@shuyhere/takotako 0.0.1

package/dist/auth/agent-profiles.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Per-agent auth profiles — provider credentials scoped to individual agents.
+ *
+ * Stored at: ~/.tako/agents/<id>/agent/auth-profiles.json
+ *
+ * Resolution order:
+ *   1. Agent-specific profile (this file)
+ *   2. Main agent's profile (inherited on creation)
+ *   3. Global auth (storage.ts / env vars)
+ */
+export interface AuthProfile {
+    type: 'api_key' | 'oauth';
+    key?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: number;
+}
+export interface AuthProfilesFile {
+    version: 1;
+    profiles: Record<string, AuthProfile>;
+}
+export declare function loadAuthProfiles(agentId: string): Promise<AuthProfilesFile>;
+export declare function saveAuthProfiles(agentId: string, data: AuthProfilesFile): Promise<void>;
+/**
+ * Set or update a single auth profile for an agent.
+ */
+export declare function setAuthProfile(agentId: string, profileKey: string, profile: AuthProfile): Promise<void>;
+/**
+ * Remove an auth profile from an agent.
+ */
+export declare function removeAuthProfile(agentId: string, profileKey: string): Promise<boolean>;
+/**
+ * Inherit auth profiles from a source agent to a new agent.
+ * Used when creating sub-agents.
+ */
+export declare function inheritAuthProfiles(sourceAgentId: string, targetAgentId: string): Promise<void>;
+/**
+ * Resolve an API key for a provider, checking agent profile first.
+ * Returns the key string or null if not found at this level.
+ */
+export declare function resolveAgentAuthKey(agentId: string, providerKey: string): Promise<string | null>;
+/**
+ * Mask an API key for display (show first 8 and last 4 chars).
+ */
+export declare function maskKey(key: string): string;
+//# sourceMappingURL=agent-profiles.d.ts.map

package/dist/auth/agent-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.d.ts","sourceRoot":"","sources":["../../src/auth/agent-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACvC;AAUD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWjF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3C"}

package/dist/auth/agent-profiles.js

@@ -0,0 +1,97 @@
+/**
+ * Per-agent auth profiles — provider credentials scoped to individual agents.
+ *
+ * Stored at: ~/.tako/agents/<id>/agent/auth-profiles.json
+ *
+ * Resolution order:
+ *   1. Agent-specific profile (this file)
+ *   2. Main agent's profile (inherited on creation)
+ *   3. Global auth (storage.ts / env vars)
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+// ─── Paths ──────────────────────────────────────────────────────────
+function getProfilesPath(agentId) {
+    return join(homedir(), '.tako', 'agents', agentId, 'agent', 'auth-profiles.json');
+}
+// ─── Read / Write ───────────────────────────────────────────────────
+export async function loadAuthProfiles(agentId) {
+    const filePath = getProfilesPath(agentId);
+    if (!existsSync(filePath)) {
+        return { version: 1, profiles: {} };
+    }
+    try {
+        const raw = await readFile(filePath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { version: 1, profiles: {} };
+    }
+}
+export async function saveAuthProfiles(agentId, data) {
+    const filePath = getProfilesPath(agentId);
+    const dir = join(filePath, '..');
+    await mkdir(dir, { recursive: true });
+    // Mask keys in the saved file for safety — store the real values
+    await writeFile(filePath, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+}
+/**
+ * Set or update a single auth profile for an agent.
+ */
+export async function setAuthProfile(agentId, profileKey, profile) {
+    const data = await loadAuthProfiles(agentId);
+    data.profiles[profileKey] = profile;
+    await saveAuthProfiles(agentId, data);
+}
+/**
+ * Remove an auth profile from an agent.
+ */
+export async function removeAuthProfile(agentId, profileKey) {
+    const data = await loadAuthProfiles(agentId);
+    if (!(profileKey in data.profiles))
+        return false;
+    delete data.profiles[profileKey];
+    await saveAuthProfiles(agentId, data);
+    return true;
+}
+/**
+ * Inherit auth profiles from a source agent to a new agent.
+ * Used when creating sub-agents.
+ */
+export async function inheritAuthProfiles(sourceAgentId, targetAgentId) {
+    const source = await loadAuthProfiles(sourceAgentId);
+    if (Object.keys(source.profiles).length === 0)
+        return;
+    await saveAuthProfiles(targetAgentId, { ...source });
+}
+/**
+ * Resolve an API key for a provider, checking agent profile first.
+ * Returns the key string or null if not found at this level.
+ */
+export async function resolveAgentAuthKey(agentId, providerKey) {
+    const data = await loadAuthProfiles(agentId);
+    const profile = data.profiles[providerKey];
+    if (!profile)
+        return null;
+    if (profile.type === 'api_key' && profile.key) {
+        return profile.key;
+    }
+    if (profile.type === 'oauth' && profile.accessToken) {
+        if (profile.expiresAt && profile.expiresAt < Date.now() / 1000) {
+            return null; // expired
+        }
+        return profile.accessToken;
+    }
+    return null;
+}
+/**
+ * Mask an API key for display (show first 8 and last 4 chars).
+ */
+export function maskKey(key) {
+    if (key.length <= 12)
+        return '***';
+    return `${key.slice(0, 8)}...${key.slice(-4)}`;
+}
+//# sourceMappingURL=agent-profiles.js.map

package/dist/auth/agent-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.js","sourceRoot":"","sources":["../../src/auth/agent-profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBrC,uEAAuE;AAEvE,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACpF,CAAC;AAED,uEAAuE;AAEvE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAsB;IAC5E,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,iEAAiE;IACjE,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACnF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,OAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;IACpC,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,aAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtD,MAAM,gBAAgB,CAAC,aAAa,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,CAAC,UAAU;QACzB,CAAC;QACD,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/auth/allow-from.d.ts

@@ -0,0 +1,27 @@
+/**
+ * AllowFrom ACL — per-agent, per-channel access control.
+ *
+ * Stores allowlist config at:
+ *   ~/.tako/credentials/<channel>-<agentId>-allowFrom.json
+ *
+ * Modes:
+ * - "open": anyone can talk (default — preserves existing behavior)
+ * - "allowlist": only listed user IDs are permitted
+ *
+ * The owner (first user to onboard) is always allowed.
+ */
+import type { Tool } from '../tools/tool.js';
+export type AllowFromMode = 'allowlist' | 'open';
+export interface AllowFromConfig {
+    allowedUserIds: string[];
+    mode: AllowFromMode;
+}
+export declare function loadAllowFrom(channel: string, agentId: string): Promise<AllowFromConfig>;
+export declare function saveAllowFrom(channel: string, agentId: string, config: AllowFromConfig): Promise<void>;
+/**
+ * Check if a user is allowed to send messages on this channel/agent.
+ * Returns true if allowed, false if blocked.
+ */
+export declare function isUserAllowed(channel: string, agentId: string, userId: string): Promise<boolean>;
+export declare function createAllowFromTools(): Tool[];
+//# sourceMappingURL=allow-from.d.ts.map

package/dist/auth/allow-from.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-from.d.ts","sourceRoot":"","sources":["../../src/auth/allow-from.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,IAAI,EAA2B,MAAM,kBAAkB,CAAC;AAItE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;CACrB;AAcD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAW9F;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5G;AAID;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAIlB;AAID,wBAAgB,oBAAoB,IAAI,IAAI,EAAE,CA4E7C"}

package/dist/auth/allow-from.js

@@ -0,0 +1,118 @@
+/**
+ * AllowFrom ACL — per-agent, per-channel access control.
+ *
+ * Stores allowlist config at:
+ *   ~/.tako/credentials/<channel>-<agentId>-allowFrom.json
+ *
+ * Modes:
+ * - "open": anyone can talk (default — preserves existing behavior)
+ * - "allowlist": only listed user IDs are permitted
+ *
+ * The owner (first user to onboard) is always allowed.
+ */
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+// ─── Paths ──────────────────────────────────────────────────────────
+function getCredentialsDir() {
+    return join(homedir(), '.tako', 'credentials');
+}
+function getAllowFromPath(channel, agentId) {
+    return join(getCredentialsDir(), `${channel}-${agentId}-allowFrom.json`);
+}
+// ─── Read / Write ───────────────────────────────────────────────────
+export async function loadAllowFrom(channel, agentId) {
+    const filePath = getAllowFromPath(channel, agentId);
+    if (!existsSync(filePath)) {
+        return { allowedUserIds: [], mode: 'open' };
+    }
+    try {
+        const raw = await readFile(filePath, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { allowedUserIds: [], mode: 'open' };
+    }
+}
+export async function saveAllowFrom(channel, agentId, config) {
+    const dir = getCredentialsDir();
+    await mkdir(dir, { recursive: true });
+    const filePath = getAllowFromPath(channel, agentId);
+    await writeFile(filePath, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+}
+// ─── Check ──────────────────────────────────────────────────────────
+/**
+ * Check if a user is allowed to send messages on this channel/agent.
+ * Returns true if allowed, false if blocked.
+ */
+export async function isUserAllowed(channel, agentId, userId) {
+    const config = await loadAllowFrom(channel, agentId);
+    if (config.mode === 'open')
+        return true;
+    return config.allowedUserIds.includes(userId);
+}
+// ─── Tools ──────────────────────────────────────────────────────────
+export function createAllowFromTools() {
+    const allowFromAdd = {
+        name: 'allow_from_add',
+        description: 'Add a user ID to the allowlist for the current channel. Requires admin/operator role.',
+        parameters: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'User ID to allow' },
+                channel: { type: 'string', description: 'Channel type (e.g. discord, telegram)' },
+                agentId: { type: 'string', description: 'Agent ID (defaults to current agent)' },
+            },
+            required: ['userId'],
+        },
+        group: 'agents',
+        async execute(params, ctx) {
+            const { userId, channel: chan, agentId: aid } = params;
+            const channel = chan ?? ctx.channelType ?? 'cli';
+            const agentId = aid ?? ctx.agentId ?? 'main';
+            const config = await loadAllowFrom(channel, agentId);
+            if (!config.allowedUserIds.includes(userId)) {
+                config.allowedUserIds.push(userId);
+            }
+            // Switch to allowlist mode when adding users
+            config.mode = 'allowlist';
+            await saveAllowFrom(channel, agentId, config);
+            return {
+                output: `Added user ${userId} to allowlist for ${channel}/${agentId}. Mode: allowlist.`,
+                success: true,
+            };
+        },
+    };
+    const allowFromRemove = {
+        name: 'allow_from_remove',
+        description: 'Remove a user ID from the allowlist for the current channel. Requires admin/operator role.',
+        parameters: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'User ID to remove' },
+                channel: { type: 'string', description: 'Channel type (e.g. discord, telegram)' },
+                agentId: { type: 'string', description: 'Agent ID (defaults to current agent)' },
+            },
+            required: ['userId'],
+        },
+        group: 'agents',
+        async execute(params, ctx) {
+            const { userId, channel: chan, agentId: aid } = params;
+            const channel = chan ?? ctx.channelType ?? 'cli';
+            const agentId = aid ?? ctx.agentId ?? 'main';
+            const config = await loadAllowFrom(channel, agentId);
+            config.allowedUserIds = config.allowedUserIds.filter((id) => id !== userId);
+            await saveAllowFrom(channel, agentId, config);
+            const modeNote = config.allowedUserIds.length === 0
+                ? ' (allowlist is now empty — consider switching to "open" mode)'
+                : '';
+            return {
+                output: `Removed user ${userId} from allowlist for ${channel}/${agentId}.${modeNote}`,
+                success: true,
+            };
+        },
+    };
+    return [allowFromAdd, allowFromRemove];
+}
+//# sourceMappingURL=allow-from.js.map

package/dist/auth/allow-from.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-from.js","sourceRoot":"","sources":["../../src/auth/allow-from.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAYrC,uEAAuE;AAEvE,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,OAAe;IACxD,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,OAAO,IAAI,OAAO,iBAAiB,CAAC,CAAC;AAC3E,CAAC;AAED,uEAAuE;AAEvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe;IAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe,EAAE,MAAuB;IAC3F,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,OAAe,EACf,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,uEAAuE;AAEvE,MAAM,UAAU,oBAAoB;IAClC,MAAM,YAAY,GAAS;QACzB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,uFAAuF;QACpG,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBAC3D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBACjF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;aACjF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,QAAQ;QACf,KAAK,CAAC,OAAO,CAAC,MAAe,EAAE,GAAgB;YAC7C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAI/C,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC;YACjD,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC;YAE7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC;YAC1B,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAE9C,OAAO;gBACL,MAAM,EAAE,cAAc,MAAM,qBAAqB,OAAO,IAAI,OAAO,oBAAoB;gBACvF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,eAAe,GAAS;QAC5B,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,4FAA4F;QACzG,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;gBAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uCAAuC,EAAE;gBACjF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;aACjF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,QAAQ;QACf,KAAK,CAAC,OAAO,CAAC,MAAe,EAAE,GAAgB;YAC7C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAI/C,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC;YACjD,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC;YAE7C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YAC5E,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;gBACjD,CAAC,CAAC,+DAA+D;gBACjE,CAAC,CAAC,EAAE,CAAC;YAEP,OAAO;gBACL,MAAM,EAAE,gBAAgB,MAAM,uBAAuB,OAAO,IAAI,OAAO,IAAI,QAAQ,EAAE;gBACrF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,66 @@
+/**
+ * OAuth helper — PKCE flow for provider authentication.
+ *
+ * Implements the Authorization Code flow with PKCE:
+ *   1. Generate code_verifier + code_challenge
+ *   2. Build authorization URL
+ *   3. Open browser (or print URL for manual visit)
+ *   4. Wait for user to paste authorization code
+ *   5. Exchange code for access + refresh tokens
+ *   6. Store tokens via auth/storage.ts
+ *   7. Auto-refresh when expired
+ */
+import { type OAuthCredential } from './storage.js';
+export declare function generateCodeVerifier(): string;
+export declare function generateCodeChallenge(verifier: string): string;
+export interface OAuthProviderConfig {
+    provider: string;
+    client_id: string;
+    auth_url: string;
+    token_url: string;
+    redirect_uri: string;
+    scopes: string[];
+}
+/** Known OAuth configurations for providers. */
+export declare const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig>;
+export interface AuthUrlParams {
+    config: OAuthProviderConfig;
+    code_verifier: string;
+    state?: string;
+}
+export declare function buildAuthUrl(params: AuthUrlParams): string;
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    token_type: string;
+    expires_in?: number;
+    scope?: string;
+}
+export declare function exchangeCode(config: OAuthProviderConfig, code: string, code_verifier: string): Promise<TokenResponse>;
+export declare function refreshToken(config: OAuthProviderConfig, refresh_token: string): Promise<TokenResponse>;
+export declare function storeOAuthTokens(provider: string, tokenResponse: TokenResponse, clientId?: string): Promise<OAuthCredential>;
+/**
+ * Get a valid OAuth access token, refreshing if expired.
+ * Returns null if no OAuth credential exists or refresh fails.
+ */
+export declare function getValidOAuthToken(provider: string): Promise<string | null>;
+/**
+ * Open a URL in the user's default browser.
+ * Falls back to printing the URL if opening fails.
+ */
+export declare function openBrowser(url: string): Promise<boolean>;
+export interface OAuthFlowResult {
+    credential: OAuthCredential;
+    provider: string;
+}
+/**
+ * Run the full interactive OAuth flow.
+ * This is used by the onboarding wizard and `tako models auth` commands.
+ * The caller provides UI functions for prompting the user.
+ */
+export declare function runOAuthFlow(providerKey: string, ui: {
+    log: (msg: string) => void;
+    prompt: (message: string) => Promise<string | null>;
+}): Promise<OAuthFlowResult | null>;
+export declare function validateAnthropicSetupToken(token: string): string | undefined;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAItB,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,gDAAgD;AAChD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAS/D,CAAC;AAIF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAc1D;AAID,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAID,wBAAsB,YAAY,CAChC,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC,CAiBxB;AAID,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,aAAa,EAC5B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAiB1B;AAID;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBjF;AAID;;;GAGG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/D;AA0DD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE;IACF,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACrD,GACA,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAuDjC;AAOD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU7E"}

package/dist/auth/oauth.js

@@ -0,0 +1,253 @@
+/**
+ * OAuth helper — PKCE flow for provider authentication.
+ *
+ * Implements the Authorization Code flow with PKCE:
+ *   1. Generate code_verifier + code_challenge
+ *   2. Build authorization URL
+ *   3. Open browser (or print URL for manual visit)
+ *   4. Wait for user to paste authorization code
+ *   5. Exchange code for access + refresh tokens
+ *   6. Store tokens via auth/storage.ts
+ *   7. Auto-refresh when expired
+ */
+import { randomBytes, createHash } from 'node:crypto';
+import { createServer } from 'node:http';
+import { writeAuthCredential, readAuthCredential, isTokenExpired, } from './storage.js';
+// ─── PKCE ───────────────────────────────────────────────────────────
+export function generateCodeVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+export function generateCodeChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/** Known OAuth configurations for providers. */
+export const OAUTH_PROVIDERS = {
+    'openai-codex': {
+        provider: 'openai-codex',
+        client_id: 'app_EMoamEEZ73f0CkXaXp7hrann',
+        auth_url: 'https://auth.openai.com/oauth/authorize',
+        token_url: 'https://auth.openai.com/oauth/token',
+        redirect_uri: 'http://localhost:1455/auth/callback',
+        scopes: ['openid', 'profile', 'email', 'offline_access'],
+    },
+};
+export function buildAuthUrl(params) {
+    const { config, code_verifier, state } = params;
+    const code_challenge = generateCodeChallenge(code_verifier);
+    const url = new URL(config.auth_url);
+    url.searchParams.set('client_id', config.client_id);
+    url.searchParams.set('redirect_uri', config.redirect_uri);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('scope', config.scopes.join(' '));
+    url.searchParams.set('code_challenge', code_challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    if (state)
+        url.searchParams.set('state', state);
+    return url.toString();
+}
+export async function exchangeCode(config, code, code_verifier) {
+    const res = await fetch(config.token_url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: config.redirect_uri,
+            client_id: config.client_id,
+            code_verifier,
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`Token exchange failed (${res.status}): ${body}`);
+    }
+    return res.json();
+}
+// ─── Token refresh ──────────────────────────────────────────────────
+export async function refreshToken(config, refresh_token) {
+    const res = await fetch(config.token_url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token,
+            client_id: config.client_id,
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`Token refresh failed (${res.status}): ${body}`);
+    }
+    return res.json();
+}
+// ─── Store OAuth tokens ─────────────────────────────────────────────
+export async function storeOAuthTokens(provider, tokenResponse, clientId) {
+    const credential = {
+        provider,
+        auth_method: 'oauth',
+        access_token: tokenResponse.access_token,
+        refresh_token: tokenResponse.refresh_token,
+        expires_at: tokenResponse.expires_in
+            ? Math.floor(Date.now() / 1000) + tokenResponse.expires_in
+            : undefined,
+        token_type: tokenResponse.token_type,
+        scope: tokenResponse.scope,
+        client_id: clientId,
+        created_at: Date.now(),
+    };
+    await writeAuthCredential(credential);
+    return credential;
+}
+// ─── Auto-refresh ───────────────────────────────────────────────────
+/**
+ * Get a valid OAuth access token, refreshing if expired.
+ * Returns null if no OAuth credential exists or refresh fails.
+ */
+export async function getValidOAuthToken(provider) {
+    const cred = await readAuthCredential(provider);
+    if (!cred || cred.auth_method !== 'oauth')
+        return null;
+    if (!isTokenExpired(cred)) {
+        return cred.access_token;
+    }
+    // Try to refresh
+    if (!cred.refresh_token)
+        return null;
+    const config = OAUTH_PROVIDERS[provider];
+    if (!config)
+        return null;
+    try {
+        const tokenResponse = await refreshToken(config, cred.refresh_token);
+        const updated = await storeOAuthTokens(provider, tokenResponse, cred.client_id);
+        return updated.access_token;
+    }
+    catch (err) {
+        console.warn(`[oauth] Failed to refresh token for ${provider}:`, err.message);
+        return null;
+    }
+}
+// ─── Browser opener ─────────────────────────────────────────────────
+/**
+ * Open a URL in the user's default browser.
+ * Falls back to printing the URL if opening fails.
+ */
+export async function openBrowser(url) {
+    try {
+        const { default: open } = await import('open');
+        await open(url);
+        return true;
+    }
+    catch {
+        // open package not available or failed — that's fine
+        return false;
+    }
+}
+// ─── Local OAuth callback server ────────────────────────────────────
+async function startLocalOAuthServer(expectedState) {
+    return new Promise((resolveServer) => {
+        let resolveCode;
+        const codePromise = new Promise((resolve) => {
+            resolveCode = resolve;
+        });
+        const server = createServer((req, res) => {
+            const url = new URL(req.url, `http://localhost:1455`);
+            if (url.pathname === '/auth/callback') {
+                const code = url.searchParams.get('code');
+                const state = url.searchParams.get('state');
+                if (state && state !== expectedState) {
+                    res.writeHead(400, { 'Content-Type': 'text/plain' });
+                    res.end('State mismatch');
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end('<html><head><title>Authentication successful</title></head>' +
+                    '<body><h2>\uD83D\uDC19 Tako — Authentication successful!</h2>' +
+                    '<p>Return to your terminal to continue.</p></body></html>');
+                if (code) {
+                    resolveCode({ code });
+                }
+            }
+        });
+        server.listen(1455, '127.0.0.1', () => {
+            resolveServer({
+                waitForCode: () => codePromise,
+                cancelWait: () => resolveCode(null),
+                close: () => server.close(),
+            });
+        });
+        // Timeout after 120 seconds
+        setTimeout(() => {
+            resolveCode(null);
+            server.close();
+        }, 120_000);
+    });
+}
+/**
+ * Run the full interactive OAuth flow.
+ * This is used by the onboarding wizard and `tako models auth` commands.
+ * The caller provides UI functions for prompting the user.
+ */
+export async function runOAuthFlow(providerKey, ui) {
+    const config = OAUTH_PROVIDERS[providerKey];
+    if (!config) {
+        ui.log(`Unknown OAuth provider: ${providerKey}`);
+        return null;
+    }
+    // Generate PKCE + state
+    const code_verifier = generateCodeVerifier();
+    const state = randomBytes(16).toString('hex');
+    const authUrl = buildAuthUrl({ config, code_verifier, state });
+    // Start local callback server
+    const server = await startLocalOAuthServer(state);
+    // Open browser
+    ui.log('Opening browser for authentication...');
+    const opened = await openBrowser(authUrl);
+    if (!opened) {
+        ui.log('Could not open browser. Visit this URL manually:');
+    }
+    ui.log(authUrl);
+    // Race: wait for callback OR manual paste as fallback
+    let code = null;
+    const callbackResult = await Promise.race([
+        server.waitForCode(),
+        ui.prompt('Waiting for browser callback... Or paste the redirect URL/code:').then((input) => {
+            if (!input)
+                return null;
+            try {
+                const url = new URL(input.trim());
+                return { code: url.searchParams.get('code') || input.trim() };
+            }
+            catch {
+                return { code: input.trim() };
+            }
+        }),
+    ]);
+    server.close();
+    if (callbackResult?.code) {
+        code = callbackResult.code;
+    }
+    if (!code) {
+        ui.log('No authorization code received.');
+        return null;
+    }
+    // Exchange code for tokens
+    const tokenResponse = await exchangeCode(config, code, code_verifier);
+    const credential = await storeOAuthTokens(providerKey, tokenResponse, config.client_id);
+    return { credential, provider: providerKey };
+}
+// ─── Anthropic setup-token helpers ──────────────────────────────────
+const ANTHROPIC_SETUP_TOKEN_PREFIX = 'sk-ant-oat01-';
+const ANTHROPIC_SETUP_TOKEN_MIN_LENGTH = 80;
+export function validateAnthropicSetupToken(token) {
+    const trimmed = token.trim();
+    if (!trimmed)
+        return 'Required';
+    if (!trimmed.startsWith(ANTHROPIC_SETUP_TOKEN_PREFIX)) {
+        return `Expected token starting with ${ANTHROPIC_SETUP_TOKEN_PREFIX}`;
+    }
+    if (trimmed.length < ANTHROPIC_SETUP_TOKEN_MIN_LENGTH) {
+        return 'Token looks too short; paste the full setup-token';
+    }
+    return undefined;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GAEf,MAAM,cAAc,CAAC;AAEtB,uEAAuE;AAEvE,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAaD,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAwC;IAClE,cAAc,EAAE;QACd,QAAQ,EAAE,cAAc;QACxB,SAAS,EAAE,8BAA8B;QACzC,QAAQ,EAAE,yCAAyC;QACnD,SAAS,EAAE,qCAAqC;QAChD,YAAY,EAAE,qCAAqC;QACnD,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;KACzD;CACF,CAAC;AAUF,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAChD,MAAM,cAAc,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEhD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA2B,EAC3B,IAAY,EACZ,aAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa;SACd,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAA4B,CAAC;AAC9C,CAAC;AAED,uEAAuE;AAEvE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA2B,EAC3B,aAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAA4B,CAAC;AAC9C,CAAC;AAED,uEAAuE;AAEvE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,aAA4B,EAC5B,QAAiB;IAEjB,MAAM,UAAU,GAAoB;QAClC,QAAQ;QACR,WAAW,EAAE,OAAO;QACpB,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,UAAU,EAAE,aAAa,CAAC,UAAU;YAClC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,UAAU;YAC1D,CAAC,CAAC,SAAS;QACb,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;IAEF,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAEvD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,YAAY,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,uCAAuC,QAAQ,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IAKxD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;QACnC,IAAI,WAAsD,CAAC;QAC3D,MAAM,WAAW,GAAG,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,EAAE;YACnE,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,uBAAuB,CAAC,CAAC;YACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBAC1B,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,6DAA6D;oBAC7D,+DAA+D;oBAC/D,2DAA2D,CAC5D,CAAC;gBAEF,IAAI,IAAI,EAAE,CAAC;oBACT,WAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,aAAa,CAAC;gBACZ,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW;gBAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,WAAY,CAAC,IAAI,CAAC;gBACpC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,4BAA4B;QAC5B,UAAU,CAAC,GAAG,EAAE;YACd,WAAY,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAmB,EACnB,EAGC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,EAAE,CAAC,GAAG,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/D,8BAA8B;IAC9B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAElD,eAAe;IACf,EAAE,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC7D,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEhB,sDAAsD;IACtD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QACxC,MAAM,CAAC,WAAW,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,iEAAiE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,IAAI,cAAc,EAAE,IAAI,EAAE,CAAC;QACzB,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAExF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED,uEAAuE;AAEvE,MAAM,4BAA4B,GAAG,eAAe,CAAC;AACrD,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAE5C,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAChC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACtD,OAAO,gCAAgC,4BAA4B,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,gCAAgC,EAAE,CAAC;QACtD,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}