codex-multi-auth 2.0.2 → 2.1.1

package/dist/lib/local-bridge.js

@@ -0,0 +1,249 @@
+import { createServer } from "node:http";
+import { Hono } from "hono";
+import { fetch as undiciFetch } from "undici";
+import { verifyLocalClientBearerToken } from "./local-client-tokens.js";
+import { appendUsageLedgerRow } from "./usage/index.js";
+const DEFAULT_HOST = "127.0.0.1";
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "expect",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const DECODED_UPSTREAM_RESPONSE_HEADERS = new Set(["content-encoding"]);
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1";
+}
+function responseHeadersForClient(headers) {
+    const result = new Headers();
+    for (const [key, value] of headers.entries()) {
+        if (HOP_BY_HOP_HEADERS.has(key.toLowerCase()))
+            continue;
+        if (DECODED_UPSTREAM_RESPONSE_HEADERS.has(key.toLowerCase()))
+            continue;
+        result.set(key, value);
+    }
+    return result;
+}
+function forwardHeaders(headers) {
+    const result = new Headers(headers);
+    for (const key of HOP_BY_HOP_HEADERS) {
+        result.delete(key);
+    }
+    result.delete("host");
+    return result;
+}
+async function streamToArrayBuffer(stream) {
+    if (!stream)
+        return null;
+    const response = new Response(stream);
+    return response.arrayBuffer();
+}
+async function closeServer(server, sockets) {
+    if (!server.listening)
+        return;
+    const closed = new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+    server.closeIdleConnections?.();
+    for (const socket of sockets) {
+        socket.destroy();
+    }
+    await closed;
+}
+async function toWebRequest(req, host, port) {
+    const url = new URL(req.url ?? "/", `http://${host}:${port}`);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                headers.append(key, item);
+        }
+        else {
+            headers.set(key, value);
+        }
+    }
+    const method = req.method ?? "GET";
+    const body = method === "GET" || method === "HEAD"
+        ? undefined
+        : await new Response(req).arrayBuffer();
+    return new Request(url, { method, headers, body });
+}
+function writeWebResponse(res, response) {
+    res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+    if (!response.body) {
+        res.end();
+        return;
+    }
+    const reader = response.body.getReader();
+    const pump = async () => {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value)
+                res.write(Buffer.from(value));
+        }
+        res.end();
+    };
+    void pump().catch((error) => {
+        if (!res.destroyed) {
+            res.destroy(error instanceof Error ? error : undefined);
+        }
+    });
+}
+export async function startLocalBridge(options) {
+    const host = options.host ?? DEFAULT_HOST;
+    if (!isLoopbackHost(host)) {
+        throw new Error("Local bridge only supports loopback hosts.");
+    }
+    const runtimeBaseUrl = options.runtimeBaseUrl.trim().replace(/\/+$/, "");
+    if (!runtimeBaseUrl) {
+        throw new Error("Local bridge requires a runtimeBaseUrl.");
+    }
+    const port = options.port ?? 0;
+    const fetchImpl = options.fetchImpl ?? undiciFetch;
+    const requireAuth = options.requireAuth ?? true;
+    const verifyBearerToken = options.verifyBearerToken ?? verifyLocalClientBearerToken;
+    const app = new Hono();
+    app.get("/health", (context) => context.json({
+        ok: true,
+        service: "codex-multi-auth-local-bridge",
+        runtimeBaseUrl,
+    }));
+    const forward = async (request, targetPath) => {
+        const startedAt = Date.now();
+        if (requireAuth) {
+            const token = await verifyBearerToken(request.headers.get("authorization"), startedAt);
+            if (!token) {
+                return new Response(JSON.stringify({
+                    error: {
+                        message: "Local bridge rejected an unauthenticated request.",
+                        code: "local_bridge_unauthorized",
+                    },
+                }), {
+                    status: 401,
+                    headers: { "content-type": "application/json; charset=utf-8" },
+                });
+            }
+        }
+        const targetUrl = `${runtimeBaseUrl}${targetPath}`;
+        let upstream;
+        try {
+            upstream = await fetchImpl(targetUrl, {
+                method: request.method,
+                headers: forwardHeaders(request.headers),
+                body: request.method === "GET" || request.method === "HEAD"
+                    ? undefined
+                    : await streamToArrayBuffer(request.body),
+            });
+        }
+        catch {
+            await appendUsageLedgerRow({
+                source: "local-bridge",
+                operation: targetPath === "/v1/models" ? "models" : "responses",
+                outcome: "failure",
+                statusCode: 502,
+                errorCode: "local_bridge_upstream_error",
+                durationMs: Date.now() - startedAt,
+            }).catch(() => undefined);
+            return new Response(JSON.stringify({
+                error: {
+                    message: "Local bridge failed to reach the runtime proxy.",
+                    code: "local_bridge_upstream_error",
+                },
+            }), {
+                status: 502,
+                headers: { "content-type": "application/json; charset=utf-8" },
+            });
+        }
+        await appendUsageLedgerRow({
+            source: "local-bridge",
+            operation: targetPath === "/v1/models" ? "models" : "responses",
+            outcome: upstream.ok ? "success" : "failure",
+            statusCode: upstream.status,
+            durationMs: Date.now() - startedAt,
+        }).catch(() => undefined);
+        return new Response(upstream.body, {
+            status: upstream.status,
+            statusText: upstream.statusText,
+            headers: responseHeadersForClient(upstream.headers),
+        });
+    };
+    app.get("/v1/models", (context) => forward(context.req.raw, "/v1/models"));
+    app.post("/v1/responses", (context) => forward(context.req.raw, "/v1/responses"));
+    app.all("*", (context) => context.json({
+        error: {
+            message: "Local bridge only accepts /health, /v1/models, and /v1/responses.",
+            code: "local_bridge_not_found",
+        },
+    }, 404));
+    const server = createServer((req, res) => {
+        void (async () => {
+            try {
+                const webRequest = await toWebRequest(req, host, resolvedPort);
+                writeWebResponse(res, await app.fetch(webRequest));
+            }
+            catch (error) {
+                if (!res.headersSent) {
+                    res.writeHead(500, { "content-type": "application/json; charset=utf-8" });
+                    res.end(`${JSON.stringify({
+                        error: {
+                            message: "Local bridge failed before forwarding the request.",
+                            code: "local_bridge_error",
+                        },
+                    })}\n`);
+                }
+                else if (!res.destroyed) {
+                    res.destroy(error instanceof Error ? error : undefined);
+                }
+            }
+        })();
+    });
+    const sockets = new Set();
+    server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+    });
+    let resolvedPort = port;
+    await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            const address = server.address();
+            resolvedPort =
+                typeof address === "object" && address ? address.port : port;
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+    return {
+        host,
+        port: resolvedPort,
+        baseUrl: `http://${host}:${resolvedPort}`,
+        close: async () => {
+            await closeServer(server, sockets);
+        },
+    };
+}
+//# sourceMappingURL=local-bridge.js.map

package/dist/lib/local-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-bridge.js","sourceRoot":"","sources":["../../lib/local-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAkBxD,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAClC,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACT,CAAC,CAAC;AACH,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAExE,SAAS,cAAc,CAAC,IAAY;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AACzF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAgB;IACjD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACxD,IAAI,iCAAiC,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACvE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB;IACvC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAyC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,OAAoB;IAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO;IAC9B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,IAAI,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACR,CAAC;YACD,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,oBAAoB,EAAE,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,IAAY,EAAE,IAAY;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,IAAI,GACT,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QACpC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAmB,EAAE,QAAkB;IAChE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACtC,OAAO,IAAI,EAAE,CAAC;YACb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK;gBAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IACF,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACpB,GAAG,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAA2B;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,WAA4B,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,4BAA4B,CAAC;IACpF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,OAAO,CAAC,IAAI,CAAC;QACZ,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,+BAA+B;QACxC,cAAc;KACd,CAAC,CACF,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACpB,OAAgB,EAChB,UAA0C,EACtB,EAAE;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACpC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EACpC,SAAS,CACT,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC;oBACd,KAAK,EAAE;wBACN,OAAO,EAAE,mDAAmD;wBAC5D,IAAI,EAAE,2BAA2B;qBACjC;iBACD,CAAC,EACF;oBACC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;iBAC9D,CACD,CAAC;YACH,CAAC;QACF,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,cAAc,GAAG,UAAU,EAAE,CAAC;QACnD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;gBACrC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;gBACxC,IAAI,EACH,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;oBACpD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC;aAC3C,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,oBAAoB,CAAC;gBAC1B,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC/D,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,6BAA6B;gBACxC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aAClC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC;gBACd,KAAK,EAAE;oBACN,OAAO,EAAE,iDAAiD;oBAC1D,IAAI,EAAE,6BAA6B;iBACnC;aACD,CAAC,EACF;gBACC,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;aAC9D,CACD,CAAC;QACH,CAAC;QACD,MAAM,oBAAoB,CAAC;YAC1B,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;YAC/D,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC5C,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAClC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC;SACnD,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;IAClF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CACxB,OAAO,CAAC,IAAI,CACX;QACC,KAAK,EAAE;YACN,OAAO,EAAE,mEAAmE;YAC5E,IAAI,EAAE,wBAAwB;SAC9B;KACD,EACD,GAAG,CACH,CACD,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,KAAK,CAAC,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBACJ,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC/D,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;oBAC1E,GAAG,CAAC,GAAG,CACN,GAAG,IAAI,CAAC,SAAS,CAAC;wBACjB,KAAK,EAAE;4BACN,OAAO,EAAE,oDAAoD;4BAC7D,IAAI,EAAE,oBAAoB;yBAC1B;qBACD,CAAC,IAAI,CACN,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;oBAC3B,GAAG,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACzD,CAAC;YACF,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACN,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;YACtC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAS,EAAE;YAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,YAAY;gBACX,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9D,OAAO,EAAE,CAAC;QACX,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO;QACN,IAAI;QACJ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,UAAU,IAAI,IAAI,YAAY,EAAE;QACzC,KAAK,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/lib/local-client-tokens.d.ts

@@ -0,0 +1,37 @@
+export interface LocalClientTokenRecord {
+    id: string;
+    label: string;
+    prefix: string;
+    tokenHash: string;
+    createdAt: number;
+    lastUsedAt: number | null;
+    revokedAt: number | null;
+}
+export interface LocalClientTokenStore {
+    version: 1;
+    tokens: LocalClientTokenRecord[];
+}
+export interface CreatedLocalClientToken {
+    plainToken: string;
+    record: LocalClientTokenRecord;
+}
+export declare function getLocalClientTokenPath(): string;
+export declare function loadLocalClientTokenStore(): Promise<LocalClientTokenStore>;
+export declare function saveLocalClientTokenStore(store: LocalClientTokenStore): Promise<void>;
+export declare function createLocalClientTokenRecord(input?: {
+    label?: string;
+    now?: number;
+}): CreatedLocalClientToken;
+export declare function addLocalClientToken(input?: {
+    label?: string;
+    now?: number;
+}): Promise<CreatedLocalClientToken>;
+export declare function rotateLocalClientToken(input: {
+    id: string;
+    label?: string;
+    now?: number;
+}): Promise<CreatedLocalClientToken | null>;
+export declare function revokeLocalClientToken(id: string, now?: number): Promise<boolean>;
+export declare function verifyLocalClientBearerToken(authorizationHeader: string | null, now?: number): Promise<LocalClientTokenRecord | null>;
+export declare function resetLocalClientTokenWriteQueueForTests(): void;
+//# sourceMappingURL=local-client-tokens.d.ts.map

package/dist/lib/local-client-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-client-tokens.d.ts","sourceRoot":"","sources":["../../lib/local-client-tokens.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,sBAAsB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,sBAAsB,CAAC;CAC/B;AA0FD,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAahF;AAED,wBAAsB,yBAAyB,CAC9C,KAAK,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,wBAAgB,4BAA4B,CAAC,KAAK,GAAE;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACR,GAAG,uBAAuB,CAY/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,GAAE;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACR,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAMxC;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAa1C;AAED,wBAAsB,sBAAsB,CAC3C,EAAE,EAAE,MAAM,EACV,GAAG,SAAa,GACd,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,4BAA4B,CACjD,mBAAmB,EAAE,MAAM,GAAG,IAAI,EAClC,GAAG,SAAa,GACd,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAaxC;AAED,wBAAgB,uCAAuC,IAAI,IAAI,CAE9D"}

package/dist/lib/local-client-tokens.js

@@ -0,0 +1,200 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync, promises as fs } from "node:fs";
+import { basename, join } from "node:path";
+import { logWarn } from "./logger.js";
+import { getCodexMultiAuthDir } from "./runtime-paths.js";
+import { isRecord, sleep } from "./utils.js";
+const TOKEN_FILE_NAME = "local-client-tokens.json";
+const TOKEN_PREFIX = "cma_local";
+const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
+let writeQueue = Promise.resolve();
+function isRetryableFsError(error) {
+    const code = error?.code;
+    return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
+}
+function normalizeLabel(value) {
+    const trimmed = value?.trim();
+    return trimmed && trimmed.length > 0 ? trimmed.slice(0, 80) : "local-client";
+}
+function hashToken(token) {
+    return `sha256:${createHash("sha256").update(token).digest("hex")}`;
+}
+function createPlainToken() {
+    return `${TOKEN_PREFIX}_${randomBytes(32).toString("base64url")}`;
+}
+function tokenPrefix(token) {
+    return token.slice(0, 18);
+}
+function emptyStore() {
+    return { version: 1, tokens: [] };
+}
+function normalizeRecord(value) {
+    if (!isRecord(value))
+        return null;
+    if (typeof value.id !== "string" || value.id.trim().length === 0)
+        return null;
+    if (typeof value.tokenHash !== "string" ||
+        !value.tokenHash.startsWith("sha256:")) {
+        return null;
+    }
+    return {
+        id: value.id.trim(),
+        label: normalizeLabel(typeof value.label === "string" ? value.label : undefined),
+        prefix: typeof value.prefix === "string" ? value.prefix.slice(0, 32) : "",
+        tokenHash: value.tokenHash,
+        createdAt: typeof value.createdAt === "number" && Number.isFinite(value.createdAt)
+            ? value.createdAt
+            : 0,
+        lastUsedAt: typeof value.lastUsedAt === "number" && Number.isFinite(value.lastUsedAt)
+            ? value.lastUsedAt
+            : null,
+        revokedAt: typeof value.revokedAt === "number" && Number.isFinite(value.revokedAt)
+            ? value.revokedAt
+            : null,
+    };
+}
+function normalizeStore(value) {
+    if (!isRecord(value) || value.version !== 1 || !Array.isArray(value.tokens)) {
+        return emptyStore();
+    }
+    return {
+        version: 1,
+        tokens: value.tokens
+            .map((entry) => normalizeRecord(entry))
+            .filter((entry) => entry !== null),
+    };
+}
+async function readFileWithRetry(path) {
+    let lastError;
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+        try {
+            return await fs.readFile(path, "utf8");
+        }
+        catch (error) {
+            lastError = error;
+            if (!isRetryableFsError(error) || attempt >= 4)
+                throw error;
+            await sleep(10 * 2 ** attempt);
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error("local client token read retry exhausted");
+}
+export function getLocalClientTokenPath() {
+    return join(getCodexMultiAuthDir(), TOKEN_FILE_NAME);
+}
+export async function loadLocalClientTokenStore() {
+    const path = getLocalClientTokenPath();
+    if (!existsSync(path))
+        return emptyStore();
+    try {
+        return normalizeStore(JSON.parse(await readFileWithRetry(path)));
+    }
+    catch (error) {
+        logWarn(`Failed to load local client tokens from ${basename(path)}: ${error instanceof Error ? error.message : String(error)}`);
+        return emptyStore();
+    }
+}
+export async function saveLocalClientTokenStore(store) {
+    const path = getLocalClientTokenPath();
+    const payload = normalizeStore(store);
+    const task = async () => {
+        await fs.mkdir(getCodexMultiAuthDir(), { recursive: true, mode: 0o700 });
+        const tempPath = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+        let moved = false;
+        try {
+            await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+            for (let attempt = 0; attempt < 5; attempt += 1) {
+                try {
+                    await fs.rename(tempPath, path);
+                    moved = true;
+                    return;
+                }
+                catch (error) {
+                    if (!isRetryableFsError(error) || attempt >= 4)
+                        throw error;
+                    await sleep(10 * 2 ** attempt);
+                }
+            }
+        }
+        finally {
+            if (!moved) {
+                try {
+                    await fs.unlink(tempPath);
+                }
+                catch {
+                    // Best-effort temp cleanup.
+                }
+            }
+        }
+    };
+    const queued = writeQueue.catch(() => undefined).then(task);
+    writeQueue = queued.then(() => undefined, () => undefined);
+    await queued;
+}
+export function createLocalClientTokenRecord(input = {}) {
+    const plainToken = createPlainToken();
+    const record = {
+        id: randomUUID(),
+        label: normalizeLabel(input.label),
+        prefix: tokenPrefix(plainToken),
+        tokenHash: hashToken(plainToken),
+        createdAt: input.now ?? Date.now(),
+        lastUsedAt: null,
+        revokedAt: null,
+    };
+    return { plainToken, record };
+}
+export async function addLocalClientToken(input = {}) {
+    const store = await loadLocalClientTokenStore();
+    const created = createLocalClientTokenRecord(input);
+    store.tokens.push(created.record);
+    await saveLocalClientTokenStore(store);
+    return created;
+}
+export async function rotateLocalClientToken(input) {
+    const store = await loadLocalClientTokenStore();
+    const existing = store.tokens.find((record) => record.id === input.id);
+    if (!existing || existing.revokedAt !== null)
+        return null;
+    const now = input.now ?? Date.now();
+    existing.revokedAt = now;
+    const created = createLocalClientTokenRecord({
+        label: input.label ?? existing.label,
+        now,
+    });
+    store.tokens.push(created.record);
+    await saveLocalClientTokenStore(store);
+    return created;
+}
+export async function revokeLocalClientToken(id, now = Date.now()) {
+    const store = await loadLocalClientTokenStore();
+    const existing = store.tokens.find((record) => record.id === id);
+    if (!existing || existing.revokedAt !== null)
+        return false;
+    existing.revokedAt = now;
+    await saveLocalClientTokenStore(store);
+    return true;
+}
+export async function verifyLocalClientBearerToken(authorizationHeader, now = Date.now()) {
+    const match = authorizationHeader?.match(/^Bearer\s+(.+)$/i);
+    const token = match?.[1]?.trim();
+    if (!token)
+        return null;
+    const tokenHash = hashToken(token);
+    const store = await loadLocalClientTokenStore();
+    const record = store.tokens.find((entry) => entry.revokedAt === null && entry.tokenHash === tokenHash);
+    if (!record)
+        return null;
+    record.lastUsedAt = now;
+    await saveLocalClientTokenStore(store);
+    return record;
+}
+export function resetLocalClientTokenWriteQueueForTests() {
+    writeQueue = Promise.resolve();
+}
+//# sourceMappingURL=local-client-tokens.js.map

package/dist/lib/local-client-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-client-tokens.js","sourceRoot":"","sources":["../../lib/local-client-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAsB7C,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACvD,IAAI,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAElD,SAAS,kBAAkB,CAAC,KAAc;IACzC,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;IAChE,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAChD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB;IACxB,OAAO,GAAG,YAAY,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU;IAClB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IACC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EACrC,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,cAAc,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EACR,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,CAAC;QACL,UAAU,EACT,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;YACxE,CAAC,CAAC,KAAK,CAAC,UAAU;YAClB,CAAC,CAAC,IAAI;QACR,SAAS,EACR,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;YACtE,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,IAAI;KACR,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;aAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;aACtC,MAAM,CAAC,CAAC,KAAK,EAAmC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;KACpE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5D,MAAM,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IACD,MAAM,SAAS,YAAY,KAAK;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,OAAO,IAAI,CAAC,oBAAoB,EAAE,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC9C,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC3C,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAY,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CACN,2CAA2C,QAAQ,CAAC,IAAI,CAAC,KACxD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACtD,EAAE,CACF,CAAC;QACF,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,KAA4B;IAE5B,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACtG,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACJ,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACrE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACX,CAAC,CAAC;YACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACJ,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAChC,KAAK,GAAG,IAAI,CAAC;oBACb,OAAO;gBACR,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5D,MAAM,KAAK,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;gBAChC,CAAC;YACF,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACJ,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACR,4BAA4B;gBAC7B,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,UAAU,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;IACF,MAAM,MAAM,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAGzC,EAAE;IACL,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,MAAM,MAAM,GAA2B;QACtC,EAAE,EAAE,UAAU,EAAE;QAChB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;QAClC,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAGtC,EAAE;IACL,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACA,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC;IACzB,MAAM,OAAO,GAAG,4BAA4B,CAAC;QAC5C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QACpC,GAAG;KACH,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,EAAU,EACV,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3D,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC;IACzB,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,mBAAkC,EAClC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,KAAK,GAAG,mBAAmB,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CACpE,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;IACxB,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uCAAuC;IACtD,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AAChC,CAAC"}

package/dist/lib/model-capability-matrix.d.ts

@@ -0,0 +1,38 @@
+import type { AccountStorageV3 } from "./storage.js";
+import { type ModelCapabilities, type ModelReasoningEffort, type PromptModelFamily } from "./request/helpers/model-map.js";
+import { type EntitlementCacheSnapshot } from "./entitlement-cache.js";
+import type { CapabilityPolicySnapshot, CapabilityPolicyStore } from "./capability-policy.js";
+import type { QuotaCacheData, QuotaCacheEntry } from "./quota-cache.js";
+export interface ModelCapabilityMatrixEntry {
+    accountIndex: number;
+    accountLabel: string;
+    accountKey: string;
+    model: string;
+    normalizedModel: string;
+    promptFamily: PromptModelFamily;
+    defaultReasoningEffort: ModelReasoningEffort;
+    supportedReasoningEfforts: readonly ModelReasoningEffort[];
+    capabilities: ModelCapabilities;
+    entitlementBlocked: boolean;
+    entitlementReason: string | null;
+    entitlementWaitMs: number;
+    capabilityPolicy: CapabilityPolicySnapshot | null;
+    capabilityBoost: number;
+    quota: QuotaCacheEntry | null;
+    available: boolean;
+    reasons: string[];
+}
+export interface ModelCapabilityMatrix {
+    generatedAt: number;
+    models: string[];
+    entries: ModelCapabilityMatrixEntry[];
+}
+export declare function buildModelCapabilityMatrix(input: {
+    storage: AccountStorageV3 | null;
+    models?: string[];
+    entitlements?: EntitlementCacheSnapshot | null;
+    capabilityPolicy?: CapabilityPolicyStore | null;
+    quotaCache?: QuotaCacheData | null;
+    now?: number;
+}): ModelCapabilityMatrix;
+//# sourceMappingURL=model-capability-matrix.d.ts.map

package/dist/lib/model-capability-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-capability-matrix.d.ts","sourceRoot":"","sources":["../../lib/model-capability-matrix.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAGN,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEN,KAAK,wBAAwB,EAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACX,wBAAwB,EACxB,qBAAqB,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxE,MAAM,WAAW,0BAA0B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,iBAAiB,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,CAAC;IAC7C,yBAAyB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3D,YAAY,EAAE,iBAAiB,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAClD,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,0BAA0B,EAAE,CAAC;CACtC;AAsBD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC/C,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,UAAU,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,qBAAqB,CA8ExB"}

package/dist/lib/model-capability-matrix.js

@@ -0,0 +1,89 @@
+import { getAccountPolicyKey } from "./account-policy.js";
+import { MODEL_PROFILES, resolveNormalizedModel, } from "./request/helpers/model-map.js";
+import { resolveEntitlementAccountKey, } from "./entitlement-cache.js";
+import { findQuotaCacheEntryForAccount } from "./quota-readiness.js";
+function getEntitlementBlock(snapshot, accountKeys, normalizedModel, now) {
+    if (!snapshot)
+        return { blocked: false, waitMs: 0, reason: null };
+    for (const accountKey of accountKeys) {
+        const blocks = snapshot.accounts[accountKey] ?? [];
+        const block = blocks.find((entry) => entry.model === normalizedModel);
+        if (!block || block.blockedUntil <= now)
+            continue;
+        return {
+            blocked: true,
+            waitMs: Math.max(0, block.blockedUntil - now),
+            reason: block.reason,
+        };
+    }
+    return { blocked: false, waitMs: 0, reason: null };
+}
+export function buildModelCapabilityMatrix(input) {
+    const now = input.now ?? Date.now();
+    const models = (input.models?.length ? input.models : Object.keys(MODEL_PROFILES))
+        .map((model) => resolveNormalizedModel(model))
+        .filter((model, index, all) => all.indexOf(model) === index)
+        .sort();
+    const accounts = input.storage?.accounts ?? [];
+    const entries = [];
+    for (const [index, account] of accounts.entries()) {
+        const accountKey = getAccountPolicyKey(account, index);
+        const entitlementKeys = [
+            accountKey,
+            resolveEntitlementAccountKey({
+                accountId: account.accountId,
+                email: account.email,
+                index,
+            }),
+        ];
+        for (const model of models) {
+            const profile = MODEL_PROFILES[model] ?? MODEL_PROFILES[resolveNormalizedModel(model)];
+            if (!profile)
+                continue;
+            const entitlement = getEntitlementBlock(input.entitlements, entitlementKeys, profile.normalizedModel, now);
+            const capabilityPolicy = input.capabilityPolicy?.getSnapshot(accountKey, profile.normalizedModel) ??
+                null;
+            const capabilityBoost = input.capabilityPolicy?.getBoost(accountKey, profile.normalizedModel, now) ??
+                0;
+            const quota = input.quotaCache && input.storage
+                ? findQuotaCacheEntryForAccount(input.quotaCache, account, input.storage.accounts)
+                : null;
+            const reasons = [];
+            if (account.enabled === false)
+                reasons.push("account disabled");
+            if (entitlement.blocked) {
+                reasons.push(`entitlement blocked: ${entitlement.reason ?? "unknown"}`);
+            }
+            if (capabilityPolicy && capabilityPolicy.unsupported > 0) {
+                reasons.push("capability policy has unsupported failures");
+            }
+            if (quota?.status === 429)
+                reasons.push("quota cache is rate-limited");
+            entries.push({
+                accountIndex: index + 1,
+                accountLabel: `Account ${index + 1}`,
+                accountKey,
+                model,
+                normalizedModel: profile.normalizedModel,
+                promptFamily: profile.promptFamily,
+                defaultReasoningEffort: profile.defaultReasoningEffort,
+                supportedReasoningEfforts: profile.supportedReasoningEfforts,
+                capabilities: profile.capabilities,
+                entitlementBlocked: entitlement.blocked,
+                entitlementReason: entitlement.reason,
+                entitlementWaitMs: entitlement.waitMs,
+                capabilityPolicy,
+                capabilityBoost,
+                quota,
+                available: reasons.length === 0,
+                reasons,
+            });
+        }
+    }
+    return {
+        generatedAt: now,
+        models,
+        entries,
+    };
+}
+//# sourceMappingURL=model-capability-matrix.js.map

package/dist/lib/model-capability-matrix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-capability-matrix.js","sourceRoot":"","sources":["../../lib/model-capability-matrix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EACN,cAAc,EACd,sBAAsB,GAItB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,4BAA4B,GAE5B,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AA4BrE,SAAS,mBAAmB,CAC3B,QAAqD,EACrD,WAAqB,EACrB,eAAuB,EACvB,GAAW;IAEX,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,GAAG;YAAE,SAAS;QAClD,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC;YAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAO1C;IACA,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;SAC3D,IAAI,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAiC,EAAE,CAAC;IAEjD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG;YACvB,UAAU;YACV,4BAA4B,CAAC;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK;aACL,CAAC;SACF,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,WAAW,GAAG,mBAAmB,CACtC,KAAK,CAAC,YAAY,EAClB,eAAe,EACf,OAAO,CAAC,eAAe,EACvB,GAAG,CACH,CAAC;YACF,MAAM,gBAAgB,GACrB,KAAK,CAAC,gBAAgB,EAAE,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC;gBACxE,IAAI,CAAC;YACN,MAAM,eAAe,GACpB,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;gBAC1E,CAAC,CAAC;YACH,MAAM,KAAK,GACV,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO;gBAChC,CAAC,CAAC,6BAA6B,CAC7B,KAAK,CAAC,UAAU,EAChB,OAAO,EACP,KAAK,CAAC,OAAO,CAAC,QAAQ,CACtB;gBACF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,wBAAwB,WAAW,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,KAAK,EAAE,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,KAAK,GAAG,CAAC;gBACvB,YAAY,EAAE,WAAW,KAAK,GAAG,CAAC,EAAE;gBACpC,UAAU;gBACV,KAAK;gBACL,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;gBAC5D,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,kBAAkB,EAAE,WAAW,CAAC,OAAO;gBACvC,iBAAiB,EAAE,WAAW,CAAC,MAAM;gBACrC,iBAAiB,EAAE,WAAW,CAAC,MAAM;gBACrC,gBAAgB;gBAChB,eAAe;gBACf,KAAK;gBACL,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC/B,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO;QACN,WAAW,EAAE,GAAG;QAChB,MAAM;QACN,OAAO;KACP,CAAC;AACH,CAAC"}