@vymalo/opencode-oauth2 0.2.0

package/dist/oauth/client.js

@@ -0,0 +1,436 @@
+import { DEFAULT_TOKEN_EXPIRY_SKEW_MS } from "../config.js";
+import { openExternalUrl } from "./browser.js";
+import { acquireTokenViaDeviceCode } from "./device-code.js";
+import { discoverOidcMetadata } from "./discovery.js";
+import { readResponseBodyPreview, redactUrl, scrubSecrets } from "./http-utils.js";
+import { startLocalCallbackServer } from "./local-callback.js";
+import { generatePkcePair, generateStateToken } from "./pkce.js";
+import { resolveSubjectToken } from "./subject-token.js";
+export function toTokenSet(payload, options) {
+    const accessToken = payload.access_token;
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("OAuth token response is missing access_token");
+    }
+    const tokenType = typeof payload.token_type === "string" && payload.token_type.length > 0
+        ? payload.token_type
+        : "Bearer";
+    const expiresIn = typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in)
+        ? payload.expires_in
+        : undefined;
+    const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token.length > 0
+        ? payload.refresh_token
+        : options?.fallbackRefreshToken;
+    if (options?.requireRefreshToken !== false && !refreshToken) {
+        throw new Error("OAuth token response is missing refresh_token");
+    }
+    return {
+        accessToken,
+        tokenType,
+        refreshToken: refreshToken,
+        scope: typeof payload.scope === "string" ? payload.scope : undefined,
+        expiresAt: expiresIn ? Date.now() + expiresIn * 1000 : undefined
+    };
+}
+export class OAuthClient {
+    server;
+    fetchImpl;
+    logger;
+    timeoutMs;
+    onAuthorizationUrl;
+    tokenExpirySkewMs;
+    constructor(server, options) {
+        this.server = server;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.logger = options.logger;
+        this.timeoutMs = options.timeoutMs;
+        this.onAuthorizationUrl = options.onAuthorizationUrl;
+        this.tokenExpirySkewMs =
+            typeof options.tokenExpirySkewMs === "number" &&
+                Number.isFinite(options.tokenExpirySkewMs) &&
+                options.tokenExpirySkewMs > 0
+                ? options.tokenExpirySkewMs
+                : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
+    }
+    isTokenValid(token) {
+        if (!token?.accessToken) {
+            return false;
+        }
+        if (!token.expiresAt) {
+            // For machine-to-machine flows (client_credentials, jwt_bearer,
+            // token_exchange), re-authentication is cheap (one POST + maybe a
+            // subject-token fetch) and the spec allows but does not require
+            // `expires_in`. Without a declared lifetime we cannot tell if the
+            // server-side token has been revoked, so we re-acquire each time to
+            // avoid persistent 401s after the server's idea of the token has
+            // expired. User-interactive flows (authorization_code, device_code)
+            // keep the old behavior — assume non-expiring when expires_in is
+            // missing — because the cost of forcing an unnecessary browser dance
+            // is high.
+            const machineFlows = [
+                "client_credentials",
+                "jwt_bearer",
+                "token_exchange"
+            ];
+            return !machineFlows.includes(this.server.authFlow);
+        }
+        return Date.now() + this.tokenExpirySkewMs < token.expiresAt;
+    }
+    /**
+     * POST to a token endpoint with an AbortController-backed timeout. Without
+     * this, a stalled IdP would block the warmup path indefinitely (the plugin
+     * runs token requests at config-hook time for cached/client_credentials
+     * paths).
+     */
+    async postWithTimeout(url, body) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            return await this.fetchImpl(url, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json"
+                },
+                body,
+                signal: controller.signal
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async ensureToken(current, options = {}) {
+        if (this.isTokenValid(current)) {
+            return current;
+        }
+        // Machine-to-machine flows never need a refresh token (they re-acquire
+        // by re-presenting the platform identity / client secret) and are safe
+        // to run during non-interactive warmup. Dispatch before the refresh
+        // branch so we don't try to use a stale refresh token that the IdP may
+        // not even have issued.
+        if (this.server.authFlow === "client_credentials") {
+            return this.loginClientCredentials();
+        }
+        if (this.server.authFlow === "jwt_bearer") {
+            return this.loginJwtBearer();
+        }
+        if (this.server.authFlow === "token_exchange") {
+            return this.loginTokenExchange();
+        }
+        if (current?.refreshToken) {
+            try {
+                const refreshed = await this.refreshToken(current.refreshToken);
+                this.logger.info("oauth_refresh_success", { serverId: this.server.id });
+                return refreshed;
+            }
+            catch (error) {
+                this.logger.warn("oauth_refresh_failed", {
+                    serverId: this.server.id,
+                    error: error instanceof Error ? error.message : String(error)
+                });
+            }
+        }
+        // When called non-interactively (e.g. plugin warmup at config-hook time),
+        // refuse to open a browser or block on device-code polling. Callers like
+        // syncServer catch this and preserve cached state; the provider's models
+        // stay empty in OpenCode until the user actually attempts a chat (which
+        // calls ensureToken with the default interactive=true).
+        if (options.interactive === false) {
+            throw new Error(`interactive authentication required for server "${this.server.id}" (authFlow=${this.server.authFlow}) but called non-interactively`);
+        }
+        if (this.server.authFlow === "device_code") {
+            return this.loginDeviceCode();
+        }
+        return this.loginInteractive();
+    }
+    async loginClientCredentials() {
+        if (!this.server.clientSecret) {
+            throw new Error("client_credentials flow requires clientSecret");
+        }
+        const endpoints = await this.resolveEndpoints();
+        const body = new URLSearchParams({
+            grant_type: "client_credentials",
+            client_id: this.server.clientId,
+            client_secret: this.server.clientSecret
+        });
+        if (this.server.scopes.length > 0) {
+            body.set("scope", this.server.scopes.join(" "));
+        }
+        this.logger.info("oauth_client_credentials_started", {
+            serverId: this.server.id,
+            // tokenEndpoint comes from user-supplied config (or OIDC discovery off
+            // a user-supplied issuer); strip userinfo + query before logging so
+            // configs like `https://user:pass@.../token` don't leak credentials.
+            tokenEndpoint: redactUrl(endpoints.tokenEndpoint)
+        });
+        const response = await this.postWithTimeout(endpoints.tokenEndpoint, body);
+        if (!response.ok) {
+            const bodyPreview = await readResponseBodyPreview(response, 500);
+            // Log the body separately so the logger's redaction can scrub matching
+            // keys, and run it through scrubSecrets to also mask token-shaped
+            // substrings that IdPs sometimes echo back inside arbitrary error text
+            // (where field-name-based redaction wouldn't help). Never embed the
+            // body in throw new Error(...) — callers log error.message verbatim.
+            this.logger.error("oauth_client_credentials_failed", {
+                serverId: this.server.id,
+                status: response.status,
+                bodyPreview: bodyPreview ? scrubSecrets(bodyPreview) : undefined
+            });
+            throw new Error(`client_credentials token request failed (${response.status})`);
+        }
+        const payload = (await response.json());
+        const token = toTokenSet(payload, { requireRefreshToken: false });
+        this.logger.info("oauth_client_credentials_success", {
+            serverId: this.server.id,
+            hasExpiry: token.expiresAt !== undefined
+        });
+        return token;
+    }
+    async loginJwtBearer() {
+        if (!this.server.subjectTokenSource) {
+            throw new Error("jwt_bearer flow requires subjectTokenSource");
+        }
+        return this.postFederatedGrant({
+            grantType: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+            extraFields: (assertion) => ({ assertion }),
+            eventPrefix: "oauth_jwt_bearer"
+        });
+    }
+    async loginTokenExchange() {
+        if (!this.server.subjectTokenSource) {
+            throw new Error("token_exchange flow requires subjectTokenSource");
+        }
+        return this.postFederatedGrant({
+            grantType: "urn:ietf:params:oauth:grant-type:token-exchange",
+            extraFields: (subjectToken) => {
+                const fields = {
+                    subject_token: subjectToken,
+                    subject_token_type: "urn:ietf:params:oauth:token-type:jwt"
+                };
+                if (this.server.tokenExchangeAudience) {
+                    fields.audience = this.server.tokenExchangeAudience;
+                }
+                return fields;
+            },
+            eventPrefix: "oauth_token_exchange"
+        });
+    }
+    /**
+     * Shared driver for jwt_bearer and token_exchange. Both grants:
+     *   - resolve a platform-supplied JWT from `subjectTokenSource`
+     *   - POST it to the token endpoint with grant-specific form fields
+     *   - get back an access token (refresh token is NOT expected for either)
+     */
+    async postFederatedGrant(spec) {
+        const subjectTokenSource = this.server.subjectTokenSource;
+        if (!subjectTokenSource) {
+            // Caller already guards this; belt-and-braces for the type narrowing.
+            throw new Error("federated flow requires subjectTokenSource");
+        }
+        const subjectToken = await resolveSubjectToken(subjectTokenSource, {
+            fetchImpl: this.fetchImpl,
+            timeoutMs: this.timeoutMs
+        });
+        const endpoints = await this.resolveEndpoints();
+        const body = new URLSearchParams({
+            grant_type: spec.grantType,
+            client_id: this.server.clientId,
+            ...spec.extraFields(subjectToken)
+        });
+        if (this.server.scopes.length > 0) {
+            body.set("scope", this.server.scopes.join(" "));
+        }
+        if (this.server.clientSecret) {
+            // Confidential federated clients are permitted by Keycloak and many
+            // others; some IdPs require both the assertion AND the client secret.
+            body.set("client_secret", this.server.clientSecret);
+        }
+        this.logger.info(`${spec.eventPrefix}_started`, {
+            serverId: this.server.id,
+            tokenEndpoint: redactUrl(endpoints.tokenEndpoint),
+            subjectTokenSource: subjectTokenSource.type
+        });
+        const response = await this.postWithTimeout(endpoints.tokenEndpoint, body);
+        if (!response.ok) {
+            const preview = await readResponseBodyPreview(response, 500);
+            this.logger.error(`${spec.eventPrefix}_failed`, {
+                serverId: this.server.id,
+                status: response.status,
+                bodyPreview: preview ? scrubSecrets(preview) : undefined
+            });
+            throw new Error(`${spec.grantType} request failed (${response.status})`);
+        }
+        const payload = (await response.json());
+        const token = toTokenSet(payload, { requireRefreshToken: false });
+        this.logger.info(`${spec.eventPrefix}_success`, {
+            serverId: this.server.id,
+            hasExpiry: token.expiresAt !== undefined
+        });
+        return token;
+    }
+    /**
+     * Resolve endpoints for the configured flow. Skips OIDC discovery entirely
+     * when the explicit endpoints needed for the flow are all present in config
+     * — discovery is unavailable on RFC 8414-only servers and on Keycloak
+     * realms where the well-known doc is locked down.
+     */
+    async resolveEndpoints() {
+        const haveAllExplicit = this.hasExplicitEndpointsForFlow();
+        if (haveAllExplicit) {
+            return {
+                authorizationEndpoint: this.server.authorizationEndpoint,
+                tokenEndpoint: this.server.tokenEndpoint,
+                deviceAuthorizationEndpoint: this.server.deviceAuthorizationEndpoint
+            };
+        }
+        const metadata = await discoverOidcMetadata(this.server.issuer, this.fetchImpl, this.timeoutMs);
+        const tokenEndpoint = this.server.tokenEndpoint ?? metadata.token_endpoint;
+        const authorizationEndpoint = this.server.authorizationEndpoint ?? metadata.authorization_endpoint;
+        const deviceAuthorizationEndpoint = this.server.deviceAuthorizationEndpoint ?? metadata.device_authorization_endpoint;
+        if (this.server.authFlow === "authorization_code" && !authorizationEndpoint) {
+            throw new Error("authorization_code flow requires an authorization_endpoint (either configured or discovered)");
+        }
+        if (this.server.authFlow === "device_code" && !deviceAuthorizationEndpoint) {
+            throw new Error("device_code flow requires a device_authorization_endpoint (either configured or discovered)");
+        }
+        return {
+            authorizationEndpoint,
+            tokenEndpoint,
+            deviceAuthorizationEndpoint
+        };
+    }
+    hasExplicitEndpointsForFlow() {
+        if (!this.server.tokenEndpoint) {
+            return false;
+        }
+        switch (this.server.authFlow) {
+            case "client_credentials":
+            case "jwt_bearer":
+            case "token_exchange":
+                return true;
+            case "device_code":
+                return Boolean(this.server.deviceAuthorizationEndpoint);
+            default:
+                return Boolean(this.server.authorizationEndpoint);
+        }
+    }
+    async refreshToken(refreshToken) {
+        const endpoints = await this.resolveEndpoints();
+        const body = new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: this.server.clientId
+        });
+        if (this.server.clientSecret) {
+            body.set("client_secret", this.server.clientSecret);
+        }
+        const response = await this.postWithTimeout(endpoints.tokenEndpoint, body);
+        if (!response.ok) {
+            throw new Error(`refresh token exchange failed (${response.status})`);
+        }
+        const payload = (await response.json());
+        const nextToken = toTokenSet(payload, {
+            fallbackRefreshToken: refreshToken,
+            requireRefreshToken: true
+        });
+        return nextToken;
+    }
+    async loginDeviceCode() {
+        const endpoints = await this.resolveEndpoints();
+        if (!endpoints.deviceAuthorizationEndpoint) {
+            throw new Error("device_code flow requires a device_authorization_endpoint (either configured or discovered)");
+        }
+        return acquireTokenViaDeviceCode({
+            deviceAuthorizationEndpoint: endpoints.deviceAuthorizationEndpoint,
+            tokenEndpoint: endpoints.tokenEndpoint,
+            clientId: this.server.clientId,
+            clientSecret: this.server.clientSecret,
+            scopes: this.server.scopes,
+            serverId: this.server.id,
+            logger: this.logger,
+            fetchImpl: this.fetchImpl,
+            timeoutMs: this.timeoutMs
+        });
+    }
+    async loginInteractive() {
+        const endpoints = await this.resolveEndpoints();
+        if (!endpoints.authorizationEndpoint) {
+            // resolveEndpoints already guards this for authorization_code, but TS
+            // sees the type as optional. Belt-and-braces.
+            throw new Error("authorization_code flow requires an authorization_endpoint (either configured or discovered)");
+        }
+        const callbackServer = await startLocalCallbackServer("/oauth2/callback", this.server.redirectPort);
+        try {
+            const { verifier, challenge } = generatePkcePair();
+            const state = generateStateToken();
+            const authorizeUrl = new URL(endpoints.authorizationEndpoint);
+            authorizeUrl.searchParams.set("response_type", "code");
+            authorizeUrl.searchParams.set("client_id", this.server.clientId);
+            authorizeUrl.searchParams.set("redirect_uri", callbackServer.redirectUri);
+            authorizeUrl.searchParams.set("scope", this.server.scopes.join(" "));
+            authorizeUrl.searchParams.set("code_challenge", challenge);
+            authorizeUrl.searchParams.set("code_challenge_method", "S256");
+            authorizeUrl.searchParams.set("state", state);
+            this.logger.info("oauth_login_started", {
+                serverId: this.server.id,
+                issuer: this.server.issuer,
+                authorizationEndpoint: `${authorizeUrl.origin}${authorizeUrl.pathname}`
+            });
+            if (this.onAuthorizationUrl) {
+                await this.onAuthorizationUrl(authorizeUrl.toString());
+            }
+            else {
+                try {
+                    await openExternalUrl(authorizeUrl.toString());
+                }
+                catch (error) {
+                    this.logger.warn("oauth_open_browser_failed", {
+                        serverId: this.server.id,
+                        error: error instanceof Error ? error.message : String(error)
+                    });
+                    // Write the URL to stderr directly so the terminal user can copy-paste
+                    // it. Bypasses the structured logger to avoid leaking the `state`
+                    // nonce (and other query params) into centralized log aggregation,
+                    // which would enable login-CSRF via a forged localhost callback.
+                    process.stderr.write(`\n[opencode-oauth2] open this URL to authenticate (${this.server.id}):\n${authorizeUrl.toString()}\n\n`);
+                }
+            }
+            const callback = await callbackServer.waitForCode();
+            if (callback.state !== state) {
+                throw new Error("OAuth callback state mismatch");
+            }
+            const tokenBody = new URLSearchParams({
+                grant_type: "authorization_code",
+                code: callback.code,
+                client_id: this.server.clientId,
+                redirect_uri: callbackServer.redirectUri,
+                code_verifier: verifier
+            });
+            if (this.server.clientSecret) {
+                tokenBody.set("client_secret", this.server.clientSecret);
+            }
+            const tokenResponse = await this.postWithTimeout(endpoints.tokenEndpoint, tokenBody);
+            if (!tokenResponse.ok) {
+                throw new Error(`authorization code exchange failed (${tokenResponse.status})`);
+            }
+            const payload = (await tokenResponse.json());
+            const token = toTokenSet(payload, { requireRefreshToken: true });
+            this.logger.info("oauth_login_success", {
+                serverId: this.server.id,
+                hasRefreshToken: true
+            });
+            return token;
+        }
+        catch (error) {
+            this.logger.error("oauth_login_failed", {
+                serverId: this.server.id,
+                error: error instanceof Error ? error.message : String(error)
+            });
+            throw error;
+        }
+        finally {
+            await callbackServer.close();
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/oauth/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oauth/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAG5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAgBzD,MAAM,UAAU,UAAU,CACxB,OAAgC,EAChC,OAGC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,UAAU;QACpB,CAAC,CAAC,QAAQ,CAAC;IAEf,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,UAAU;QACpB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAEpC,IAAI,OAAO,EAAE,mBAAmB,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,WAAW;QACX,SAAS;QACT,YAAY,EAAE,YAAsB;QACpC,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACpE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,WAAW;IAQH;IAPF,SAAS,CAAe;IACxB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,kBAAkB,CAAyC;IAC3D,iBAAiB,CAAS;IAE3C,YACmB,MAAyB,EAC1C,OAA2B;QADV,WAAM,GAAN,MAAM,CAAmB;QAG1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,iBAAiB;YACpB,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;gBAC7C,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBAC1C,OAAO,CAAC,iBAAiB,GAAG,CAAC;gBAC3B,CAAC,CAAC,OAAO,CAAC,iBAAiB;gBAC3B,CAAC,CAAC,4BAA4B,CAAC;IACrC,CAAC;IAEO,YAAY,CAAC,KAAgB;QACnC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,gEAAgE;YAChE,kEAAkE;YAClE,gEAAgE;YAChE,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,WAAW;YACX,MAAM,YAAY,GAAiC;gBACjD,oBAAoB;gBACpB,YAAY;gBACZ,gBAAgB;aACjB,CAAC;YACF,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,IAAqB;QAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAkB,EAClB,UAAqC,EAAE;QAEvC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,OAAmB,CAAC;QAC7B,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxE,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACvC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,gCAAgC,CACrI,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACxC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACnD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC;SAClD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAE3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBACnD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACnD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS;SACzC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;YAC7B,SAAS,EAAE,6CAA6C;YACxD,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YAC3C,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC;YAC7B,SAAS,EAAE,iDAAiD;YAC5D,WAAW,EAAE,CAAC,YAAY,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAA2B;oBACrC,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,sCAAsC;iBAC3D,CAAC;gBACF,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBACtC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;gBACtD,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,WAAW,EAAE,sBAAsB;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,IAIhC;QACC,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC1D,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,EAAE;YACjE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,UAAU,EAAE;YAC9C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC;YACjD,kBAAkB,EAAE,kBAAkB,CAAC,IAAI;SAC5C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAE3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,SAAS,EAAE;gBAC9C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;aACzD,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,oBAAoB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACnE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,UAAU,EAAE;YAC9C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS;SACzC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB;QAC5B,MAAM,eAAe,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAC3D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO;gBACL,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;gBACxD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAuB;gBAClD,2BAA2B,EAAE,IAAI,CAAC,MAAM,CAAC,2BAA2B;aACrE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhG,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,cAAc,CAAC;QAC3E,MAAM,qBAAqB,GACzB,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,QAAQ,CAAC,sBAAsB,CAAC;QACvE,MAAM,2BAA2B,GAC/B,IAAI,CAAC,MAAM,CAAC,2BAA2B,IAAI,QAAQ,CAAC,6BAA6B,CAAC;QAEpF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,oBAAoB,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,OAAO;YACL,qBAAqB;YACrB,aAAa;YACb,2BAA2B;SAC5B,CAAC;IACJ,CAAC;IAEO,2BAA2B;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,oBAAoB,CAAC;YAC1B,KAAK,YAAY,CAAC;YAClB,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC;YACd,KAAK,aAAa;gBAChB,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC1D;gBACE,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAE3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACnE,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE;YACpC,oBAAoB,EAAE,YAAY;YAClC,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,2BAA2B,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,OAAO,yBAAyB,CAAC;YAC/B,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;YAClE,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACrC,sEAAsE;YACtE,8CAA8C;YAC9C,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,wBAAwB,CACnD,kBAAkB,EAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CACzB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAE9D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACvD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;YAC1E,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YAC/D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,qBAAqB,EAAE,GAAG,YAAY,CAAC,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE;aACxE,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,eAAe,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;wBAC5C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;wBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,uEAAuE;oBACvE,kEAAkE;oBAClE,mEAAmE;oBACnE,iEAAiE;oBACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDAAsD,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CACzG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC;gBACpC,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,YAAY,EAAE,cAAc,CAAC,WAAW;gBACxC,aAAa,EAAE,QAAQ;aACxB,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC7B,SAAS,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAErF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAA4B,CAAC;YACxE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACxB,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}

package/dist/oauth/device-code.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from "../logging.js";
+import type { TokenSet } from "../types.js";
+export interface AcquireTokenViaDeviceCodeOptions {
+    deviceAuthorizationEndpoint: string;
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    scopes: string[];
+    serverId: string;
+    logger: Logger;
+    fetchImpl?: typeof fetch;
+    timeoutMs: number;
+    /**
+     * Sleep function used between polls. Overridable for tests.
+     */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * Clock used to measure elapsed time. Overridable for tests.
+     */
+    now?: () => number;
+}
+export declare function acquireTokenViaDeviceCode(options: AcquireTokenViaDeviceCodeOptions): Promise<TokenSet>;