codexgpt 1.0.0

package/dist/auth/configuration.js

@@ -0,0 +1,167 @@
+import { isIP } from "node:net";
+import path from "node:path";
+import { domainToASCII } from "node:url";
+import { authConfigurationError } from "./errors.js";
+import { createOAuthListenerConfig, parseHttpAuthMode } from "./schemas.js";
+function normalized(value) {
+    return value === undefined ? undefined : value.trim();
+}
+export function resolveHttpAuthMode(input) {
+    const currentProcess = normalized(input.currentProcess);
+    const persistedUser = normalized(input.persistedUser);
+    const profile = normalized(input.profile);
+    const parsed = {
+        currentProcess: currentProcess === undefined ? undefined : parseHttpAuthMode(currentProcess, "CODEXGPT_AUTH_MODE"),
+        persistedUser: persistedUser === undefined ? undefined : parseHttpAuthMode(persistedUser, "Persisted user CODEXGPT_AUTH_MODE"),
+        profile: profile === undefined ? undefined : parseHttpAuthMode(profile, "Workspace profile authMode")
+    };
+    if (parsed.currentProcess !== undefined) {
+        return Object.freeze({ mode: parsed.currentProcess, source: "current-process" });
+    }
+    if (parsed.persistedUser !== undefined) {
+        return Object.freeze({ mode: parsed.persistedUser, source: "persisted-user" });
+    }
+    if (parsed.profile !== undefined) {
+        return Object.freeze({ mode: parsed.profile, source: "profile" });
+    }
+    return Object.freeze({ mode: "legacy", source: "default" });
+}
+export function assertHttpAuthModeCompatibility(input) {
+    if (input.mode === "oauth" &&
+        (input.allowQueryToken || input.allowNoHttpToken || input.legacyTokenPresent)) {
+        throw authConfigurationError("AUTH_MODE_CONFLICT", "OAuth mode cannot be combined with query-token, no-token, or legacy static-token configuration.", "$env:CODEXGPT_ALLOW_QUERY_TOKEN='0'; Remove-Item Env:CODEXGPT_ALLOW_NO_HTTP_TOKEN,Env:CODEXGPT_HTTP_TOKEN,Env:CODEBASE_BRIDGE_HTTP_TOKEN -ErrorAction SilentlyContinue");
+    }
+}
+function canonicalPathKey(value, platform) {
+    const normalized = platform === "win32" ? path.win32.normalize(value) : path.posix.normalize(value);
+    return platform === "win32" ? normalized.toLocaleLowerCase("en-US") : normalized;
+}
+export function resolveOAuthRootSelection(input) {
+    const platform = input.platform ?? process.platform;
+    if (input.explicitRoot) {
+        assertAbsoluteCanonicalRoot(input.explicitRoot);
+        return input.explicitRoot;
+    }
+    if (input.matchingProfileRoot) {
+        assertAbsoluteCanonicalRoot(input.currentDirectory);
+        assertAbsoluteCanonicalRoot(input.matchingProfileRoot);
+    }
+    if (input.matchingProfileRoot &&
+        canonicalPathKey(input.currentDirectory, platform) === canonicalPathKey(input.matchingProfileRoot, platform)) {
+        return input.matchingProfileRoot;
+    }
+    throw authConfigurationError("OAUTH_ROOT_REQUIRED", "OAuth mode requires an explicit canonical --root unless the current directory has one exact matching profile.");
+}
+export function normalizeOAuthHostname(input) {
+    const raw = input.trim();
+    if (!raw ||
+        raw.includes("*") ||
+        raw.includes("\\") ||
+        raw.includes("%") ||
+        /\.$/.test(raw) ||
+        /[\u0000-\u001f\u007f]/.test(raw)) {
+        throw authConfigurationError("OAUTH_HOSTNAME_INVALID", "OAuth hostname is empty or ambiguous.");
+    }
+    let parsed;
+    try {
+        parsed = new URL(raw.includes("://") ? raw : `https://${raw}`);
+    }
+    catch {
+        throw authConfigurationError("OAUTH_HOSTNAME_INVALID", "OAuth hostname must be one stable HTTPS DNS hostname.");
+    }
+    try {
+        if (parsed.protocol !== "https:" ||
+            parsed.username ||
+            parsed.password ||
+            parsed.search ||
+            parsed.hash ||
+            (parsed.pathname !== "/" && parsed.pathname !== "/mcp") ||
+            (parsed.port && parsed.port !== "443")) {
+            throw new Error("unsupported URL component");
+        }
+        const ascii = domainToASCII(parsed.hostname).toLocaleLowerCase("en-US");
+        if (!ascii ||
+            ascii.endsWith(".") ||
+            ascii.includes("_") ||
+            ascii === "localhost" ||
+            isIP(ascii) !== 0 ||
+            !ascii.includes(".") ||
+            !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/.test(ascii)) {
+            throw new Error("invalid DNS hostname");
+        }
+        return ascii;
+    }
+    catch (cause) {
+        throw authConfigurationError("OAUTH_HOSTNAME_INVALID", "OAuth hostname must be one stable HTTPS DNS hostname.");
+    }
+}
+export function resolveEnabledOAuthScopes(input) {
+    const scopes = ["codexgpt:read"];
+    if (input.writeEnabled)
+        scopes.push("codexgpt:write");
+    if (input.executeEnabled)
+        scopes.push("codexgpt:execute");
+    return Object.freeze(scopes);
+}
+function assertAbsoluteCanonicalRoot(root) {
+    const pathApi = process.platform !== "win32" && path.posix.isAbsolute(root)
+        ? path.posix
+        : path.win32.isAbsolute(root)
+            ? path.win32
+            : undefined;
+    if (!pathApi || pathApi.normalize(root) !== root) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth deployment root must already be an absolute canonical path.");
+    }
+}
+export function resolveOAuthDeploymentConfiguration(input) {
+    const platform = input.platform ?? process.platform;
+    if (platform !== "win32") {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "Phase 8 Core OAuth production requires native Windows capability.");
+    }
+    assertAbsoluteCanonicalRoot(input.canonicalRoot);
+    if (!/^[a-f0-9]{24}$/.test(input.profileId)) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth profile id is invalid.");
+    }
+    if (input.tunnel !== "cloudflare-named" ||
+        !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(input.tunnelName) ||
+        input.tunnelOwner !== "codexgpt") {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth requires one dedicated owner-marked Cloudflare named tunnel.");
+    }
+    const hostname = normalizeOAuthHostname(input.hostname);
+    const issuer = `https://${hostname}`;
+    const resource = `${issuer}/mcp`;
+    if ((input.issuer && input.issuer !== issuer) || (input.resource && input.resource !== resource)) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "Saved OAuth issuer/resource must match the normalized hostname exactly.");
+    }
+    const listeners = createOAuthListenerConfig({
+        publicHost: (input.publicHost ?? input.listeners?.publicHost),
+        publicPort: input.publicPort ?? input.listeners?.publicPort ?? Number.NaN,
+        localAdminHost: (input.localAdminHost ?? input.listeners?.localAdminHost),
+        localAdminPort: input.localAdminPort ?? input.listeners?.localAdminPort ?? Number.NaN
+    });
+    const identityKey = `${issuer}\n${resource}\n${hostname}`;
+    return Object.freeze({
+        canonicalRoot: input.canonicalRoot,
+        profileId: input.profileId,
+        hostname,
+        issuer,
+        resource,
+        identityKey,
+        tunnel: "cloudflare-named",
+        tunnelName: input.tunnelName,
+        tunnelOwner: "codexgpt",
+        listeners
+    });
+}
+export function assertDeploymentBindingCompatible(existing, candidate, platform = process.platform) {
+    if (existing.identityKey !== candidate.identityKey)
+        return;
+    if (canonicalPathKey(existing.canonicalRoot, platform) !== canonicalPathKey(candidate.canonicalRoot, platform) ||
+        existing.profileId !== candidate.profileId) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_CONFLICT", "The OAuth issuer/resource/hostname is already bound to a different canonical profile/root.");
+    }
+}
+export function throwOAuthRuntimeUnavailable() {
+    throw authConfigurationError("OAUTH_RUNTIME_UNAVAILABLE", "OAuth configuration is valid, but the Phase 8 runtime is not available yet.");
+}
+//# sourceMappingURL=configuration.js.map

package/dist/auth/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/auth/configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAwC5E,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA8B;IAChE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,EAAE,oBAAoB,CAAC;QAClH,aAAa,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,EAAE,mCAAmC,CAAC;QAC9H,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,4BAA4B,CAAC;KACtG,CAAC;IAEF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IACC,IACE,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAC7E,CAAC;QACD,MAAM,sBAAsB,CAC1B,oBAAoB,EACpB,iGAAiG,EACjG,wKAAwK,CACzK,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAyB;IAChE,MAAM,UAAU,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpG,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,2BAA2B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpD,2BAA2B,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACzD,CAAC;IACD,IACE,KAAK,CAAC,mBAAmB;QACzB,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,gBAAgB,CAAC,KAAK,CAAC,mBAAmB,EAAE,QAAQ,CAAC,EAC5G,CAAC;QACD,OAAO,KAAK,CAAC,mBAAmB,CAAC;IACnC,CAAC;IACD,MAAM,sBAAsB,CAC1B,qBAAqB,EACrB,+GAA+G,CAChH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACzB,IACE,CAAC,GAAG;QACJ,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACf,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EACjC,CAAC;QACD,MAAM,sBAAsB,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,sBAAsB,CAAC,wBAAwB,EAAE,uDAAuD,CAAC,CAAC;IAClH,CAAC;IAED,IAAI,CAAC;QACH,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,IAAI;YACX,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC;YACvD,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxE,IACE,CAAC,KAAK;YACN,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnB,KAAK,KAAK,WAAW;YACrB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACjB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpB,CAAC,wGAAwG,CAAC,IAAI,CAAC,KAAK,CAAC,EACrH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,sBAAsB,CAAC,wBAAwB,EAAE,uDAAuD,CAAC,CAAC;IAClH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA+B;IAE/B,MAAM,MAAM,GAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,cAAc;QAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,sBAAsB,CAC1B,0BAA0B,EAC1B,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAwC;IAExC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,sBAAsB,CAC1B,0BAA0B,EAC1B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,2BAA2B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,8BAA8B,CAAC,CAAC;IAC3F,CAAC;IACD,IACE,KAAK,CAAC,MAAM,KAAK,kBAAkB;QACnC,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5D,KAAK,CAAC,WAAW,KAAK,UAAU,EAChC,CAAC;QACD,MAAM,sBAAsB,CAC1B,0BAA0B,EAC1B,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,QAAQ,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,MAAM,MAAM,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QACjG,MAAM,sBAAsB,CAC1B,0BAA0B,EAC1B,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,EAAE,UAAU,CAAgB;QAC5E,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,EAAE,UAAU,IAAI,MAAM,CAAC,GAAG;QACzE,cAAc,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,EAAE,cAAc,CAAgB;QACxF,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,EAAE,cAAc,IAAI,MAAM,CAAC,GAAG;KACtF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,GAAG,MAAM,KAAK,QAAQ,KAAK,QAAQ,EAAE,CAAC;IAE1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,MAAM;QACN,QAAQ;QACR,WAAW;QACX,MAAM,EAAE,kBAAkB;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,UAAU;QACvB,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,QAAsC,EACtC,SAAuC,EACvC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;QAAE,OAAO;IAC3D,IACE,gBAAgB,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,gBAAgB,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC1G,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,EAC1C,CAAC;QACD,MAAM,sBAAsB,CAC1B,2BAA2B,EAC3B,4FAA4F,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,MAAM,sBAAsB,CAC1B,2BAA2B,EAC3B,6EAA6E,CAC9E,CAAC;AACJ,CAAC"}

package/dist/auth/credentialStore.js

@@ -0,0 +1,65 @@
+import { authConfigurationError } from "./errors.js";
+export const OAUTH_CREDENTIAL_PROVIDER = "windows-dpapi-current-user";
+export const MAX_CREDENTIAL_PAYLOAD_BYTES = 64 * 1024;
+const DEPLOYMENT_PURPOSE = /^codexgpt-deployment-v1:binding_[a-f0-9]{32}:incarnation_[a-f0-9]{32}:(?:signing-key|refresh-pepper)$/;
+export function assertCredentialPurpose(value) {
+    if (value !== "codexgpt-owner-v1" && !DEPLOYMENT_PURPOSE.test(value)) {
+        throw authConfigurationError("OAUTH_CREDENTIAL_PROVIDER_FAILURE", "OAuth credential purpose is invalid.");
+    }
+}
+export function assertCredentialPayload(value) {
+    if (!(value instanceof Uint8Array) || value.byteLength < 1 || value.byteLength > MAX_CREDENTIAL_PAYLOAD_BYTES) {
+        throw authConfigurationError("OAUTH_CREDENTIAL_PROVIDER_FAILURE", "OAuth credential payload is outside the supported bounds.");
+    }
+}
+export function assertProtectedCredential(value) {
+    if (value.length < 4 ||
+        value.length > Math.ceil(MAX_CREDENTIAL_PAYLOAD_BYTES * 2) ||
+        value.length % 4 !== 0 ||
+        !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        throw authConfigurationError("OAUTH_CREDENTIAL_PROVIDER_FAILURE", "Protected OAuth credential is malformed.");
+    }
+}
+export class MemoryCredentialStore {
+    provider = OAUTH_CREDENTIAL_PROVIDER;
+    #key;
+    constructor(key = Buffer.alloc(32, 0x5a)) {
+        if (!Buffer.isBuffer(key) || key.length !== 32) {
+            throw authConfigurationError("OAUTH_CREDENTIAL_PROVIDER_FAILURE", "Memory credential key is invalid.");
+        }
+        this.#key = Buffer.from(key);
+    }
+    async probe() { }
+    async protect(plaintext, purpose) {
+        assertCredentialPurpose(purpose);
+        assertCredentialPayload(plaintext);
+        const input = Buffer.from(plaintext);
+        const purposeBytes = Buffer.from(purpose, "utf8");
+        const output = Buffer.alloc(input.length + 1);
+        output[0] = purposeBytes.reduce((sum, byte) => (sum + byte) & 0xff, 0);
+        for (let index = 0; index < input.length; index += 1) {
+            output[index + 1] = input[index] ^ this.#key[index % this.#key.length] ^ output[0];
+        }
+        input.fill(0);
+        return output.toString("base64");
+    }
+    async unprotect(protectedValue, purpose) {
+        assertCredentialPurpose(purpose);
+        assertProtectedCredential(protectedValue);
+        const input = Buffer.from(protectedValue, "base64");
+        if (input.length < 2) {
+            throw authConfigurationError("OAUTH_CREDENTIAL_PROVIDER_FAILURE", "Protected OAuth credential is invalid.");
+        }
+        const expectedPurpose = Buffer.from(purpose, "utf8").reduce((sum, byte) => (sum + byte) & 0xff, 0);
+        if (input[0] !== expectedPurpose) {
+            throw authConfigurationError("OAUTH_CREDENTIAL_PROVIDER_FAILURE", "Protected OAuth credential purpose does not match.");
+        }
+        const output = Buffer.alloc(input.length - 1);
+        for (let index = 1; index < input.length; index += 1) {
+            output[index - 1] = input[index] ^ this.#key[(index - 1) % this.#key.length] ^ input[0];
+        }
+        input.fill(0);
+        return output;
+    }
+}
+//# sourceMappingURL=credentialStore.js.map

package/dist/auth/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,yBAAyB,GAAG,4BAAqC,CAAC;AAC/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAatD,MAAM,kBAAkB,GAAG,uGAAuG,CAAC;AAEnI,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,KAAK,KAAK,mBAAmB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,sBAAsB,CAC1B,mCAAmC,EACnC,sCAAsC,CACvC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAiB;IACvD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAC9G,MAAM,sBAAsB,CAC1B,mCAAmC,EACnC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IACE,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,CAAC;QAC1D,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QACtB,CAAC,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/E,CAAC;QACD,MAAM,sBAAsB,CAC1B,mCAAmC,EACnC,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,OAAO,qBAAqB;IACvB,QAAQ,GAAG,yBAAyB,CAAC;IACrC,IAAI,CAAS;IAEtB,YAAY,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,sBAAsB,CAAC,mCAAmC,EAAE,mCAAmC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK,KAAmB,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,SAAqB,EAAE,OAA0B;QAC7D,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,OAA0B;QAChE,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,yBAAyB,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,sBAAsB,CAAC,mCAAmC,EAAE,wCAAwC,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACnG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;YACjC,MAAM,sBAAsB,CAAC,mCAAmC,EAAE,oDAAoD,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/auth/deploymentLock.js

@@ -0,0 +1,220 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomBytes as nodeRandomBytes } from "node:crypto";
+import { z } from "zod";
+import { classifyProcessLiveness } from "../transactions/workspaceLock.js";
+import { authConfigurationError } from "./errors.js";
+import { authStatePaths } from "./stateStore.js";
+const instanceSchema = z.object({
+    schemaVersion: z.literal(1),
+    instanceId: z.string().regex(/^authinstance_[a-f0-9]{32}$/),
+    pid: z.number().int().positive(),
+    createdAt: z.string().datetime({ offset: true })
+}).strict();
+const ownerSchema = z.object({
+    schemaVersion: z.literal(1),
+    lockToken: z.string().regex(/^authlock_[a-f0-9]{32}$/),
+    runId: z.string().regex(/^authrun_[a-f0-9]{32}$/),
+    instanceId: z.string().regex(/^authinstance_[a-f0-9]{32}$/),
+    pid: z.number().int().positive(),
+    lockName: z.string().regex(/^(?:installation|registry|deployment_binding_[a-f0-9]{32})$/),
+    createdAt: z.string().datetime({ offset: true })
+}).strict();
+function writeExclusive(file, value) {
+    let descriptor;
+    try {
+        descriptor = fs.openSync(file, "wx", 0o600);
+        fs.writeFileSync(descriptor, `${JSON.stringify(value)}\n`, "utf8");
+        fs.fsyncSync(descriptor);
+    }
+    catch {
+        throw authConfigurationError("OAUTH_STATE_BUSY", "OAuth lock ownership could not be persisted.");
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs.closeSync(descriptor);
+    }
+}
+function isExists(error) {
+    const code = error.code;
+    return code === "EEXIST" || code === "ENOTEMPTY" || code === "EPERM" || code === "EACCES";
+}
+export class AuthProcessInstanceRegistry {
+    record;
+    recordPath;
+    #instancesDirectory;
+    #disposed = false;
+    constructor(stateRoot, dependencies = {}) {
+        const runtime = authStatePaths(stateRoot).runtimeDirectory;
+        this.#instancesDirectory = path.join(runtime, "instances");
+        fs.mkdirSync(this.#instancesDirectory, { recursive: true, mode: 0o700 });
+        const random = (dependencies.randomBytes ?? nodeRandomBytes)(16);
+        if (!Buffer.isBuffer(random) || random.length !== 16) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth process instance random source is invalid.");
+        }
+        this.record = instanceSchema.parse({
+            schemaVersion: 1,
+            instanceId: `authinstance_${random.toString("hex")}`,
+            pid: dependencies.pid ?? process.pid,
+            createdAt: new Date((dependencies.now ?? Date.now)()).toISOString()
+        });
+        this.recordPath = path.join(this.#instancesDirectory, `${this.record.instanceId}.json`);
+        writeExclusive(this.recordPath, this.record);
+    }
+    isVerifiable(instanceId, pid) {
+        if (!/^authinstance_[a-f0-9]{32}$/.test(instanceId))
+            return false;
+        try {
+            const record = instanceSchema.parse(JSON.parse(fs.readFileSync(path.join(this.#instancesDirectory, `${instanceId}.json`), "utf8")));
+            return record.instanceId === instanceId && record.pid === pid;
+        }
+        catch {
+            return false;
+        }
+    }
+    dispose() {
+        if (this.#disposed)
+            return;
+        this.#disposed = true;
+        try {
+            const current = instanceSchema.parse(JSON.parse(fs.readFileSync(this.recordPath, "utf8")));
+            if (current.instanceId === this.record.instanceId && current.pid === this.record.pid)
+                fs.unlinkSync(this.recordPath);
+        }
+        catch {
+            // Exact-instance cleanup is best effort and never affects lock correctness.
+        }
+    }
+}
+export class AuthStateLockHandle {
+    lockDirectory;
+    recoveryDirectories;
+    owner;
+    #released = false;
+    constructor(lockDirectory, recoveryDirectories, owner) {
+        this.lockDirectory = lockDirectory;
+        this.recoveryDirectories = recoveryDirectories;
+        this.owner = owner;
+    }
+    release() {
+        if (this.#released)
+            return;
+        let current;
+        try {
+            current = ownerSchema.parse(JSON.parse(fs.readFileSync(path.join(this.lockDirectory, "owner.json"), "utf8")));
+        }
+        catch {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth lock owner record is invalid.");
+        }
+        if (current.lockToken !== this.owner.lockToken ||
+            current.runId !== this.owner.runId ||
+            current.instanceId !== this.owner.instanceId ||
+            current.pid !== this.owner.pid) {
+            throw authConfigurationError("OAUTH_STATE_BUSY", "OAuth lock ownership changed before release.");
+        }
+        const released = `${this.lockDirectory}.release-${this.owner.lockToken.slice(9, 25)}`;
+        try {
+            fs.renameSync(this.lockDirectory, released);
+            fs.rmSync(released, { recursive: true, force: true });
+            this.#released = true;
+        }
+        catch {
+            throw authConfigurationError("OAUTH_STATE_BUSY", "OAuth lock could not be released safely.");
+        }
+    }
+}
+export class AuthStateLock {
+    #lockRoot;
+    #registry;
+    #randomBytes;
+    #now;
+    #kill;
+    constructor(stateRoot, registry, dependencies = {}) {
+        this.#lockRoot = path.join(authStatePaths(stateRoot).runtimeDirectory, "locks");
+        this.#registry = registry;
+        this.#randomBytes = dependencies.randomBytes ?? nodeRandomBytes;
+        this.#now = dependencies.now ?? Date.now;
+        this.#kill = dependencies.kill ?? process.kill.bind(process);
+    }
+    acquire(lockName) {
+        if (!/^(?:installation|registry|deployment_binding_[a-f0-9]{32})$/.test(lockName)) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth lock name is invalid.");
+        }
+        fs.mkdirSync(this.#lockRoot, { recursive: true, mode: 0o700 });
+        const lockDirectory = path.join(this.#lockRoot, `${lockName}.lock`);
+        const recoveryDirectories = [];
+        for (let attempt = 0; attempt < 4; attempt += 1) {
+            const claim = this.#claim(lockDirectory, lockName, recoveryDirectories);
+            if (claim)
+                return claim;
+            let owner;
+            try {
+                owner = ownerSchema.parse(JSON.parse(fs.readFileSync(path.join(lockDirectory, "owner.json"), "utf8")));
+            }
+            catch {
+                throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth lock owner cannot be verified.");
+            }
+            const liveness = classifyProcessLiveness(owner.pid, this.#kill);
+            if (liveness !== "dead") {
+                throw authConfigurationError("OAUTH_STATE_BUSY", `OAuth state is owned by pid ${owner.pid}, run ${owner.runId}.`);
+            }
+            if (!this.#registry.isVerifiable(owner.instanceId, owner.pid)) {
+                throw authConfigurationError("OAUTH_STATE_BUSY", "Dead OAuth lock owner lacks exact instance evidence.");
+            }
+            const suffix = this.#random(8).toString("hex");
+            const recovery = `${lockDirectory}.recovery-${suffix}`;
+            try {
+                fs.renameSync(lockDirectory, recovery);
+                recoveryDirectories.push(recovery);
+            }
+            catch (error) {
+                if (error.code === "ENOENT" || isExists(error))
+                    continue;
+                throw authConfigurationError("OAUTH_STATE_BUSY", "Dead OAuth lock could not be quarantined safely.");
+            }
+        }
+        throw authConfigurationError("OAUTH_STATE_BUSY", "OAuth state lock remained contended.");
+    }
+    #claim(lockDirectory, lockName, recoveryDirectories) {
+        const claimDirectory = `${lockDirectory}.claim-${this.#random(8).toString("hex")}`;
+        const owner = ownerSchema.parse({
+            schemaVersion: 1,
+            lockToken: `authlock_${this.#random(16).toString("hex")}`,
+            runId: `authrun_${this.#random(16).toString("hex")}`,
+            instanceId: this.#registry.record.instanceId,
+            pid: this.#registry.record.pid,
+            lockName,
+            createdAt: new Date(this.#now()).toISOString()
+        });
+        try {
+            fs.mkdirSync(claimDirectory, { mode: 0o700 });
+            writeExclusive(path.join(claimDirectory, "owner.json"), owner);
+            try {
+                fs.renameSync(claimDirectory, lockDirectory);
+                return new AuthStateLockHandle(lockDirectory, recoveryDirectories, owner);
+            }
+            catch (error) {
+                if (!isExists(error)) {
+                    throw authConfigurationError("OAUTH_STATE_BUSY", "OAuth lock claim could not be published.");
+                }
+                return null;
+            }
+        }
+        finally {
+            try {
+                fs.rmSync(claimDirectory, { recursive: true, force: true });
+            }
+            catch {
+                // Private claim cleanup cannot alter a published lock.
+            }
+        }
+    }
+    #random(size) {
+        const value = this.#randomBytes(size);
+        if (!Buffer.isBuffer(value) || value.length !== size) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth lock random source is invalid.");
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=deploymentLock.js.map

package/dist/auth/deploymentLock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploymentLock.js","sourceRoot":"","sources":["../../src/auth/deploymentLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,CAAC;IACzF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,SAAS,cAAc,CAAC,IAAY,EAAE,KAAc;IAClD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;IACnG,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AAC5F,CAAC;AASD,MAAM,OAAO,2BAA2B;IAC7B,MAAM,CAAiC;IACvC,UAAU,CAAS;IACnB,mBAAmB,CAAS;IACrC,SAAS,GAAG,KAAK,CAAC;IAElB,YAAY,SAAiB,EAAE,eAAqC,EAAE;QACpE,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,gBAAgB,CAAC;QAC3D,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC;YACjC,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,gBAAgB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpD,GAAG,EAAE,YAAY,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YACpC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,OAAO,CAAC,CAAC;QACxF,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,CAAC,UAAkB,EAAE,GAAW;QAC1C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,UAAU,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACpI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvH,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAInB;IACA;IACA;IALX,SAAS,GAAG,KAAK,CAAC;IAElB,YACW,aAAqB,EACrB,mBAAsC,EACtC,KAAsB;QAFtB,kBAAa,GAAb,aAAa,CAAQ;QACrB,wBAAmB,GAAnB,mBAAmB,CAAmB;QACtC,UAAK,GAAL,KAAK,CAAiB;IAC9B,CAAC;IAEJ,OAAO;QACL,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,OAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC;QACvG,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YAC1C,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;YAClC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU;YAC5C,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAC9B,CAAC;YACD,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,aAAa,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC5C,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IACf,SAAS,CAAS;IAClB,SAAS,CAA8B;IACvC,YAAY,CAA2B;IACvC,IAAI,CAAe;IACnB,KAAK,CAAmC;IAEjD,YAAY,SAAiB,EAAE,QAAqC,EAAE,eAAqC,EAAE;QAC3G,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAChF,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,WAAW,IAAI,eAAe,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,CAAC,QAAsE;QAC5E,IAAI,CAAC,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClF,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;QACrF,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;QACpE,MAAM,mBAAmB,GAAa,EAAE,CAAC;QACzC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;YACxE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,IAAI,KAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACzG,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,sCAAsC,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,sBAAsB,CAC1B,kBAAkB,EAClB,+BAA+B,KAAK,CAAC,GAAG,SAAS,KAAK,CAAC,KAAK,GAAG,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,GAAG,aAAa,aAAa,MAAM,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;gBACvC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACpF,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QACD,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,CAAC,aAAqB,EAAE,QAAgB,EAAE,mBAAsC;QACpF,MAAM,cAAc,GAAG,GAAG,aAAa,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;YAC9B,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACzD,KAAK,EAAE,WAAW,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpD,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU;YAC5C,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;YAC9B,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,IAAI,mBAAmB,CAAC,aAAa,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,sBAAsB,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;gBAC/F,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/auth/deploymentRegistry.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { authConfigurationError } from "./errors.js";
+function samePath(left, right, platform) {
+    return platform === "win32"
+        ? left.toLocaleLowerCase("en-US") === right.toLocaleLowerCase("en-US")
+        : left === right;
+}
+function normalizedIdentityKey(value) {
+    if (/^sha256:[a-f0-9]{64}$/.test(value))
+        return value;
+    return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
+}
+export class DeploymentRegistry {
+    store;
+    platform;
+    constructor(store, platform = process.platform) {
+        this.store = store;
+        this.platform = platform;
+    }
+    resolve(identityKey) {
+        const registry = this.store.readRegistry();
+        if (!registry)
+            return null;
+        return registry.entries.find((entry) => entry.identityKey === normalizedIdentityKey(identityKey)) ?? null;
+    }
+    async bind(input) {
+        const current = this.store.readRegistry();
+        const identityKey = normalizedIdentityKey(input.configuration.identityKey);
+        const existing = current?.entries.find((entry) => entry.identityKey === identityKey);
+        if (existing) {
+            const compatible = samePath(existing.canonicalRoot, input.configuration.canonicalRoot, this.platform) &&
+                existing.profileId === input.configuration.profileId &&
+                existing.hostname === input.configuration.hostname &&
+                existing.issuer === input.configuration.issuer &&
+                existing.resource === input.configuration.resource &&
+                existing.bindingId === input.state.bindingId;
+            if (!compatible) {
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth issuer/resource/hostname is already bound to a different canonical deployment.");
+            }
+            if (existing.currentIncarnationId === input.state.incarnationId)
+                return current;
+            return this.setCurrentIncarnation(existing.bindingId, input.state.incarnationId);
+        }
+        for (const entry of current?.entries ?? []) {
+            if (entry.hostname === input.configuration.hostname ||
+                entry.issuer === input.configuration.issuer ||
+                entry.resource === input.configuration.resource) {
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth hostname, issuer, or resource is already owned by another deployment.");
+            }
+        }
+        const entry = {
+            identityKey,
+            canonicalRoot: input.configuration.canonicalRoot,
+            profileId: input.configuration.profileId,
+            hostname: input.configuration.hostname,
+            issuer: input.configuration.issuer,
+            resource: input.configuration.resource,
+            bindingId: input.state.bindingId,
+            currentIncarnationId: input.state.incarnationId,
+            tunnelOwnerMarker: {
+                tunnel: "cloudflare-named",
+                tunnelName: input.configuration.tunnelName,
+                tunnelOwner: "codexgpt",
+                bindingId: input.state.bindingId
+            }
+        };
+        return this.store.writeRegistry({
+            schemaVersion: 1,
+            generation: (current?.generation ?? 0) + 1,
+            entries: [...(current?.entries ?? []), entry].sort((left, right) => left.identityKey.localeCompare(right.identityKey)),
+            updatedAt: new Date().toISOString()
+        }, {
+            bindingId: input.state.bindingId,
+            incarnationId: input.state.incarnationId
+        });
+    }
+    async rebind(input) {
+        const current = this.store.readRegistry();
+        if (!current)
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment registry does not exist.");
+        const identityKey = normalizedIdentityKey(input.identityKey);
+        let matched = false;
+        const entries = current.entries.map((entry) => {
+            if (entry.identityKey !== identityKey)
+                return entry;
+            matched = true;
+            if (entry.bindingId !== input.state.bindingId) {
+                throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth rebind cannot change the stable binding.");
+            }
+            return {
+                ...entry,
+                canonicalRoot: input.configuration.canonicalRoot,
+                profileId: input.configuration.profileId,
+                hostname: input.configuration.hostname,
+                issuer: input.configuration.issuer,
+                resource: input.configuration.resource,
+                currentIncarnationId: input.state.incarnationId,
+                tunnelOwnerMarker: {
+                    tunnel: "cloudflare-named",
+                    tunnelName: input.configuration.tunnelName,
+                    tunnelOwner: "codexgpt",
+                    bindingId: input.state.bindingId
+                }
+            };
+        });
+        if (!matched)
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment binding is not registered.");
+        return this.store.writeRegistry({
+            schemaVersion: 1,
+            generation: current.generation + 1,
+            entries,
+            updatedAt: new Date().toISOString()
+        }, { bindingId: input.state.bindingId, incarnationId: input.state.incarnationId });
+    }
+    async setCurrentIncarnation(bindingId, incarnationId) {
+        const current = this.store.readRegistry();
+        if (!current) {
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment registry does not exist.");
+        }
+        let matched = false;
+        const entries = current.entries.map((entry) => {
+            if (entry.bindingId !== bindingId)
+                return entry;
+            matched = true;
+            return { ...entry, currentIncarnationId: incarnationId };
+        });
+        if (!matched) {
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment binding is not registered.");
+        }
+        return this.store.writeRegistry({
+            schemaVersion: 1,
+            generation: current.generation + 1,
+            entries,
+            updatedAt: new Date().toISOString()
+        }, { bindingId, incarnationId });
+    }
+    readCurrentState(identityKey) {
+        const entry = this.resolve(identityKey);
+        if (!entry) {
+            throw authConfigurationError("OAUTH_STATE_CONFLICT", "OAuth deployment is not registered.");
+        }
+        const state = this.store.readDeployment(entry.bindingId, entry.currentIncarnationId);
+        if (state.bindingId !== entry.bindingId || state.incarnationId !== entry.currentIncarnationId) {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth registry and deployment state disagree.");
+        }
+        return state;
+    }
+}
+//# sourceMappingURL=deploymentRegistry.js.map

package/dist/auth/deploymentRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploymentRegistry.js","sourceRoot":"","sources":["../../src/auth/deploymentRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AASrD,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa,EAAE,QAAyB;IACtE,OAAO,QAAQ,KAAK,OAAO;QACzB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC;QACtE,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,kBAAkB;IAElB;IACA;IAFX,YACW,KAAqB,EACrB,WAA4B,OAAO,CAAC,QAAQ;QAD5C,UAAK,GAAL,KAAK,CAAgB;QACrB,aAAQ,GAAR,QAAQ,CAAoC;IACpD,CAAC;IAEJ,OAAO,CAAC,WAAmB;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,qBAAqB,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAGV;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QACrF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,UAAU,GACd,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC;gBAClF,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,aAAa,CAAC,SAAS;gBACpD,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,QAAQ;gBAClD,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM;gBAC9C,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,QAAQ;gBAClD,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,sBAAsB,CAC1B,sBAAsB,EACtB,sFAAsF,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,oBAAoB,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa;gBAAE,OAAO,OAAQ,CAAC;YACjF,OAAO,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YAC3C,IACE,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,QAAQ;gBAC/C,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM;gBAC3C,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,QAAQ,EAC/C,CAAC;gBACD,MAAM,sBAAsB,CAC1B,sBAAsB,EACtB,6EAA6E,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAA8B;YACvC,WAAW;YACX,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;YAChD,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,SAAS;YACxC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;YACtC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;YAClC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;YACtC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YAC/C,iBAAiB,EAAE;gBACjB,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU;gBAC1C,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9B,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC;YAC1C,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACtH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EAAE;YACD,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;SACzC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,2CAA2C,CAAC,CAAC;QAChH,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAC;YACpD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC9C,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,gDAAgD,CAAC,CAAC;YACzG,CAAC;YACD,OAAO;gBACL,GAAG,KAAK;gBACR,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;gBAChD,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,SAAS;gBACxC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;gBACtC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;gBAClC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;gBACtC,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBAC/C,iBAAiB,EAAE;oBACjB,MAAM,EAAE,kBAA2B;oBACnC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU;oBAC1C,WAAW,EAAE,UAAmB;oBAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;iBACjC;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC;QAClH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9B,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;YAClC,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,aAAqB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,2CAA2C,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAChD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9B,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;YAClC,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,sBAAsB,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACrF,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC9F,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,+CAA+C,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}