@zivis/mcp 0.1.0-alpha.17 → 0.1.0-alpha.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api-client.d.ts +3 -11
- package/dist/api-client.js +28 -55
- package/dist/api-client.js.map +1 -1
- package/dist/auth/index.d.ts +3 -2
- package/dist/auth/index.js +7 -5
- package/dist/auth/index.js.map +1 -1
- package/dist/auth/keychain.d.ts +6 -5
- package/dist/auth/keychain.js +50 -45
- package/dist/auth/keychain.js.map +1 -1
- package/dist/auth/oauth.js +2 -2
- package/dist/auth/oauth.js.map +1 -1
- package/dist/auth/sessions.d.ts +5 -4
- package/dist/auth/sessions.js +20 -14
- package/dist/auth/sessions.js.map +1 -1
- package/dist/auth/token-refresh.d.ts +2 -2
- package/dist/auth/token-refresh.js +7 -6
- package/dist/auth/token-refresh.js.map +1 -1
- package/dist/cli.d.ts +7 -15
- package/dist/cli.js +35 -905
- package/dist/cli.js.map +1 -1
- package/dist/project-binding.d.ts +13 -2
- package/dist/project-binding.js +38 -3
- package/dist/project-binding.js.map +1 -1
- package/dist/server.d.ts +1 -1
- package/dist/server.js +59 -44
- package/dist/server.js.map +1 -1
- package/dist/tools/check-project.d.ts +4 -4
- package/dist/tools/check-project.js +41 -42
- package/dist/tools/check-project.js.map +1 -1
- package/dist/types.d.ts +19 -0
- package/dist/types.js +10 -0
- package/dist/types.js.map +1 -1
- package/package.json +1 -1
package/dist/api-client.d.ts
CHANGED
|
@@ -1,13 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* ZIVIS API Client
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
* - OAuth: Authorization: Bearer <token>
|
|
7
|
-
* - API Key: X-API-Key: <key>
|
|
8
|
-
*
|
|
9
|
-
* Handles 401 responses by attempting token refresh (OAuth)
|
|
10
|
-
* before returning an auth error.
|
|
4
|
+
* Uses API keys for all requests (X-API-Key). OAuth in the CLI exists to mint
|
|
5
|
+
* org-scoped keys via `zivis auth bind`; Bearer access tokens are not used here.
|
|
11
6
|
*/
|
|
12
7
|
import type { ZivisConfig } from "./types.js";
|
|
13
8
|
export declare class ApiClient {
|
|
@@ -26,10 +21,7 @@ export declare class ApiClient {
|
|
|
26
21
|
*/
|
|
27
22
|
private buildAuthHeaders;
|
|
28
23
|
/**
|
|
29
|
-
* Make an authenticated request to the ZIVIS API.
|
|
30
|
-
*
|
|
31
|
-
* Automatically resolves credentials and attaches auth headers.
|
|
32
|
-
* On 401 with OAuth, attempts one token refresh and retries.
|
|
24
|
+
* Make an authenticated request to the ZIVIS API using an MCP API key (X-API-Key).
|
|
33
25
|
*/
|
|
34
26
|
request<T>(method: string, path: string, body?: unknown): Promise<T>;
|
|
35
27
|
private doRequest;
|
package/dist/api-client.js
CHANGED
|
@@ -1,16 +1,11 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* ZIVIS API Client
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
* - OAuth: Authorization: Bearer <token>
|
|
7
|
-
* - API Key: X-API-Key: <key>
|
|
8
|
-
*
|
|
9
|
-
* Handles 401 responses by attempting token refresh (OAuth)
|
|
10
|
-
* before returning an auth error.
|
|
4
|
+
* Uses API keys for all requests (X-API-Key). OAuth in the CLI exists to mint
|
|
5
|
+
* org-scoped keys via `zivis auth bind`; Bearer access tokens are not used here.
|
|
11
6
|
*/
|
|
12
7
|
import { resolveAuth } from "./auth/index.js";
|
|
13
|
-
import { detectProjectBinding } from "./project-binding.js";
|
|
8
|
+
import { detectProjectBinding, resolveConfigFromBinding, resolveMcpSessionForWorkspace, } from "./project-binding.js";
|
|
14
9
|
import { DEFAULT_CONFIG } from "./types.js";
|
|
15
10
|
export class ApiClient {
|
|
16
11
|
config;
|
|
@@ -25,26 +20,24 @@ export class ApiClient {
|
|
|
25
20
|
* `zivis mcp install`.
|
|
26
21
|
*/
|
|
27
22
|
resolveEffectiveConfig(cwd) {
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
if (this.config.session) {
|
|
23
|
+
const ws = this.config.workspacePath ?? cwd ?? process.cwd();
|
|
24
|
+
const detected = detectProjectBinding(ws);
|
|
25
|
+
if (!detected) {
|
|
32
26
|
return this.config;
|
|
33
27
|
}
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
}
|
|
46
|
-
}
|
|
47
|
-
return this.config;
|
|
28
|
+
const { binding } = detected;
|
|
29
|
+
const fromBinding = resolveConfigFromBinding(ws);
|
|
30
|
+
// Same session precedence as server startup (see resolveMcpSessionForWorkspace).
|
|
31
|
+
// Always overlay binding for this workspace (OAuth URL, API host, keychain bucket).
|
|
32
|
+
return {
|
|
33
|
+
...this.config,
|
|
34
|
+
session: resolveMcpSessionForWorkspace(this.config, ws, detected, fromBinding),
|
|
35
|
+
...(binding.apiBaseUrl ? { apiBaseUrl: binding.apiBaseUrl } : {}),
|
|
36
|
+
...(binding.oauthApiUrl ? { oauthApiUrl: binding.oauthApiUrl } : {}),
|
|
37
|
+
...(binding.oauthClientId ? { oauthClientId: binding.oauthClientId } : {}),
|
|
38
|
+
...(binding.keychainPrefix ? { keychainPrefix: binding.keychainPrefix } : {}),
|
|
39
|
+
...(binding.configDir ? { configDir: binding.configDir } : {}),
|
|
40
|
+
};
|
|
48
41
|
}
|
|
49
42
|
/**
|
|
50
43
|
* Build auth headers from current credentials
|
|
@@ -60,42 +53,22 @@ export class ApiClient {
|
|
|
60
53
|
}
|
|
61
54
|
}
|
|
62
55
|
/**
|
|
63
|
-
* Make an authenticated request to the ZIVIS API.
|
|
64
|
-
*
|
|
65
|
-
* Automatically resolves credentials and attaches auth headers.
|
|
66
|
-
* On 401 with OAuth, attempts one token refresh and retries.
|
|
56
|
+
* Make an authenticated request to the ZIVIS API using an MCP API key (X-API-Key).
|
|
67
57
|
*/
|
|
68
58
|
async request(method, path, body) {
|
|
69
59
|
const effectiveConfig = this.resolveEffectiveConfig();
|
|
70
|
-
const creds = await resolveAuth(effectiveConfig);
|
|
60
|
+
const creds = await resolveAuth(effectiveConfig, "apikey");
|
|
71
61
|
if (creds.method === "none") {
|
|
72
|
-
throw new ApiError("Not authenticated.
|
|
73
|
-
}
|
|
74
|
-
const result = await this.doRequest(method, path, body, creds);
|
|
75
|
-
// If 401 and using OAuth, try refreshing
|
|
76
|
-
if (result.status === 401 && creds.method === "oauth") {
|
|
77
|
-
const freshCreds = await resolveAuth(effectiveConfig);
|
|
78
|
-
if (freshCreds.method === "oauth" &&
|
|
79
|
-
freshCreds.accessToken !== creds.accessToken) {
|
|
80
|
-
// Token was refreshed, retry
|
|
81
|
-
const retryResult = await this.doRequest(method, path, body, freshCreds);
|
|
82
|
-
if (retryResult.status === 401) {
|
|
83
|
-
throw new ApiError("Session expired. Run: zivis auth login", 401, "SESSION_EXPIRED");
|
|
84
|
-
}
|
|
85
|
-
if (!retryResult.ok) {
|
|
86
|
-
throw new ApiError(retryResult.errorMessage || "API request failed", retryResult.status, "API_ERROR");
|
|
87
|
-
}
|
|
88
|
-
return retryResult.data;
|
|
89
|
-
}
|
|
90
|
-
throw new ApiError("Session expired. Run: zivis auth login", 401, "SESSION_EXPIRED");
|
|
62
|
+
throw new ApiError("Not authenticated. MCP uses API keys only — run: zivis auth bind (or zivis auth token sk_... --session <name>)", 401, "AUTH_REQUIRED");
|
|
91
63
|
}
|
|
64
|
+
const result = await this.doRequest(method, path, body, creds, effectiveConfig.apiBaseUrl);
|
|
92
65
|
if (!result.ok) {
|
|
93
66
|
throw new ApiError(result.errorMessage || `API request failed: ${method} ${path}`, result.status, "API_ERROR");
|
|
94
67
|
}
|
|
95
68
|
return result.data;
|
|
96
69
|
}
|
|
97
|
-
async doRequest(method, path, body, creds) {
|
|
98
|
-
const url = `${
|
|
70
|
+
async doRequest(method, path, body, creds, apiBaseUrl) {
|
|
71
|
+
const url = `${apiBaseUrl}${path}`;
|
|
99
72
|
const headers = {
|
|
100
73
|
"Content-Type": "application/json",
|
|
101
74
|
"User-Agent": "@zivis-ai/cli",
|
|
@@ -136,11 +109,11 @@ export class ApiClient {
|
|
|
136
109
|
*/
|
|
137
110
|
async getText(path) {
|
|
138
111
|
const effectiveConfig = this.resolveEffectiveConfig();
|
|
139
|
-
const creds = await resolveAuth(effectiveConfig);
|
|
112
|
+
const creds = await resolveAuth(effectiveConfig, "apikey");
|
|
140
113
|
if (creds.method === "none") {
|
|
141
|
-
throw new ApiError("Not authenticated.
|
|
114
|
+
throw new ApiError("Not authenticated. MCP uses API keys only — run: zivis auth bind", 401, "AUTH_REQUIRED");
|
|
142
115
|
}
|
|
143
|
-
const url = `${
|
|
116
|
+
const url = `${effectiveConfig.apiBaseUrl}${path}`;
|
|
144
117
|
const headers = {
|
|
145
118
|
"User-Agent": "@zivis-ai/cli",
|
|
146
119
|
...this.buildAuthHeaders(creds),
|
package/dist/api-client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,OAAO,SAAS;IACZ,MAAM,CAAc;IAE5B,YAAY,SAAsB,cAAc;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB,CAAC,GAAY;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAC7B,MAAM,WAAW,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACjD,iFAAiF;QACjF,oFAAoF;QACpF,OAAO;YACL,GAAG,IAAI,CAAC,MAAM;YACd,OAAO,EAAE,6BAA6B,CACpC,IAAI,CAAC,MAAM,EACX,EAAE,EACF,QAAQ,EACR,WAAW,CACZ;YACD,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CACtB,KAAsB;QAEtB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,KAAK,OAAO;gBACV,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1D,KAAK,QAAQ;gBACX,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,MAAO,EAAE,CAAC;YACxC,KAAK,MAAM;gBACT,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAE3D,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAChB,gHAAgH,EAChH,GAAG,EACH,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,eAAe,CAAC,UAAU,CAC3B,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,MAAM,CAAC,YAAY,IAAI,uBAAuB,MAAM,IAAI,IAAI,EAAE,EAC9D,MAAM,CAAC,MAAM,EACb,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,IAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,KAAsB,EACtB,UAAkB;QAOlB,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QACnC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,eAAe;YAC7B,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChC,CAAC;QAEF,MAAM,YAAY,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtD,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAEhD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,YAAY,EACT,SAAoC,CAAC,OAAO;wBAC5C,SAAoC,CAAC,KAAK;wBAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE;iBAC5B,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gBAAgB;YAChB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAChE,MAAM,IAAI,QAAQ,CAChB,mCAAmC,GAAG,MAAM,OAAO,EAAE,EACrD,CAAC,EACD,eAAe,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAE3D,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAChB,kEAAkE,EAClE,GAAG,EACH,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,eAAe,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QACnD,MAAM,OAAO,GAA2B;YACtC,YAAY,EAAE,eAAe;YAC7B,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;SAChC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,QAAQ,CACf,SAAoC,CAAC,OAAO;gBAC1C,SAAoC,CAAC,KAAK;gBAC3C,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAC3B,QAAQ,CAAC,MAAM,EACf,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF"}
|
package/dist/auth/index.d.ts
CHANGED
|
@@ -4,9 +4,10 @@
|
|
|
4
4
|
* Resolves credentials using the defined precedence:
|
|
5
5
|
* 1. OS Keychain — Local Project Binding Token / API key (apikey.<session>)
|
|
6
6
|
* Minted by `zivis auth bind` — org-scoped, never expires, no refresh drift.
|
|
7
|
-
*
|
|
7
|
+
* The MCP server resolves with forceMethod=`"apikey"` only: OAuth is for
|
|
8
|
+
* browser login that *mints* this key, not for Bearer access to tenant APIs.
|
|
8
9
|
* 2. ZIVIS_API_KEY env var (CI environments)
|
|
9
|
-
* 3. OS Keychain — OAuth tokens (
|
|
10
|
+
* 3. OS Keychain — OAuth tokens (CLI `zivis auth status` / token refresh only — not MCP)
|
|
10
11
|
* 4. OS Keychain — default API key (no named session)
|
|
11
12
|
* 5. Not authenticated
|
|
12
13
|
*/
|
package/dist/auth/index.js
CHANGED
|
@@ -4,15 +4,16 @@
|
|
|
4
4
|
* Resolves credentials using the defined precedence:
|
|
5
5
|
* 1. OS Keychain — Local Project Binding Token / API key (apikey.<session>)
|
|
6
6
|
* Minted by `zivis auth bind` — org-scoped, never expires, no refresh drift.
|
|
7
|
-
*
|
|
7
|
+
* The MCP server resolves with forceMethod=`"apikey"` only: OAuth is for
|
|
8
|
+
* browser login that *mints* this key, not for Bearer access to tenant APIs.
|
|
8
9
|
* 2. ZIVIS_API_KEY env var (CI environments)
|
|
9
|
-
* 3. OS Keychain — OAuth tokens (
|
|
10
|
+
* 3. OS Keychain — OAuth tokens (CLI `zivis auth status` / token refresh only — not MCP)
|
|
10
11
|
* 4. OS Keychain — default API key (no named session)
|
|
11
12
|
* 5. Not authenticated
|
|
12
13
|
*/
|
|
13
14
|
import { keychainRead } from "./keychain.js";
|
|
14
15
|
import { getValidAccessToken } from "./token-refresh.js";
|
|
15
|
-
import { DEFAULT_CONFIG } from "../types.js";
|
|
16
|
+
import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
|
|
16
17
|
export { login } from "./oauth.js";
|
|
17
18
|
export { keychainClearAll, keychainClearSession, getStorageName, getSessionAccount } from "./keychain.js";
|
|
18
19
|
export { keychainStore, keychainRead, keychainDelete } from "./keychain.js";
|
|
@@ -29,6 +30,7 @@ export { loadSessionIndex, saveSessionEntry, removeSessionEntry, listSessions }
|
|
|
29
30
|
*/
|
|
30
31
|
export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
|
|
31
32
|
const session = config.session;
|
|
33
|
+
const st = credentialStorageFromConfig(config);
|
|
32
34
|
// 1. Per-session keychain API key — Local Project Binding Token (preferred).
|
|
33
35
|
// Minted by `zivis auth bind` and stored under `apikey.<session>`.
|
|
34
36
|
// Org-scoped at the WorkOS level, never refreshes, no drift risk.
|
|
@@ -36,7 +38,7 @@ export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
|
|
|
36
38
|
if (forceMethod !== "oauth") {
|
|
37
39
|
const apiKeyAccount = session ? `apikey.${session}` : null;
|
|
38
40
|
if (apiKeyAccount) {
|
|
39
|
-
const sessionApiKey = await keychainRead(apiKeyAccount);
|
|
41
|
+
const sessionApiKey = await keychainRead(apiKeyAccount, st);
|
|
40
42
|
if (sessionApiKey) {
|
|
41
43
|
return { method: "apikey", apiKey: sessionApiKey };
|
|
42
44
|
}
|
|
@@ -62,7 +64,7 @@ export async function resolveAuth(config = DEFAULT_CONFIG, forceMethod) {
|
|
|
62
64
|
}
|
|
63
65
|
// 4. Default API key from keychain (no named session).
|
|
64
66
|
if (forceMethod !== "oauth") {
|
|
65
|
-
const apiKey = await keychainRead("apikey");
|
|
67
|
+
const apiKey = await keychainRead("apikey", st);
|
|
66
68
|
if (apiKey) {
|
|
67
69
|
return { method: "apikey", apiKey };
|
|
68
70
|
}
|
package/dist/auth/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAErG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAsB,cAAc,EACpC,WAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAE/B,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAE/C,6EAA6E;IAC7E,sEAAsE;IACtE,qEAAqE;IACrE,8EAA8E;IAC9E,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,gFAAgF;IAChF,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,wCAAwC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,uDAAuD;IACvD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAsB,cAAc;IAEpC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,sBAAsB,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,YAAY,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QACpG,KAAK,MAAM;YACT,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC"}
|
package/dist/auth/keychain.d.ts
CHANGED
|
@@ -10,24 +10,25 @@
|
|
|
10
10
|
*
|
|
11
11
|
* Falls back to encrypted file if keychain CLI is unavailable.
|
|
12
12
|
*/
|
|
13
|
+
import { type CredentialStorage } from "../types.js";
|
|
13
14
|
/**
|
|
14
15
|
* Returns the keychain account key for a given session.
|
|
15
16
|
* - No session or undefined → "oauth" (backward compatible)
|
|
16
17
|
* - Named session → "oauth.{session}"
|
|
17
18
|
*/
|
|
18
19
|
export declare function getSessionAccount(session?: string): string;
|
|
19
|
-
export declare function keychainStore(account: string, value: string): Promise<void>;
|
|
20
|
-
export declare function keychainRead(account: string): Promise<string | null>;
|
|
21
|
-
export declare function keychainDelete(account: string): Promise<void>;
|
|
20
|
+
export declare function keychainStore(account: string, value: string, storage?: CredentialStorage): Promise<void>;
|
|
21
|
+
export declare function keychainRead(account: string, storage?: CredentialStorage): Promise<string | null>;
|
|
22
|
+
export declare function keychainDelete(account: string, storage?: CredentialStorage): Promise<void>;
|
|
22
23
|
/**
|
|
23
24
|
* Delete credentials for a specific session
|
|
24
25
|
*/
|
|
25
|
-
export declare function keychainClearSession(session?: string): Promise<void>;
|
|
26
|
+
export declare function keychainClearSession(session?: string, storage?: CredentialStorage): Promise<void>;
|
|
26
27
|
/**
|
|
27
28
|
* Delete all stored credentials (default OAuth + API key).
|
|
28
29
|
* Does NOT clear named sessions — use keychainClearSession() for those.
|
|
29
30
|
*/
|
|
30
|
-
export declare function keychainClearAll(): Promise<void>;
|
|
31
|
+
export declare function keychainClearAll(storage?: CredentialStorage): Promise<void>;
|
|
31
32
|
/**
|
|
32
33
|
* Returns the storage mechanism name for display purposes
|
|
33
34
|
*/
|
package/dist/auth/keychain.js
CHANGED
|
@@ -18,8 +18,12 @@ import * as os from "node:os";
|
|
|
18
18
|
import * as crypto from "node:crypto";
|
|
19
19
|
import { ENV_CONFIG } from "../types.js";
|
|
20
20
|
const execFileAsync = promisify(execFile);
|
|
21
|
-
|
|
22
|
-
|
|
21
|
+
function resolvedStorage(storage) {
|
|
22
|
+
return (storage ?? {
|
|
23
|
+
keychainPrefix: ENV_CONFIG.keychainPrefix,
|
|
24
|
+
configDir: ENV_CONFIG.configDir,
|
|
25
|
+
});
|
|
26
|
+
}
|
|
23
27
|
/**
|
|
24
28
|
* Returns the keychain account key for a given session.
|
|
25
29
|
* - No session or undefined → "oauth" (backward compatible)
|
|
@@ -28,23 +32,21 @@ const SERVICE_PREFIX = ENV_CONFIG.keychainPrefix;
|
|
|
28
32
|
export function getSessionAccount(session) {
|
|
29
33
|
return session ? `oauth.${session}` : "oauth";
|
|
30
34
|
}
|
|
31
|
-
function getServiceName(account) {
|
|
32
|
-
return `${
|
|
35
|
+
function getServiceName(account, keychainPrefix) {
|
|
36
|
+
return `${keychainPrefix}.${account}`;
|
|
33
37
|
}
|
|
34
|
-
function getFallbackDir() {
|
|
35
|
-
// Use environment-aware config dir so staging and production are isolated
|
|
36
|
-
const configDir = ENV_CONFIG.configDir;
|
|
38
|
+
function getFallbackDir(configDir) {
|
|
37
39
|
if (process.platform === "win32") {
|
|
38
40
|
return path.join(process.env.APPDATA || os.homedir(), configDir);
|
|
39
41
|
}
|
|
40
42
|
return path.join(os.homedir(), ".config", configDir);
|
|
41
43
|
}
|
|
42
|
-
function getFallbackPath(account) {
|
|
43
|
-
return path.join(getFallbackDir(), `${account}.enc`);
|
|
44
|
+
function getFallbackPath(account, storage) {
|
|
45
|
+
return path.join(getFallbackDir(storage.configDir), `${account}.enc`);
|
|
44
46
|
}
|
|
45
47
|
// ── macOS Keychain ──
|
|
46
|
-
async function macosStore(account, value) {
|
|
47
|
-
const service = getServiceName(account);
|
|
48
|
+
async function macosStore(account, value, keychainPrefix) {
|
|
49
|
+
const service = getServiceName(account, keychainPrefix);
|
|
48
50
|
// Delete existing entry first (ignore errors if not found)
|
|
49
51
|
try {
|
|
50
52
|
await execFileAsync("security", [
|
|
@@ -68,8 +70,8 @@ async function macosStore(account, value) {
|
|
|
68
70
|
value,
|
|
69
71
|
]);
|
|
70
72
|
}
|
|
71
|
-
async function macosRead(account) {
|
|
72
|
-
const service = getServiceName(account);
|
|
73
|
+
async function macosRead(account, keychainPrefix) {
|
|
74
|
+
const service = getServiceName(account, keychainPrefix);
|
|
73
75
|
try {
|
|
74
76
|
const { stdout } = await execFileAsync("security", [
|
|
75
77
|
"find-generic-password",
|
|
@@ -85,8 +87,8 @@ async function macosRead(account) {
|
|
|
85
87
|
return null;
|
|
86
88
|
}
|
|
87
89
|
}
|
|
88
|
-
async function macosDelete(account) {
|
|
89
|
-
const service = getServiceName(account);
|
|
90
|
+
async function macosDelete(account, keychainPrefix) {
|
|
91
|
+
const service = getServiceName(account, keychainPrefix);
|
|
90
92
|
try {
|
|
91
93
|
await execFileAsync("security", [
|
|
92
94
|
"delete-generic-password",
|
|
@@ -101,13 +103,13 @@ async function macosDelete(account) {
|
|
|
101
103
|
}
|
|
102
104
|
}
|
|
103
105
|
// ── Linux Secret Service ──
|
|
104
|
-
async function linuxStore(account, value) {
|
|
106
|
+
async function linuxStore(account, value, keychainPrefix) {
|
|
105
107
|
const child = execFileAsync("secret-tool", [
|
|
106
108
|
"store",
|
|
107
109
|
"--label",
|
|
108
110
|
`ZIVIS MCP ${account}`,
|
|
109
111
|
"service",
|
|
110
|
-
|
|
112
|
+
keychainPrefix,
|
|
111
113
|
"account",
|
|
112
114
|
account,
|
|
113
115
|
]);
|
|
@@ -116,12 +118,12 @@ async function linuxStore(account, value) {
|
|
|
116
118
|
child.child.stdin?.end();
|
|
117
119
|
await child;
|
|
118
120
|
}
|
|
119
|
-
async function linuxRead(account) {
|
|
121
|
+
async function linuxRead(account, keychainPrefix) {
|
|
120
122
|
try {
|
|
121
123
|
const { stdout } = await execFileAsync("secret-tool", [
|
|
122
124
|
"lookup",
|
|
123
125
|
"service",
|
|
124
|
-
|
|
126
|
+
keychainPrefix,
|
|
125
127
|
"account",
|
|
126
128
|
account,
|
|
127
129
|
]);
|
|
@@ -131,12 +133,12 @@ async function linuxRead(account) {
|
|
|
131
133
|
return null;
|
|
132
134
|
}
|
|
133
135
|
}
|
|
134
|
-
async function linuxDelete(account) {
|
|
136
|
+
async function linuxDelete(account, keychainPrefix) {
|
|
135
137
|
try {
|
|
136
138
|
await execFileAsync("secret-tool", [
|
|
137
139
|
"clear",
|
|
138
140
|
"service",
|
|
139
|
-
|
|
141
|
+
keychainPrefix,
|
|
140
142
|
"account",
|
|
141
143
|
account,
|
|
142
144
|
]);
|
|
@@ -151,7 +153,7 @@ function deriveKey() {
|
|
|
151
153
|
const seed = `zivis-mcp:${os.hostname()}:${os.userInfo().username}`;
|
|
152
154
|
return crypto.createHash("sha256").update(seed).digest();
|
|
153
155
|
}
|
|
154
|
-
async function fileStore(account, value) {
|
|
156
|
+
async function fileStore(account, value, storage) {
|
|
155
157
|
const key = deriveKey();
|
|
156
158
|
const iv = crypto.randomBytes(16);
|
|
157
159
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
@@ -159,13 +161,13 @@ async function fileStore(account, value) {
|
|
|
159
161
|
let encrypted = cipher.update(value, "utf8", "hex");
|
|
160
162
|
encrypted += cipher.final("hex");
|
|
161
163
|
const data = JSON.stringify({ iv: iv.toString("hex"), data: encrypted });
|
|
162
|
-
const dir = getFallbackDir();
|
|
164
|
+
const dir = getFallbackDir(storage.configDir);
|
|
163
165
|
await fs.mkdir(dir, { recursive: true });
|
|
164
|
-
await fs.writeFile(getFallbackPath(account), data, { mode: 0o600 });
|
|
166
|
+
await fs.writeFile(getFallbackPath(account, storage), data, { mode: 0o600 });
|
|
165
167
|
}
|
|
166
|
-
async function fileRead(account) {
|
|
168
|
+
async function fileRead(account, storage) {
|
|
167
169
|
try {
|
|
168
|
-
const raw = await fs.readFile(getFallbackPath(account), "utf8");
|
|
170
|
+
const raw = await fs.readFile(getFallbackPath(account, storage), "utf8");
|
|
169
171
|
const { iv, data } = JSON.parse(raw);
|
|
170
172
|
const key = deriveKey();
|
|
171
173
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
@@ -178,9 +180,9 @@ async function fileRead(account) {
|
|
|
178
180
|
return null;
|
|
179
181
|
}
|
|
180
182
|
}
|
|
181
|
-
async function fileDelete(account) {
|
|
183
|
+
async function fileDelete(account, storage) {
|
|
182
184
|
try {
|
|
183
|
-
await fs.unlink(getFallbackPath(account));
|
|
185
|
+
await fs.unlink(getFallbackPath(account, storage));
|
|
184
186
|
}
|
|
185
187
|
catch {
|
|
186
188
|
// File didn't exist
|
|
@@ -211,51 +213,54 @@ async function useKeychain() {
|
|
|
211
213
|
return keychainAvailable;
|
|
212
214
|
}
|
|
213
215
|
// ── Public API ──
|
|
214
|
-
export async function keychainStore(account, value) {
|
|
216
|
+
export async function keychainStore(account, value, storage) {
|
|
217
|
+
const st = resolvedStorage(storage);
|
|
215
218
|
// Always store to encrypted file as fallback (for environments where keychain CLI
|
|
216
219
|
// may not be available, e.g., MCP servers spawned by IDEs with different $PATH)
|
|
217
|
-
await fileStore(account, value);
|
|
220
|
+
await fileStore(account, value, st);
|
|
218
221
|
// Also store to native keychain if available
|
|
219
222
|
if (await useKeychain()) {
|
|
220
223
|
if (process.platform === "darwin") {
|
|
221
|
-
await macosStore(account, value);
|
|
224
|
+
await macosStore(account, value, st.keychainPrefix);
|
|
222
225
|
}
|
|
223
226
|
else if (process.platform === "linux") {
|
|
224
|
-
await linuxStore(account, value);
|
|
227
|
+
await linuxStore(account, value, st.keychainPrefix);
|
|
225
228
|
}
|
|
226
229
|
}
|
|
227
230
|
}
|
|
228
|
-
export async function keychainRead(account) {
|
|
231
|
+
export async function keychainRead(account, storage) {
|
|
232
|
+
const st = resolvedStorage(storage);
|
|
229
233
|
if (await useKeychain()) {
|
|
230
234
|
if (process.platform === "darwin")
|
|
231
|
-
return macosRead(account);
|
|
235
|
+
return macosRead(account, st.keychainPrefix);
|
|
232
236
|
if (process.platform === "linux")
|
|
233
|
-
return linuxRead(account);
|
|
237
|
+
return linuxRead(account, st.keychainPrefix);
|
|
234
238
|
}
|
|
235
|
-
return fileRead(account);
|
|
239
|
+
return fileRead(account, st);
|
|
236
240
|
}
|
|
237
|
-
export async function keychainDelete(account) {
|
|
241
|
+
export async function keychainDelete(account, storage) {
|
|
242
|
+
const st = resolvedStorage(storage);
|
|
238
243
|
if (await useKeychain()) {
|
|
239
244
|
if (process.platform === "darwin")
|
|
240
|
-
return macosDelete(account);
|
|
245
|
+
return macosDelete(account, st.keychainPrefix);
|
|
241
246
|
if (process.platform === "linux")
|
|
242
|
-
return linuxDelete(account);
|
|
247
|
+
return linuxDelete(account, st.keychainPrefix);
|
|
243
248
|
}
|
|
244
|
-
return fileDelete(account);
|
|
249
|
+
return fileDelete(account, st);
|
|
245
250
|
}
|
|
246
251
|
/**
|
|
247
252
|
* Delete credentials for a specific session
|
|
248
253
|
*/
|
|
249
|
-
export async function keychainClearSession(session) {
|
|
250
|
-
await keychainDelete(getSessionAccount(session));
|
|
254
|
+
export async function keychainClearSession(session, storage) {
|
|
255
|
+
await keychainDelete(getSessionAccount(session), storage);
|
|
251
256
|
}
|
|
252
257
|
/**
|
|
253
258
|
* Delete all stored credentials (default OAuth + API key).
|
|
254
259
|
* Does NOT clear named sessions — use keychainClearSession() for those.
|
|
255
260
|
*/
|
|
256
|
-
export async function keychainClearAll() {
|
|
257
|
-
await keychainDelete("oauth");
|
|
258
|
-
await keychainDelete("apikey");
|
|
261
|
+
export async function keychainClearAll(storage) {
|
|
262
|
+
await keychainDelete("oauth", storage);
|
|
263
|
+
await keychainDelete("apikey", storage);
|
|
259
264
|
}
|
|
260
265
|
/**
|
|
261
266
|
* Returns the storage mechanism name for display purposes
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,
|
|
1
|
+
{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AAEjE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,SAAS,eAAe,CAAC,OAA2B;IAClD,OAAO,CACL,OAAO,IAAI;QACT,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,cAAsB;IAC7D,OAAO,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,OAA0B;IAClE,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,uBAAuB;AAEvB,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,KAAa,EACb,cAAsB;IAEtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACxD,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB;YACzB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,MAAM,aAAa,CAAC,UAAU,EAAE;QAC9B,sBAAsB;QACtB,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,cAAsB;IAEtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,uBAAuB;YACvB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAe,EACf,cAAsB;IAEtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,UAAU,EAAE;YAC9B,yBAAyB;YACzB,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,KAAa,EACb,cAAsB;IAEtB,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,EAAE;QACzC,OAAO;QACP,SAAS;QACT,aAAa,OAAO,EAAE;QACtB,SAAS;QACT,cAAc;QACd,SAAS;QACT,OAAO;KACR,CAAC,CAAC;IACH,qCAAqC;IACrC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACzB,MAAM,KAAK,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE;YACpD,QAAQ;YACR,SAAS;YACT,cAAc;YACd,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAe,EACf,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,aAAa,EAAE;YACjC,OAAO;YACP,SAAS;YACT,cAAc;YACd,SAAS;YACT,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,SAAS,SAAS;IAChB,mDAAmD;IACnD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAAe,EACf,KAAa,EACb,OAA0B;IAE1B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAU,EAAE,EAAS,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,OAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,GAAU,EACV,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAQ,CAC9B,CAAC;QACF,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrD,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,OAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED,sCAAsC;AAEtC,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAmB,IAAI,CAAC;AAE7C,KAAK,UAAU,WAAW;IACxB,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,iBAAiB,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,mBAAmB;AAEnB,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,KAAa,EACb,OAA2B;IAE3B,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpC,kFAAkF;IAClF,gFAAgF;IAChF,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAEpC,6CAA6C;IAC7C,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,OAA2B;IAE3B,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC/B,OAAO,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,OAA2B;IAE3B,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,WAAW,EAAE,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,OAA2B;IAE3B,MAAM,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA2B;IAChE,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAC1D,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}
|
package/dist/auth/oauth.js
CHANGED
|
@@ -19,7 +19,7 @@ import { URL } from "node:url";
|
|
|
19
19
|
import open from "open";
|
|
20
20
|
import { keychainStore, getSessionAccount } from "./keychain.js";
|
|
21
21
|
import { decodeJwtPayload } from "./jwt.js";
|
|
22
|
-
import { DEFAULT_CONFIG } from "../types.js";
|
|
22
|
+
import { DEFAULT_CONFIG, credentialStorageFromConfig } from "../types.js";
|
|
23
23
|
const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
|
|
24
24
|
function generatePKCE() {
|
|
25
25
|
const verifier = crypto.randomBytes(32).toString("base64url");
|
|
@@ -284,7 +284,7 @@ export async function login(config = DEFAULT_CONFIG, session, organizationId, op
|
|
|
284
284
|
console.error(`[zivis] \u2713 JWT org_id verified: ${jwtOrgId}`);
|
|
285
285
|
}
|
|
286
286
|
// Store in keychain (session-qualified key for multi-tenant isolation)
|
|
287
|
-
await keychainStore(getSessionAccount(session), JSON.stringify(tokens));
|
|
287
|
+
await keychainStore(getSessionAccount(session), JSON.stringify(tokens), credentialStorageFromConfig(config));
|
|
288
288
|
return tokens;
|
|
289
289
|
}
|
|
290
290
|
//# sourceMappingURL=oauth.js.map
|
package/dist/auth/oauth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1E,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAOpD,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CACnB,MAAmB,EACnB,aAAqB,EACrB,KAAa,EACb,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,aAAa;QAC/B,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,WAAW;QAChE,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK,EAAE,qCAAqC;KAC7C,CAAC,CAAC;IAEH,8EAA8E;IAC9E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IACpE,uFAAuF;IACvF,0EAA0E;IAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE9B,2GAA2G;IAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAChE,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAExE,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,gDAAgD;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAEtE,IAAI,SAAS,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAElE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBAEpD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;oBACjD,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC;oBACtC,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC,CAAC;oBACtE,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC;;;;;2CAK2B,SAAS,CAAC,QAAQ;;QAErD,CAAC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CACJ,IAAI,KAAK,CAAC,2CAA2C,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjC,UAAU;QACV,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,YAAqB;IAC3D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;;;;;;;;QAQH,CAAC;IACP,CAAC;IACD,OAAO;;;;;OAKF,YAAY,IAAI,eAAe;;;QAG9B,CAAC;AACT,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAmB,EACnB,IAAY,EACZ,YAAoB;IAEpB,yGAAyG;IACzG,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IAChG,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,IAAI;YACJ,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,WAAW;SACjE,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGrD,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,uBAAuB,CAAC;QACnF,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,kEAAkE;QAClE,2EAA2E;QAC3E,kEAAkE;QAClE,uFAAuF;QACvF,OAAO,CAAC,KAAK,CACX,0DAA0D;YAC1D,+FAA+F;YAC/F,iEAAiE,CAClE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACtG,CAAC;IAED,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AA2CD,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,SAAsB,cAAc,EACpC,OAAgB,EAChB,cAAuB,EACvB,OAAqB,EAAE;IAEvB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAEvE,wFAAwF;IACxF,wFAAwF;IACxF,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;YAC3B,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,cAAc,GAAG;YACvC,CAAC,CAAC,cAAc,CAAC;QACnB,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;QACpD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,gBAAgB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,yCAAyC,QAAQ,GAAG,YAAY,EAAE,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpF,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,yCAAyC,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,+CAA+C;IAC/C,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEpE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,6EAA6E;QAC7E,KAAK,MAAM,GAAG,IAAI;YAChB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE;YAChD,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE;YAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC/C,EAAE,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpF,OAAO,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,IAAI,yBAAyB,CAAC,CAAC;gBACrF,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC3E,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACjF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;IAED,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;IAE/B,2BAA2B;IAC3B,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnE,sEAAsE;IACtE,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,2DAA2D;gBAC3D,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+BAA+B,cAAc,cAAc,QAAQ,IAAI;gBACvE,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,MAAM,aAAa,CACjB,iBAAiB,CAAC,OAAO,CAAC,EAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,2BAA2B,CAAC,MAAM,CAAC,CACpC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
|