@salesforce/b2c-tooling-sdk 0.0.1 → 0.0.2

package/dist/esm/auth/index.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Authentication strategies for B2C Commerce APIs.
+ *
+ * This module provides different authentication mechanisms for connecting to
+ * B2C Commerce instances and platform services.
+ *
+ * ## Available Strategies
+ *
+ * - {@link BasicAuthStrategy} - Username/password authentication for WebDAV operations
+ * - {@link OAuthStrategy} - OAuth 2.0 client credentials for OCAPI and platform APIs
+ * - {@link ImplicitOAuthStrategy} - Interactive browser-based OAuth for CLI/desktop apps
+ * - {@link ApiKeyStrategy} - API key authentication for MRT services
+ *
+ * ## Strategy Resolution
+ *
+ * Use {@link resolveAuthStrategy} to automatically select the best strategy based on
+ * available credentials and allowed methods:
+ *
+ * ```typescript
+ * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Automatically picks client-credentials if secret available, otherwise implicit
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
+ * });
+ *
+ * // Force a specific method
+ * const implicitOnly = resolveAuthStrategy(
+ *   { clientId: 'your-client-id' },
+ *   { allowedMethods: ['implicit'] }
+ * );
+ * ```
+ *
+ * ## Direct Usage
+ *
+ * All strategies implement the {@link AuthStrategy} interface:
+ *
+ * ```typescript
+ * import { OAuthStrategy, ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // For automated/server usage (client credentials)
+ * const oauthAuth = new OAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ * });
+ *
+ * // For interactive/CLI usage (opens browser)
+ * const implicitAuth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ * });
+ * ```
+ *
+ * @module auth
+ */
+export type { AuthStrategy, AccessTokenResponse, DecodedJWT, AuthConfig, BasicAuthConfig, OAuthAuthConfig, ApiKeyAuthConfig, AuthMethod, AuthCredentials, } from './types.js';
+export { ALL_AUTH_METHODS } from './types.js';
+export { BasicAuthStrategy } from './basic.js';
+export { OAuthStrategy, decodeJWT } from './oauth.js';
+export type { OAuthConfig } from './oauth.js';
+export { ImplicitOAuthStrategy } from './oauth-implicit.js';
+export type { ImplicitOAuthConfig } from './oauth-implicit.js';
+export { ApiKeyStrategy } from './api-key.js';
+export { resolveAuthStrategy, checkAvailableAuthMethods } from './resolve.js';
+export type { ResolveAuthStrategyOptions, AvailableAuthMethods } from './resolve.js';

package/dist/esm/auth/index.js

@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * Authentication strategies for B2C Commerce APIs.
+ *
+ * This module provides different authentication mechanisms for connecting to
+ * B2C Commerce instances and platform services.
+ *
+ * ## Available Strategies
+ *
+ * - {@link BasicAuthStrategy} - Username/password authentication for WebDAV operations
+ * - {@link OAuthStrategy} - OAuth 2.0 client credentials for OCAPI and platform APIs
+ * - {@link ImplicitOAuthStrategy} - Interactive browser-based OAuth for CLI/desktop apps
+ * - {@link ApiKeyStrategy} - API key authentication for MRT services
+ *
+ * ## Strategy Resolution
+ *
+ * Use {@link resolveAuthStrategy} to automatically select the best strategy based on
+ * available credentials and allowed methods:
+ *
+ * ```typescript
+ * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // Automatically picks client-credentials if secret available, otherwise implicit
+ * const strategy = resolveAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
+ * });
+ *
+ * // Force a specific method
+ * const implicitOnly = resolveAuthStrategy(
+ *   { clientId: 'your-client-id' },
+ *   { allowedMethods: ['implicit'] }
+ * );
+ * ```
+ *
+ * ## Direct Usage
+ *
+ * All strategies implement the {@link AuthStrategy} interface:
+ *
+ * ```typescript
+ * import { OAuthStrategy, ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * // For automated/server usage (client credentials)
+ * const oauthAuth = new OAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ * });
+ *
+ * // For interactive/CLI usage (opens browser)
+ * const implicitAuth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ * });
+ * ```
+ *
+ * @module auth
+ */
+export { ALL_AUTH_METHODS } from './types.js';
+// Strategies
+export { BasicAuthStrategy } from './basic.js';
+export { OAuthStrategy, decodeJWT } from './oauth.js';
+export { ImplicitOAuthStrategy } from './oauth-implicit.js';
+export { ApiKeyStrategy } from './api-key.js';
+// Resolution helpers
+export { resolveAuthStrategy, checkAvailableAuthMethods } from './resolve.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAE5C,aAAa;AACb,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,aAAa,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAE5C,qBAAqB;AACrB,OAAO,EAAC,mBAAmB,EAAE,yBAAyB,EAAC,MAAM,cAAc,CAAC"}

package/dist/esm/auth/oauth-implicit.d.ts

@@ -0,0 +1,74 @@
+import type { AuthStrategy, AccessTokenResponse, DecodedJWT } from './types.js';
+/**
+ * Configuration for the implicit OAuth flow.
+ */
+export interface ImplicitOAuthConfig {
+    /** OAuth client ID registered with Account Manager */
+    clientId: string;
+    /** OAuth scopes to request (e.g., 'sfcc.products', 'sfcc.orders') */
+    scopes?: string[];
+    /** Account Manager host (defaults to 'account.demandware.com') */
+    accountManagerHost?: string;
+    /**
+     * Local port for the OAuth redirect server.
+     * Defaults to 8080 or SFCC_OAUTH_LOCAL_PORT environment variable.
+     */
+    localPort?: number;
+}
+/**
+ * OAuth 2.0 Implicit Grant Flow authentication strategy.
+ *
+ * This strategy is used when only a client ID is available (no client secret).
+ * It opens a browser for the user to authenticate with Account Manager,
+ * then captures the access token from the OAuth redirect.
+ *
+ * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
+ * This flow requires user interaction and a TTY.
+ *
+ * @example
+ * ```typescript
+ * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * const auth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   scopes: ['sfcc.products', 'sfcc.orders'],
+ * });
+ *
+ * // Will open browser for authentication
+ * const response = await auth.fetch('https://example.com/api/resource');
+ * ```
+ */
+export declare class ImplicitOAuthStrategy implements AuthStrategy {
+    private config;
+    private accountManagerHost;
+    private localPort;
+    constructor(config: ImplicitOAuthConfig);
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    getAuthorizationHeader(): Promise<string>;
+    /**
+     * Gets the decoded JWT payload
+     */
+    getJWT(): Promise<DecodedJWT>;
+    /**
+     * Gets the full token response including expiration and scopes.
+     * Useful for commands that need to display or return token metadata.
+     */
+    getTokenResponse(): Promise<AccessTokenResponse>;
+    /**
+     * Invalidates the cached token, forcing re-authentication on next request
+     */
+    invalidateToken(): void;
+    /**
+     * Gets an access token, using cache if valid.
+     * Uses a mutex to prevent concurrent auth flows for the same clientId.
+     */
+    private getAccessToken;
+    /**
+     * Performs an implicit OAuth2 login flow.
+     * Opens the user's browser for authentication with Account Manager.
+     *
+     * NOTE: This method requires a TTY and user intervention; it is interactive.
+     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
+     */
+    private implicitFlowLogin;
+}

package/dist/esm/auth/oauth-implicit.js

@@ -0,0 +1,330 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+import { createServer } from 'node:http';
+import { URL } from 'node:url';
+import { getLogger } from '../logging/logger.js';
+import { decodeJWT } from './oauth.js';
+import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
+const DEFAULT_LOCAL_PORT = 8080;
+// Module-level token cache to support multiple instances with same clientId
+const ACCESS_TOKEN_CACHE = new Map();
+// Module-level pending auth promises to prevent concurrent auth flows for the same clientId
+const PENDING_AUTH = new Map();
+/**
+ * Returns the HTML page served to the browser to extract the access token
+ * from the URL fragment and redirect it as query parameters.
+ */
+function getOauth2RedirectHTML(port) {
+    return `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>OAuth Return Flow</title>
+</head>
+<body onload="doReturnFlow()">
+<script>
+    function doReturnFlow() {
+        document.location = "http://localhost:${port}/?" + window.location.hash.substring(1);
+    }
+</script>
+</body>
+</html>
+`;
+}
+/**
+ * Opens the system default browser to the specified URL.
+ * Dynamically imports 'open' package to handle the browser opening.
+ */
+async function openBrowser(url) {
+    try {
+        // Dynamic import of 'open' package
+        const open = await import('open');
+        await open.default(url);
+    }
+    catch {
+        // If open fails, the URL will still be printed to console
+        getLogger().debug('Could not automatically open browser');
+    }
+}
+/**
+ * OAuth 2.0 Implicit Grant Flow authentication strategy.
+ *
+ * This strategy is used when only a client ID is available (no client secret).
+ * It opens a browser for the user to authenticate with Account Manager,
+ * then captures the access token from the OAuth redirect.
+ *
+ * Note: The access token from implicit flow is valid for 30 minutes and cannot be renewed.
+ * This flow requires user interaction and a TTY.
+ *
+ * @example
+ * ```typescript
+ * import { ImplicitOAuthStrategy } from '@salesforce/b2c-tooling-sdk';
+ *
+ * const auth = new ImplicitOAuthStrategy({
+ *   clientId: 'your-client-id',
+ *   scopes: ['sfcc.products', 'sfcc.orders'],
+ * });
+ *
+ * // Will open browser for authentication
+ * const response = await auth.fetch('https://example.com/api/resource');
+ * ```
+ */
+export class ImplicitOAuthStrategy {
+    config;
+    accountManagerHost;
+    localPort;
+    constructor(config) {
+        this.config = config;
+        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
+        this.localPort = config.localPort || parseInt(process.env.SFCC_OAUTH_LOCAL_PORT || '', 10) || DEFAULT_LOCAL_PORT;
+        const logger = getLogger();
+        logger.debug({ clientId: this.config.clientId, accountManagerHost: this.accountManagerHost, port: this.localPort }, '[Auth] ImplicitOAuthStrategy initialized');
+        logger.trace({ scopes: this.config.scopes }, '[Auth] Configured scopes');
+    }
+    async fetch(url, init = {}) {
+        const logger = getLogger();
+        const method = init.method || 'GET';
+        logger.trace({ method, url }, '[Auth] Fetching with implicit OAuth');
+        const token = await this.getAccessToken();
+        const headers = new Headers(init.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        headers.set('x-dw-client-id', this.config.clientId);
+        const startTime = Date.now();
+        let res = await fetch(url, { ...init, headers });
+        const duration = Date.now() - startTime;
+        logger.debug({ method, url, status: res.status, duration }, '[Auth] Response');
+        // RESILIENCE: If the server says 401, the token might have expired or been revoked.
+        // We retry exactly once after invalidating the cached token.
+        if (res.status === 401) {
+            logger.debug('[Auth] Received 401, invalidating token and retrying');
+            this.invalidateToken();
+            const newToken = await this.getAccessToken();
+            headers.set('Authorization', `Bearer ${newToken}`);
+            const retryStart = Date.now();
+            res = await fetch(url, { ...init, headers });
+            const retryDuration = Date.now() - retryStart;
+            logger.debug({ method, url, status: res.status, duration: retryDuration }, '[Auth] Retry response');
+        }
+        return res;
+    }
+    async getAuthorizationHeader() {
+        const token = await this.getAccessToken();
+        return `Bearer ${token}`;
+    }
+    /**
+     * Gets the decoded JWT payload
+     */
+    async getJWT() {
+        const token = await this.getAccessToken();
+        return decodeJWT(token);
+    }
+    /**
+     * Gets the full token response including expiration and scopes.
+     * Useful for commands that need to display or return token metadata.
+     */
+    async getTokenResponse() {
+        const logger = getLogger();
+        const cached = ACCESS_TOKEN_CACHE.get(this.config.clientId);
+        if (cached) {
+            const now = new Date();
+            const requiredScopes = this.config.scopes || [];
+            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+            if (hasAllScopes && now.getTime() <= cached.expires.getTime()) {
+                logger.debug('Reusing cached access token');
+                return cached;
+            }
+        }
+        // Get new token via implicit flow
+        const tokenResponse = await this.implicitFlowLogin();
+        ACCESS_TOKEN_CACHE.set(this.config.clientId, tokenResponse);
+        return tokenResponse;
+    }
+    /**
+     * Invalidates the cached token, forcing re-authentication on next request
+     */
+    invalidateToken() {
+        ACCESS_TOKEN_CACHE.delete(this.config.clientId);
+    }
+    /**
+     * Gets an access token, using cache if valid.
+     * Uses a mutex to prevent concurrent auth flows for the same clientId.
+     */
+    async getAccessToken() {
+        const logger = getLogger();
+        const clientId = this.config.clientId;
+        const cached = ACCESS_TOKEN_CACHE.get(clientId);
+        logger.trace({ clientId, hasCached: !!cached }, '[Auth] Getting access token');
+        if (cached) {
+            const now = new Date();
+            const requiredScopes = this.config.scopes || [];
+            const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
+            const timeUntilExpiry = cached.expires.getTime() - now.getTime();
+            logger.trace({
+                cachedScopes: cached.scopes,
+                requiredScopes,
+                hasAllScopes,
+                expiresAt: cached.expires.toISOString(),
+                timeUntilExpiryMs: timeUntilExpiry,
+            }, '[Auth] Checking cached token validity');
+            if (!hasAllScopes) {
+                logger.warn({ cachedScopes: cached.scopes, requiredScopes }, '[Auth] Access token missing scopes; invalidating and re-authenticating');
+                ACCESS_TOKEN_CACHE.delete(clientId);
+            }
+            else if (now.getTime() > cached.expires.getTime()) {
+                logger.warn({ expiresAt: cached.expires.toISOString() }, '[Auth] Access token expired; invalidating and re-authenticating');
+                ACCESS_TOKEN_CACHE.delete(clientId);
+            }
+            else {
+                logger.debug({ timeUntilExpiryMs: timeUntilExpiry }, '[Auth] Reusing cached access token');
+                return cached.accessToken;
+            }
+        }
+        // Check if there's already an auth flow in progress for this clientId
+        const pendingAuth = PENDING_AUTH.get(clientId);
+        if (pendingAuth) {
+            logger.debug('[Auth] Auth flow already in progress, waiting for it to complete');
+            const tokenResponse = await pendingAuth;
+            return tokenResponse.accessToken;
+        }
+        // Start new auth flow and store the promise so concurrent calls can wait
+        logger.debug('[Auth] No valid cached token, starting implicit flow login');
+        const authPromise = this.implicitFlowLogin();
+        PENDING_AUTH.set(clientId, authPromise);
+        try {
+            const tokenResponse = await authPromise;
+            ACCESS_TOKEN_CACHE.set(clientId, tokenResponse);
+            logger.debug({ expiresAt: tokenResponse.expires.toISOString(), scopes: tokenResponse.scopes }, '[Auth] New token cached');
+            return tokenResponse.accessToken;
+        }
+        finally {
+            // Clean up pending auth promise
+            PENDING_AUTH.delete(clientId);
+        }
+    }
+    /**
+     * Performs an implicit OAuth2 login flow.
+     * Opens the user's browser for authentication with Account Manager.
+     *
+     * NOTE: This method requires a TTY and user intervention; it is interactive.
+     * NOTE: Access token is valid for 30 minutes and cannot be renewed.
+     */
+    async implicitFlowLogin() {
+        const logger = getLogger();
+        const redirectUrl = `http://localhost:${this.localPort}`;
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: redirectUrl,
+            response_type: 'token',
+        });
+        if (this.config.scopes && this.config.scopes.length > 0) {
+            params.append('scope', this.config.scopes.join(' '));
+        }
+        const authorizeUrl = `https://${this.accountManagerHost}/dwsso/oauth2/authorize?${params.toString()}`;
+        logger.debug({
+            clientId: this.config.clientId,
+            redirectUrl,
+            scopes: this.config.scopes,
+            accountManagerHost: this.accountManagerHost,
+        }, '[Auth] Starting implicit OAuth flow');
+        logger.trace({ authorizeUrl }, '[Auth] Authorization URL');
+        // Print URL to console (in case machine has no default browser)
+        logger.info({ url: authorizeUrl }, `Login URL: ${authorizeUrl}`);
+        logger.info('If the URL does not open automatically, copy/paste it into a browser on this machine.');
+        // Attempt to open the browser
+        logger.debug('[Auth] Attempting to open browser');
+        await openBrowser(authorizeUrl);
+        return new Promise((resolve, reject) => {
+            const sockets = new Set();
+            const startTime = Date.now();
+            const server = createServer((request, response) => {
+                const requestUrl = new URL(request.url || '/', `http://localhost:${this.localPort}`);
+                const accessToken = requestUrl.searchParams.get('access_token');
+                const error = requestUrl.searchParams.get('error');
+                const errorDescription = requestUrl.searchParams.get('error_description');
+                logger.trace({
+                    path: requestUrl.pathname,
+                    hasAccessToken: !!accessToken,
+                    hasError: !!error,
+                }, '[Auth] Received redirect request');
+                if (!accessToken && !error) {
+                    // Serve HTML page to extract token from URL fragment
+                    logger.debug('[Auth] Serving token extraction HTML page');
+                    response.writeHead(200, { 'Content-Type': 'text/html' });
+                    response.write(getOauth2RedirectHTML(this.localPort));
+                    response.end();
+                }
+                else if (accessToken) {
+                    const authDuration = Date.now() - startTime;
+                    // Successfully received access token
+                    logger.debug({ duration: authDuration }, `[Auth] Got access token response (${authDuration}ms)`);
+                    logger.info('Successfully authenticated');
+                    try {
+                        const jwt = decodeJWT(accessToken);
+                        logger.trace({ jwt: jwt.payload }, '[Auth] Decoded JWT payload');
+                    }
+                    catch {
+                        logger.debug('[Auth] Error decoding JWT (token may not be a JWT)');
+                    }
+                    const expiresIn = parseInt(requestUrl.searchParams.get('expires_in') || '0', 10);
+                    const now = new Date();
+                    const expiration = new Date(now.getTime() + expiresIn * 1000);
+                    const scopes = requestUrl.searchParams.get('scope')?.split(' ') ?? [];
+                    logger.debug({ expiresIn, expiresAt: expiration.toISOString(), scopes }, `[Auth] Token expires in ${expiresIn}s, scopes: ${scopes.join(' ')}`);
+                    resolve({
+                        accessToken,
+                        expires: expiration,
+                        scopes,
+                    });
+                    response.writeHead(200, { 'Content-Type': 'text/plain' });
+                    response.write('Authentication successful! You may close this browser window and return to your terminal.');
+                    response.end();
+                    // Shutdown server after a short delay
+                    setTimeout(() => {
+                        logger.debug('[Auth] Shutting down OAuth redirect server');
+                        server.close(() => logger.trace('[Auth] OAuth redirect server closed'));
+                        for (const socket of sockets) {
+                            socket.destroy();
+                        }
+                        logger.trace({ socketCount: sockets.size }, '[Auth] Cleaned up sockets');
+                    }, 100);
+                }
+                else if (error) {
+                    // OAuth error response
+                    const errorMessage = errorDescription || error;
+                    logger.error({ error, errorDescription }, `[Auth] OAuth error: ${error}`);
+                    response.writeHead(500, { 'Content-Type': 'text/plain' });
+                    response.write(`Authentication failed: ${errorMessage}`);
+                    response.end();
+                    reject(new Error(`OAuth error: ${errorMessage}`));
+                    setTimeout(() => {
+                        server.close();
+                        for (const socket of sockets) {
+                            socket.destroy();
+                        }
+                    }, 100);
+                }
+            });
+            server.on('connection', (socket) => {
+                sockets.add(socket);
+                logger.trace({ socketCount: sockets.size }, '[Auth] New socket connection');
+                socket.on('close', () => {
+                    sockets.delete(socket);
+                    logger.trace({ socketCount: sockets.size }, '[Auth] Socket closed');
+                });
+            });
+            server.listen(this.localPort, () => {
+                logger.debug({ port: this.localPort }, `[Auth] OAuth redirect server listening on port ${this.localPort}`);
+                logger.info('Waiting for user to authenticate...');
+            });
+            server.on('error', (err) => {
+                logger.error({ error: err.message, port: this.localPort }, '[Auth] Failed to start OAuth redirect server');
+                reject(new Error(`Failed to start OAuth redirect server: ${err.message}`));
+            });
+        });
+    }
+}
+//# sourceMappingURL=oauth-implicit.js.map

package/dist/esm/auth/oauth-implicit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-implicit.js","sourceRoot":"","sources":["../../../src/auth/oauth-implicit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAC,YAAY,EAAyD,MAAM,WAAW,CAAC;AAE/F,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAE7B,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AACrC,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAE5D,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEvE,4FAA4F;AAC5F,MAAM,YAAY,GAA8C,IAAI,GAAG,EAAE,CAAC;AAmB1E;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO;;;;;;;;;;gDAUuC,IAAI;;;;;CAKnD,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,mCAAmC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,SAAS,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,qBAAqB;IAIZ;IAHZ,kBAAkB,CAAS;IAC3B,SAAS,CAAS;IAE1B,YAAoB,MAA2B;QAA3B,WAAM,GAAN,MAAM,CAAqB;QAC7C,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC;QAEjH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAC,EACnG,0CAA0C,CAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAC,EAAE,0BAA0B,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAoB,EAAE;QAC7C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAC,EAAE,qCAAqC,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,iBAAiB,CAAC,CAAC;QAE7E,oFAAoF;QACpF,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACrE,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YAEnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;YAE9C,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAC,EAAE,uBAAuB,CAAC,CAAC;QACpG,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpF,IAAI,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC9D,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAC,EAAE,6BAA6B,CAAC,CAAC;QAE7E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACpF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAEjE,MAAM,CAAC,KAAK,CACV;gBACE,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,cAAc;gBACd,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;gBACvC,iBAAiB,EAAE,eAAe;aACnC,EACD,uCAAuC,CACxC,CAAC;YAEF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CACT,EAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAC,EAC7C,wEAAwE,CACzE,CAAC;gBACF,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CACT,EAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAC,EACzC,iEAAiE,CAClE,CAAC;gBACF,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,EAAC,iBAAiB,EAAE,eAAe,EAAC,EAAE,oCAAoC,CAAC,CAAC;gBACzF,OAAO,MAAM,CAAC,WAAW,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACjF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC;YACxC,OAAO,aAAa,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,yEAAyE;QACzE,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC;YACxC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CACV,EAAC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAC,EAC9E,yBAAyB,CAC1B,CAAC;YACF,OAAO,aAAa,CAAC,WAAW,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,gCAAgC;YAChC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC;QAEzD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,IAAI,CAAC,kBAAkB,2BAA2B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEtG,MAAM,CAAC,KAAK,CACV;YACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,WAAW;YACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,EACD,qCAAqC,CACtC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,EAAC,YAAY,EAAC,EAAE,0BAA0B,CAAC,CAAC;QAEzD,gEAAgE;QAChE,MAAM,CAAC,IAAI,CAAC,EAAC,GAAG,EAAE,YAAY,EAAC,EAAE,cAAc,YAAY,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAErG,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QAEhC,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1D,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;gBACzF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACrF,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAE1E,MAAM,CAAC,KAAK,CACV;oBACE,IAAI,EAAE,UAAU,CAAC,QAAQ;oBACzB,cAAc,EAAE,CAAC,CAAC,WAAW;oBAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK;iBAClB,EACD,kCAAkC,CACnC,CAAC;gBAEF,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC3B,qDAAqD;oBACrD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBAC1D,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,WAAW,EAAC,CAAC,CAAC;oBACvD,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBACtD,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjB,CAAC;qBAAM,IAAI,WAAW,EAAE,CAAC;oBACvB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBAC5C,qCAAqC;oBACrC,MAAM,CAAC,KAAK,CAAC,EAAC,QAAQ,EAAE,YAAY,EAAC,EAAE,qCAAqC,YAAY,KAAK,CAAC,CAAC;oBAC/F,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAE1C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;wBACnC,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAC,EAAE,4BAA4B,CAAC,CAAC;oBACjE,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;oBACrE,CAAC;oBAED,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACjF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;oBAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAEtE,MAAM,CAAC,KAAK,CACV,EAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,EAAC,EACxD,2BAA2B,SAAS,cAAc,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACrE,CAAC;oBAEF,OAAO,CAAC;wBACN,WAAW;wBACX,OAAO,EAAE,UAAU;wBACnB,MAAM;qBACP,CAAC,CAAC;oBAEH,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACxD,QAAQ,CAAC,KAAK,CAAC,2FAA2F,CAAC,CAAC;oBAC5G,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAEf,sCAAsC;oBACtC,UAAU,CAAC,GAAG,EAAE;wBACd,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;wBAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;wBACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;wBACD,MAAM,CAAC,KAAK,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAC,EAAE,2BAA2B,CAAC,CAAC;oBACzE,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;qBAAM,IAAI,KAAK,EAAE,CAAC;oBACjB,uBAAuB;oBACvB,MAAM,YAAY,GAAG,gBAAgB,IAAI,KAAK,CAAC;oBAC/C,MAAM,CAAC,KAAK,CAAC,EAAC,KAAK,EAAE,gBAAgB,EAAC,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;oBACxE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,YAAY,EAAC,CAAC,CAAC;oBACxD,QAAQ,CAAC,KAAK,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;oBACzD,QAAQ,CAAC,GAAG,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC,CAAC;oBAElD,UAAU,CAAC,GAAG,EAAE;wBACd,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;oBACH,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAC,EAAE,8BAA8B,CAAC,CAAC;gBAC1E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvB,MAAM,CAAC,KAAK,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAC,EAAE,sBAAsB,CAAC,CAAC;gBACpE,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBACjC,MAAM,CAAC,KAAK,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAC,EAAE,kDAAkD,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzG,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,KAAK,CAAC,EAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAC,EAAE,8CAA8C,CAAC,CAAC;gBACzG,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/auth/oauth.d.ts

@@ -0,0 +1,48 @@
+import type { AuthStrategy, AccessTokenResponse, DecodedJWT } from './types.js';
+export interface OAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+    accountManagerHost?: string;
+}
+/**
+ * Decodes a JWT token without verification
+ */
+declare function decodeJWT(jwt: string): DecodedJWT;
+export declare class OAuthStrategy implements AuthStrategy {
+    private config;
+    private accountManagerHost;
+    constructor(config: OAuthConfig);
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+    getAuthorizationHeader(): Promise<string>;
+    /**
+     * Gets the decoded JWT payload
+     */
+    getJWT(): Promise<DecodedJWT>;
+    /**
+     * Gets the full token response including expiration and scopes.
+     * Useful for commands that need to display or return token metadata.
+     */
+    getTokenResponse(): Promise<AccessTokenResponse>;
+    /**
+     * Invalidates the cached token, forcing re-authentication on next request
+     */
+    invalidateToken(): void;
+    /**
+     * Creates a new OAuthStrategy with additional scopes merged in.
+     * Used by clients that have specific scope requirements.
+     *
+     * @param additionalScopes - Scopes to add to this strategy's existing scopes
+     * @returns A new OAuthStrategy instance with merged scopes
+     */
+    withAdditionalScopes(additionalScopes: string[]): OAuthStrategy;
+    /**
+     * Gets an access token, using cache if valid
+     */
+    private getAccessToken;
+    /**
+     * Performs client credentials grant flow
+     */
+    private clientCredentialsGrant;
+}
+export { decodeJWT };