@rockhopper-co/mcp-server 0.6.0 → 0.8.0

package/dist/auth/device-grant-client.d.ts

@@ -0,0 +1,80 @@
+/**
+ * ENG-1444 / KI-081 — RFC 8628 device-grant client.
+ *
+ * Talks to the backend's `POST /auth/device/{code,token}` endpoints
+ * (introduced in ENG-1384 PR 1, `Rockhopper-Co/backend#473`). Used by
+ * the mcp-server CLI when no PAT env var is set and no OAuth bundle
+ * is stored in the OS keychain.
+ *
+ * Surfaces a single entrypoint, `runDeviceGrantFlow`, that:
+ *
+ *   1. Calls `/auth/device/code` to get a (deviceCode, userCode) pair.
+ *   2. Emits the user-facing `userCode` + verification URI to stderr
+ *      (LLM clients pick this up via stdout's stderr passthrough).
+ *   3. Polls `/auth/device/token` at the server-specified interval,
+ *      respecting RFC 8628 § 3.5 `slow_down` (bumps interval +5s) and
+ *      `authorization_pending` (continues polling).
+ *   4. Resolves with the access-token bundle on success, rejects on
+ *      `access_denied` / `expired_token` / network failure.
+ *
+ * No external HTTP dependency — uses globalThis.fetch (Node 18+).
+ * `fetchImpl` + `sleep` + `onUserCode` are injectable for tests.
+ */
+export interface DeviceCodeResponse {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+}
+export interface DeviceTokenSuccess {
+    accessToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    refreshToken?: string;
+}
+export interface DeviceGrantFlowOptions {
+    baseUrl: string;
+    clientId: string;
+    /** Override for tests. Defaults to globalThis.fetch. */
+    fetchImpl?: typeof fetch;
+    /** Override for tests. Defaults to setTimeout-based sleep. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Called once with the user code + verification URI. Defaults to stderr. */
+    onUserCode?: (info: {
+        userCode: string;
+        verificationUri: string;
+        verificationUriComplete: string;
+    }) => void;
+}
+export declare class DeviceGrantError extends Error {
+    readonly code: 'access_denied' | 'expired_token' | 'network_error' | 'unknown';
+    constructor(code: 'access_denied' | 'expired_token' | 'network_error' | 'unknown', message: string);
+}
+/**
+ * Issue a fresh device code + user code pair.
+ */
+export declare function requestDeviceCode(opts: Pick<DeviceGrantFlowOptions, 'baseUrl' | 'clientId' | 'fetchImpl'>): Promise<DeviceCodeResponse>;
+/**
+ * Internal: one polling round-trip. Returns the token bundle on
+ * success, or a sentinel describing why the server isn't ready yet.
+ */
+export declare function pollOnce(opts: Pick<DeviceGrantFlowOptions, 'baseUrl' | 'clientId' | 'fetchImpl'>, deviceCode: string): Promise<{
+    kind: 'success';
+    bundle: DeviceTokenSuccess;
+} | {
+    kind: 'pending';
+} | {
+    kind: 'slow_down';
+}>;
+/**
+ * Full flow — request code, print to stderr, poll until success or
+ * fatal error. Returns the access-token bundle on success.
+ *
+ * `interval` (seconds, server-supplied) becomes the poll cadence.
+ * `slow_down` responses bump the interval by RFC's recommended +5s.
+ * Total wall time is bounded by the server-supplied `expiresIn`.
+ */
+export declare function runDeviceGrantFlow(opts: DeviceGrantFlowOptions): Promise<DeviceTokenSuccess>;
+//# sourceMappingURL=device-grant-client.d.ts.map

package/dist/auth/device-grant-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-grant-client.d.ts","sourceRoot":"","sources":["../../src/auth/device-grant-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,uBAAuB,EAAE,MAAM,CAAC;KACjC,KAAK,IAAI,CAAC;CACZ;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,IAAI,EAChB,eAAe,GACf,eAAe,GACf,eAAe,GACf,SAAS;gBAJG,IAAI,EAChB,eAAe,GACf,eAAe,GACf,eAAe,GACf,SAAS,EACb,OAAO,EAAE,MAAM;CAKlB;AAkBD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC,GACvE,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC,EACxE,UAAU,EAAE,MAAM,GACjB,OAAO,CACN;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CACxB,CAwDA;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgC7B"}

package/dist/auth/device-grant-client.js

@@ -0,0 +1,140 @@
+/**
+ * ENG-1444 / KI-081 — RFC 8628 device-grant client.
+ *
+ * Talks to the backend's `POST /auth/device/{code,token}` endpoints
+ * (introduced in ENG-1384 PR 1, `Rockhopper-Co/backend#473`). Used by
+ * the mcp-server CLI when no PAT env var is set and no OAuth bundle
+ * is stored in the OS keychain.
+ *
+ * Surfaces a single entrypoint, `runDeviceGrantFlow`, that:
+ *
+ *   1. Calls `/auth/device/code` to get a (deviceCode, userCode) pair.
+ *   2. Emits the user-facing `userCode` + verification URI to stderr
+ *      (LLM clients pick this up via stdout's stderr passthrough).
+ *   3. Polls `/auth/device/token` at the server-specified interval,
+ *      respecting RFC 8628 § 3.5 `slow_down` (bumps interval +5s) and
+ *      `authorization_pending` (continues polling).
+ *   4. Resolves with the access-token bundle on success, rejects on
+ *      `access_denied` / `expired_token` / network failure.
+ *
+ * No external HTTP dependency — uses globalThis.fetch (Node 18+).
+ * `fetchImpl` + `sleep` + `onUserCode` are injectable for tests.
+ */
+export class DeviceGrantError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'DeviceGrantError';
+    }
+}
+/* v8 ignore next 2 -- trivial setTimeout wrapper; tests inject a sleep stub via `opts.sleep` */
+const DEFAULT_SLEEP = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const DEFAULT_ON_USER_CODE = (info) => {
+    process.stderr.write('\nRockhopper — sign in to authorize this MCP client.\n' +
+        `Open: ${info.verificationUriComplete}\n` +
+        `(or visit ${info.verificationUri} and enter code: ${info.userCode})\n\n`);
+};
+/**
+ * Issue a fresh device code + user code pair.
+ */
+export async function requestDeviceCode(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await fetchImpl(`${opts.baseUrl}/auth/device/code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ clientId: opts.clientId }),
+        });
+    }
+    catch (e) {
+        throw new DeviceGrantError('network_error', `Failed to reach ${opts.baseUrl}/auth/device/code: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!res.ok) {
+        throw new DeviceGrantError('unknown', `Device-code request failed with HTTP ${res.status}`);
+    }
+    return (await res.json());
+}
+/**
+ * Internal: one polling round-trip. Returns the token bundle on
+ * success, or a sentinel describing why the server isn't ready yet.
+ */
+export async function pollOnce(opts, deviceCode) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await fetchImpl(`${opts.baseUrl}/auth/device/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ deviceCode, clientId: opts.clientId }),
+        });
+    }
+    catch (e) {
+        throw new DeviceGrantError('network_error', `Failed to reach ${opts.baseUrl}/auth/device/token: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (res.ok) {
+        return {
+            kind: 'success',
+            bundle: (await res.json()),
+        };
+    }
+    // RFC 8628 error mapping. Body shape is `{ error, error_description }`
+    // per the backend (Rockhopper's exception filter unwraps it — see
+    // memory `project_backend_badrequest_unwraps_payload`).
+    let body = {};
+    try {
+        // TS 6.0 types `Response.json()` as `Promise<unknown>`; the body shape is
+        // validated structurally by the `switch (body.error)` below.
+        body = (await res.json());
+    }
+    catch {
+        // Non-JSON error body — fall through to 'unknown'.
+    }
+    switch (body.error) {
+        case 'authorization_pending':
+            return { kind: 'pending' };
+        case 'slow_down':
+            return { kind: 'slow_down' };
+        case 'access_denied':
+            throw new DeviceGrantError('access_denied', body.error_description ?? 'Device code denied.');
+        case 'expired_token':
+            throw new DeviceGrantError('expired_token', body.error_description ?? 'Device code expired before approval.');
+        default:
+            throw new DeviceGrantError('unknown', `Unexpected device-grant error (HTTP ${res.status}): ${body.error ?? 'no error code'}`);
+    }
+}
+/**
+ * Full flow — request code, print to stderr, poll until success or
+ * fatal error. Returns the access-token bundle on success.
+ *
+ * `interval` (seconds, server-supplied) becomes the poll cadence.
+ * `slow_down` responses bump the interval by RFC's recommended +5s.
+ * Total wall time is bounded by the server-supplied `expiresIn`.
+ */
+export async function runDeviceGrantFlow(opts) {
+    const sleep = opts.sleep ?? DEFAULT_SLEEP;
+    const onUserCode = opts.onUserCode ?? DEFAULT_ON_USER_CODE;
+    const code = await requestDeviceCode(opts);
+    onUserCode({
+        userCode: code.userCode,
+        verificationUri: code.verificationUri,
+        verificationUriComplete: code.verificationUriComplete,
+    });
+    let intervalMs = code.interval * 1000;
+    const deadline = Date.now() + code.expiresIn * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        const result = await pollOnce(opts, code.deviceCode);
+        if (result.kind === 'success') {
+            return result.bundle;
+        }
+        if (result.kind === 'slow_down') {
+            // RFC 8628 § 3.5 — increase interval by 5s and retry.
+            intervalMs += 5_000;
+        }
+        // 'pending' just continues at the current interval.
+    }
+    throw new DeviceGrantError('expired_token', `Device code expired (waited ${code.expiresIn}s without approval).`);
+}
+//# sourceMappingURL=device-grant-client.js.map

package/dist/auth/device-grant-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-grant-client.js","sourceRoot":"","sources":["../../src/auth/device-grant-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAiCH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEvB;IADlB,YACkB,IAIH,EACb,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,SAAI,GAAJ,IAAI,CAIP;QAIb,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,EAAE,CACnC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1D,MAAM,oBAAoB,GAAG,CAAC,IAI7B,EAAE,EAAE;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wDAAwD;QACtD,SAAS,IAAI,CAAC,uBAAuB,IAAI;QACzC,aAAa,IAAI,CAAC,eAAe,oBAAoB,IAAI,CAAC,QAAQ,OAAO,CAC5E,CAAC;AACJ,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAwE;IAExE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,mBAAmB,IAAI,CAAC,OAAO,sBAAsB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,SAAS,EACT,wCAAwC,GAAG,CAAC,MAAM,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAwE,EACxE,UAAkB;IAMlB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,mBAAmB,IAAI,CAAC,OAAO,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB;SACjD,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,wDAAwD;IACxD,IAAI,IAAI,GAAmD,EAAE,CAAC;IAC9D,IAAI,CAAC;QACH,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/B,KAAK,eAAe;YAClB,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,IAAI,CAAC,iBAAiB,IAAI,qBAAqB,CAChD,CAAC;QACJ,KAAK,eAAe;YAClB,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,IAAI,CAAC,iBAAiB,IAAI,sCAAsC,CACjE,CAAC;QACJ;YACE,MAAM,IAAI,gBAAgB,CACxB,SAAS,EACT,uCAAuC,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CACvF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;KACtD,CAAC,CAAC;IAEH,IAAI,UAAU,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IAEpD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,sDAAsD;YACtD,UAAU,IAAI,KAAK,CAAC;QACtB,CAAC;QACD,oDAAoD;IACtD,CAAC;IAED,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,+BAA+B,IAAI,CAAC,SAAS,sBAAsB,CACpE,CAAC;AACJ,CAAC"}

package/dist/auth/resolve-auth.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ENG-1444 / KI-081 — auth resolution for the mcp-server CLI.
+ *
+ * Decides where the bearer token comes from on each launch, in order:
+ *
+ *   1. `ROCKHOPPER_TOKEN` env var — Personal Access Token. Headless /
+ *      CI / scripted scenarios. Same path as pre-OAuth releases.
+ *   2. Stored OAuth bundle in the OS keychain (token-store). The user
+ *      previously completed the device-grant flow; if the access
+ *      token is still valid, use it.
+ *   3. Device-grant flow — issues a fresh code, prints the user code
+ *      + verification URI to stderr, polls for approval, persists the
+ *      resulting bundle to the keychain for next time.
+ *
+ * Returns `{ accessToken, source }` where `source` is one of
+ * `'pat' | 'stored-oauth' | 'device-grant'` for logging / debugging.
+ *
+ * Heavy dependencies (token store, device-grant flow, env reads) are
+ * injectable for tests.
+ */
+import { runDeviceGrantFlow } from './device-grant-client.js';
+import { isExpired as defaultIsExpired, type OAuthTokenBundle } from './token-store.js';
+export type AuthSource = 'pat' | 'stored-oauth' | 'device-grant';
+export interface ResolvedAuth {
+    accessToken: string;
+    source: AuthSource;
+}
+export interface ResolveAuthOptions {
+    baseUrl: string;
+    /** Defaults to `'mcp-stdio'`. */
+    clientId?: string;
+    /** Typically `process.env.ROCKHOPPER_TOKEN`. */
+    patFromEnv?: string;
+    /** Override for tests. */
+    tokenStoreGet?: () => Promise<OAuthTokenBundle | null>;
+    /** Override for tests. */
+    tokenStoreSet?: (bundle: OAuthTokenBundle) => Promise<void>;
+    /** Override for tests. */
+    tokenStoreClear?: () => Promise<void>;
+    /** Override for tests. */
+    isExpiredFn?: typeof defaultIsExpired;
+    /** Override for tests. Defaults to `runDeviceGrantFlow`. */
+    deviceGrantFlow?: typeof runDeviceGrantFlow;
+    /** Optional stderr logger; defaults to `process.stderr.write` line-suffixed. */
+    log?: (msg: string) => void;
+}
+export declare class AuthResolutionError extends Error {
+    readonly code: 'pat_malformed' | 'device_grant_failed' | 'token_store_failure';
+    constructor(code: 'pat_malformed' | 'device_grant_failed' | 'token_store_failure', message: string);
+}
+export declare function resolveAuth(opts: ResolveAuthOptions): Promise<ResolvedAuth>;
+//# sourceMappingURL=resolve-auth.d.ts.map

package/dist/auth/resolve-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-auth.d.ts","sourceRoot":"","sources":["../../src/auth/resolve-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAEL,kBAAkB,EAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,SAAS,IAAI,gBAAgB,EAE7B,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,cAAc,GAAG,cAAc,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACvD,0BAA0B;IAC1B,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0BAA0B;IAC1B,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,0BAA0B;IAC1B,WAAW,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACtC,4DAA4D;IAC5D,eAAe,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC5C,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAChB,eAAe,GACf,qBAAqB,GACrB,qBAAqB;gBAHT,IAAI,EAChB,eAAe,GACf,qBAAqB,GACrB,qBAAqB,EACzB,OAAO,EAAE,MAAM;CAKlB;AAKD,wBAAsB,WAAW,CAC/B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,YAAY,CAAC,CAgFvB"}

package/dist/auth/resolve-auth.js

@@ -0,0 +1,100 @@
+/**
+ * ENG-1444 / KI-081 — auth resolution for the mcp-server CLI.
+ *
+ * Decides where the bearer token comes from on each launch, in order:
+ *
+ *   1. `ROCKHOPPER_TOKEN` env var — Personal Access Token. Headless /
+ *      CI / scripted scenarios. Same path as pre-OAuth releases.
+ *   2. Stored OAuth bundle in the OS keychain (token-store). The user
+ *      previously completed the device-grant flow; if the access
+ *      token is still valid, use it.
+ *   3. Device-grant flow — issues a fresh code, prints the user code
+ *      + verification URI to stderr, polls for approval, persists the
+ *      resulting bundle to the keychain for next time.
+ *
+ * Returns `{ accessToken, source }` where `source` is one of
+ * `'pat' | 'stored-oauth' | 'device-grant'` for logging / debugging.
+ *
+ * Heavy dependencies (token store, device-grant flow, env reads) are
+ * injectable for tests.
+ */
+import { DeviceGrantError, runDeviceGrantFlow, } from './device-grant-client.js';
+import { clearTokens as defaultClearTokens, getTokens as defaultGetTokens, isExpired as defaultIsExpired, setTokens as defaultSetTokens, } from './token-store.js';
+const PAT_PREFIX = 'rh_pat_';
+export class AuthResolutionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AuthResolutionError';
+    }
+}
+/* v8 ignore next -- trivial stderr wrapper; tests inject a log stub via `opts.log` */
+const DEFAULT_LOG = (msg) => process.stderr.write(`${msg}\n`);
+export async function resolveAuth(opts) {
+    const clientId = opts.clientId ?? 'mcp-stdio';
+    const log = opts.log ?? DEFAULT_LOG;
+    const tokenStoreGet = opts.tokenStoreGet ?? defaultGetTokens;
+    const tokenStoreSet = opts.tokenStoreSet ?? defaultSetTokens;
+    const tokenStoreClear = opts.tokenStoreClear ?? defaultClearTokens;
+    const isExpiredFn = opts.isExpiredFn ?? defaultIsExpired;
+    const deviceGrantFlow = opts.deviceGrantFlow ?? runDeviceGrantFlow;
+    // 1. PAT env var — takes precedence; matches pre-OAuth behavior.
+    if (opts.patFromEnv) {
+        if (!opts.patFromEnv.startsWith(PAT_PREFIX)) {
+            throw new AuthResolutionError('pat_malformed', `ROCKHOPPER_TOKEN does not look like a valid Personal Access Token. Tokens start with "${PAT_PREFIX}".`);
+        }
+        return { accessToken: opts.patFromEnv, source: 'pat' };
+    }
+    // 2. Stored OAuth bundle.
+    let stored = null;
+    try {
+        stored = await tokenStoreGet();
+    }
+    catch (e) {
+        // Keychain backend missing or locked. Don't abort yet — fall through
+        // to device-grant. If THAT fails too, surface a combined error.
+        log(`Could not read OS keychain (${e instanceof Error ? e.message : String(e)}). Falling back to device-grant flow.`);
+    }
+    if (stored && !isExpiredFn(stored)) {
+        return { accessToken: stored.accessToken, source: 'stored-oauth' };
+    }
+    if (stored) {
+        // Expired bundle — clear it and proceed.
+        try {
+            await tokenStoreClear();
+        }
+        catch {
+            // Non-fatal — overwrite on the upcoming setTokens.
+        }
+    }
+    // 3. Device-grant flow.
+    let bundle;
+    try {
+        bundle = await deviceGrantFlow({
+            baseUrl: opts.baseUrl,
+            clientId,
+        });
+    }
+    catch (e) {
+        if (e instanceof DeviceGrantError) {
+            throw new AuthResolutionError('device_grant_failed', `Device-grant flow failed (${e.code}): ${e.message}`);
+        }
+        throw new AuthResolutionError('device_grant_failed', `Device-grant flow failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // Persist for next launch. Storage failure is non-fatal — the
+    // current token still works, the user just re-runs the flow next
+    // time.
+    try {
+        await tokenStoreSet({
+            accessToken: bundle.accessToken,
+            refreshToken: bundle.refreshToken,
+            expiresAt: Date.now() + bundle.expiresIn * 1000,
+        });
+    }
+    catch (e) {
+        log(`Warning: could not persist OAuth token to OS keychain (${e instanceof Error ? e.message : String(e)}). You may need to re-authenticate on the next launch.`);
+    }
+    return { accessToken: bundle.accessToken, source: 'device-grant' };
+}
+//# sourceMappingURL=resolve-auth.js.map

package/dist/auth/resolve-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-auth.js","sourceRoot":"","sources":["../../src/auth/resolve-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAEnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,WAAW,IAAI,kBAAkB,EACjC,SAAS,IAAI,gBAAgB,EAC7B,SAAS,IAAI,gBAAgB,EAC7B,SAAS,IAAI,gBAAgB,GAE9B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,GAAG,SAAS,CAAC;AA6B7B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IADlB,YACkB,IAGS,EACzB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QANC,SAAI,GAAJ,IAAI,CAGK;QAIzB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC;IACpC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,gBAAgB,CAAC;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,gBAAgB,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;IACnE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAEnE,iEAAiE;IACjE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,yFAAyF,UAAU,IAAI,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,qEAAqE;QACrE,gEAAgE;QAChE,GAAG,CACD,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,uCAAuC,CACjH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAC3B,qBAAqB,EACrB,6BAA6B,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,qBAAqB,EACrB,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,iEAAiE;IACjE,QAAQ;IACR,IAAI,CAAC;QACH,MAAM,aAAa,CAAC;YAClB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CACD,0DAA0D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,wDAAwD,CAC7J,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACrE,CAAC"}

package/dist/auth/token-store.d.ts

@@ -0,0 +1,51 @@
+/**
+ * ENG-1444 / KI-081 — RFC 8628 device-grant token storage.
+ *
+ * Wraps `keytar` to persist OAuth tokens in the OS-native keychain
+ * (Keychain on macOS, Credential Manager on Windows, libsecret on
+ * Linux). The mcp-server is spawned by AI clients (Cursor, Claude
+ * Desktop) and survives across client launches, so tokens must live
+ * outside the process.
+ *
+ * One bundle per machine — there's no multi-user concept inside a
+ * single mcp-server install. If the user re-runs the device-grant
+ * flow, the prior bundle is overwritten.
+ *
+ * Linux without libsecret installed will throw on first keytar call
+ * (the native binding loads but the backend lookup fails). The CLI
+ * surfaces a clear remediation message ("apt-get install
+ * libsecret-tools" etc.) — we do NOT silently fall back to plaintext
+ * file storage. Encrypted file fallback may land in a follow-up.
+ */
+export interface OAuthTokenBundle {
+    accessToken: string;
+    /** Optional — backend does not currently issue refresh tokens (ENG-1446). */
+    refreshToken?: string;
+    /** Epoch milliseconds. Null means "no expiry set" — treat as expired. */
+    expiresAt: number | null;
+}
+/**
+ * Read the persisted OAuth bundle. Returns null if no bundle is stored
+ * OR if the stored value is malformed (corrupted entry — treat as
+ * "no tokens" and let the CLI initiate a fresh device flow).
+ */
+export declare function getTokens(): Promise<OAuthTokenBundle | null>;
+/**
+ * Persist the OAuth bundle, overwriting any prior bundle.
+ */
+export declare function setTokens(bundle: OAuthTokenBundle): Promise<void>;
+/**
+ * Delete any persisted bundle. Safe to call when nothing is stored
+ * (keytar returns false; we ignore the return).
+ */
+export declare function clearTokens(): Promise<void>;
+/**
+ * `true` if `bundle.expiresAt` is in the past (or null). Pure helper —
+ * the device-grant client wires this into its refresh-on-expiry logic.
+ *
+ * A small safety margin (60s by default) treats tokens about to expire
+ * as already expired, so the client refreshes BEFORE the API rejects
+ * the next call.
+ */
+export declare function isExpired(bundle: OAuthTokenBundle, marginMs?: number, now?: number): boolean;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgDH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBlE;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE;AAED;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAGjD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,gBAAgB,EACxB,QAAQ,SAAS,EACjB,GAAG,SAAa,GACf,OAAO,CAGT"}

package/dist/auth/token-store.js

@@ -0,0 +1,98 @@
+/**
+ * ENG-1444 / KI-081 — RFC 8628 device-grant token storage.
+ *
+ * Wraps `keytar` to persist OAuth tokens in the OS-native keychain
+ * (Keychain on macOS, Credential Manager on Windows, libsecret on
+ * Linux). The mcp-server is spawned by AI clients (Cursor, Claude
+ * Desktop) and survives across client launches, so tokens must live
+ * outside the process.
+ *
+ * One bundle per machine — there's no multi-user concept inside a
+ * single mcp-server install. If the user re-runs the device-grant
+ * flow, the prior bundle is overwritten.
+ *
+ * Linux without libsecret installed will throw on first keytar call
+ * (the native binding loads but the backend lookup fails). The CLI
+ * surfaces a clear remediation message ("apt-get install
+ * libsecret-tools" etc.) — we do NOT silently fall back to plaintext
+ * file storage. Encrypted file fallback may land in a follow-up.
+ */
+let _keytar = null;
+let _keytarErr = null;
+async function loadKeytar() {
+    if (_keytar)
+        return _keytar;
+    /* v8 ignore next */
+    if (_keytarErr)
+        throw _keytarErr;
+    try {
+        _keytar = await import('keytar');
+        return _keytar;
+    }
+    catch (e) {
+        /* v8 ignore next 9 -- runtime dlopen failure (Linux without libsecret); the catch can't be reached via vi.mock since the mock factory always resolves successfully. Behavior is covered by the CLI's end-to-end behavior on platforms where the import genuinely fails. */
+        const reason = e instanceof Error ? e.message : String(e);
+        _keytarErr = new Error(`OS keychain unavailable (${reason}). ` +
+            'On Linux, install libsecret (e.g. `apt-get install libsecret-1-dev` on Debian/Ubuntu, ' +
+            '`dnf install libsecret` on Fedora). Or set ROCKHOPPER_TOKEN to a Personal Access Token ' +
+            'to use PAT auth instead of OAuth.');
+        throw _keytarErr;
+    }
+}
+const KEYTAR_SERVICE = 'rockhopper-mcp';
+const KEYTAR_ACCOUNT = 'oauth-tokens';
+/**
+ * Read the persisted OAuth bundle. Returns null if no bundle is stored
+ * OR if the stored value is malformed (corrupted entry — treat as
+ * "no tokens" and let the CLI initiate a fresh device flow).
+ */
+export async function getTokens() {
+    const keytar = await loadKeytar();
+    const raw = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed?.accessToken !== 'string')
+            return null;
+        return {
+            accessToken: parsed.accessToken,
+            refreshToken: typeof parsed.refreshToken === 'string'
+                ? parsed.refreshToken
+                : undefined,
+            expiresAt: typeof parsed.expiresAt === 'number' ? parsed.expiresAt : null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Persist the OAuth bundle, overwriting any prior bundle.
+ */
+export async function setTokens(bundle) {
+    const keytar = await loadKeytar();
+    await keytar.setPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT, JSON.stringify(bundle));
+}
+/**
+ * Delete any persisted bundle. Safe to call when nothing is stored
+ * (keytar returns false; we ignore the return).
+ */
+export async function clearTokens() {
+    const keytar = await loadKeytar();
+    await keytar.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+}
+/**
+ * `true` if `bundle.expiresAt` is in the past (or null). Pure helper —
+ * the device-grant client wires this into its refresh-on-expiry logic.
+ *
+ * A small safety margin (60s by default) treats tokens about to expire
+ * as already expired, so the client refreshes BEFORE the API rejects
+ * the next call.
+ */
+export function isExpired(bundle, marginMs = 60_000, now = Date.now()) {
+    if (bundle.expiresAt === null)
+        return true;
+    return bundle.expiresAt - marginMs <= now;
+}
+//# sourceMappingURL=token-store.js.map

package/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAsBH,IAAI,OAAO,GAAwB,IAAI,CAAC;AACxC,IAAI,UAAU,GAAiB,IAAI,CAAC;AAEpC,KAAK,UAAU,UAAU;IACvB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,oBAAoB;IACpB,IAAI,UAAU;QAAE,MAAM,UAAU,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2QAA2Q;QAC3Q,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,UAAU,GAAG,IAAI,KAAK,CACpB,4BAA4B,MAAM,KAAK;YACrC,wFAAwF;YACxF,yFAAyF;YACzF,mCAAmC,CACtC,CAAC;QACF,MAAM,UAAU,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,cAAc,GAAG,cAAc,CAAC;AAUtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,EAAE,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;gBACrC,CAAC,CAAC,MAAM,CAAC,YAAY;gBACrB,CAAC,CAAC,SAAS;YACf,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAwB;IACtD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,CAAC,WAAW,CACtB,cAAc,EACd,cAAc,EACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CACvB,MAAwB,EACxB,QAAQ,GAAG,MAAM,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,MAAM,CAAC,SAAS,GAAG,QAAQ,IAAI,GAAG,CAAC;AAC5C,CAAC"}