@vybestack/llxprt-code-auth 0.11.0 → 0.12.0-nightly.260910.2aac6841e

package/dist/src/index.d.ts

@@ -9,7 +9,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 export type * from './interfaces/index.js';
-export type { OAuthUIEvent, OAuthUIEventType, OAuthUICallback, } from './oauth-ui-events.js';
+export type { OAuthUIEvent, OAuthUIEventType, OAuthUICallback, OAuthInteractiveAuthOutcomeKind, } from './oauth-ui-events.js';
 export { OAuthUIBridge, oauthUIBridge, OAUTH_UI_MAX_PENDING, } from './oauth-ui-bridge.js';
 export type { OAuthToken, CodexOAuthToken, AuthStatus, BucketStats, DeviceCodeResponse, } from './types.js';
 export { OAuthTokenSchema, CodexOAuthTokenSchema, AuthStatusSchema, BucketStatsSchema, DeviceCodeResponseSchema, } from './types.js';
@@ -19,7 +19,7 @@ export { OAuthError, OAuthErrorFactory, OAuthErrorCategory, OAuthErrorType, Retr
 export type { RetryConfig } from './oauth-errors.js';
 export { mergeRefreshedToken } from './token-merge.js';
 export type { OAuthTokenWithExtras } from './token-merge.js';
-export { sanitizeTokenForProxy } from './token-sanitization.js';
+export { SanitizedOAuthTokenSchema, sanitizeTokenForProxy, } from './token-sanitization.js';
 export type { SanitizedOAuthToken } from './token-sanitization.js';
 export { AuthPrecedenceResolver } from './auth-precedence-resolver.js';
 export type { ResolveAuthOptions } from './auth-precedence-resolver.js';
@@ -33,5 +33,6 @@ export { encodeFrame, FrameDecoder, FrameError, MAX_FRAME_SIZE, V1_MAX_FRAME_SIZ
 export type { FrameDecoderOptions } from './proxy/framing.js';
 export { ProxySocketClient, REQUEST_TIMEOUT_MS, IDLE_TIMEOUT_MS, PROTOCOL_VERSION, } from './proxy/proxy-socket-client.js';
 export type { ProxyResponse, RequestOptions, } from './proxy/proxy-socket-client.js';
+export { ProxyResponseSchema, OAuthTokenDataSchema, ProvidersDataSchema, BucketsDataSchema, BucketStatsDataSchema, ApiKeyDataSchema, ApiKeysDataSchema, HasApiKeyDataSchema, } from './proxy/proxy-payload-schemas.js';
 export { ProxyTokenStore } from './proxy/proxy-token-store.js';
 export { ProxyProviderKeyStorage } from './proxy/proxy-provider-key-storage.js';

package/dist/src/index.js

@@ -11,7 +11,7 @@ export { KeyringTokenStore } from './keyring-token-store.js';
 export { OAuthError, OAuthErrorFactory, OAuthErrorCategory, OAuthErrorType, RetryHandler, GracefulErrorHandler, } from './oauth-errors.js';
 // ─── Token Utilities ─────────────────────────────────────────────────────────
 export { mergeRefreshedToken } from './token-merge.js';
-export { sanitizeTokenForProxy } from './token-sanitization.js';
+export { SanitizedOAuthTokenSchema, sanitizeTokenForProxy, } from './token-sanitization.js';
 // ─── Precedence / Auth Resolution ────────────────────────────────────────────
 export { AuthPrecedenceResolver } from './auth-precedence-resolver.js';
 export { CredentialResolutionError } from './credential-resolution-error.js';
@@ -22,6 +22,7 @@ export { CodexDeviceFlow, CODEX_CONFIG } from './flows/codex-device-flow.js';
 // ─── Proxy Infrastructure ────────────────────────────────────────────────────
 export { encodeFrame, FrameDecoder, FrameError, MAX_FRAME_SIZE, V1_MAX_FRAME_SIZE, PARTIAL_FRAME_TIMEOUT_MS, } from './proxy/framing.js';
 export { ProxySocketClient, REQUEST_TIMEOUT_MS, IDLE_TIMEOUT_MS, PROTOCOL_VERSION, } from './proxy/proxy-socket-client.js';
+export { ProxyResponseSchema, OAuthTokenDataSchema, ProvidersDataSchema, BucketsDataSchema, BucketStatsDataSchema, ApiKeyDataSchema, ApiKeysDataSchema, HasApiKeyDataSchema, } from './proxy/proxy-payload-schemas.js';
 export { ProxyTokenStore } from './proxy/proxy-token-store.js';
 export { ProxyProviderKeyStorage } from './proxy/proxy-provider-key-storage.js';
 //# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH,OAAO,EACL,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAapB,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,gFAAgF;AAChF,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,gFAAgF;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAS7E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EACf,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAYzB,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE7E,gFAAgF;AAChF,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,OAAO,EACL,aAAa,EACb,aAAa,EACb,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAapB,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,gFAAgF;AAChF,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAGjC,gFAAgF;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAS7E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EACf,8BAA8B,EAC9B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAYzB,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAE7E,gFAAgF;AAChF,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/src/mcp-auth-provider-type.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * How an MCP server authenticates (#3305).
+ *
+ * Lives here rather than in `core` so that `@vybestack/llxprt-code-mcp` can
+ * reach it without depending on `core`, which value-imports `mcp` and would
+ * therefore form a runtime cycle. This package is a dependency-graph leaf, so
+ * both `core` and `mcp` can depend on it.
+ */
+export declare enum AuthProviderType {
+    DYNAMIC_DISCOVERY = "dynamic_discovery",
+    GOOGLE_CREDENTIALS = "google_credentials",
+    SERVICE_ACCOUNT_IMPERSONATION = "service_account_impersonation"
+}

package/dist/src/mcp-auth-provider-type.js

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * How an MCP server authenticates (#3305).
+ *
+ * Lives here rather than in `core` so that `@vybestack/llxprt-code-mcp` can
+ * reach it without depending on `core`, which value-imports `mcp` and would
+ * therefore form a runtime cycle. This package is a dependency-graph leaf, so
+ * both `core` and `mcp` can depend on it.
+ */
+export var AuthProviderType;
+(function (AuthProviderType) {
+    AuthProviderType["DYNAMIC_DISCOVERY"] = "dynamic_discovery";
+    AuthProviderType["GOOGLE_CREDENTIALS"] = "google_credentials";
+    AuthProviderType["SERVICE_ACCOUNT_IMPERSONATION"] = "service_account_impersonation";
+})(AuthProviderType || (AuthProviderType = {}));
+//# sourceMappingURL=mcp-auth-provider-type.js.map

package/dist/src/mcp-auth-provider-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-provider-type.js","sourceRoot":"","sources":["../../src/mcp-auth-provider-type.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,2DAAuC,CAAA;IACvC,6DAAyC,CAAA;IACzC,mFAA+D,CAAA;AACjE,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B"}

package/dist/src/oauth-ui-events.d.ts

@@ -15,8 +15,13 @@
  * OAuth providers emit these event kinds; this seam lets the providers live
  * in `@vybestack/llxprt-code-auth` without importing UI types.
  */
+/**
+ * @plan PLAN-20260827-ISSUE2562.P05
+ * @requirement REQ-2562-4
+ */
 /** The set of OAuth UI event discriminator values. */
-export type OAuthUIEventType = 'info' | 'warning' | 'error' | 'oauth_url';
+export type OAuthUIEventType = 'info' | 'warning' | 'error' | 'oauth_url' | 'oauth_waiting' | 'oauth_settled';
+export type OAuthInteractiveAuthOutcomeKind = 'succeeded' | 'cancelled' | 'failed' | 'timed_out';
 /**
  * Discriminated union of all OAuth UI events.
  *
@@ -24,6 +29,8 @@ export type OAuthUIEventType = 'info' | 'warning' | 'error' | 'oauth_url';
  * - `warning`: a non-fatal warning message (e.g. a recoverable fallback).
  * - `error`: a non-fatal error message.
  * - `oauth_url`: an authorization URL the user must visit.
+ * - `oauth_waiting`: a host-owned interactive authentication session is waiting.
+ * - `oauth_settled`: a host-owned interactive authentication session settled.
  */
 export type OAuthUIEvent = {
     readonly type: 'info';
@@ -40,6 +47,21 @@ export type OAuthUIEvent = {
     readonly type: 'oauth_url';
     readonly text: string;
     readonly url: string;
+} | {
+    readonly type: 'oauth_waiting';
+    readonly provider: string;
+    readonly bucket?: string;
+    readonly requesterRuntimeKind: string;
+    readonly correlationId: string;
+    readonly waiterCount: number;
+} | {
+    readonly type: 'oauth_settled';
+    readonly provider: string;
+    readonly bucket?: string;
+    readonly requesterRuntimeKind: string;
+    readonly correlationId: string;
+    readonly waiterCount: number;
+    readonly kind: OAuthInteractiveAuthOutcomeKind;
 };
 /**
  * Callback invoked when an {@link OAuthUIEvent} is emitted to a handler.

package/dist/src/proxy/proxy-payload-schemas.d.ts

@@ -0,0 +1,130 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Narrowly scoped schemas that validate credential-proxy payloads at the
+ * IPC trust boundary (issue #2197). Successful response envelopes and
+ * operation-specific data are parsed with these before use.
+ */
+import { z } from 'zod';
+/**
+ * Stable error message for a successful response whose data does not match its
+ * operation schema. Used at every client payload boundary.
+ */
+export declare const PROXY_PAYLOAD_ERROR = "PROXY_PAYLOAD_ERROR";
+export declare function proxyPayloadError(message: string): Error;
+/**
+ * Response envelope schema. `ok` must be boolean; `data` must be a
+ * non-null, non-array object when present; `error`, `code`, and
+ * `retryAfter` must have their protocol types when present. Unknown envelope
+ * fields, including the request `id`, are preserved so the same schema validates
+ * handshake and correlated frames.
+ */
+export declare const ProxyResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    error: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    retryAfter: z.ZodOptional<z.ZodNumber>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    error: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    retryAfter: z.ZodOptional<z.ZodNumber>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    error: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    retryAfter: z.ZodOptional<z.ZodNumber>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ProxyResponse = z.infer<typeof ProxyResponseSchema>;
+/** Success payload for get_token. Validates and preserves the full OAuth token. */
+export declare const OAuthTokenDataSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/** Success payload for list_providers. */
+export declare const ProvidersDataSchema: z.ZodObject<{
+    providers: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    providers: string[];
+}, {
+    providers: string[];
+}>;
+/** Success payload for list_buckets. */
+export declare const BucketsDataSchema: z.ZodObject<{
+    buckets: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    buckets: string[];
+}, {
+    buckets: string[];
+}>;
+/** Success payload for get_bucket_stats. */
+export declare const BucketStatsDataSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    requestCount: z.ZodNumber;
+    percentage: z.ZodNumber;
+    lastUsed: z.ZodOptional<z.ZodNumber>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    bucket: z.ZodString;
+    requestCount: z.ZodNumber;
+    percentage: z.ZodNumber;
+    lastUsed: z.ZodOptional<z.ZodNumber>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    bucket: z.ZodString;
+    requestCount: z.ZodNumber;
+    percentage: z.ZodNumber;
+    lastUsed: z.ZodOptional<z.ZodNumber>;
+}, z.ZodTypeAny, "passthrough">>;
+/** Success payload for get_api_key. */
+export declare const ApiKeyDataSchema: z.ZodObject<{
+    key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+}, {
+    key: string;
+}>;
+/** Success payload for list_api_keys. */
+export declare const ApiKeysDataSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    keys: string[];
+}, {
+    keys: string[];
+}>;
+/** Success payload for has_api_key. */
+export declare const HasApiKeyDataSchema: z.ZodObject<{
+    exists: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    exists: boolean;
+}, {
+    exists: boolean;
+}>;
+/**
+ * Parses an operation-specific successful payload with the given schema. When
+ * the data is missing, malformed, or wrong-typed, throws the stable proxy
+ * payload validation error.
+ */
+export declare function parseSuccessPayload<T>(schema: z.ZodType<T, z.ZodTypeDef, unknown>, data: Record<string, unknown> | undefined, operation: string): T;

package/dist/src/proxy/proxy-payload-schemas.js

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Narrowly scoped schemas that validate credential-proxy payloads at the
+ * IPC trust boundary (issue #2197). Successful response envelopes and
+ * operation-specific data are parsed with these before use.
+ */
+import { z } from 'zod';
+import { OAuthTokenSchema, BucketStatsSchema } from '../types.js';
+/**
+ * Stable error message for a successful response whose data does not match its
+ * operation schema. Used at every client payload boundary.
+ */
+export const PROXY_PAYLOAD_ERROR = 'PROXY_PAYLOAD_ERROR';
+export function proxyPayloadError(message) {
+    return new Error(`${PROXY_PAYLOAD_ERROR}: ${message}`);
+}
+/**
+ * Response envelope schema. `ok` must be boolean; `data` must be a
+ * non-null, non-array object when present; `error`, `code`, and
+ * `retryAfter` must have their protocol types when present. Unknown envelope
+ * fields, including the request `id`, are preserved so the same schema validates
+ * handshake and correlated frames.
+ */
+export const ProxyResponseSchema = z
+    .object({
+    ok: z.boolean(),
+    data: z.record(z.string(), z.unknown()).optional(),
+    error: z.string().optional(),
+    code: z.string().optional(),
+    retryAfter: z.number().optional(),
+})
+    .passthrough();
+/** Success payload for get_token. Validates and preserves the full OAuth token. */
+export const OAuthTokenDataSchema = OAuthTokenSchema.passthrough();
+/** Success payload for list_providers. */
+export const ProvidersDataSchema = z.object({
+    providers: z.array(z.string()),
+});
+/** Success payload for list_buckets. */
+export const BucketsDataSchema = z.object({ buckets: z.array(z.string()) });
+/** Success payload for get_bucket_stats. */
+export const BucketStatsDataSchema = BucketStatsSchema.passthrough();
+/** Success payload for get_api_key. */
+export const ApiKeyDataSchema = z.object({ key: z.string() });
+/** Success payload for list_api_keys. */
+export const ApiKeysDataSchema = z.object({ keys: z.array(z.string()) });
+/** Success payload for has_api_key. */
+export const HasApiKeyDataSchema = z.object({ exists: z.boolean() });
+/**
+ * Parses an operation-specific successful payload with the given schema. When
+ * the data is missing, malformed, or wrong-typed, throws the stable proxy
+ * payload validation error.
+ */
+export function parseSuccessPayload(schema, data, operation) {
+    if (data === undefined) {
+        throw proxyPayloadError(`${operation}: missing data`);
+    }
+    const parsed = schema.safeParse(data);
+    if (!parsed.success) {
+        throw proxyPayloadError(`${operation}: malformed payload`);
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=proxy-payload-schemas.js.map

package/dist/src/proxy/proxy-payload-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-payload-schemas.js","sourceRoot":"","sources":["../../../src/proxy/proxy-payload-schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,KAAK,CAAC,GAAG,mBAAmB,KAAK,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;AAEnE,0CAA0C;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC/B,CAAC,CAAC;AAEH,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;AAErE,uCAAuC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE9D,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzE,uCAAuC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAErE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2C,EAC3C,IAAyC,EACzC,SAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CAAC,GAAG,SAAS,gBAAgB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,iBAAiB,CAAC,GAAG,SAAS,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/src/proxy/proxy-provider-key-storage.js

@@ -3,6 +3,7 @@
  * Copyright 2025 Vybestack LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { ApiKeyDataSchema, ApiKeysDataSchema, HasApiKeyDataSchema, parseSuccessPayload, } from './proxy-payload-schemas.js';
 export class ProxyProviderKeyStorage {
     client;
     constructor(client) {
@@ -15,21 +16,22 @@ export class ProxyProviderKeyStorage {
                 return null;
             throw new Error(response.error ?? 'proxy error');
         }
-        return response.data.key;
+        return parseSuccessPayload(ApiKeyDataSchema, response.data, 'get_api_key')
+            .key;
     }
     async listKeys() {
         const response = await this.client.request('list_api_keys', {});
         if (!response.ok) {
             throw new Error(response.error ?? 'proxy error');
         }
-        return response.data.keys;
+        return parseSuccessPayload(ApiKeysDataSchema, response.data, 'list_api_keys').keys;
     }
     async hasKey(name) {
         const response = await this.client.request('has_api_key', { name });
         if (!response.ok) {
             throw new Error(response.error ?? 'proxy error');
         }
-        return response.data.exists;
+        return parseSuccessPayload(HasApiKeyDataSchema, response.data, 'has_api_key').exists;
     }
     async saveKey(_name, _apiKey) {
         throw new Error('API key management is not available in sandbox mode');

package/dist/src/proxy/proxy-provider-key-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-provider-key-storage.js","sourceRoot":"","sources":["../../../src/proxy/proxy-provider-key-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,MAAM,OAAO,uBAAuB;IACjB,MAAM,CAAoB;IAE3C,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAK,CAAC,GAAa,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAK,CAAC,IAAgB,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAK,CAAC,MAAiB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAe;QAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"proxy-provider-key-storage.js","sourceRoot":"","sources":["../../../src/proxy/proxy-provider-key-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,OAAO,uBAAuB;IACjB,MAAM,CAAoB;IAE3C,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;aACvE,GAAG,CAAC;IACT,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,mBAAmB,CACxB,iBAAiB,EACjB,QAAQ,CAAC,IAAI,EACb,eAAe,CAChB,CAAC,IAAI,CAAC;IACT,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,mBAAmB,CACxB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,EACb,aAAa,CACd,CAAC,MAAM,CAAC;IACX,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAe;QAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/src/proxy/proxy-socket-client.d.ts

@@ -3,16 +3,11 @@
  * Copyright 2025 Vybestack LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { type ProxyResponse } from './proxy-payload-schemas.js';
+export type { ProxyResponse } from './proxy-payload-schemas.js';
 export declare const REQUEST_TIMEOUT_MS = 30000;
 export declare const IDLE_TIMEOUT_MS = 300000;
 export declare const PROTOCOL_VERSION = 2;
-export type ProxyResponse = {
-    ok: boolean;
-    data?: Record<string, unknown>;
-    error?: string;
-    code?: string;
-    retryAfter?: number;
-};
 /**
  * Per-request options controlling timeout and cancellation.
  *

package/dist/src/proxy/proxy-socket-client.js

@@ -13,27 +13,15 @@
 import * as net from 'node:net';
 import * as crypto from 'node:crypto';
 import { encodeFrame, FrameDecoder } from './framing.js';
+import { ProxyResponseSchema, } from './proxy-payload-schemas.js';
 export const REQUEST_TIMEOUT_MS = 30000;
 export const IDLE_TIMEOUT_MS = 300000;
 export const PROTOCOL_VERSION = 2;
-/** Validates that a decoded frame has the shape of a ProxyResponse, guarding
- *  against adversarial or malformed server responses with unexpected types
- *  for `ok`, `code`, or `error`. */
-function isProxyResponseFrame(frame) {
-    if (typeof frame.ok !== 'boolean')
-        return false;
-    if (frame.code !== undefined && typeof frame.code !== 'string')
-        return false;
-    if (frame.error !== undefined && typeof frame.error !== 'string')
-        return false;
-    if (frame.retryAfter !== undefined && typeof frame.retryAfter !== 'number')
-        return false;
-    if (frame.data !== undefined &&
-        (typeof frame.data !== 'object' ||
-            frame.data === null ||
-            Array.isArray(frame.data)))
-        return false;
-    return true;
+function parseResponseFrame(frame) {
+    const parsed = ProxyResponseSchema.safeParse(frame);
+    if (!parsed.success)
+        return null;
+    return parsed.data;
 }
 const PROXY_CONNECT_FAILURE_PATTERN = /connect (?:ECONNREFUSED|ENOENT|EACCES|EHOSTUNREACH|ENETUNREACH|ETIMEDOUT|EPERM|ENOTDIR)/i;
 export class ProxyRequestError extends Error {
@@ -412,8 +400,9 @@ export class ProxySocketClient {
             return;
         }
         this.handshakeResolver = null;
-        if (isProxyResponseFrame(frame)) {
-            resolver.resolve(frame);
+        const parsedFrame = parseResponseFrame(frame);
+        if (parsedFrame !== null) {
+            resolver.resolve(parsedFrame);
         }
         else {
             // Reject first, then clean up. destroy() will not double-reject
@@ -433,7 +422,7 @@ export class ProxySocketClient {
      */
     resolvePendingRequest(frame) {
         const id = frame.id;
-        if (!id) {
+        if (typeof id !== 'string' || id === '') {
             return;
         }
         const pending = this.pendingRequests.get(id);
@@ -441,8 +430,9 @@ export class ProxySocketClient {
             clearTimeout(pending.timer);
             this.pendingRequests.delete(id);
             this.releaseAbortCleanup(id);
-            if (isProxyResponseFrame(frame)) {
-                pending.resolve(frame);
+            const parsedFrame = parseResponseFrame(frame);
+            if (parsedFrame !== null) {
+                pending.resolve(parsedFrame);
             }
             else {
                 pending.reject(new Error(`Malformed response for request ${id}`));

package/dist/src/proxy/proxy-socket-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-socket-client.js","sourceRoot":"","sources":["../../../src/proxy/proxy-socket-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAwBlC;;oCAEoC;AACpC,SAAS,oBAAoB,CAC3B,KAA8B;IAE9B,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC9D,OAAO,KAAK,CAAC;IACf,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACxE,OAAO,KAAK,CAAC;IACf,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC7B,KAAK,CAAC,IAAI,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,6BAA6B,GACjC,0FAA0F,CAAC;AAE7F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,cAAc,CAAU;IAEjC,YAAY,KAAc,EAAE,cAAuB;QACjD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;CACF;AAQD,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAS;IACnB,eAAe,CAAqB;IAC7C,MAAM,GAAsB,IAAI,CAAC;IACjC,OAAO,GAAiB,IAAI,YAAY,CAAC;QAC/C,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;KAC9D,CAAC,CAAC;IACK,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IACjE;;;;;OAKG;IACK,aAAa,GAA4B,IAAI,GAAG,EAAE,CAAC;IAE3D;;;;;OAKG;IACK,mBAAmB,CAAC,EAAU;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB;QAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IACO,iBAAiB,GAAY,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACK,kBAAkB,GAAW,gBAAgB,CAAC;IAEtD,oEAAoE;IACpE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IACO,SAAS,GAAyC,IAAI,CAAC;IACvD,iBAAiB,GAAyB,IAAI,CAAC;IAC/C,iBAAiB,GAGd,IAAI,CAAC;IAEhB,YAAY,UAAkB,EAAE,eAAwB;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,wBAAwB,GAC5B,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9C,OAAO,wBAAwB,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CAAC,MAAkB;QACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,IAAI,KAAK,CAAC,wDAAwD,CAAC,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAgC,EAChC,OAAwB;QAExB,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;YACnC,IAAI,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClD,wBAAwB,GAAG,IAAI,CAAC;gBAChC,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC;gBACrD,cAAc,GAAG,IAAI,CAAC;gBACtB,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,KAAK,CAAC;YACpD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,6BAA6B,GACjC,CAAC,wBAAwB;gBACzB,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,iBAAiB,CACzB,KAAK,EACL,cAAc,IAAI,6BAA6B,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CACjB,EAAU,EACV,OAAgC,EAChC,OAAwB;QAExB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC;QAE3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,IAAI,CAAC,CAAC,CAAC;gBAC5D,mEAAmE;gBACnE,mEAAmE;gBACnE,iDAAiD;gBACjD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,qEAAqE;gBACrE,8DAA8D;gBAC9D,gEAAgE;gBAChE,oEAAoE;gBACpE,cAAc;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO;oBAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBAC7B,wDAAwD;gBACxD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,YAAY,GAAG,GAAS,EAAE;gBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;oBAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChB,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;oBAC/C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,6CAA6C;YAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAC9B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAU;QACf,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO;QAChC,MAAM,WAAW,GAAG;YAClB,CAAC,EAAE,IAAI,CAAC,kBAAkB;YAC1B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,EAAE,EAAE,QAAQ;YACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC1B,CAAC;QACF,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,aAAa;QACX,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC;YAC9B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,4EAA4E;QAC5E,gEAAgE;IAClE,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAA4B,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,gBAAgB;YACnB,EAAE,EAAE,WAAW;YACf,OAAO;SACR,CAAC;QACF,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpE,IAAI,CAAC,iBAAiB,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,kBAAkB,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEvB,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACvD,IAAI,CAAC,iBAAiB,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,cAAc,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,0CAA0C;oBACxC,CAAC,QAAQ,CAAC,KAAK,IAAI,qCAAqC,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,kBAAkB;gBAChB,QAAQ;gBACR,IAAI;gBACJ,CAAC,QAAQ,CAAC,KAAK,IAAI,eAAe,CAAC,CACtC,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,OAA6B,CAAC;QACnE,IAAI,CAAC,kBAAkB;YACrB,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAAE,OAAO;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAA8B;QACjD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IAC9B,CAAC;IAEO,gBAAgB,CAAC,KAA8B;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,sDAAsD;YACtD,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAAC,KAA8B;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,EAAwB,CAAC;QAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAW;QACzB,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACzE,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,yBAAyB;QAC/B,IAAI,CAAC,OAAO,CACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClC,sEAAsE;YACtE,+DAA+D;YAC/D,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,qBAAqB;QACrB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"proxy-socket-client.js","sourceRoot":"","sources":["../../../src/proxy/proxy-socket-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EACL,mBAAmB,GAEpB,MAAM,4BAA4B,CAAC;AAIpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAgBlC,SAAS,kBAAkB,CACzB,KAA8B;IAE9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,6BAA6B,GACjC,0FAA0F,CAAC;AAE7F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,cAAc,CAAU;IAEjC,YAAY,KAAc,EAAE,cAAuB;QACjD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;CACF;AAQD,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAS;IACnB,eAAe,CAAqB;IAC7C,MAAM,GAAsB,IAAI,CAAC;IACjC,OAAO,GAAiB,IAAI,YAAY,CAAC;QAC/C,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;KAC9D,CAAC,CAAC;IACK,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IACjE;;;;;OAKG;IACK,aAAa,GAA4B,IAAI,GAAG,EAAE,CAAC;IAE3D;;;;;OAKG;IACK,mBAAmB,CAAC,EAAU;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,uBAAuB;QAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IACO,iBAAiB,GAAY,KAAK,CAAC;IAC3C;;;;;;;;OAQG;IACK,kBAAkB,GAAW,gBAAgB,CAAC;IAEtD,oEAAoE;IACpE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IACO,SAAS,GAAyC,IAAI,CAAC;IACvD,iBAAiB,GAAyB,IAAI,CAAC;IAC/C,iBAAiB,GAGd,IAAI,CAAC;IAEhB,YAAY,UAAkB,EAAE,eAAwB;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,wBAAwB,GAC5B,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9C,OAAO,wBAAwB,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CAAC,MAAkB;QACxD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,IAAI,KAAK,CAAC,wDAAwD,CAAC,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAgC,EAChC,OAAwB;QAExB,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;YACnC,IAAI,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClD,wBAAwB,GAAG,IAAI,CAAC;gBAChC,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC;gBACrD,cAAc,GAAG,IAAI,CAAC;gBACtB,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,KAAK,CAAC;YACpD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,6BAA6B,GACjC,CAAC,wBAAwB;gBACzB,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,iBAAiB,CACzB,KAAK,EACL,cAAc,IAAI,6BAA6B,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CACjB,EAAU,EACV,OAAgC,EAChC,OAAwB;QAExB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC;QAE3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,IAAI,CAAC,CAAC,CAAC;gBAC5D,mEAAmE;gBACnE,mEAAmE;gBACnE,iDAAiD;gBACjD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,qEAAqE;gBACrE,8DAA8D;gBAC9D,gEAAgE;gBAChE,oEAAoE;gBACpE,cAAc;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO;oBAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBAC7B,wDAAwD;gBACxD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,YAAY,GAAG,GAAS,EAAE;gBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;oBAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChB,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;oBAC/C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,6CAA6C;YAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAC9B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAU;QACf,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO;QAChC,MAAM,WAAW,GAAG;YAClB,CAAC,EAAE,IAAI,CAAC,kBAAkB;YAC1B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,EAAE,EAAE,QAAQ;YACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC1B,CAAC;QACF,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,aAAa;QACX,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC;YAC9B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,4EAA4E;QAC5E,gEAAgE;IAClE,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAA4B,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,gBAAgB;YACnB,EAAE,EAAE,WAAW;YACf,OAAO;SACR,CAAC;QACF,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpE,IAAI,CAAC,iBAAiB,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,kBAAkB,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEvB,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACvD,IAAI,CAAC,iBAAiB,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,cAAc,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,0CAA0C;oBACxC,CAAC,QAAQ,CAAC,KAAK,IAAI,qCAAqC,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,kBAAkB;gBAChB,QAAQ;gBACR,IAAI;gBACJ,CAAC,QAAQ,CAAC,KAAK,IAAI,eAAe,CAAC,CACtC,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;QAC7C,IAAI,CAAC,kBAAkB;YACrB,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAAE,OAAO;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAA8B;QACjD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IAC9B,CAAC;IAEO,gBAAgB,CAAC,KAA8B;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,sDAAsD;YACtD,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,qBAAqB,CAAC,KAA8B;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAW;QACzB,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACzE,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,yBAAyB;QAC/B,IAAI,CAAC,OAAO,CACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAClC,sEAAsE;YACtE,+DAA+D;YAC/D,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,qBAAqB;QACrB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB;QACvB,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}

package/dist/src/proxy/proxy-token-store.js

@@ -3,6 +3,7 @@
  * Copyright 2025 Vybestack LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { OAuthTokenDataSchema, parseSuccessPayload, ProvidersDataSchema, BucketsDataSchema, BucketStatsDataSchema, } from './proxy-payload-schemas.js';
 import { ProxySocketClient } from './proxy-socket-client.js';
 export class ProxyTokenStore {
     client;
@@ -18,7 +19,7 @@ export class ProxyTokenStore {
             return null;
         if (!response.ok)
             throw new Error(response.error ?? 'proxy error');
-        return response.data;
+        return parseSuccessPayload(OAuthTokenDataSchema, response.data, 'get_token');
     }
     async saveToken(provider, token, bucket) {
         const response = await this.client.request('save_token', {
@@ -39,15 +40,20 @@ export class ProxyTokenStore {
     }
     async listProviders() {
         const response = await this.client.request('list_providers', {});
-        if (!response.ok)
+        if (!response.ok) {
             throw new Error(response.error ?? 'proxy error');
-        return response.data.providers;
+        }
+        return parseSuccessPayload(ProvidersDataSchema, response.data, 'list_providers').providers;
     }
     async listBuckets(provider) {
-        const response = await this.client.request('list_buckets', { provider });
-        if (!response.ok)
+        const response = await this.client.request('list_buckets', {
+            provider,
+        });
+        if (!response.ok) {
             throw new Error(response.error ?? 'proxy error');
-        return response.data.buckets;
+        }
+        return parseSuccessPayload(BucketsDataSchema, response.data, 'list_buckets')
+            .buckets;
     }
     async getBucketStats(provider, bucket) {
         const response = await this.client.request('get_bucket_stats', {
@@ -58,13 +64,7 @@ export class ProxyTokenStore {
             return null;
         if (!response.ok)
             throw new Error(response.error ?? 'proxy error');
-        const data = response.data;
-        return {
-            bucket,
-            requestCount: typeof data.requestCount === 'number' ? data.requestCount : 0,
-            percentage: typeof data.percentage === 'number' ? data.percentage : 0,
-            lastUsed: data.lastUsed,
-        };
+        return parseSuccessPayload(BucketStatsDataSchema, response.data, 'get_bucket_stats');
     }
     async acquireRefreshLock(_provider, _options) {
         return true;

package/dist/src/proxy/proxy-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-token-store.js","sourceRoot":"","sources":["../../../src/proxy/proxy-token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,OAAO,eAAe;IACT,MAAM,CAAoB;IAE3C,YAAY,UAAkB,EAAE,eAAwB;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,iBAAiB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;YACtD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,IAA6B,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,KAAiB,EACjB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;YACvD,QAAQ;YACR,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,MAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE;YACzD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAQ,QAAQ,CAAC,IAAgC,CAAC,SAAqB,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAQ,QAAQ,CAAC,IAAgC,CAAC,OAAmB,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE;YAC7D,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;QACtD,OAAO;YACL,MAAM;YACN,YAAY,EACV,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/D,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAA8B;SAC9C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAgB;QAC1D,8CAA8C;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAgB;QACvD,2CAA2C;IAC7C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"proxy-token-store.js","sourceRoot":"","sources":["../../../src/proxy/proxy-token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,OAAO,eAAe;IACT,MAAM,CAAoB;IAE3C,YAAY,UAAkB,EAAE,eAAwB;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,iBAAiB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;YACtD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAO,mBAAmB,CACxB,oBAAoB,EACpB,QAAQ,CAAC,IAAI,EACb,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,KAAiB,EACjB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;YACvD,QAAQ;YACR,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,MAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE;YACzD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,mBAAmB,CACxB,mBAAmB,EACnB,QAAQ,CAAC,IAAI,EACb,gBAAgB,CACjB,CAAC,SAAS,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE;YACzD,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,mBAAmB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;aACzE,OAAO,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE;YAC7D,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAO,mBAAmB,CACxB,qBAAqB,EACrB,QAAQ,CAAC,IAAI,EACb,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAgB;QAC1D,8CAA8C;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAgB;QACvD,2CAA2C;IAC7C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/src/token-sanitization.d.ts

@@ -11,6 +11,47 @@
  * @requirement R10.1, R10.2, R10.3
  * @pseudocode analysis/pseudocode/002-token-sanitization-merge.md
  */
+import type { z } from 'zod';
 import { type OAuthToken } from './types.js';
-export type SanitizedOAuthToken = Omit<OAuthToken, 'refresh_token'> & Record<string, unknown>;
+/**
+ * Sanitized OAuth token schema: validates the supported OAuth fields while
+ * preserving provider-specific extension fields before the refresh_token is stripped.
+ */
+export declare const SanitizedOAuthTokenSchema: z.ZodEffects<z.ZodObject<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>, {
+    [k: string]: unknown;
+    access_token: string;
+    expiry: number;
+    token_type: "Bearer" | "bearer";
+    scope?: string | null | undefined;
+    resource_url?: string | undefined;
+}, z.objectInputType<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expiry: z.ZodNumber;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    token_type: z.ZodEnum<["Bearer", "bearer"]>;
+    resource_url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type SanitizedOAuthToken = z.infer<typeof SanitizedOAuthTokenSchema>;
 export declare function sanitizeTokenForProxy(token: OAuthToken): SanitizedOAuthToken;

package/dist/src/token-sanitization.js

@@ -3,8 +3,16 @@
  * Copyright 2025 Vybestack LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { OAuthTokenSchema } from './types.js';
+/**
+ * Sanitized OAuth token schema: validates the supported OAuth fields while
+ * preserving provider-specific extension fields before the refresh_token is stripped.
+ */
+export const SanitizedOAuthTokenSchema = OAuthTokenSchema.passthrough().transform((token) => {
+    const { refresh_token: _refresh_token, ...rest } = token;
+    return rest;
+});
 export function sanitizeTokenForProxy(token) {
-    const { refresh_token: _refresh_token, ...sanitized } = token;
-    return sanitized;
+    return SanitizedOAuthTokenSchema.parse(token);
 }
 //# sourceMappingURL=token-sanitization.js.map

package/dist/src/token-sanitization.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-sanitization.js","sourceRoot":"","sources":["../../src/token-sanitization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"token-sanitization.js","sourceRoot":"","sources":["../../src/token-sanitization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,gBAAgB,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;IACjD,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAIL,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,OAAO,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vybestack/llxprt-code-auth",
-  "version": "0.11.0",
+  "version": "0.12.0-nightly.260910.2aac6841e",
   "description": "LLxprt Code Auth — authentication and authorization domain",
   "license": "Apache-2.0",
   "repository": {
@@ -65,6 +65,11 @@
       "types": "./dist/src/proxy/proxy-token-store.d.ts",
       "bun": "./src/proxy/proxy-token-store.ts",
       "import": "./dist/src/proxy/proxy-token-store.js"
+    },
+    "./mcp-auth-provider-type.js": {
+      "types": "./dist/src/mcp-auth-provider-type.d.ts",
+      "bun": "./src/mcp-auth-provider-type.ts",
+      "import": "./dist/src/mcp-auth-provider-type.js"
     }
   },
   "scripts": {

package/src/index.ts

@@ -20,6 +20,7 @@ export type {
   OAuthUIEvent,
   OAuthUIEventType,
   OAuthUICallback,
+  OAuthInteractiveAuthOutcomeKind,
 } from './oauth-ui-events.js';
 export {
   OAuthUIBridge,
@@ -73,7 +74,10 @@ export type { RetryConfig } from './oauth-errors.js';
 export { mergeRefreshedToken } from './token-merge.js';
 export type { OAuthTokenWithExtras } from './token-merge.js';
 
-export { sanitizeTokenForProxy } from './token-sanitization.js';
+export {
+  SanitizedOAuthTokenSchema,
+  sanitizeTokenForProxy,
+} from './token-sanitization.js';
 export type { SanitizedOAuthToken } from './token-sanitization.js';
 
 // ─── Precedence / Auth Resolution ────────────────────────────────────────────
@@ -140,5 +144,16 @@ export type {
   RequestOptions,
 } from './proxy/proxy-socket-client.js';
 
+export {
+  ProxyResponseSchema,
+  OAuthTokenDataSchema,
+  ProvidersDataSchema,
+  BucketsDataSchema,
+  BucketStatsDataSchema,
+  ApiKeyDataSchema,
+  ApiKeysDataSchema,
+  HasApiKeyDataSchema,
+} from './proxy/proxy-payload-schemas.js';
+
 export { ProxyTokenStore } from './proxy/proxy-token-store.js';
 export { ProxyProviderKeyStorage } from './proxy/proxy-provider-key-storage.js';

package/src/mcp-auth-provider-type.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * How an MCP server authenticates (#3305).
+ *
+ * Lives here rather than in `core` so that `@vybestack/llxprt-code-mcp` can
+ * reach it without depending on `core`, which value-imports `mcp` and would
+ * therefore form a runtime cycle. This package is a dependency-graph leaf, so
+ * both `core` and `mcp` can depend on it.
+ */
+export enum AuthProviderType {
+  DYNAMIC_DISCOVERY = 'dynamic_discovery',
+  GOOGLE_CREDENTIALS = 'google_credentials',
+  SERVICE_ACCOUNT_IMPERSONATION = 'service_account_impersonation',
+}

package/src/oauth-ui-events.ts

@@ -17,8 +17,24 @@
  * in `@vybestack/llxprt-code-auth` without importing UI types.
  */
 
+/**
+ * @plan PLAN-20260827-ISSUE2562.P05
+ * @requirement REQ-2562-4
+ */
 /** The set of OAuth UI event discriminator values. */
-export type OAuthUIEventType = 'info' | 'warning' | 'error' | 'oauth_url';
+export type OAuthUIEventType =
+  | 'info'
+  | 'warning'
+  | 'error'
+  | 'oauth_url'
+  | 'oauth_waiting'
+  | 'oauth_settled';
+
+export type OAuthInteractiveAuthOutcomeKind =
+  | 'succeeded'
+  | 'cancelled'
+  | 'failed'
+  | 'timed_out';
 
 /**
  * Discriminated union of all OAuth UI events.
@@ -27,6 +43,8 @@ export type OAuthUIEventType = 'info' | 'warning' | 'error' | 'oauth_url';
  * - `warning`: a non-fatal warning message (e.g. a recoverable fallback).
  * - `error`: a non-fatal error message.
  * - `oauth_url`: an authorization URL the user must visit.
+ * - `oauth_waiting`: a host-owned interactive authentication session is waiting.
+ * - `oauth_settled`: a host-owned interactive authentication session settled.
  */
 export type OAuthUIEvent =
   | {
@@ -37,7 +55,24 @@ export type OAuthUIEvent =
     }
   | { readonly type: 'warning'; readonly text: string }
   | { readonly type: 'error'; readonly text: string }
-  | { readonly type: 'oauth_url'; readonly text: string; readonly url: string };
+  | { readonly type: 'oauth_url'; readonly text: string; readonly url: string }
+  | {
+      readonly type: 'oauth_waiting';
+      readonly provider: string;
+      readonly bucket?: string;
+      readonly requesterRuntimeKind: string;
+      readonly correlationId: string;
+      readonly waiterCount: number;
+    }
+  | {
+      readonly type: 'oauth_settled';
+      readonly provider: string;
+      readonly bucket?: string;
+      readonly requesterRuntimeKind: string;
+      readonly correlationId: string;
+      readonly waiterCount: number;
+      readonly kind: OAuthInteractiveAuthOutcomeKind;
+    };
 
 /**
  * Callback invoked when an {@link OAuthUIEvent} is emitted to a handler.

package/src/proxy/proxy-payload-schemas.ts

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * Copyright 2026 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Narrowly scoped schemas that validate credential-proxy payloads at the
+ * IPC trust boundary (issue #2197). Successful response envelopes and
+ * operation-specific data are parsed with these before use.
+ */
+
+import { z } from 'zod';
+import { OAuthTokenSchema, BucketStatsSchema } from '../types.js';
+
+/**
+ * Stable error message for a successful response whose data does not match its
+ * operation schema. Used at every client payload boundary.
+ */
+export const PROXY_PAYLOAD_ERROR = 'PROXY_PAYLOAD_ERROR';
+
+export function proxyPayloadError(message: string): Error {
+  return new Error(`${PROXY_PAYLOAD_ERROR}: ${message}`);
+}
+
+/**
+ * Response envelope schema. `ok` must be boolean; `data` must be a
+ * non-null, non-array object when present; `error`, `code`, and
+ * `retryAfter` must have their protocol types when present. Unknown envelope
+ * fields, including the request `id`, are preserved so the same schema validates
+ * handshake and correlated frames.
+ */
+export const ProxyResponseSchema = z
+  .object({
+    ok: z.boolean(),
+    data: z.record(z.string(), z.unknown()).optional(),
+    error: z.string().optional(),
+    code: z.string().optional(),
+    retryAfter: z.number().optional(),
+  })
+  .passthrough();
+
+export type ProxyResponse = z.infer<typeof ProxyResponseSchema>;
+
+/** Success payload for get_token. Validates and preserves the full OAuth token. */
+export const OAuthTokenDataSchema = OAuthTokenSchema.passthrough();
+
+/** Success payload for list_providers. */
+export const ProvidersDataSchema = z.object({
+  providers: z.array(z.string()),
+});
+
+/** Success payload for list_buckets. */
+export const BucketsDataSchema = z.object({ buckets: z.array(z.string()) });
+
+/** Success payload for get_bucket_stats. */
+export const BucketStatsDataSchema = BucketStatsSchema.passthrough();
+
+/** Success payload for get_api_key. */
+export const ApiKeyDataSchema = z.object({ key: z.string() });
+
+/** Success payload for list_api_keys. */
+export const ApiKeysDataSchema = z.object({ keys: z.array(z.string()) });
+
+/** Success payload for has_api_key. */
+export const HasApiKeyDataSchema = z.object({ exists: z.boolean() });
+
+/**
+ * Parses an operation-specific successful payload with the given schema. When
+ * the data is missing, malformed, or wrong-typed, throws the stable proxy
+ * payload validation error.
+ */
+export function parseSuccessPayload<T>(
+  schema: z.ZodType<T, z.ZodTypeDef, unknown>,
+  data: Record<string, unknown> | undefined,
+  operation: string,
+): T {
+  if (data === undefined) {
+    throw proxyPayloadError(`${operation}: missing data`);
+  }
+  const parsed = schema.safeParse(data);
+  if (!parsed.success) {
+    throw proxyPayloadError(`${operation}: malformed payload`);
+  }
+  return parsed.data;
+}

package/src/proxy/proxy-provider-key-storage.ts

@@ -14,6 +14,12 @@
  */
 
 import type { ProxySocketClient } from './proxy-socket-client.js';
+import {
+  ApiKeyDataSchema,
+  ApiKeysDataSchema,
+  HasApiKeyDataSchema,
+  parseSuccessPayload,
+} from './proxy-payload-schemas.js';
 
 export class ProxyProviderKeyStorage {
   private readonly client: ProxySocketClient;
@@ -28,7 +34,8 @@ export class ProxyProviderKeyStorage {
       if (response.code === 'NOT_FOUND') return null;
       throw new Error(response.error ?? 'proxy error');
     }
-    return response.data!.key as string;
+    return parseSuccessPayload(ApiKeyDataSchema, response.data, 'get_api_key')
+      .key;
   }
 
   async listKeys(): Promise<string[]> {
@@ -36,7 +43,11 @@ export class ProxyProviderKeyStorage {
     if (!response.ok) {
       throw new Error(response.error ?? 'proxy error');
     }
-    return response.data!.keys as string[];
+    return parseSuccessPayload(
+      ApiKeysDataSchema,
+      response.data,
+      'list_api_keys',
+    ).keys;
   }
 
   async hasKey(name: string): Promise<boolean> {
@@ -44,7 +55,11 @@ export class ProxyProviderKeyStorage {
     if (!response.ok) {
       throw new Error(response.error ?? 'proxy error');
     }
-    return response.data!.exists as boolean;
+    return parseSuccessPayload(
+      HasApiKeyDataSchema,
+      response.data,
+      'has_api_key',
+    ).exists;
   }
 
   async saveKey(_name: string, _apiKey: string): Promise<void> {

package/src/proxy/proxy-socket-client.ts

@@ -15,19 +15,17 @@
 import * as net from 'node:net';
 import * as crypto from 'node:crypto';
 import { encodeFrame, FrameDecoder } from './framing.js';
+import {
+  ProxyResponseSchema,
+  type ProxyResponse,
+} from './proxy-payload-schemas.js';
+
+export type { ProxyResponse } from './proxy-payload-schemas.js';
 
 export const REQUEST_TIMEOUT_MS = 30000;
 export const IDLE_TIMEOUT_MS = 300000;
 export const PROTOCOL_VERSION = 2;
 
-export type ProxyResponse = {
-  ok: boolean;
-  data?: Record<string, unknown>;
-  error?: string;
-  code?: string;
-  retryAfter?: number;
-};
-
 /**
  * Per-request options controlling timeout and cancellation.
  *
@@ -42,26 +40,12 @@ export interface RequestOptions {
   signal?: AbortSignal;
 }
 
-/** Validates that a decoded frame has the shape of a ProxyResponse, guarding
- *  against adversarial or malformed server responses with unexpected types
- *  for `ok`, `code`, or `error`. */
-function isProxyResponseFrame(
+function parseResponseFrame(
   frame: Record<string, unknown>,
-): frame is ProxyResponse {
-  if (typeof frame.ok !== 'boolean') return false;
-  if (frame.code !== undefined && typeof frame.code !== 'string') return false;
-  if (frame.error !== undefined && typeof frame.error !== 'string')
-    return false;
-  if (frame.retryAfter !== undefined && typeof frame.retryAfter !== 'number')
-    return false;
-  if (
-    frame.data !== undefined &&
-    (typeof frame.data !== 'object' ||
-      frame.data === null ||
-      Array.isArray(frame.data))
-  )
-    return false;
-  return true;
+): ProxyResponse | null {
+  const parsed = ProxyResponseSchema.safeParse(frame);
+  if (!parsed.success) return null;
+  return parsed.data;
 }
 
 const PROXY_CONNECT_FAILURE_PATTERN =
@@ -452,7 +436,7 @@ export class ProxySocketClient {
       );
     }
     // Record the negotiated version from the server's handshake_ack.
-    const serverVersion = response.data?.version as number | undefined;
+    const serverVersion = response.data?.version;
     this._negotiatedVersion =
       typeof serverVersion === 'number' ? serverVersion : 1;
     this.handshakeComplete = true;
@@ -489,8 +473,9 @@ export class ProxySocketClient {
       return;
     }
     this.handshakeResolver = null;
-    if (isProxyResponseFrame(frame)) {
-      resolver.resolve(frame);
+    const parsedFrame = parseResponseFrame(frame);
+    if (parsedFrame !== null) {
+      resolver.resolve(parsedFrame);
     } else {
       // Reject first, then clean up. destroy() will not double-reject
       // because handshakeResolver was already nulled above.
@@ -509,8 +494,8 @@ export class ProxySocketClient {
    * @pseudocode 002-frame-and-cancel.md lines 30-32
    */
   private resolvePendingRequest(frame: Record<string, unknown>): void {
-    const id = frame.id as string | undefined;
-    if (!id) {
+    const id = frame.id;
+    if (typeof id !== 'string' || id === '') {
       return;
     }
     const pending = this.pendingRequests.get(id);
@@ -518,8 +503,9 @@ export class ProxySocketClient {
       clearTimeout(pending.timer);
       this.pendingRequests.delete(id);
       this.releaseAbortCleanup(id);
-      if (isProxyResponseFrame(frame)) {
-        pending.resolve(frame);
+      const parsedFrame = parseResponseFrame(frame);
+      if (parsedFrame !== null) {
+        pending.resolve(parsedFrame);
       } else {
         pending.reject(new Error(`Malformed response for request ${id}`));
         this.destroy('Malformed response from proxy — connection reset');

package/src/proxy/proxy-token-store.ts

@@ -15,6 +15,13 @@
 
 import { type OAuthToken, type BucketStats } from '../types.js';
 import { type TokenStore } from '../token-store.js';
+import {
+  OAuthTokenDataSchema,
+  parseSuccessPayload,
+  ProvidersDataSchema,
+  BucketsDataSchema,
+  BucketStatsDataSchema,
+} from './proxy-payload-schemas.js';
 import { ProxySocketClient } from './proxy-socket-client.js';
 
 export class ProxyTokenStore implements TokenStore {
@@ -34,7 +41,11 @@ export class ProxyTokenStore implements TokenStore {
     });
     if (!response.ok && response.code === 'NOT_FOUND') return null;
     if (!response.ok) throw new Error(response.error ?? 'proxy error');
-    return response.data as unknown as OAuthToken;
+    return parseSuccessPayload(
+      OAuthTokenDataSchema,
+      response.data,
+      'get_token',
+    );
   }
 
   async saveToken(
@@ -60,14 +71,25 @@ export class ProxyTokenStore implements TokenStore {
 
   async listProviders(): Promise<string[]> {
     const response = await this.client.request('list_providers', {});
-    if (!response.ok) throw new Error(response.error ?? 'proxy error');
-    return (response.data as Record<string, unknown>).providers as string[];
+    if (!response.ok) {
+      throw new Error(response.error ?? 'proxy error');
+    }
+    return parseSuccessPayload(
+      ProvidersDataSchema,
+      response.data,
+      'list_providers',
+    ).providers;
   }
 
   async listBuckets(provider: string): Promise<string[]> {
-    const response = await this.client.request('list_buckets', { provider });
-    if (!response.ok) throw new Error(response.error ?? 'proxy error');
-    return (response.data as Record<string, unknown>).buckets as string[];
+    const response = await this.client.request('list_buckets', {
+      provider,
+    });
+    if (!response.ok) {
+      throw new Error(response.error ?? 'proxy error');
+    }
+    return parseSuccessPayload(BucketsDataSchema, response.data, 'list_buckets')
+      .buckets;
   }
 
   async getBucketStats(
@@ -80,14 +102,11 @@ export class ProxyTokenStore implements TokenStore {
     });
     if (!response.ok && response.code === 'NOT_FOUND') return null;
     if (!response.ok) throw new Error(response.error ?? 'proxy error');
-    const data = response.data as Record<string, unknown>;
-    return {
-      bucket,
-      requestCount:
-        typeof data.requestCount === 'number' ? data.requestCount : 0,
-      percentage: typeof data.percentage === 'number' ? data.percentage : 0,
-      lastUsed: data.lastUsed as number | undefined,
-    };
+    return parseSuccessPayload(
+      BucketStatsDataSchema,
+      response.data,
+      'get_bucket_stats',
+    );
   }
 
   async acquireRefreshLock(

package/src/token-sanitization.ts

@@ -13,12 +13,21 @@
  * @pseudocode analysis/pseudocode/002-token-sanitization-merge.md
  */
 
-import { type OAuthToken } from './types.js';
+import type { z } from 'zod';
+import { OAuthTokenSchema, type OAuthToken } from './types.js';
 
-export type SanitizedOAuthToken = Omit<OAuthToken, 'refresh_token'> &
-  Record<string, unknown>;
+/**
+ * Sanitized OAuth token schema: validates the supported OAuth fields while
+ * preserving provider-specific extension fields before the refresh_token is stripped.
+ */
+export const SanitizedOAuthTokenSchema =
+  OAuthTokenSchema.passthrough().transform((token) => {
+    const { refresh_token: _refresh_token, ...rest } = token;
+    return rest;
+  });
+
+export type SanitizedOAuthToken = z.infer<typeof SanitizedOAuthTokenSchema>;
 
 export function sanitizeTokenForProxy(token: OAuthToken): SanitizedOAuthToken {
-  const { refresh_token: _refresh_token, ...sanitized } = token;
-  return sanitized;
+  return SanitizedOAuthTokenSchema.parse(token);
 }