@vybestack/llxprt-code-core 0.7.0-nightly.251214.7c8736a50 → 0.7.0-nightly.251215.66bf0bc39

package/dist/src/auth/codex-device-flow.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @license
+ * Copyright 2025 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type CodexOAuthToken } from './types.js';
+/**
+ * Codex OAuth PKCE flow implementation
+ * Implements OAuth 2.0 Authorization Code flow with PKCE for Codex authentication
+ */
+export declare class CodexDeviceFlow {
+    private logger;
+    private codeVerifiers;
+    constructor();
+    /**
+     * Build authorization URL for browser-based OAuth flow
+     * @param redirectUri Callback URL for OAuth redirect
+     * @param state Random state parameter for CSRF protection
+     * @returns Authorization URL to open in browser
+     */
+    buildAuthorizationUrl(redirectUri: string, state: string): string;
+    /**
+     * Exchange authorization code for OAuth tokens
+     * @param authCode Authorization code from OAuth callback
+     * @param redirectUri Callback URL (must match the one used in authorization request)
+     * @param state State parameter from OAuth callback
+     * @returns Validated CodexOAuthToken with account_id
+     * @throws Error if code verifier not found for state or token exchange fails
+     */
+    exchangeCodeForToken(authCode: string, redirectUri: string, state: string): Promise<CodexOAuthToken>;
+    /**
+     * Refresh an expired access token using refresh token
+     * @param refreshToken Valid refresh token
+     * @returns New CodexOAuthToken with updated expiry
+     * @throws Error if refresh fails or id_token missing
+     */
+    refreshToken(refreshToken: string): Promise<CodexOAuthToken>;
+    /**
+     * Extract account_id from id_token JWT without external libraries
+     * JWT format: header.payload.signature (base64url encoded)
+     * @param idToken JWT id_token from OAuth response
+     * @returns account_id extracted from JWT claims
+     * @throws Error if JWT format invalid or account_id not found
+     */
+    private extractAccountIdFromIdToken;
+    /**
+     * Helper to throw error when id_token is missing
+     * @throws Error indicating id_token required
+     */
+    private throwMissingAccountId;
+    /**
+     * Generates PKCE code verifier and challenge
+     * @returns Object containing verifier and challenge strings
+     */
+    private generatePKCE;
+}

package/dist/src/auth/codex-device-flow.js

@@ -0,0 +1,231 @@
+/**
+ * @license
+ * Copyright 2025 Vybestack LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { randomBytes, createHash } from 'crypto';
+import { DebugLogger } from '../debug/index.js';
+import { CodexOAuthTokenSchema, CodexTokenResponseSchema, } from './types.js';
+import { z } from 'zod';
+/**
+ * Codex-specific OAuth configuration
+ */
+const CODEX_CONFIG = {
+    clientId: 'app_EMoamEEZ73f0CkXaXp7hrann',
+    issuer: 'https://auth.openai.com',
+    tokenEndpoint: 'https://auth.openai.com/oauth/token',
+    authorizationEndpoint: 'https://auth.openai.com/oauth/authorize',
+    scopes: ['openid', 'profile', 'email', 'offline_access'],
+    originator: 'codex_cli_rs',
+};
+/**
+ * JWT payload schema for account_id extraction
+ * Handles multiple possible locations of account_id in the JWT
+ */
+const JwtPayloadSchema = z.object({
+    'https://api.openai.com/auth': z
+        .object({
+        chatgpt_account_id: z.string().optional(),
+        account_id: z.string().optional(),
+    })
+        .optional(),
+    account_id: z.string().optional(),
+});
+/**
+ * Codex OAuth PKCE flow implementation
+ * Implements OAuth 2.0 Authorization Code flow with PKCE for Codex authentication
+ */
+export class CodexDeviceFlow {
+    logger;
+    codeVerifiers = new Map();
+    constructor() {
+        this.logger = new DebugLogger('llxprt:auth:codex-device-flow');
+    }
+    /**
+     * Build authorization URL for browser-based OAuth flow
+     * @param redirectUri Callback URL for OAuth redirect
+     * @param state Random state parameter for CSRF protection
+     * @returns Authorization URL to open in browser
+     */
+    buildAuthorizationUrl(redirectUri, state) {
+        this.logger.debug(() => `[FLOW] buildAuthorizationUrl() called with redirectUri=${redirectUri}, state=${state.substring(0, 8)}...`);
+        const { verifier, challenge } = this.generatePKCE();
+        this.logger.debug(() => `[FLOW] PKCE generated: verifier length=${verifier.length}, challenge length=${challenge.length}`);
+        this.codeVerifiers.set(state, verifier);
+        this.logger.debug(() => `[FLOW] Stored PKCE verifier for state, codeVerifiers.size=${this.codeVerifiers.size}`);
+        // Manually construct query string to use %20 for spaces (not +)
+        // This ensures proper parsing with decodeURIComponent
+        // Include all required params per shell-scripts/codex-oauth.sh
+        const params = [
+            `response_type=code`,
+            `client_id=${encodeURIComponent(CODEX_CONFIG.clientId)}`,
+            `redirect_uri=${encodeURIComponent(redirectUri)}`,
+            `scope=${encodeURIComponent(CODEX_CONFIG.scopes.join(' '))}`,
+            `code_challenge=${encodeURIComponent(challenge)}`,
+            `code_challenge_method=S256`,
+            `id_token_add_organizations=true`,
+            `codex_cli_simplified_flow=true`,
+            `state=${encodeURIComponent(state)}`,
+            `originator=${encodeURIComponent(CODEX_CONFIG.originator)}`,
+            `theme=dark`,
+        ].join('&');
+        this.logger.debug(() => '[FLOW] Built authorization URL with PKCE S256');
+        return `${CODEX_CONFIG.authorizationEndpoint}?${params}`;
+    }
+    /**
+     * Exchange authorization code for OAuth tokens
+     * @param authCode Authorization code from OAuth callback
+     * @param redirectUri Callback URL (must match the one used in authorization request)
+     * @param state State parameter from OAuth callback
+     * @returns Validated CodexOAuthToken with account_id
+     * @throws Error if code verifier not found for state or token exchange fails
+     */
+    async exchangeCodeForToken(authCode, redirectUri, state) {
+        this.logger.debug(() => `[FLOW] exchangeCodeForToken() called with code=${authCode.substring(0, 10)}..., redirectUri=${redirectUri}, state=${state.substring(0, 8)}...`);
+        const codeVerifier = this.codeVerifiers.get(state);
+        if (!codeVerifier) {
+            this.logger.debug(() => `[FLOW] PKCE verifier NOT FOUND for state! Available states: ${Array.from(this.codeVerifiers.keys())
+                .map((k) => k.substring(0, 8))
+                .join(', ')}`);
+            throw new Error(`PKCE code verifier not found for state: ${state}`);
+        }
+        this.logger.debug(() => `[FLOW] Found PKCE verifier for state, length=${codeVerifier.length}`);
+        this.logger.debug(() => `[FLOW] Making token exchange request to ${CODEX_CONFIG.tokenEndpoint}`);
+        const response = await fetch(CODEX_CONFIG.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+            },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code: authCode,
+                redirect_uri: redirectUri,
+                client_id: CODEX_CONFIG.clientId,
+                code_verifier: codeVerifier,
+            }).toString(),
+        });
+        this.logger.debug(() => `[FLOW] Token exchange response status: ${response.status}`);
+        if (!response.ok) {
+            const errorText = await response.text();
+            this.logger.debug(() => `[FLOW] Token exchange FAILED: ${errorText}`);
+            throw new Error(`Token exchange failed: ${response.status} ${errorText}`);
+        }
+        const data = await response.json();
+        this.logger.debug(() => `[FLOW] Token response received, keys: ${Object.keys(data).join(', ')}`);
+        // Validate with Zod schema - NO TYPE ASSERTIONS
+        const tokenResponse = CodexTokenResponseSchema.parse(data);
+        this.logger.debug(() => `[FLOW] Token response validated: has_id_token=${!!tokenResponse.id_token}, has_refresh_token=${!!tokenResponse.refresh_token}, expires_in=${tokenResponse.expires_in}`);
+        // Extract account_id from id_token JWT
+        this.logger.debug(() => '[FLOW] Extracting account_id from id_token...');
+        const accountId = tokenResponse.id_token
+            ? this.extractAccountIdFromIdToken(tokenResponse.id_token)
+            : this.throwMissingAccountId();
+        this.logger.debug(() => `[FLOW] Extracted account_id: ${accountId.substring(0, 8)}...`);
+        // Build validated Codex token - use Unix timestamp in SECONDS (not milliseconds)
+        const now = Math.floor(Date.now() / 1000);
+        const expiresIn = tokenResponse.expires_in || 3600; // Default 1 hour
+        const expiry = now + expiresIn;
+        this.logger.debug(() => `[FLOW] Building CodexOAuthToken with expiry=${expiry} (in ${expiresIn}s)`);
+        const codexToken = CodexOAuthTokenSchema.parse({
+            access_token: tokenResponse.access_token,
+            token_type: tokenResponse.token_type,
+            expiry,
+            refresh_token: tokenResponse.refresh_token,
+            account_id: accountId,
+            id_token: tokenResponse.id_token,
+        });
+        this.logger.debug(() => `[FLOW] Token exchange successful! account_id=${accountId.substring(0, 8)}..., token_type=${codexToken.token_type}`);
+        this.codeVerifiers.delete(state);
+        this.logger.debug(() => `[FLOW] Cleaned up PKCE verifier, remaining: ${this.codeVerifiers.size}`);
+        return codexToken;
+    }
+    /**
+     * Refresh an expired access token using refresh token
+     * @param refreshToken Valid refresh token
+     * @returns New CodexOAuthToken with updated expiry
+     * @throws Error if refresh fails or id_token missing
+     */
+    async refreshToken(refreshToken) {
+        this.logger.debug(() => 'Refreshing expired token');
+        const response = await fetch(CODEX_CONFIG.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: CODEX_CONFIG.clientId,
+            }).toString(),
+        });
+        if (!response.ok) {
+            throw new Error(`Token refresh failed: ${response.status}`);
+        }
+        const data = await response.json();
+        const tokenResponse = CodexTokenResponseSchema.parse(data);
+        // Extract account_id from new id_token or throw
+        const accountId = tokenResponse.id_token
+            ? this.extractAccountIdFromIdToken(tokenResponse.id_token)
+            : this.throwMissingAccountId();
+        // Use Unix timestamp in SECONDS
+        const now = Math.floor(Date.now() / 1000);
+        const expiresIn = tokenResponse.expires_in || 3600;
+        const expiry = now + expiresIn;
+        return CodexOAuthTokenSchema.parse({
+            access_token: tokenResponse.access_token,
+            token_type: tokenResponse.token_type,
+            expiry,
+            refresh_token: tokenResponse.refresh_token ?? refreshToken,
+            account_id: accountId,
+            id_token: tokenResponse.id_token,
+        });
+    }
+    /**
+     * Extract account_id from id_token JWT without external libraries
+     * JWT format: header.payload.signature (base64url encoded)
+     * @param idToken JWT id_token from OAuth response
+     * @returns account_id extracted from JWT claims
+     * @throws Error if JWT format invalid or account_id not found
+     */
+    extractAccountIdFromIdToken(idToken) {
+        const parts = idToken.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid JWT format: expected 3 parts');
+        }
+        // Decode payload (middle part) from base64url
+        const payload = parts[1];
+        const decoded = Buffer.from(payload, 'base64url').toString('utf-8');
+        // Parse and validate with Zod
+        const parsedPayload = JSON.parse(decoded);
+        const validated = JwtPayloadSchema.parse(parsedPayload);
+        // Extract account_id from OpenAI-specific claim or root
+        const accountId = validated['https://api.openai.com/auth']?.chatgpt_account_id ||
+            validated['https://api.openai.com/auth']?.account_id ||
+            validated.account_id;
+        if (!accountId) {
+            throw new Error('No account_id found in id_token JWT claims');
+        }
+        return accountId;
+    }
+    /**
+     * Helper to throw error when id_token is missing
+     * @throws Error indicating id_token required
+     */
+    throwMissingAccountId() {
+        throw new Error('id_token required to extract account_id');
+    }
+    /**
+     * Generates PKCE code verifier and challenge
+     * @returns Object containing verifier and challenge strings
+     */
+    generatePKCE() {
+        // Generate 64 random bytes for verifier (matches shell script and Rust CLI)
+        const verifier = randomBytes(64).toString('base64url');
+        // Create SHA-256 hash of verifier for challenge (S256 method)
+        const challenge = createHash('sha256').update(verifier).digest('base64url');
+        return { verifier, challenge };
+    }
+}
+//# sourceMappingURL=codex-device-flow.js.map

package/dist/src/auth/codex-device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-device-flow.js","sourceRoot":"","sources":["../../../src/auth/codex-device-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GAEzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,YAAY,GAAG;IACnB,QAAQ,EAAE,8BAA8B;IACxC,MAAM,EAAE,yBAAyB;IACjC,aAAa,EAAE,qCAAqC;IACpD,qBAAqB,EAAE,yCAAyC;IAChE,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;IACxD,UAAU,EAAE,cAAc;CAClB,CAAC;AAEX;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,6BAA6B,EAAE,CAAC;SAC7B,MAAM,CAAC;QACN,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,CAAc;IACpB,aAAa,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEvD;QACE,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,WAAmB,EAAE,KAAa;QACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,0DAA0D,WAAW,WAAW,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAC7G,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,0CAA0C,QAAQ,CAAC,MAAM,sBAAsB,SAAS,CAAC,MAAM,EAAE,CACpG,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,6DAA6D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CACzF,CAAC;QACF,gEAAgE;QAChE,sDAAsD;QACtD,+DAA+D;QAC/D,MAAM,MAAM,GAAG;YACb,oBAAoB;YACpB,aAAa,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE;YACxD,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YACjD,SAAS,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE;YAC5D,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,EAAE;YACjD,4BAA4B;YAC5B,iCAAiC;YACjC,gCAAgC;YAChC,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE;YACpC,cAAc,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE;YAC3D,YAAY;SACb,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACzE,OAAO,GAAG,YAAY,CAAC,qBAAqB,IAAI,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,WAAmB,EACnB,KAAa;QAEb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,kDAAkD,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,WAAW,WAAW,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAClJ,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,+DAA+D,KAAK,CAAC,IAAI,CACvE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAC1B;iBACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,CAClB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,gDAAgD,YAAY,CAAC,MAAM,EAAE,CACxE,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,2CAA2C,YAAY,CAAC,aAAa,EAAE,CAC1E,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,QAAQ;gBACd,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,YAAY,CAAC,QAAQ;gBAChC,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAClE,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,yCAAyC,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;QAEF,gDAAgD;QAChD,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,iDAAiD,CAAC,CAAC,aAAa,CAAC,QAAQ,uBAAuB,CAAC,CAAC,aAAa,CAAC,aAAa,gBAAgB,aAAa,CAAC,UAAU,EAAE,CAC1K,CAAC;QAEF,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,+CAA+C,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ;YACtC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CAAC,gCAAgC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CACrE,CAAC;QAEF,iFAAiF;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,iBAAiB;QACrE,MAAM,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,+CAA+C,MAAM,QAAQ,SAAS,IAAI,CAC7E,CAAC;QAEF,MAAM,UAAU,GAAoB,qBAAqB,CAAC,KAAK,CAAC;YAC9D,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,MAAM;YACN,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,gDAAgD,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,mBAAmB,UAAU,CAAC,UAAU,EAAE,CACtH,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,EAAE,CACH,+CAA+C,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAC3E,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,YAAY,CAAC,QAAQ;aACjC,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3D,gDAAgD;QAChD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ;YACtC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEjC,gCAAgC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;QAE/B,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,MAAM;YACN,aAAa,EAAE,aAAa,CAAC,aAAa,IAAI,YAAY;YAC1D,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,aAAa,CAAC,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,2BAA2B,CAAC,OAAe;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,8CAA8C;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEpE,8BAA8B;QAC9B,MAAM,aAAa,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAExD,wDAAwD;QACxD,MAAM,SAAS,GACb,SAAS,CAAC,6BAA6B,CAAC,EAAE,kBAAkB;YAC5D,SAAS,CAAC,6BAA6B,CAAC,EAAE,UAAU;YACpD,SAAS,CAAC,UAAU,CAAC;QAEvB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,qBAAqB;QAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACK,YAAY;QAClB,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEvD,8DAA8D;QAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;CACF"}

package/dist/src/auth/token-store.d.ts

@@ -3,7 +3,7 @@
  * Copyright 2025 Vybestack LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { type OAuthToken } from './types.js';
+import { type OAuthToken, type BucketStats } from './types.js';
 /**
  * Interface for multi-provider OAuth token storage
  */
@@ -12,24 +12,40 @@ export interface TokenStore {
      * Save an OAuth token for a specific provider
      * @param provider - The provider name (e.g., 'gemini', 'qwen')
      * @param token - The OAuth token to save
+     * @param bucket - Optional bucket name for multi-account support
      */
-    saveToken(provider: string, token: OAuthToken): Promise<void>;
+    saveToken(provider: string, token: OAuthToken, bucket?: string): Promise<void>;
     /**
      * Retrieve an OAuth token for a specific provider
      * @param provider - The provider name
+     * @param bucket - Optional bucket name for multi-account support
      * @returns The token if found, null otherwise
      */
-    getToken(provider: string): Promise<OAuthToken | null>;
+    getToken(provider: string, bucket?: string): Promise<OAuthToken | null>;
     /**
      * Remove an OAuth token for a specific provider
      * @param provider - The provider name
+     * @param bucket - Optional bucket name for multi-account support
      */
-    removeToken(provider: string): Promise<void>;
+    removeToken(provider: string, bucket?: string): Promise<void>;
     /**
      * List all providers that have stored tokens
      * @returns Array of provider names with stored tokens
      */
     listProviders(): Promise<string[]>;
+    /**
+     * List all buckets for a specific provider
+     * @param provider - The provider name
+     * @returns Array of bucket names for the provider
+     */
+    listBuckets(provider: string): Promise<string[]>;
+    /**
+     * Get usage statistics for a specific bucket
+     * @param provider - The provider name
+     * @param bucket - The bucket name
+     * @returns Bucket statistics if available, null otherwise
+     */
+    getBucketStats(provider: string, bucket: string): Promise<BucketStats | null>;
 }
 /**
  * Implementation of multi-provider token storage
@@ -37,23 +53,32 @@ export interface TokenStore {
  */
 export declare class MultiProviderTokenStore implements TokenStore {
     private readonly basePath;
-    constructor();
+    constructor(basePath?: string);
     /**
      * Save an OAuth token for a specific provider
      */
-    saveToken(provider: string, token: OAuthToken): Promise<void>;
+    saveToken(provider: string, token: OAuthToken, bucket?: string): Promise<void>;
     /**
      * Retrieve an OAuth token for a specific provider
      */
-    getToken(provider: string): Promise<OAuthToken | null>;
+    getToken(provider: string, bucket?: string): Promise<OAuthToken | null>;
     /**
      * Remove an OAuth token for a specific provider
      */
-    removeToken(provider: string): Promise<void>;
+    removeToken(provider: string, bucket?: string): Promise<void>;
     /**
      * List all providers that have stored tokens
      */
     listProviders(): Promise<string[]>;
+    /**
+     * List all buckets for a specific provider
+     */
+    listBuckets(provider: string): Promise<string[]>;
+    /**
+     * Get usage statistics for a specific bucket
+     * Returns placeholder statistics for now
+     */
+    getBucketStats(provider: string, bucket: string): Promise<BucketStats | null>;
     /**
      * Ensure the OAuth directory exists with secure permissions
      */
@@ -63,4 +88,9 @@ export declare class MultiProviderTokenStore implements TokenStore {
      * Uses path.join to prevent path traversal attacks
      */
     private getTokenPath;
+    /**
+     * Validate bucket name for filesystem safety
+     * Rejects characters that could cause issues with file paths
+     */
+    private validateBucketName;
 }

package/dist/src/auth/token-store.js

@@ -6,30 +6,34 @@
 import { promises as fs } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
-import { OAuthTokenSchema } from './types.js';
+import { OAuthTokenSchema, } from './types.js';
 /**
  * Implementation of multi-provider token storage
  * Stores tokens securely in ~/.llxprt/oauth/ directory
  */
 export class MultiProviderTokenStore {
     basePath;
-    constructor() {
-        this.basePath = join(homedir(), '.llxprt', 'oauth');
+    constructor(basePath) {
+        this.basePath = basePath ?? join(homedir(), '.llxprt', 'oauth');
     }
     /**
      * Save an OAuth token for a specific provider
      */
-    async saveToken(provider, token) {
+    async saveToken(provider, token, bucket) {
         // Validate provider name
         if (!provider || provider.trim() === '') {
             throw new Error('Provider name cannot be empty');
         }
-        // Validate token structure
-        const validatedToken = OAuthTokenSchema.parse(token);
+        // Validate bucket name if provided
+        if (bucket) {
+            this.validateBucketName(bucket);
+        }
+        // Validate token structure, but allow extra provider-specific fields (e.g., account_id for Codex)
+        const validatedToken = OAuthTokenSchema.passthrough().parse(token);
         // Ensure directory exists with secure permissions
         await this.ensureDirectory();
         // Generate file paths
-        const tokenPath = this.getTokenPath(provider);
+        const tokenPath = this.getTokenPath(provider, bucket);
         const tempPath = `${tokenPath}.tmp-${Date.now()}-${Math.random().toString(36).substring(2, 8)}`;
         try {
             // Write to temporary file first (atomic operation)
@@ -57,13 +61,17 @@ export class MultiProviderTokenStore {
     /**
      * Retrieve an OAuth token for a specific provider
      */
-    async getToken(provider) {
+    async getToken(provider, bucket) {
+        // Validate bucket name if provided
+        if (bucket) {
+            this.validateBucketName(bucket);
+        }
         try {
-            const tokenPath = this.getTokenPath(provider);
+            const tokenPath = this.getTokenPath(provider, bucket);
             const content = await fs.readFile(tokenPath, 'utf8');
             const parsed = JSON.parse(content);
-            // Validate token structure
-            const validatedToken = OAuthTokenSchema.parse(parsed);
+            // Validate token structure, but allow extra provider-specific fields (e.g., account_id for Codex)
+            const validatedToken = OAuthTokenSchema.passthrough().parse(parsed);
             return validatedToken;
         }
         catch (_error) {
@@ -74,9 +82,13 @@ export class MultiProviderTokenStore {
     /**
      * Remove an OAuth token for a specific provider
      */
-    async removeToken(provider) {
+    async removeToken(provider, bucket) {
+        // Validate bucket name if provided
+        if (bucket) {
+            this.validateBucketName(bucket);
+        }
         try {
-            const tokenPath = this.getTokenPath(provider);
+            const tokenPath = this.getTokenPath(provider, bucket);
             await fs.unlink(tokenPath);
         }
         catch (error) {
@@ -115,6 +127,59 @@ export class MultiProviderTokenStore {
             throw error;
         }
     }
+    /**
+     * List all buckets for a specific provider
+     */
+    async listBuckets(provider) {
+        try {
+            const files = await fs.readdir(this.basePath);
+            const providerPrefix = `${provider}`;
+            const buckets = files
+                .filter((file) => file.startsWith(providerPrefix) && file.endsWith('.json'))
+                .map((file) => {
+                const name = file.slice(0, -5); // Remove .json extension
+                if (name === provider) {
+                    return 'default';
+                }
+                // Remove "provider-" prefix to get bucket name
+                return name.slice(provider.length + 1);
+            })
+                .sort();
+            return buckets;
+        }
+        catch (error) {
+            // If directory doesn't exist, return empty array
+            if (error &&
+                typeof error === 'object' &&
+                'code' in error &&
+                error.code === 'ENOENT') {
+                return [];
+            }
+            throw error;
+        }
+    }
+    /**
+     * Get usage statistics for a specific bucket
+     * Returns placeholder statistics for now
+     */
+    async getBucketStats(provider, bucket) {
+        // Validate bucket name if provided
+        if (bucket) {
+            this.validateBucketName(bucket);
+        }
+        // Check if bucket exists
+        const token = await this.getToken(provider, bucket);
+        if (!token) {
+            return null;
+        }
+        // Return placeholder stats - actual implementation would track usage
+        return {
+            bucket,
+            requestCount: 0,
+            percentage: 0,
+            lastUsed: undefined,
+        };
+    }
     /**
      * Ensure the OAuth directory exists with secure permissions
      */
@@ -144,8 +209,19 @@ export class MultiProviderTokenStore {
      * Generate secure file path for a provider token
      * Uses path.join to prevent path traversal attacks
      */
-    getTokenPath(provider) {
-        return join(this.basePath, `${provider}.json`);
+    getTokenPath(provider, bucket) {
+        const bucketSuffix = bucket && bucket !== 'default' ? `-${bucket}` : '';
+        return join(this.basePath, `${provider}${bucketSuffix}.json`);
+    }
+    /**
+     * Validate bucket name for filesystem safety
+     * Rejects characters that could cause issues with file paths
+     */
+    validateBucketName(bucket) {
+        const invalidChars = /[:/\\<>"|?*]/;
+        if (invalidChars.test(bucket)) {
+            throw new Error(`Invalid bucket name: "${bucket}". Bucket names cannot contain: : / \\ < > " | ? *`);
+        }
     }
 }
 //# sourceMappingURL=token-store.js.map

package/dist/src/auth/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAmB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAiC/D;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACjB,QAAQ,CAAS;IAElC;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,KAAiB;QACjD,yBAAyB;QACzB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,2BAA2B;QAC3B,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAErD,kDAAkD;QAClD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,GAAG,SAAS,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAEhG,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACpE,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YAEH,sDAAsD;YACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,kCAAkC;YAClC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEnC,2BAA2B;YAC3B,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtD,OAAO,cAAc,CAAC;QACxB,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,kBAAkB;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+CAA+C;YAC/C,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,mDAAmD;gBACnD,OAAO;YACT,CAAC;YACD,wBAAwB;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK;iBACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;iBACxC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iDAAiD;YACjD,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEhE,qFAAqF;YACrF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAErC,8DAA8D;gBAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,QAAgB;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;IACjD,CAAC;CACF"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAEL,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAuDpB;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IACjB,QAAQ,CAAS;IAElC,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,KAAiB,EACjB,MAAe;QAEf,yBAAyB;QACzB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,mCAAmC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,kGAAkG;QAClG,MAAM,cAAc,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnE,kDAAkD;QAClD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,SAAS,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAEhG,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACpE,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YAEH,sDAAsD;YACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,kCAAkC;YAClC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAAe;QAEf,mCAAmC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEnC,kGAAkG;YAClG,MAAM,cAAc,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpE,OAAO,cAAc,CAAC;QACxB,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,kBAAkB;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,MAAe;QACjD,mCAAmC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+CAA+C;YAC/C,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,mDAAmD;gBACnD,OAAO;YACT,CAAC;YACD,wBAAwB;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK;iBACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;iBACxC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iDAAiD;YACjD,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,cAAc,GAAG,GAAG,QAAQ,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK;iBAClB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CACpE;iBACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;gBACzD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,+CAA+C;gBAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC;iBACD,IAAI,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iDAAiD;YACjD,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAc;QAEd,mCAAmC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,yBAAyB;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qEAAqE;QACrE,OAAO;YACL,MAAM;YACN,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEhE,qFAAqF;YACrF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAErC,8DAA8D;gBAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACf,KAAK,CAAC,IAAI,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,QAAgB,EAAE,MAAe;QACpD,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,GAAG,YAAY,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,MAAc;QACvC,MAAM,YAAY,GAAG,cAAc,CAAC;QACpC,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,oDAAoD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}