brightspace-mcp-server 1.6.3 → 3.0.0

package/build/auth/auth-lock.js

@@ -0,0 +1,162 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { hostname } from "node:os";
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+/**
+ * Windows refuses to rename or remove a directory while any process still
+ * holds a handle inside it. Every contender for a stale lock is doing exactly
+ * that: reclaim.lock lives inside the directory the winner is trying to rename,
+ * so the loser's own scan blocks the winner. POSIX renames by inode and never
+ * sees this.
+ *
+ * The condition clears in milliseconds, so a short retry turns a spurious
+ * EPERM into an ordinary release instead of an unhandled crash.
+ */
+const CONTENTION_CODES = new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
+const RENAME_ATTEMPTS = 5;
+/**
+ * Rename, tolerating Windows contention. Resolves true when the directory
+ * moved, false when it is already gone or contention never cleared. Only a
+ * genuinely unexpected error is thrown, so callers decide what a failed
+ * rename means rather than being handed an ambiguous EPERM.
+ */
+async function renameThroughContention(from, to) {
+    for (let attempt = 0; attempt < RENAME_ATTEMPTS; attempt += 1) {
+        try {
+            await fs.rename(from, to);
+            return true;
+        }
+        catch (error) {
+            const code = error.code ?? "";
+            if (code === "ENOENT")
+                return false;
+            if (!CONTENTION_CODES.has(code))
+                throw error;
+            await delay(10 * (attempt + 1));
+        }
+    }
+    return false;
+}
+export class AuthenticationInProgressError extends Error {
+    code = "AUTH_IN_PROGRESS";
+    constructor() {
+        super("Authentication already in progress. Retry after the current authentication finishes.");
+        this.name = "AuthenticationInProgressError";
+    }
+}
+async function readOwner(lockPath) {
+    try {
+        const owner = JSON.parse(await fs.readFile(path.join(lockPath, "owner.json"), "utf8"));
+        if (Number.isSafeInteger(owner.pid) && owner.pid > 0 && typeof owner.host === "string" && typeof owner.nonce === "string")
+            return owner;
+    }
+    catch {
+        // An incomplete or unknown lock is not proof that its owner is gone.
+    }
+    return undefined;
+}
+function isDead(owner) {
+    // Session directories are local-only. DHCP can change the host's name
+    // without changing this process table, so only PID liveness decides.
+    try {
+        process.kill(owner.pid, 0);
+        return false;
+    }
+    catch (error) {
+        return error.code === "ESRCH";
+    }
+}
+/** Remove only our fixed metadata names, after the directory was retired. */
+async function cleanRetired(lockPath) {
+    await fs.unlink(path.join(lockPath, "owner.json")).catch(() => { });
+    await cleanChild(path.join(lockPath, "reclaim.lock"));
+    await fs.rmdir(lockPath).catch(() => { });
+}
+async function cleanChild(childPath) {
+    try {
+        if ((await fs.lstat(childPath)).isDirectory())
+            await cleanRetired(childPath);
+    }
+    catch { /* Already absent. */ }
+}
+class Lease {
+    directory;
+    owner;
+    constructor(directory, owner) {
+        this.directory = directory;
+        this.owner = owner;
+    }
+    async release() {
+        const current = await readOwner(this.directory);
+        if (current?.nonce !== this.owner.nonce)
+            return;
+        const retired = `${this.directory}.released.${this.owner.nonce}`;
+        // Releasing must never throw. It runs in a finally, so an exception here
+        // would mask the real failure and strand the lock for everyone else.
+        if (await renameThroughContention(this.directory, retired)) {
+            await cleanRetired(retired);
+            return;
+        }
+        // Contention never cleared. Clear the directory where it stands so the
+        // next process sees no owner rather than a lock nobody holds.
+        await cleanRetired(this.directory);
+    }
+}
+/** Acquire a process-shared lock without waiting or relying on its age. */
+export async function acquireProcessLock(lockPath) {
+    await fs.mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+    const lease = await acquireLease(lockPath, 0);
+    return () => lease.release();
+}
+async function acquireLease(lockPath, depth) {
+    if (depth > 16)
+        throw new AuthenticationInProgressError();
+    const owner = { pid: process.pid, host: hostname(), nonce: randomUUID() };
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        try {
+            await fs.mkdir(lockPath, { mode: 0o700 });
+            try {
+                await fs.writeFile(path.join(lockPath, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 0o600 });
+            }
+            catch (error) {
+                await fs.rmdir(lockPath).catch(() => { });
+                throw error;
+            }
+            return new Lease(lockPath, owner);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                throw new AuthenticationInProgressError();
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        const stale = await readOwner(lockPath);
+        if (!stale || !isDead(stale))
+            throw new AuthenticationInProgressError();
+        // Recovery gets its own process lock within the stale directory. If a
+        // recovering process crashes, the same dead-owner rules recover its lock.
+        // Keep this claim in the directory during rename to serialize contenders.
+        const claim = await acquireLease(path.join(lockPath, "reclaim.lock"), depth + 1);
+        try {
+            const current = await readOwner(lockPath);
+            if (current?.nonce !== stale.nonce || !isDead(current))
+                throw new AuthenticationInProgressError();
+            const retired = `${lockPath}.stale.${owner.nonce}`;
+            // A rename blocked by contention means another contender is inside this
+            // directory recovering the same stale lock. That is someone else holding
+            // authentication, not a failure of ours.
+            if (!await renameThroughContention(lockPath, retired)) {
+                throw new AuthenticationInProgressError();
+            }
+            claim.directory = path.join(retired, "reclaim.lock");
+            await claim.release();
+            await cleanRetired(retired);
+        }
+        finally {
+            await claim.release();
+        }
+    }
+    throw new AuthenticationInProgressError();
+}
+//# sourceMappingURL=auth-lock.js.map

package/build/auth/auth-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lock.js","sourceRoot":"","sources":["../../src/auth/auth-lock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5E,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,EAAU;IAC7D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,eAAe,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;YACzD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC7C,MAAM,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC7C,IAAI,GAAG,kBAAkB,CAAC;IACnC;QACE,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAQD,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC1I,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,KAAY;IAC1B,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,KAAK;IACU;IAA4B;IAA/C,YAAmB,SAAiB,EAAW,KAAY;QAAxC,cAAS,GAAT,SAAS,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAC/D,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO;QAChD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,MAAM,uBAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3D,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa;IACzD,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACjF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAClG,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAClG,MAAM,OAAO,GAAG,GAAG,QAAQ,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC;YACnD,wEAAwE;YACxE,yEAAyE;YACzE,yCAAyC;YACzC,IAAI,CAAC,MAAM,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAC5C,CAAC;YACD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,6BAA6B,EAAE,CAAC;AAC5C,CAAC"}

package/build/auth/auth-runner.d.ts

@@ -3,24 +3,45 @@
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
  * Licensed under MIT — see LICENSE file for details.
  */
+import { AuthError } from "../utils/errors.js";
+export type AuthFailureKind = "busy" | "cooldown" | "unsupported" | "secureStorage" | "transport" | "timeout" | "failed";
+export declare class AuthProcessError extends AuthError {
+    readonly kind: AuthFailureKind;
+    constructor(kind: AuthFailureKind, message: string);
+}
+export interface AuthRunnerOptions {
+    timeoutMs?: number;
+    onProgress?: (line: string) => void;
+}
 /**
  * Launches the brightspace-auth CLI as a child process to
  * re-authenticate when the current session has expired.
  *
- * The child process inherits the parent's environment (so .env credentials
- * are available via dotenv in the auth CLI) and runs with the project root
- * as CWD (so dotenv can find the .env file).
+ * The child inherits the parent's resolved environment and working directory,
+ * so both processes read the same account configuration and .env file.
  */
 export declare class AuthRunner {
-    private running;
+    /**
+     * The login this process already started, if one is still running.
+     *
+     * Every tool call funnels here the moment the saved session is gone, and a
+     * stdio MCP server serves tool calls concurrently. Without a latch, two cold
+     * calls both see no token and both spawn a login: two browsers racing the
+     * same cross-process lock, and at Purdue two Authenticator prompts on the
+     * user's phone for one request. Holding the in-flight Promise makes every
+     * caller await the same login and read the same outcome.
+     */
+    private inFlight;
     private readonly scriptPath;
-    private readonly projectRoot;
-    constructor();
+    private readonly timeoutMs;
+    private readonly onProgress?;
+    constructor(options?: AuthRunnerOptions);
     /**
-     * Spawn the auth CLI and wait for it to complete.
-     * Returns true if authentication succeeded, false otherwise.
-     * Prevents concurrent auth attempts via a simple mutex.
+     * Authenticate, joining the login this process already started if there is
+     * one. Returns true on success and throws a useful error on failure.
      */
     run(): Promise<boolean>;
+    /** One child process, start to finish. */
+    private spawnAuth;
 }
 //# sourceMappingURL=auth-runner.d.ts.map

package/build/auth/auth-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runner.d.ts","sourceRoot":"","sources":["../../src/auth/auth-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4CH;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;;IASrC;;;;OAIG;IACG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAwD9B"}
+{"version":3,"file":"auth-runner.d.ts","sourceRoot":"","sources":["../../src/auth/auth-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY/C,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEzH,qBAAa,gBAAiB,SAAQ,SAAS;aACjB,IAAI,EAAE,eAAe;gBAArB,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAInE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAkDD;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAyB;gBAEzC,OAAO,GAAE,iBAAsB;IAQ3C;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB7B,0CAA0C;YAC5B,SAAS;CAgGxB"}

package/build/auth/auth-runner.js

@@ -3,17 +3,47 @@
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
  * Licensed under MIT — see LICENSE file for details.
  */
-import { spawn } from "node:child_process";
+import { spawn, execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import * as path from "node:path";
 import { log } from "../utils/logger.js";
+import { AuthError } from "../utils/errors.js";
+import { AUTH_COMMAND } from "../utils/commands.js";
 /**
  * Timeout for the auth process. It has to outlast the child's own MFA wait,
  * which is five minutes: a person has to find their phone, unlock it, and read
  * a number off the screen. A shorter parent budget would kill the child in the
  * middle of a sign-in the user was still completing.
  */
-const AUTH_TIMEOUT_MS = 6 * 60 * 1000; // 6 minutes
+const AUTH_TIMEOUT_MS = 8 * 60 * 1000;
+const KILL_GRACE_MS = 5000;
+export class AuthProcessError extends AuthError {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = "AuthProcessError";
+    }
+}
+/** Chromium can lead a separate process group, so a forced stop needs its PID. */
+function descendantPids(parentPid) {
+    const rows = execFileSync("ps", ["-eo", "pid=,ppid="], {
+        encoding: "utf8", timeout: 1000,
+    }).trim().split("\n").map(line => line.trim().split(/\s+/).map(Number));
+    const descendants = [];
+    const visited = new Set([parentPid]);
+    const visit = (parent) => {
+        for (const [pid, ppid] of rows) {
+            if (ppid === parent && Number.isInteger(pid) && pid > 1 && !visited.has(pid)) {
+                visited.add(pid);
+                visit(pid);
+                descendants.push(pid);
+            }
+        }
+    };
+    visit(parentPid);
+    return descendants;
+}
 /**
  * Forward a child stream to the server log, one line at a time.
  *
@@ -45,74 +75,159 @@ function forwardLines(stream, emit) {
  * Launches the brightspace-auth CLI as a child process to
  * re-authenticate when the current session has expired.
  *
- * The child process inherits the parent's environment (so .env credentials
- * are available via dotenv in the auth CLI) and runs with the project root
- * as CWD (so dotenv can find the .env file).
+ * The child inherits the parent's resolved environment and working directory,
+ * so both processes read the same account configuration and .env file.
  */
 export class AuthRunner {
-    running = false;
+    /**
+     * The login this process already started, if one is still running.
+     *
+     * Every tool call funnels here the moment the saved session is gone, and a
+     * stdio MCP server serves tool calls concurrently. Without a latch, two cold
+     * calls both see no token and both spawn a login: two browsers racing the
+     * same cross-process lock, and at Purdue two Authenticator prompts on the
+     * user's phone for one request. Holding the in-flight Promise makes every
+     * caller await the same login and read the same outcome.
+     */
+    inFlight = null;
     scriptPath;
-    projectRoot;
-    constructor() {
+    timeoutMs;
+    onProgress;
+    constructor(options = {}) {
         // Resolve paths relative to this file's compiled location (build/auth/auth-runner.js)
         const thisDir = path.dirname(fileURLToPath(import.meta.url));
         this.scriptPath = path.resolve(thisDir, "..", "auth-cli.js");
-        this.projectRoot = path.resolve(thisDir, "..", "..");
+        this.timeoutMs = options.timeoutMs ?? AUTH_TIMEOUT_MS;
+        this.onProgress = options.onProgress;
     }
     /**
-     * Spawn the auth CLI and wait for it to complete.
-     * Returns true if authentication succeeded, false otherwise.
-     * Prevents concurrent auth attempts via a simple mutex.
+     * Authenticate, joining the login this process already started if there is
+     * one. Returns true on success and throws a useful error on failure.
      */
     async run() {
-        if (this.running) {
-            log("DEBUG", "Auth already running, skipping duplicate attempt");
-            return false;
+        if (this.inFlight) {
+            log("DEBUG", "Joining the authentication already in flight");
+            return this.inFlight;
         }
-        this.running = true;
-        try {
-            log("INFO", "Auto-launching brightspace-auth...");
-            return await new Promise((resolve) => {
-                const child = spawn(process.execPath, // use the same Node binary
-                [this.scriptPath], {
-                    cwd: this.projectRoot,
-                    env: { ...process.env },
-                    stdio: ["ignore", "pipe", "pipe"],
-                });
-                let timedOut = false;
-                const timer = setTimeout(() => {
-                    timedOut = true;
-                    child.kill("SIGTERM");
-                }, AUTH_TIMEOUT_MS);
-                forwardLines(child.stderr, (line) => log("INFO", line));
-                // Piped and drained rather than ignored: a full stdout pipe would
-                // block the child mid-login.
-                forwardLines(child.stdout, (line) => log("DEBUG", line));
-                child.on("error", (error) => {
-                    clearTimeout(timer);
-                    log("ERROR", "Auto-auth process failed", error.message);
-                    resolve(false);
-                });
-                child.on("close", (code) => {
-                    clearTimeout(timer);
-                    if (timedOut) {
-                        log("ERROR", `Auto-auth timed out after ${AUTH_TIMEOUT_MS / 60000} minutes`);
-                        resolve(false);
-                    }
-                    else if (code === 0) {
-                        log("INFO", "Auto-auth completed successfully");
-                        resolve(true);
+        // The latch is released by the flow that owns it, as it settles, so a
+        // failed login is never replayed: the tool call after a declined MFA
+        // prompt starts a fresh attempt rather than inheriting the stale
+        // rejection. Ownership is checked because a caller could in principle
+        // clear the latch while this flow is still running.
+        const flow = this.spawnAuth().finally(() => {
+            if (this.inFlight === flow)
+                this.inFlight = null;
+        });
+        this.inFlight = flow;
+        return flow;
+    }
+    /** One child process, start to finish. */
+    async spawnAuth() {
+        log("INFO", "Auto-launching brightspace-auth...");
+        return await new Promise((resolve, reject) => {
+            const child = spawn(process.execPath, // use the same Node binary
+            [this.scriptPath, "--automatic"], {
+                cwd: process.cwd(),
+                env: { ...process.env },
+                stdio: ["ignore", "pipe", "pipe"],
+                detached: process.platform !== "win32",
+            });
+            let timedOut = false;
+            let settled = false;
+            let killTimer;
+            const kill = (signal) => {
+                try {
+                    if (child.pid && process.platform === "win32") {
+                        execFileSync("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+                            stdio: "ignore", timeout: 5000,
+                        });
                     }
-                    else {
-                        log("ERROR", `Auto-auth process failed with exit code ${code}`);
-                        resolve(false);
+                    else if (child.pid) {
+                        if (signal === "SIGKILL") {
+                            try {
+                                for (const pid of descendantPids(child.pid)) {
+                                    try {
+                                        process.kill(pid, "SIGKILL");
+                                    }
+                                    catch { /* Already exited. */ }
+                                }
+                            }
+                            catch { /* Still terminate the owned process group if ps is unavailable. */ }
+                        }
+                        process.kill(-child.pid, signal);
                     }
-                });
+                    else
+                        child.kill(signal);
+                }
+                catch {
+                    // The child may already have exited between close and cleanup.
+                }
+            };
+            const onExit = () => kill("SIGTERM");
+            process.once("exit", onExit);
+            const finish = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                if (killTimer)
+                    clearTimeout(killTimer);
+                process.off("exit", onExit);
+                if (error)
+                    reject(error);
+                else
+                    resolve(true);
+            };
+            const timer = setTimeout(() => {
+                timedOut = true;
+                kill("SIGTERM");
+                killTimer = setTimeout(() => {
+                    kill("SIGKILL");
+                    finish(new AuthProcessError("timeout", `Authentication timed out. Run ${AUTH_COMMAND} to try again.`));
+                }, KILL_GRACE_MS);
+            }, this.timeoutMs);
+            forwardLines(child.stderr, (line) => {
+                log("INFO", line);
+                try {
+                    this.onProgress?.(line);
+                }
+                catch { /* Logging must not interrupt authentication. */ }
             });
-        }
-        finally {
-            this.running = false;
-        }
+            // Piped and drained rather than ignored: a full stdout pipe would
+            // block the child mid-login.
+            forwardLines(child.stdout, (line) => log("DEBUG", line));
+            child.on("error", (error) => {
+                if (settled)
+                    return;
+                log("ERROR", "Auto-auth process failed", error.message);
+                kill("SIGKILL");
+                finish(new AuthProcessError("failed", `Could not start authentication. Run ${AUTH_COMMAND} for details.`));
+            });
+            child.on("close", (code) => {
+                if (settled)
+                    return;
+                if (timedOut) {
+                    kill("SIGKILL");
+                    finish(new AuthProcessError("timeout", `Authentication timed out. Run ${AUTH_COMMAND} to try again.`));
+                }
+                else if (code === 0) {
+                    log("INFO", "Auto-auth completed successfully");
+                    finish();
+                }
+                else {
+                    const failures = {
+                        2: ["busy", "Authentication already in progress in another process. Complete that attempt, then retry."],
+                        3: ["cooldown", `Automatic MFA is paused after an unsuccessful attempt. Run ${AUTH_COMMAND} to retry immediately.`],
+                        4: ["unsupported", "This identity provider cannot complete headless authentication. See the authentication logs."],
+                        5: ["secureStorage", "The native credential store is unavailable or locked. Unlock it and retry."],
+                        6: ["transport", "Brightspace authentication is temporarily unavailable because of a network or server failure. Your saved session was preserved. Try again later."],
+                    };
+                    const [kind, message] = failures[code ?? -1] ?? ["failed", `Authentication failed. Run ${AUTH_COMMAND} to try again.`];
+                    kill("SIGKILL");
+                    finish(new AuthProcessError(kind, message));
+                }
+            });
+        });
     }
 }
 //# sourceMappingURL=auth-runner.js.map

package/build/auth/auth-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runner.js","sourceRoot":"","sources":["../../src/auth/auth-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEnD;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,MAAuB,EACvB,IAA4B;IAE5B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAClC,QAAQ,IAAI,KAAK,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACpB,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACb,OAAO,GAAG,KAAK,CAAC;IACP,UAAU,CAAS;IACnB,WAAW,CAAS;IAErC;QACE,sFAAsF;QACtF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,GAAG,CAAC,OAAO,EAAE,kDAAkD,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;YAElD,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;gBAC5C,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,QAAQ,EAAE,2BAA2B;gBAC7C,CAAC,IAAI,CAAC,UAAU,CAAC,EACjB;oBACE,GAAG,EAAE,IAAI,CAAC,WAAW;oBACrB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;oBACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CACF,CAAC;gBAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,QAAQ,GAAG,IAAI,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,eAAe,CAAC,CAAC;gBAEpB,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACxD,kEAAkE;gBAClE,6BAA6B;gBAC7B,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAEzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBACxD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;gBAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;oBACzB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,QAAQ,EAAE,CAAC;wBACb,GAAG,CAAC,OAAO,EAAE,6BAA6B,eAAe,GAAG,KAAK,UAAU,CAAC,CAAC;wBAC7E,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;yBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACtB,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;wBAChD,OAAO,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,OAAO,EAAE,2CAA2C,IAAI,EAAE,CAAC,CAAC;wBAChE,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"auth-runner.js","sourceRoot":"","sources":["../../src/auth/auth-runner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,aAAa,GAAG,IAAI,CAAC;AAI3B,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IACjB;IAA5B,YAA4B,IAAqB,EAAE,OAAe;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAiB;QAE/C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAOD,kFAAkF;AAClF,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QACrD,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;KAChC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjB,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,SAAS,CAAC,CAAC;IACjB,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,MAAuB,EACvB,IAA4B;IAE5B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAClC,QAAQ,IAAI,KAAK,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACpB,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACrB;;;;;;;;;OASG;IACK,QAAQ,GAA4B,IAAI,CAAC;IAChC,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,UAAU,CAA0B;IAErD,YAAY,UAA6B,EAAE;QACzC,sFAAsF;QACtF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAClC,KAAK,CAAC,SAAS;QACrB,GAAG,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;QAElD,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,QAAQ,EAAE,2BAA2B;YAC7C,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAChC;gBACE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;gBACvB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;aACvC,CACF,CAAC;YAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,SAAoD,CAAC;YACzD,MAAM,IAAI,GAAG,CAAC,MAAsB,EAAE,EAAE;gBACtC,IAAI,CAAC;oBACH,IAAI,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;wBAC9C,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;4BAChE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI;yBAC/B,CAAC,CAAC;oBACL,CAAC;yBAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;wBACrB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;4BACzB,IAAI,CAAC;gCACH,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oCAC5C,IAAI,CAAC;wCAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oCAAC,CAAC;oCAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;gCACvE,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC,CAAC,mEAAmE,CAAC,CAAC;wBACjF,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACnC,CAAC;;wBAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAE,EAAE;gBAC1C,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,SAAS;oBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC5B,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,IAAI,CAAC,SAAS,CAAC,CAAC;oBAChB,MAAM,CAAC,IAAI,gBAAgB,CAAC,SAAS,EAAE,iCAAiC,YAAY,gBAAgB,CAAC,CAAC,CAAC;gBACzG,CAAC,EAAE,aAAa,CAAC,CAAC;YACpB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAClC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAClB,IAAI,CAAC;oBAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;YAC7F,CAAC,CAAC,CAAC;YACH,kEAAkE;YAClE,6BAA6B;YAC7B,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAEzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxD,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,MAAM,CAAC,IAAI,gBAAgB,CAAC,QAAQ,EAAE,uCAAuC,YAAY,eAAe,CAAC,CAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,SAAS,CAAC,CAAC;oBAChB,MAAM,CAAC,IAAI,gBAAgB,CAAC,SAAS,EAAE,iCAAiC,YAAY,gBAAgB,CAAC,CAAC,CAAC;gBACzG,CAAC;qBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;oBAChD,MAAM,EAAE,CAAC;gBACX,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAA8C;wBAC1D,CAAC,EAAE,CAAC,MAAM,EAAE,2FAA2F,CAAC;wBACxG,CAAC,EAAE,CAAC,UAAU,EAAE,8DAA8D,YAAY,wBAAwB,CAAC;wBACnH,CAAC,EAAE,CAAC,aAAa,EAAE,8FAA8F,CAAC;wBAClH,CAAC,EAAE,CAAC,eAAe,EAAE,4EAA4E,CAAC;wBAClG,CAAC,EAAE,CAAC,WAAW,EAAE,kJAAkJ,CAAC;qBACrK,CAAC;oBACF,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,8BAA8B,YAAY,gBAAgB,CAAC,CAAC;oBACvH,IAAI,CAAC,SAAS,CAAC,CAAC;oBAChB,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}