,EAAE,yDAAyD;YACjE,KAAK,EAAE,qCAAqC;SAC7C;QACD,eAAe,EAAE,oBAAoB;QACrC,eAAe,EAAE,OAAO;KACzB;IACD;QACE,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE,KAAK,EAAE,wBAAwB,EAAE;QAC/F,eAAe,EAAE,6BAA6B;QAC9C,eAAe,EAAE,UAAU;KAC5B;IACD;QACE,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;QAC7D,eAAe,EAAE,kBAAkB;QACnC,eAAe,EAAE,UAAU;KAC5B;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,OAAwB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IACrF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAElF,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,OAAO,GAAG;gBACd,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;aACrD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;gBACtC,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE;gBACnE,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAC9E,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,KAAK,MAAM,IAAI,IAAI;QACjB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC;QAC9B,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;KACpC,EAAE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzG,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,QAAgB,EAAE,UAAkB;IACrD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AASD,SAAS,UAAU,CAAC,OAAwB;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClE,IAAI,WAAW;QAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAAiB,EAAE,IAAwB;IACpE,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpE,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,wEAAwE;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,IAAwB;IACrE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,IAAwB;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpG,OAAO,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,KAAa,EAAE,OAAgB,EAAE,IAAa;IACpG,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,kFAAkF;QAClF,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;QAChH,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,KAAa,EAA6B,EAAE,CACxE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;AAEtF,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpC,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAC1B;4CACsC,CACvC,CAAC;QACF,+EAA+E;QAC/E,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAoC,CAAC;QAE/D,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjH,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YACxG,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,qEAAqE;YACjF,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBACtB,KAAK;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC5B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC;gBAC7B,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,WAAqB,CAAC;gBAChD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;gBAClC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1D,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}