@withbuddi/buddi 0.1.0-pre.21 → 0.1.0-pre.22

package/packages/runtime/dist/index.d.ts

@@ -15,6 +15,8 @@ export * from './codex-oauth.js';
 export * from './codex-direct.js';
 export * from './codex-profile.js';
 export * from './provider-models.js';
+export * from './oauth.js';
+export * from './oauth-port.js';
 export { AnthropicOAuthProtocol, createAnthropicLogin, parseAnthropicCode, readAnthropicTokens, type AnthropicTokens } from './anthropic-oauth.js';
 export * from './ollama-signing.js';
 //# sourceMappingURL=index.d.ts.map

package/packages/runtime/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACnJ,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACnJ,cAAc,qBAAqB,CAAC"}

package/packages/runtime/dist/index.js

@@ -16,6 +16,8 @@ export * from './codex-oauth.js';
 export * from './codex-direct.js';
 export * from './codex-profile.js';
 export * from './provider-models.js';
+export * from './oauth.js';
+export * from './oauth-port.js';
 export { AnthropicOAuthProtocol, createAnthropicLogin, parseAnthropicCode, readAnthropicTokens } from './anthropic-oauth.js';
 export * from './ollama-signing.js';
 //# sourceMappingURL=index.js.map

package/packages/runtime/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,yEAAyE;AACzE,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AACnJ,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,yEAAyE;AACzE,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AACnJ,cAAc,qBAAqB,CAAC"}

package/packages/runtime/dist/oauth-port.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The shared OAuth module as one object a plugin is handed
+ * (buddi-planning/specs/mcp-client.md §4, docs/connections.md).
+ *
+ * A plugin reaches core through `ctx.buddi` and `@buddi/core/plugin` only, so
+ * it cannot import this package. The gateway builds this over the one shared
+ * transport and hands it to the connections plugin: discovery, registration,
+ * PKCE, the authorize URL, the code exchange and the refresh discipline, the
+ * same code the Claude and ChatGPT sign-ins run. Nothing here returns a token
+ * to anyone but the caller that stores it or puts it in a header.
+ */
+import type { Vault } from '@buddi/core';
+import { type AuthorizeUrlParams, type DiscoveredAuthorization, type OAuthTokens } from './oauth.js';
+import { type HttpTransport } from './transport.js';
+export interface OAuthPortOptions {
+    transport?: HttpTransport;
+    /** `http://` on loopback for servers and authorization servers: tests only. */
+    allowLoopbackHttp?: boolean;
+    now?: () => number;
+}
+export interface OAuthPort {
+    discover(resourceUrl: string, opts: {
+        wwwAuthenticate: string | null;
+    }): Promise<DiscoveredAuthorization>;
+    register(registrationEndpoint: string, request: {
+        client_name?: string;
+        redirect_uris: string[];
+        scope?: string;
+    }): Promise<{
+        clientId: string;
+        clientSecret?: string;
+    }>;
+    pkce(): {
+        verifier: string;
+        challenge: string;
+    };
+    state(): string;
+    authorizeUrl(params: AuthorizeUrlParams): string;
+    validClientId(id: string): boolean;
+    /** The code for tokens. `extra` is kept on the envelope (the token endpoint a refresh goes to). */
+    exchange(input: {
+        tokenEndpoint: string;
+        clientId: string;
+        clientSecret?: string;
+        resource: string;
+        code: string;
+        verifier: string;
+        redirectUri: string;
+        scopes: readonly string[];
+        extra: Record<string, string>;
+        failure: string;
+    }): Promise<OAuthTokens>;
+    /**
+     * The envelope under `ref`, refreshed first when it expires within five
+     * minutes, under the durable-marker discipline. The refresh goes to
+     * `extra.tokenEndpoint` with the envelope's own client id and resource.
+     */
+    fresh(vault: Pick<Vault, 'get' | 'set'>, ref: string, messages: {
+        invalid: string;
+        missing: string;
+        interrupted: string;
+        refreshFailed: string;
+        unsaved: string;
+        cannotRenew: string;
+    }): Promise<OAuthTokens>;
+}
+export declare function createOAuthPort(options?: OAuthPortOptions): OAuthPort;
+//# sourceMappingURL=oauth-port.d.ts.map

package/packages/runtime/dist/oauth-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-port.d.ts","sourceRoot":"","sources":["../src/oauth-port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAWL,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1G,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzK,IAAI,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,IAAI,MAAM,CAAC;IAChB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAAC;IACjD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,mGAAmG;IACnG,QAAQ,CAAC,KAAK,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QACjF,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;KAChD,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC9D,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;KACpH,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS,CA8CzE"}

package/packages/runtime/dist/oauth-port.js

@@ -0,0 +1,51 @@
+import { authorizeUrl, discoverAuthorization, OAuthClient, oauthState, pkcePair, readOAuthTokens, refreshDiscipline, registerClient, validOAuthId, validToken, } from './oauth.js';
+import { defaultHttpTransport } from './transport.js';
+export function createOAuthPort(options = {}) {
+    const transport = options.transport ?? defaultHttpTransport;
+    const loopback = options.allowLoopbackHttp ? { allowLoopbackHttp: true } : {};
+    const now = options.now ?? Date.now;
+    return {
+        discover: (resourceUrl, opts) => discoverAuthorization(resourceUrl, { transport, wwwAuthenticate: opts.wwwAuthenticate, ...loopback }),
+        register: async (endpoint, request) => {
+            const registered = await registerClient(endpoint, request, { transport, ...loopback });
+            return { clientId: registered.clientId, ...(registered.clientSecret ? { clientSecret: registered.clientSecret } : {}) };
+        },
+        pkce: () => pkcePair(),
+        state: () => oauthState(),
+        authorizeUrl: (params) => authorizeUrl(params),
+        validClientId: (id) => validOAuthId(id) || validToken(id),
+        exchange: async (input) => {
+            const client = new OAuthClient({
+                tokenEndpoint: input.tokenEndpoint, clientId: input.clientId,
+                ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+                resource: input.resource, transport, now,
+                messages: { exchange: input.failure },
+            });
+            const tokens = await client.exchangeCode({ code: input.code, verifier: input.verifier, redirectUri: input.redirectUri, scopes: input.scopes });
+            return { ...tokens, extra: { ...(tokens.extra ?? {}), ...input.extra } };
+        },
+        fresh: (vault, ref, messages) => refreshDiscipline(vault, ref, {
+            read: (raw) => readOAuthTokens(raw, { invalidMessage: messages.invalid }),
+            refresh: (tokens) => {
+                const tokenEndpoint = tokens.extra?.tokenEndpoint;
+                if (!tokenEndpoint || !tokens.clientId)
+                    return Promise.reject(new Error(messages.cannotRenew));
+                return new OAuthClient({
+                    tokenEndpoint,
+                    clientId: tokens.clientId,
+                    ...(tokens.extra?.clientSecret ? { clientSecret: tokens.extra.clientSecret } : {}),
+                    ...(tokens.resource ? { resource: tokens.resource } : {}),
+                    transport, now,
+                    finish: (next, _data, previous) => ({ ...next, ...(previous?.extra ? { extra: previous.extra } : {}) }),
+                    messages: { refresh: messages.refreshFailed },
+                }).refresh(tokens);
+            },
+        }, now, {
+            messages: {
+                missing: messages.missing, interrupted: messages.interrupted,
+                refreshFailed: messages.refreshFailed, unsaved: messages.unsaved,
+            },
+        }),
+    };
+}
+//# sourceMappingURL=oauth-port.js.map

package/packages/runtime/dist/oauth-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-port.js","sourceRoot":"","sources":["../src/oauth-port.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,UAAU,GAIX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAsB,MAAM,gBAAgB,CAAC;AAgC1E,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,OAAO;QACL,QAAQ,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtI,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;YACpC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;YACvF,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1H,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtB,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;QACzB,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;QAC9C,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC;QACzD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;gBAC7B,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBAC5D,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG;gBACxC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;aACtC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/I,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAc,EAAE,GAAG,EAAE;YACtE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;gBAClB,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/F,OAAO,IAAI,WAAW,CAAC;oBACrB,aAAa;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,SAAS,EAAE,GAAG;oBACd,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;oBACvG,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,EAAE;iBAC9C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;SACF,EAAE,GAAG,EAAE;YACN,QAAQ,EAAE;gBACR,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW;gBAC5D,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;aACjE;SACF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/packages/runtime/dist/oauth.d.ts

@@ -0,0 +1,255 @@
+import type { Vault } from '@buddi/core';
+import { type HttpTransport } from './transport.js';
+/**
+ * What one vault entry holds for one OAuth sign-in. `state: 'refreshing'` is
+ * the durable marker written before a refresh token is spent: an entry found in
+ * that state means a refresh may have been consumed and its answer lost, so the
+ * only safe move is a new sign-in, never a replay.
+ */
+export interface OAuthTokens {
+    version: 1;
+    state: 'ready' | 'refreshing';
+    accessToken: string;
+    /** Absent when the server gave none: connected until `expiresAt`, then reconnect. */
+    refreshToken?: string;
+    /** Epoch ms. */
+    expiresAt: number;
+    scopes?: string[];
+    /** The client id the tokens were issued to (a registered client, for MCP). */
+    clientId?: string;
+    /** The resource (RFC 8707) the tokens are for: an MCP server's address. */
+    resource?: string;
+    /** A provider's account id, when the tokens name one (ChatGPT). */
+    accountId?: string;
+    /** Small provider-specific strings kept with the tokens (an id token). */
+    extra?: Record<string, string>;
+}
+export interface ReadOAuthTokensOptions {
+    /** The sentence thrown for anything unreadable. */
+    invalidMessage?: string;
+    requireRefreshToken?: boolean;
+    requireScopes?: boolean;
+    requireAccountId?: boolean;
+    /** `expiresAt` must be > 0 (a stored 0 otherwise reads "expired, refresh"). */
+    requirePositiveExpiry?: boolean;
+    /**
+     * Stored envelopes of an older shape, converted before validation: return
+     * the envelope, or undefined when `data` is not that shape.
+     */
+    adapt?: (data: Record<string, unknown>) => Record<string, unknown> | undefined;
+    /** Top-level token-shaped fields of a caller's own envelope kept verbatim in `extra`. */
+    keep?: readonly string[];
+}
+export declare function validToken(value: unknown): value is string;
+export declare function validOAuthId(value: unknown): value is string;
+/** Parse and check a stored envelope. Throws `invalidMessage`, never the value. */
+export declare function readOAuthTokens(raw: string, opts?: ReadOAuthTokensOptions): OAuthTokens;
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+    method: 'S256';
+}
+/** A fresh verifier and its S256 challenge. The verifier never enters a URL. */
+export declare function pkcePair(): PkcePair;
+/** A fresh, unguessable `state`. */
+export declare function oauthState(): string;
+export interface AuthorizeUrlParams {
+    authorizationEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    challenge: string;
+    scopes?: readonly string[];
+    /** RFC 8707: the MCP server the token is for. */
+    resource?: string;
+    /** Provider-specific parameters, placed first (Claude's `code=true`). */
+    extra?: Record<string, string>;
+}
+export declare function authorizeUrl(p: AuthorizeUrlParams): string;
+export type OAuthCallbackProblem = 'malformed' | 'foreign' | 'state' | 'denied';
+/** Why a callback was refused. `reason` lets a caller say it in its own words. */
+export declare class OAuthCallbackError extends Error {
+    readonly reason: OAuthCallbackProblem;
+    constructor(reason: OAuthCallbackProblem, message: string);
+}
+export interface ParseCallbackOptions {
+    /** A full URL must have this origin + path. Absent: any https URL (or loopback http). */
+    redirectUri?: string;
+    /** Accept a pasted `code#state` (Claude's code page). */
+    allowCodeHashState?: boolean;
+}
+/**
+ * The code from a redirect URL, or a pasted `code#state`, checked against the
+ * state this sign-in sent in constant time. Throws `OAuthCallbackError`.
+ */
+export declare function parseCallback(input: string | URL, expectedState: string, opts?: ParseCallbackOptions): {
+    code: string;
+    state: string;
+};
+export interface AuthorizationServerMetadata {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint?: string;
+    scopesSupported?: string[];
+    codeChallengeMethods?: string[];
+    grantTypesSupported?: string[];
+    tokenEndpointAuthMethods?: string[];
+}
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorizationServers: string[];
+    scopesSupported?: string[];
+}
+export interface DiscoveredAuthorization {
+    /** The canonical resource to name in `resource=` (the protected resource's own, when it said). */
+    resource: string;
+    /** Undefined when the server published none (the pre-2025-06 MCP fallback was used). */
+    protectedResource?: ProtectedResourceMetadata;
+    authorizationServer: AuthorizationServerMetadata;
+    /** The scopes to ask for: the challenge's, else the resource's, else none. */
+    scopes: string[];
+}
+/** A `WWW-Authenticate` header, read: scheme and its auth-params. */
+export declare function parseWwwAuthenticate(header: string | null | undefined): {
+    scheme: string;
+    params: Record<string, string>;
+} | undefined;
+export interface DiscoverOptions {
+    transport?: HttpTransport;
+    /** The `WWW-Authenticate` of a 401 from the resource, when there was one. */
+    wwwAuthenticate?: string | null;
+    /** Allow `http:` for loopback addresses (tests, a local server). Off by default. */
+    allowLoopbackHttp?: boolean;
+}
+/**
+ * How to sign in to `resourceUrl` (an MCP server's address), per the MCP
+ * authorization spec: the resource metadata a 401 named, or the well-known
+ * one at the resource (path-aware, then root); then the named authorization
+ * server's metadata, RFC 8414 first, OpenID Connect discovery second. A server
+ * that publishes no resource metadata is taken to be its own authorization
+ * server (the MCP 2025-03-26 fallback). Every URL must be https; nothing
+ * follows a redirect.
+ */
+export declare function discoverAuthorization(resourceUrl: string, opts?: DiscoverOptions): Promise<DiscoveredAuthorization>;
+/** RFC 8414 metadata for an issuer, with the OIDC discovery fallbacks. */
+export declare function discoverAuthorizationServer(issuerUrl: string, opts?: Omit<DiscoverOptions, 'wwwAuthenticate'>): Promise<AuthorizationServerMetadata>;
+/** RFC 8707 / MCP: scheme and host lower-case, no fragment, no trailing slash on a bare origin. */
+export declare function canonicalResource(url: string | URL): string;
+export interface ClientRegistrationRequest {
+    client_name?: string;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    scope?: string;
+}
+export interface RegisteredClient {
+    clientId: string;
+    /** Only when the server insisted on a confidential client; buddi asks for none. */
+    clientSecret?: string;
+    /** Epoch ms, 0 or absent for never. */
+    clientSecretExpiresAt?: number;
+}
+/**
+ * Register buddi as a public client (no secret, PKCE) with an authorization
+ * server that allows it. One call, never retried; the answer's `client_id` is
+ * what the vault keeps beside the tokens.
+ */
+export declare function registerClient(registrationEndpoint: string, request: ClientRegistrationRequest, opts?: {
+    transport?: HttpTransport;
+    allowLoopbackHttp?: boolean;
+}): Promise<RegisteredClient>;
+export interface OAuthClientOptions {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+    /** How the token request is encoded. RFC 6749 says form; Claude's endpoint takes JSON. */
+    format?: 'form' | 'json';
+    /** RFC 8707 resource, sent with every token request and kept on the envelope. */
+    resource?: string;
+    transport?: HttpTransport;
+    now?: () => number;
+    /** Refuse an answer without a refresh token. */
+    requireRefreshToken?: boolean;
+    /** Refuse an answer without `expires_in` (and no `expiryFallback`). */
+    requireExpiry?: boolean;
+    /** Scopes an answer must grant, or it is refused. */
+    requiredScopes?: readonly string[];
+    /** Expiry (epoch ms) when the answer has no usable `expires_in`; 0 refuses. */
+    expiryFallback?: (data: Record<string, unknown>) => number;
+    /**
+     * Lifetime assumed when a server gives no `expires_in` and there is no
+     * fallback: an hour with a refresh token (a refresh then is harmless), a
+     * year without one (the 401 is what ends it, not a guess).
+     */
+    assumedLifetimeMs?: number;
+    /** Shape the envelope from the raw answer: an account id, an id token. Throw to refuse. */
+    finish?: (tokens: OAuthTokens, data: Record<string, unknown>, previous?: OAuthTokens) => OAuthTokens;
+    /** Error sentences; the defaults name no provider. */
+    messages?: {
+        exchange?: string;
+        refresh?: string;
+    };
+    /** Parameters every token request carries (added before the grant's own). */
+    extraParams?: Record<string, string>;
+}
+/** Code exchange and refresh at one token endpoint, for one client. */
+export declare class OAuthClient {
+    #private;
+    readonly options: OAuthClientOptions;
+    readonly transport: HttpTransport;
+    readonly now: () => number;
+    constructor(options: OAuthClientOptions);
+    /** The authorization code for tokens. One request, never retried. */
+    exchangeCode(input: {
+        code: string;
+        verifier: string;
+        redirectUri: string;
+        state?: string;
+        scopes?: readonly string[];
+    }): Promise<OAuthTokens>;
+    /** Spend the refresh token for a new pair. The caller persists the answer. */
+    refresh(tokens: OAuthTokens, extra?: Record<string, string>): Promise<OAuthTokens>;
+}
+/** What `refreshDiscipline` needs of a sign-in: how to read its envelope and refresh it. */
+export interface RefreshProtocol<T extends {
+    state: 'ready' | 'refreshing';
+    accessToken: string;
+    expiresAt: number;
+}> {
+    read(raw: string): T;
+    refresh(tokens: T): Promise<T>;
+}
+export interface RefreshDisciplineOptions {
+    /** Refresh this long before expiry. Five minutes. */
+    skewMs?: number;
+    /** Rechecked right before the marker is written (the account still exists, still enabled). */
+    beforeRefresh?: () => Promise<void>;
+    messages?: {
+        /** Nothing in the vault. */
+        missing?: string;
+        /** The entry holds the `refreshing` marker. */
+        interrupted?: string;
+        /** The refresh call failed; unset keeps the protocol's own sentence. */
+        refreshFailed?: string;
+        /** Rotated, but the save failed. */
+        unsaved?: string;
+    };
+}
+/**
+ * The account's tokens, refreshed when they expire within `skewMs`.
+ *
+ * Order is the whole point. A durable `refreshing` marker is written *before*
+ * the refresh token is spent, so a crash, a timeout or a failed save leaves an
+ * entry that says "reconnect" rather than one another process would replay.
+ * The rotated pair is saved before it is returned; a rotation that could not
+ * be saved is never used. If the marker itself cannot be written, nothing is
+ * spent. The caller holds the cross-process lock for this account.
+ */
+export declare function refreshDiscipline<T extends {
+    state: 'ready' | 'refreshing';
+    accessToken: string;
+    expiresAt: number;
+}>(vault: Vault, ref: string, protocol: RefreshProtocol<T>, now?: () => number, opts?: RefreshDisciplineOptions): Promise<T>;
+//# sourceMappingURL=oauth.d.ts.map

package/packages/runtime/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAwB,KAAK,aAAa,EAA0B,MAAM,gBAAgB,CAAC;AAMlG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC/E,yFAAyF;IACzF,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAID,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1D;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE5D;AAKD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,sBAA2B,GAAG,WAAW,CAwC3F;AAMD,MAAM,WAAW,QAAQ;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAEjF,gFAAgF;AAChF,wBAAgB,QAAQ,IAAI,QAAQ,CAGnC;AAED,oCAAoC;AACpC,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAW1D;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhF,kFAAkF;AAClF,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB;gBAA5B,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CACnE;AAED,MAAM,WAAW,oBAAoB;IACnC,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6B1I;AAeD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,mBAAmB,EAAE,2BAA2B,CAAC;IACjD,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,CAatI;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAID;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAgC7H;AAED,0EAA0E;AAC1E,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAkB9J;AAqED,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,CAI3D;AAcD,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,aAAa,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAO,GACpE,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAMD,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gDAAgD;IAChD,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+EAA+E;IAC/E,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC3D;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,WAAW,CAAC;IACrG,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAID,uEAAuE;AACvE,qBAAa,WAAW;;IAGV,QAAQ,CAAC,OAAO,EAAE,kBAAkB;IAFhD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;gBACN,OAAO,EAAE,kBAAkB;IA+DhD,qEAAqE;IACrE,YAAY,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ9I,8EAA8E;IAC9E,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,WAAW,CAAC;CAMvF;AAMD,4FAA4F;AAC5F,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;IAClH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE;QACT,4BAA4B;QAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,+CAA+C;QAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,wEAAwE;QACxE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,oCAAoC;QACpC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,OAAO,GAAG,YAAY,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,EAC5B,GAAG,GAAE,MAAM,MAAiB,EAC5B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,CAAC,CAAC,CAkBZ"}