everything-dev 1.53.2 → 2.0.0-rc.0

package/dist/app.mjs

@@ -1,4 +1,4 @@
-import { buildRuntimeConfig as buildRuntimeConfig$1, getProjectRoot, resolveLocalDevelopmentPath } from "./config.mjs";
+import { resolveLocalDevelopmentPath } from "./config.mjs";
 import { claimedPorts } from "./process-registry.mjs";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
@@ -9,38 +9,51 @@ import { createServer } from "node:net";
 const PROBE_TIMEOUT_MS = 250;
 const MAX_PORT_SCAN_STEPS = 1e3;
 const PARALLEL_PROBE_WINDOW = 8;
+const BLOCK_STEP = 100;
 var PortAllocationError = class extends Data.TaggedError("PortAllocationError") {};
-var PortAllocator = class extends Context.Tag("PortAllocator")() {};
-function detectLocalPackages(bosConfig, runtimeConfig) {
+var PortAllocator = class extends Context.Service()("PortAllocator") {};
+function detectLocalPackages(bosConfig, runtimeConfig, root = process.cwd()) {
 	const packages = [];
-	const configDir = getProjectRoot();
+	const configDir = root;
 	const uiLocalPath = runtimeConfig?.ui.localPath ?? resolveLocalDevelopmentPath(bosConfig?.app.ui.development, configDir);
-	if (uiLocalPath && existsSync(join(uiLocalPath, "package.json"))) packages.push("ui");
+	if (uiLocalPath && existsSync(join(uiLocalPath, "package.json"))) packages.push({
+		name: "ui",
+		dir: uiLocalPath
+	});
 	const apiLocalPath = runtimeConfig?.api.localPath ?? resolveLocalDevelopmentPath(bosConfig?.app.api.development, configDir);
-	if (apiLocalPath && existsSync(join(apiLocalPath, "package.json"))) packages.push("api");
+	if (apiLocalPath && existsSync(join(apiLocalPath, "package.json"))) packages.push({
+		name: "api",
+		dir: apiLocalPath
+	});
 	const hostLocalPath = runtimeConfig?.host?.localPath ?? resolveLocalDevelopmentPath(bosConfig?.app.host.development, configDir);
-	if (hostLocalPath && existsSync(join(hostLocalPath, "package.json"))) packages.push("host");
-	else if (existsSync(join(configDir, "host", "package.json"))) packages.push("host");
+	if (hostLocalPath && existsSync(join(hostLocalPath, "package.json"))) packages.push({
+		name: "host",
+		dir: hostLocalPath
+	});
+	else if (existsSync(join(configDir, "host", "package.json"))) packages.push({
+		name: "host",
+		dir: join(configDir, "host")
+	});
 	for (const [pluginId, pluginConfig] of Object.entries(runtimeConfig?.plugins ?? {})) {
-		if (pluginConfig.localPath && existsSync(join(pluginConfig.localPath, "package.json"))) packages.push(`plugin:${pluginId}`);
-		if (pluginConfig.ui?.localPath && existsSync(join(pluginConfig.ui.localPath, "package.json"))) packages.push(`plugin-ui:${pluginId}`);
+		if (pluginConfig.localPath && existsSync(join(pluginConfig.localPath, "package.json"))) packages.push({
+			name: `plugin:${pluginId}`,
+			dir: pluginConfig.localPath
+		});
+		if (pluginConfig.ui?.localPath && existsSync(join(pluginConfig.ui.localPath, "package.json"))) packages.push({
+			name: `plugin-ui:${pluginId}`,
+			dir: pluginConfig.ui.localPath
+		});
 	}
 	const authLocalPath = runtimeConfig?.auth?.localPath ?? resolveLocalDevelopmentPath(bosConfig?.app.auth?.development, configDir);
-	if (authLocalPath && existsSync(join(authLocalPath, "package.json"))) packages.push("auth");
-	return packages;
-}
-async function buildRuntimeConfig(bosConfig, options) {
-	return buildRuntimeConfig$1(bosConfig, getProjectRoot(), options.env ?? "development", {
-		hostSource: options.hostSource,
-		uiSource: options.uiSource,
-		apiSource: options.apiSource,
-		authSource: options.authSource,
-		proxy: options.proxy,
-		plugins: options.plugins
+	if (authLocalPath && existsSync(join(authLocalPath, "package.json"))) packages.push({
+		name: "auth",
+		dir: authLocalPath
 	});
+	return packages;
 }
+const scheduleTimeout = (ms, fn) => setTimeout(fn, ms);
 function probePortBindable(port) {
-	return Effect.async((resume) => {
+	return Effect.callback((resume) => {
 		const server = createServer();
 		server.once("listening", () => {
 			server.close(() => {
@@ -52,13 +65,13 @@ function probePortBindable(port) {
 			resume(Effect.succeed(false));
 		});
 		server.listen(port, "127.0.0.1");
-		const timer = setTimeout(() => {
+		const timer = scheduleTimeout(PROBE_TIMEOUT_MS, () => {
 			server.removeAllListeners();
 			try {
 				server.close();
 			} catch {}
 			resume(Effect.succeed(false));
-		}, PROBE_TIMEOUT_MS);
+		});
 		server.once("listening", () => clearTimeout(timer));
 		server.once("error", () => clearTimeout(timer));
 	});
@@ -76,7 +89,7 @@ function pickAvailablePort(preferred, usedPorts, budget) {
 			cause: budget ? `No free port in budget [${budget.min}, ${budget.max}] starting from ${preferred}` : `No free port found starting from ${preferred} within ${MAX_PORT_SCAN_STEPS} steps`
 		}));
 		while (true) {
-			if (port >= ceiling || steps > MAX_PORT_SCAN_STEPS) yield* fail();
+			if (port >= ceiling || steps > MAX_PORT_SCAN_STEPS) return yield* fail();
 			const candidates = [];
 			for (let i = 0; i < PARALLEL_PROBE_WINDOW && port + i < ceiling; i++) {
 				const candidate = port + i;
@@ -102,9 +115,69 @@ function pickAvailablePort(preferred, usedPorts, budget) {
 }
 const PortAllocatorLive = Layer.sync(PortAllocator, () => {
 	const usedPorts = claimedPorts();
-	return { pickAvailable: (preferred, budget) => pickAvailablePort(preferred, usedPorts, budget) };
+	return {
+		pickAvailable: (preferred, budget) => pickAvailablePort(preferred, usedPorts, budget),
+		acquireBlock: (request) => acquireBlockPort(request, usedPorts)
+	};
 });
+function acquireBlockPort(request, usedPorts) {
+	const step = request.step ?? BLOCK_STEP;
+	const fail = (cause) => Effect.fail(new PortAllocationError({
+		preferred: request.base,
+		cause
+	}));
+	return Effect.gen(function* () {
+		let base = request.base;
+		let steps = 0;
+		let firstConflicts = [];
+		while (steps <= MAX_PORT_SCAN_STEPS) {
+			const shift = base - request.base;
+			const candidates = request.entries.map((entry) => ({
+				...entry,
+				port: entry.pinned ? entry.preferred : entry.preferred + shift
+			}));
+			let pinnedHeldByListener;
+			for (const candidate of candidates.filter((c) => c.pinned)) {
+				if (!(yield* probePortBindable(candidate.port))) {
+					pinnedHeldByListener = candidate;
+					break;
+				}
+				usedPorts.delete(candidate.port);
+			}
+			if (pinnedHeldByListener) return yield* fail(`explicitly-requested port ${pinnedHeldByListener.port} (${pinnedHeldByListener.key}) is occupied by a listener`);
+			const unpinned = candidates.filter((c) => !c.pinned);
+			const claimConflicts = unpinned.filter((c) => usedPorts.has(c.port)).map((c) => ({
+				key: c.key,
+				port: c.port,
+				claimed: true
+			}));
+			if (shift === 0) firstConflicts = claimConflicts;
+			if (claimConflicts.length === 0) {
+				const busy = (yield* Effect.forEach(unpinned, (c) => probePortBindable(c.port).pipe(Effect.map((free) => ({
+					...c,
+					free
+				}))), { concurrency: "unbounded" })).filter((r) => !r.free);
+				if (shift === 0) firstConflicts = busy.map((b) => ({
+					key: b.key,
+					port: b.port,
+					claimed: false
+				}));
+				if (busy.length === 0) {
+					for (const candidate of candidates) usedPorts.add(candidate.port);
+					return {
+						base,
+						ports: Object.fromEntries(candidates.map((c) => [c.key, c.port])),
+						conflicts: firstConflicts
+					};
+				}
+			}
+			base += step;
+			steps += 1;
+		}
+		return yield* fail(`no free port block within ${MAX_PORT_SCAN_STEPS} steps of base ${request.base} (step ${step})`);
+	});
+}
 
 //#endregion
-export { PortAllocationError, PortAllocator, PortAllocatorLive, buildRuntimeConfig, detectLocalPackages };
+export { PortAllocationError, PortAllocator, PortAllocatorLive, detectLocalPackages, probePortBindable };
 //# sourceMappingURL=app.mjs.map

package/dist/app.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"app.mjs","names":["configBuildRuntimeConfig"],"sources":["../src/app.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { createServer } from \"node:net\";\nimport { join } from \"node:path\";\nimport { Context, Data, Effect, Layer } from \"effect\";\nimport type { DevPortState } from \"./cli/infra\";\nimport {\n  buildRuntimeConfig as configBuildRuntimeConfig,\n  getProjectRoot,\n  resolveLocalDevelopmentPath,\n} from \"./config\";\nimport { claimedPorts } from \"./process-registry\";\nimport type { AppOrchestrator } from \"./service-descriptor\";\nimport type { BosConfig, RuntimeConfig, RuntimePluginConfig } from \"./types\";\n\nexport type { AppOrchestrator };\n\nconst DEFAULT_HOST_PORT = 3000;\nconst DEFAULT_API_PORT = 3001;\nconst DEFAULT_AUTH_PORT = 3002;\nconst DEFAULT_UI_PORT = 3003;\nconst DEFAULT_PLUGIN_PORT_START = 3010;\n\nconst PROBE_TIMEOUT_MS = 250;\nconst MAX_PORT_SCAN_STEPS = 1000;\nconst PARALLEL_PROBE_WINDOW = 8;\n\nexport type PortBudget = { min: number; max: number };\n\nexport class PortAllocationError extends Data.TaggedError(\"PortAllocationError\")<{\n  preferred: number;\n  budget?: PortBudget;\n  cause?: unknown;\n}> {}\n\nexport class PortAllocator extends Context.Tag(\"PortAllocator\")<\n  PortAllocator,\n  {\n    pickAvailable: (\n      preferred: number,\n      budget?: PortBudget,\n    ) => Effect.Effect<number, PortAllocationError>;\n  }\n>() {}\n\nexport function detectLocalPackages(\n  bosConfig?: BosConfig,\n  runtimeConfig?: RuntimeConfig,\n): string[] {\n  const packages: string[] = [];\n  const configDir = getProjectRoot();\n\n  const uiLocalPath =\n    runtimeConfig?.ui.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.ui.development, configDir);\n  if (uiLocalPath && existsSync(join(uiLocalPath, \"package.json\"))) {\n    packages.push(\"ui\");\n  }\n\n  const apiLocalPath =\n    runtimeConfig?.api.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.api.development, configDir);\n  if (apiLocalPath && existsSync(join(apiLocalPath, \"package.json\"))) {\n    packages.push(\"api\");\n  }\n\n  const hostLocalPath =\n    runtimeConfig?.host?.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.host.development, configDir);\n  if (hostLocalPath && existsSync(join(hostLocalPath, \"package.json\"))) {\n    packages.push(\"host\");\n  } else if (existsSync(join(configDir, \"host\", \"package.json\"))) {\n    packages.push(\"host\");\n  }\n\n  for (const [pluginId, pluginConfig] of Object.entries(runtimeConfig?.plugins ?? {})) {\n    if (pluginConfig.localPath && existsSync(join(pluginConfig.localPath, \"package.json\"))) {\n      packages.push(`plugin:${pluginId}`);\n    }\n    if (pluginConfig.ui?.localPath && existsSync(join(pluginConfig.ui.localPath, \"package.json\"))) {\n      packages.push(`plugin-ui:${pluginId}`);\n    }\n  }\n\n  const authLocalPath =\n    runtimeConfig?.auth?.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.auth?.development, configDir);\n  if (authLocalPath && existsSync(join(authLocalPath, \"package.json\"))) {\n    packages.push(\"auth\");\n  }\n\n  return packages;\n}\n\nexport async function buildRuntimeConfig(\n  bosConfig: BosConfig,\n  options: {\n    hostSource?: \"local\" | \"remote\";\n    uiSource?: \"local\" | \"remote\";\n    apiSource?: \"local\" | \"remote\";\n    authSource?: \"local\" | \"remote\";\n    proxy?: string;\n    env?: \"development\" | \"production\";\n    plugins?: Record<string, RuntimePluginConfig>;\n  },\n): Promise<RuntimeConfig> {\n  return configBuildRuntimeConfig(bosConfig, getProjectRoot(), options.env ?? \"development\", {\n    hostSource: options.hostSource,\n    uiSource: options.uiSource,\n    apiSource: options.apiSource,\n    authSource: options.authSource,\n    proxy: options.proxy,\n    plugins: options.plugins,\n  });\n}\n\nfunction probePortBindable(port: number): Effect.Effect<boolean> {\n  return Effect.async<boolean>((resume) => {\n    const server = createServer();\n\n    server.once(\"listening\", () => {\n      server.close(() => {\n        resume(Effect.succeed(true));\n      });\n    });\n\n    server.once(\"error\", () => {\n      server.removeAllListeners();\n      // EADDRINUSE, EACCES, or any other bind error → not available\n      resume(Effect.succeed(false));\n    });\n\n    server.listen(port, \"127.0.0.1\");\n\n    const timer = setTimeout(() => {\n      server.removeAllListeners();\n      try {\n        server.close();\n      } catch {\n        // ignore\n      }\n      resume(Effect.succeed(false));\n    }, PROBE_TIMEOUT_MS);\n\n    server.once(\"listening\", () => clearTimeout(timer));\n    server.once(\"error\", () => clearTimeout(timer));\n  });\n}\n\nfunction pickAvailablePort(\n  preferred: number,\n  usedPorts: Set<number>,\n  budget?: PortBudget,\n): Effect.Effect<number, PortAllocationError> {\n  return Effect.gen(function* () {\n    const within = (candidate: number): boolean =>\n      !budget || (candidate >= budget.min && candidate <= budget.max);\n\n    let port = preferred;\n    if (!within(port)) {\n      port = budget ? budget.min : port;\n    }\n\n    const ceiling = budget ? budget.max + 1 : Number.MAX_SAFE_INTEGER;\n    let steps = 0;\n\n    const fail = () =>\n      Effect.fail(\n        new PortAllocationError({\n          preferred,\n          budget,\n          cause: budget\n            ? `No free port in budget [${budget.min}, ${budget.max}] starting from ${preferred}`\n            : `No free port found starting from ${preferred} within ${MAX_PORT_SCAN_STEPS} steps`,\n        }),\n      );\n\n    while (true) {\n      if (port >= ceiling || steps > MAX_PORT_SCAN_STEPS) {\n        yield* fail();\n      }\n\n      const candidates: number[] = [];\n      for (let i = 0; i < PARALLEL_PROBE_WINDOW && port + i < ceiling; i++) {\n        const candidate = port + i;\n        if (!usedPorts.has(candidate)) {\n          candidates.push(candidate);\n        }\n      }\n\n      if (candidates.length === 0) {\n        port += PARALLEL_PROBE_WINDOW;\n        steps += PARALLEL_PROBE_WINDOW;\n        continue;\n      }\n\n      const results = yield* Effect.forEach(\n        candidates,\n        (c) => probePortBindable(c).pipe(Effect.map((free) => ({ port: c, free }))),\n        { concurrency: \"unbounded\" },\n      );\n\n      const firstFree = results.find((r) => r.free);\n      if (firstFree) {\n        usedPorts.add(firstFree.port);\n        return firstFree.port;\n      }\n\n      port += PARALLEL_PROBE_WINDOW;\n      steps += PARALLEL_PROBE_WINDOW;\n    }\n  });\n}\n\nexport const PortAllocatorLive: Layer.Layer<PortAllocator> = Layer.sync(PortAllocator, () => {\n  const usedPorts = claimedPorts();\n  return {\n    pickAvailable: (preferred, budget) => pickAvailablePort(preferred, usedPorts, budget),\n  };\n});\n\nfunction withLocalRuntimeUrl<\n  T extends { url: string; entry: string; port?: number; localPath?: string },\n>(entry: T, port: number): T {\n  const url = `http://localhost:${port}`;\n  return {\n    ...entry,\n    url,\n    entry: `${url}/mf-manifest.json`,\n    port,\n  };\n}\n\nexport interface DevPortOptions {\n  hostPort?: number;\n  apiPort?: number;\n  uiPort?: number;\n  authPort?: number;\n  pluginPortStart?: number;\n  ssr?: boolean;\n  portBudget?: PortBudget;\n}\n\nexport interface PreparedDevRuntime {\n  runtimeConfig: RuntimeConfig;\n  devPorts: DevPortState;\n}\n\nexport function prepareDevelopmentRuntimeConfig(\n  runtimeConfig: RuntimeConfig,\n  options?: DevPortOptions,\n): Effect.Effect<PreparedDevRuntime, PortAllocationError, PortAllocator> {\n  return Effect.gen(function* () {\n    const allocator = yield* PortAllocator;\n    const budget = options?.portBudget;\n\n    const pickedHostPort = yield* allocator.pickAvailable(\n      options?.hostPort ?? DEFAULT_HOST_PORT,\n      budget,\n    );\n\n    const hostIsLocal = runtimeConfig.host.source === \"local\";\n    const next: RuntimeConfig = {\n      ...runtimeConfig,\n      host: hostIsLocal\n        ? {\n            ...runtimeConfig.host,\n            url: `http://localhost:${pickedHostPort}`,\n            port: pickedHostPort,\n          }\n        : { ...runtimeConfig.host },\n      ui: { ...runtimeConfig.ui },\n      api: { ...runtimeConfig.api },\n      auth: runtimeConfig.auth ? { ...runtimeConfig.auth } : undefined,\n      plugins: runtimeConfig.plugins ? { ...runtimeConfig.plugins } : undefined,\n    };\n\n    const devPorts: DevPortState = {\n      host: hostIsLocal ? pickedHostPort : undefined,\n      api: undefined,\n      ui: undefined,\n      auth: undefined,\n      pluginPortStart: undefined,\n    };\n\n    if (next.api.source === \"local\" && next.api.localPath) {\n      const apiPort = yield* allocator.pickAvailable(\n        options?.apiPort ?? next.api.port ?? DEFAULT_API_PORT,\n        budget,\n      );\n      next.api = withLocalRuntimeUrl(next.api, apiPort);\n      devPorts.api = apiPort;\n    }\n\n    if (next.auth?.source === \"local\" && next.auth.localPath) {\n      const authPort = yield* allocator.pickAvailable(\n        options?.authPort ?? next.auth.port ?? DEFAULT_AUTH_PORT,\n        budget,\n      );\n      next.auth = withLocalRuntimeUrl(next.auth, authPort);\n      devPorts.auth = authPort;\n    }\n\n    if (next.ui.source === \"local\" && next.ui.localPath) {\n      const uiPort = yield* allocator.pickAvailable(\n        options?.uiPort ?? next.ui.port ?? DEFAULT_UI_PORT,\n        budget,\n      );\n      next.ui = withLocalRuntimeUrl(next.ui, uiPort);\n      devPorts.ui = uiPort;\n      if (options?.ssr) {\n        const ssrPort = yield* allocator.pickAvailable(uiPort + 1, budget);\n        next.ui.ssrUrl = `http://localhost:${ssrPort}`;\n      } else {\n        next.ui.ssrUrl = undefined;\n      }\n    }\n\n    if (next.plugins) {\n      const entries = Object.entries(next.plugins).sort(([a], [b]) => a.localeCompare(b));\n      let pluginBasePort = options?.pluginPortStart ?? DEFAULT_PLUGIN_PORT_START;\n      let firstLocalPluginPort: number | undefined;\n\n      for (const [pluginId, plugin] of entries) {\n        if (plugin.source === \"local\" && plugin.localPath) {\n          const pluginPort = yield* allocator.pickAvailable(plugin.port ?? pluginBasePort, budget);\n          next.plugins[pluginId] = withLocalRuntimeUrl(plugin, pluginPort);\n          if (firstLocalPluginPort === undefined) firstLocalPluginPort = pluginPort;\n          pluginBasePort = pluginPort + 1;\n        }\n\n        if (plugin.ui?.source === \"local\" && plugin.ui.localPath) {\n          const pluginUiPort = yield* allocator.pickAvailable(\n            plugin.ui.port ?? pluginBasePort,\n            budget,\n          );\n          next.plugins[pluginId] = {\n            ...next.plugins[pluginId]!,\n            ui: withLocalRuntimeUrl(plugin.ui, pluginUiPort),\n          };\n          if (firstLocalPluginPort === undefined) firstLocalPluginPort = pluginUiPort;\n          pluginBasePort = pluginUiPort + 1;\n        }\n      }\n\n      devPorts.pluginPortStart = firstLocalPluginPort;\n    }\n\n    return { runtimeConfig: next, devPorts };\n  });\n}\n"],"mappings":";;;;;;;;AAsBA,MAAM,mBAAmB;AACzB,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAI9B,IAAa,sBAAb,cAAyC,KAAK,YAAY,qBAAqB,CAAC,CAI7E,CAAC;AAEJ,IAAa,gBAAb,cAAmC,QAAQ,IAAI,eAAe,CAAC,CAQ7D,CAAC,CAAC,CAAC;AAEL,SAAgB,oBACd,WACA,eACU;CACV,MAAM,WAAqB,CAAC;CAC5B,MAAM,YAAY,eAAe;CAEjC,MAAM,cACJ,eAAe,GAAG,aAClB,4BAA4B,WAAW,IAAI,GAAG,aAAa,SAAS;CACtE,IAAI,eAAe,WAAW,KAAK,aAAa,cAAc,CAAC,GAC7D,SAAS,KAAK,IAAI;CAGpB,MAAM,eACJ,eAAe,IAAI,aACnB,4BAA4B,WAAW,IAAI,IAAI,aAAa,SAAS;CACvE,IAAI,gBAAgB,WAAW,KAAK,cAAc,cAAc,CAAC,GAC/D,SAAS,KAAK,KAAK;CAGrB,MAAM,gBACJ,eAAe,MAAM,aACrB,4BAA4B,WAAW,IAAI,KAAK,aAAa,SAAS;CACxE,IAAI,iBAAiB,WAAW,KAAK,eAAe,cAAc,CAAC,GACjE,SAAS,KAAK,MAAM;MACf,IAAI,WAAW,KAAK,WAAW,QAAQ,cAAc,CAAC,GAC3D,SAAS,KAAK,MAAM;CAGtB,KAAK,MAAM,CAAC,UAAU,iBAAiB,OAAO,QAAQ,eAAe,WAAW,CAAC,CAAC,GAAG;EACnF,IAAI,aAAa,aAAa,WAAW,KAAK,aAAa,WAAW,cAAc,CAAC,GACnF,SAAS,KAAK,UAAU,UAAU;EAEpC,IAAI,aAAa,IAAI,aAAa,WAAW,KAAK,aAAa,GAAG,WAAW,cAAc,CAAC,GAC1F,SAAS,KAAK,aAAa,UAAU;CAEzC;CAEA,MAAM,gBACJ,eAAe,MAAM,aACrB,4BAA4B,WAAW,IAAI,MAAM,aAAa,SAAS;CACzE,IAAI,iBAAiB,WAAW,KAAK,eAAe,cAAc,CAAC,GACjE,SAAS,KAAK,MAAM;CAGtB,OAAO;AACT;AAEA,eAAsB,mBACpB,WACA,SASwB;CACxB,OAAOA,qBAAyB,WAAW,eAAe,GAAG,QAAQ,OAAO,eAAe;EACzF,YAAY,QAAQ;EACpB,UAAU,QAAQ;EAClB,WAAW,QAAQ;EACnB,YAAY,QAAQ;EACpB,OAAO,QAAQ;EACf,SAAS,QAAQ;CACnB,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAsC;CAC/D,OAAO,OAAO,OAAgB,WAAW;EACvC,MAAM,SAAS,aAAa;EAE5B,OAAO,KAAK,mBAAmB;GAC7B,OAAO,YAAY;IACjB,OAAO,OAAO,QAAQ,IAAI,CAAC;GAC7B,CAAC;EACH,CAAC;EAED,OAAO,KAAK,eAAe;GACzB,OAAO,mBAAmB;GAE1B,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;EAED,OAAO,OAAO,MAAM,WAAW;EAE/B,MAAM,QAAQ,iBAAiB;GAC7B,OAAO,mBAAmB;GAC1B,IAAI;IACF,OAAO,MAAM;GACf,QAAQ,CAER;GACA,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,GAAG,gBAAgB;EAEnB,OAAO,KAAK,mBAAmB,aAAa,KAAK,CAAC;EAClD,OAAO,KAAK,eAAe,aAAa,KAAK,CAAC;CAChD,CAAC;AACH;AAEA,SAAS,kBACP,WACA,WACA,QAC4C;CAC5C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,cACd,CAAC,UAAW,aAAa,OAAO,OAAO,aAAa,OAAO;EAE7D,IAAI,OAAO;EACX,IAAI,CAAC,OAAO,IAAI,GACd,OAAO,SAAS,OAAO,MAAM;EAG/B,MAAM,UAAU,SAAS,OAAO,MAAM,IAAI,OAAO;EACjD,IAAI,QAAQ;EAEZ,MAAM,aACJ,OAAO,KACL,IAAI,oBAAoB;GACtB;GACA;GACA,OAAO,SACH,2BAA2B,OAAO,IAAI,IAAI,OAAO,IAAI,kBAAkB,cACvE,oCAAoC,UAAU,UAAU,oBAAoB;EAClF,CAAC,CACH;EAEF,OAAO,MAAM;GACX,IAAI,QAAQ,WAAW,QAAQ,qBAC7B,OAAO,KAAK;GAGd,MAAM,aAAuB,CAAC;GAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,yBAAyB,OAAO,IAAI,SAAS,KAAK;IACpE,MAAM,YAAY,OAAO;IACzB,IAAI,CAAC,UAAU,IAAI,SAAS,GAC1B,WAAW,KAAK,SAAS;GAE7B;GAEA,IAAI,WAAW,WAAW,GAAG;IAC3B,QAAQ;IACR,SAAS;IACT;GACF;GAQA,MAAM,aAAY,OANK,OAAO,QAC5B,aACC,MAAM,kBAAkB,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU;IAAE,MAAM;IAAG;GAAK,EAAE,CAAC,GAC1E,EAAE,aAAa,YAAY,CAC7B,EAEyB,CAAC,MAAM,MAAM,EAAE,IAAI;GAC5C,IAAI,WAAW;IACb,UAAU,IAAI,UAAU,IAAI;IAC5B,OAAO,UAAU;GACnB;GAEA,QAAQ;GACR,SAAS;EACX;CACF,CAAC;AACH;AAEA,MAAa,oBAAgD,MAAM,KAAK,qBAAqB;CAC3F,MAAM,YAAY,aAAa;CAC/B,OAAO,EACL,gBAAgB,WAAW,WAAW,kBAAkB,WAAW,WAAW,MAAM,EACtF;AACF,CAAC"}
+{"version":3,"file":"app.mjs","names":[],"sources":["../src/app.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { createServer } from \"node:net\";\nimport { join } from \"node:path\";\nimport { Context, Data, Effect, Layer } from \"effect\";\nimport { resolveLocalDevelopmentPath } from \"./config\";\nimport { claimedPorts } from \"./process-registry\";\nimport type { AppOrchestrator } from \"./service-descriptor\";\nimport type { BosConfig, RuntimeConfig } from \"./types\";\n\nexport type { AppOrchestrator };\n\nconst PROBE_TIMEOUT_MS = 250;\nconst MAX_PORT_SCAN_STEPS = 1000;\nconst PARALLEL_PROBE_WINDOW = 8;\nconst BLOCK_STEP = 100;\n\nexport type PortBudget = { min: number; max: number };\n\nexport class PortAllocationError extends Data.TaggedError(\"PortAllocationError\")<{\n  preferred: number;\n  budget?: PortBudget;\n  cause?: unknown;\n}> {}\n\nexport interface PortBlockEntry {\n  key: string;\n  preferred: number;\n  pinned: boolean;\n}\n\nexport interface PortBlockRequest {\n  base: number;\n  step?: number;\n  entries: PortBlockEntry[];\n}\n\nexport interface PortBlockAllocation {\n  base: number;\n  ports: Record<string, number>;\n  conflicts: Array<{ key: string; port: number; claimed: boolean }>;\n}\n\nexport class PortAllocator extends Context.Service<\n  PortAllocator,\n  {\n    pickAvailable: (\n      preferred: number,\n      budget?: PortBudget,\n    ) => Effect.Effect<number, PortAllocationError>;\n    acquireBlock: (\n      request: PortBlockRequest,\n    ) => Effect.Effect<PortBlockAllocation, PortAllocationError>;\n  }\n>()(\"PortAllocator\") {}\n\nexport interface LocalPackage {\n  readonly name: string;\n  readonly dir: string;\n}\n\nexport function detectLocalPackages(\n  bosConfig?: BosConfig,\n  runtimeConfig?: RuntimeConfig,\n  root: string = process.cwd(),\n): LocalPackage[] {\n  const packages: LocalPackage[] = [];\n  const configDir = root;\n\n  const uiLocalPath =\n    runtimeConfig?.ui.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.ui.development, configDir);\n  if (uiLocalPath && existsSync(join(uiLocalPath, \"package.json\"))) {\n    packages.push({ name: \"ui\", dir: uiLocalPath });\n  }\n\n  const apiLocalPath =\n    runtimeConfig?.api.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.api.development, configDir);\n  if (apiLocalPath && existsSync(join(apiLocalPath, \"package.json\"))) {\n    packages.push({ name: \"api\", dir: apiLocalPath });\n  }\n\n  const hostLocalPath =\n    runtimeConfig?.host?.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.host.development, configDir);\n  if (hostLocalPath && existsSync(join(hostLocalPath, \"package.json\"))) {\n    packages.push({ name: \"host\", dir: hostLocalPath });\n  } else if (existsSync(join(configDir, \"host\", \"package.json\"))) {\n    packages.push({ name: \"host\", dir: join(configDir, \"host\") });\n  }\n\n  for (const [pluginId, pluginConfig] of Object.entries(runtimeConfig?.plugins ?? {})) {\n    if (pluginConfig.localPath && existsSync(join(pluginConfig.localPath, \"package.json\"))) {\n      packages.push({ name: `plugin:${pluginId}`, dir: pluginConfig.localPath });\n    }\n    if (pluginConfig.ui?.localPath && existsSync(join(pluginConfig.ui.localPath, \"package.json\"))) {\n      packages.push({ name: `plugin-ui:${pluginId}`, dir: pluginConfig.ui.localPath });\n    }\n  }\n\n  const authLocalPath =\n    runtimeConfig?.auth?.localPath ??\n    resolveLocalDevelopmentPath(bosConfig?.app.auth?.development, configDir);\n  if (authLocalPath && existsSync(join(authLocalPath, \"package.json\"))) {\n    packages.push({ name: \"auth\", dir: authLocalPath });\n  }\n\n  return packages;\n}\n\nconst scheduleTimeout = (ms: number, fn: () => void): ReturnType<typeof setTimeout> =>\n  setTimeout(fn, ms);\n\nexport function probePortBindable(port: number): Effect.Effect<boolean> {\n  return Effect.callback<boolean>((resume) => {\n    const server = createServer();\n\n    server.once(\"listening\", () => {\n      server.close(() => {\n        resume(Effect.succeed(true));\n      });\n    });\n\n    server.once(\"error\", () => {\n      server.removeAllListeners();\n      // EADDRINUSE, EACCES, or any other bind error → not available\n      resume(Effect.succeed(false));\n    });\n\n    server.listen(port, \"127.0.0.1\");\n\n    const timer = scheduleTimeout(PROBE_TIMEOUT_MS, () => {\n      server.removeAllListeners();\n      try {\n        server.close();\n      } catch {\n        // ignore\n      }\n      resume(Effect.succeed(false));\n    });\n\n    server.once(\"listening\", () => clearTimeout(timer));\n    server.once(\"error\", () => clearTimeout(timer));\n  });\n}\n\nfunction pickAvailablePort(\n  preferred: number,\n  usedPorts: Set<number>,\n  budget?: PortBudget,\n): Effect.Effect<number, PortAllocationError> {\n  return Effect.gen(function* () {\n    const within = (candidate: number): boolean =>\n      !budget || (candidate >= budget.min && candidate <= budget.max);\n\n    let port = preferred;\n    if (!within(port)) {\n      port = budget ? budget.min : port;\n    }\n\n    const ceiling = budget ? budget.max + 1 : Number.MAX_SAFE_INTEGER;\n    let steps = 0;\n\n    const fail = () =>\n      Effect.fail(\n        new PortAllocationError({\n          preferred,\n          budget,\n          cause: budget\n            ? `No free port in budget [${budget.min}, ${budget.max}] starting from ${preferred}`\n            : `No free port found starting from ${preferred} within ${MAX_PORT_SCAN_STEPS} steps`,\n        }),\n      );\n\n    while (true) {\n      if (port >= ceiling || steps > MAX_PORT_SCAN_STEPS) {\n        return yield* fail();\n      }\n\n      const candidates: number[] = [];\n      for (let i = 0; i < PARALLEL_PROBE_WINDOW && port + i < ceiling; i++) {\n        const candidate = port + i;\n        if (!usedPorts.has(candidate)) {\n          candidates.push(candidate);\n        }\n      }\n\n      if (candidates.length === 0) {\n        port += PARALLEL_PROBE_WINDOW;\n        steps += PARALLEL_PROBE_WINDOW;\n        continue;\n      }\n\n      const results = yield* Effect.forEach(\n        candidates,\n        (c) => probePortBindable(c).pipe(Effect.map((free) => ({ port: c, free }))),\n        { concurrency: \"unbounded\" },\n      );\n\n      const firstFree = results.find((r) => r.free);\n      if (firstFree) {\n        usedPorts.add(firstFree.port);\n        return firstFree.port;\n      }\n\n      port += PARALLEL_PROBE_WINDOW;\n      steps += PARALLEL_PROBE_WINDOW;\n    }\n  });\n}\n\nexport const PortAllocatorLive: Layer.Layer<PortAllocator> = Layer.sync(PortAllocator, () => {\n  const usedPorts = claimedPorts();\n  return {\n    pickAvailable: (preferred, budget) => pickAvailablePort(preferred, usedPorts, budget),\n    acquireBlock: (request) => acquireBlockPort(request, usedPorts),\n  };\n});\n\n// acquireBlockPort validates and acquires a whole port block atomically: every\n// entry is probed before any is yielded; on any conflict the entire block\n// steps (base += step) and retries. Pinned entries (explicit CLI flags) are\n// absolute — an actual listener on one fails loudly instead of silently\n// drifting a port the user named; a registry claim without a listener is\n// stale (PID reuse across container restarts) and never wedges allocation.\nfunction acquireBlockPort(\n  request: PortBlockRequest,\n  usedPorts: Set<number>,\n): Effect.Effect<PortBlockAllocation, PortAllocationError> {\n  const step = request.step ?? BLOCK_STEP;\n  const fail = (cause: string) =>\n    Effect.fail(\n      new PortAllocationError({\n        preferred: request.base,\n        cause,\n      }),\n    );\n\n  return Effect.gen(function* () {\n    let base = request.base;\n    let steps = 0;\n    let firstConflicts: PortBlockAllocation[\"conflicts\"] = [];\n    while (steps <= MAX_PORT_SCAN_STEPS) {\n      const shift = base - request.base;\n      const candidates = request.entries.map((entry) => ({\n        ...entry,\n        port: entry.pinned ? entry.preferred : entry.preferred + shift,\n      }));\n\n      // Pinned entries are absolute (ADR 0012): an actual listener on one\n      // fails loudly instead of drifting a port the user named. Verified\n      // against the real socket every iteration — a registry claim without\n      // a listener is stale (PID reuse across container restarts) and must\n      // never wedge a pinned allocation.\n      let pinnedHeldByListener: (typeof candidates)[number] | undefined;\n      for (const candidate of candidates.filter((c) => c.pinned)) {\n        const bindable = yield* probePortBindable(candidate.port);\n        if (!bindable) {\n          pinnedHeldByListener = candidate;\n          break;\n        }\n        usedPorts.delete(candidate.port);\n      }\n      if (pinnedHeldByListener) {\n        return yield* fail(\n          `explicitly-requested port ${pinnedHeldByListener.port} (${pinnedHeldByListener.key}) is occupied by a listener`,\n        );\n      }\n\n      const unpinned = candidates.filter((c) => !c.pinned);\n      const claimConflicts = unpinned\n        .filter((c) => usedPorts.has(c.port))\n        .map((c) => ({ key: c.key, port: c.port, claimed: true }));\n      if (shift === 0) {\n        firstConflicts = claimConflicts;\n      }\n\n      if (claimConflicts.length === 0) {\n        const results = yield* Effect.forEach(\n          unpinned,\n          (c) => probePortBindable(c.port).pipe(Effect.map((free) => ({ ...c, free }))),\n          { concurrency: \"unbounded\" },\n        );\n        const busy = results.filter((r) => !r.free);\n        if (shift === 0) {\n          firstConflicts = busy.map((b) => ({ key: b.key, port: b.port, claimed: false }));\n        }\n        if (busy.length === 0) {\n          for (const candidate of candidates) usedPorts.add(candidate.port);\n          return {\n            base,\n            ports: Object.fromEntries(candidates.map((c) => [c.key, c.port])),\n            conflicts: firstConflicts,\n          };\n        }\n      }\n\n      base += step;\n      steps += 1;\n    }\n    return yield* fail(\n      `no free port block within ${MAX_PORT_SCAN_STEPS} steps of base ${request.base} (step ${step})`,\n    );\n  });\n}\n"],"mappings":";;;;;;;;AAWA,MAAM,mBAAmB;AACzB,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAC9B,MAAM,aAAa;AAInB,IAAa,sBAAb,cAAyC,KAAK,YAAY,qBAAqB,CAAC,CAI7E,CAAC;AAoBJ,IAAa,gBAAb,cAAmC,QAAQ,QAWzC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAOtB,SAAgB,oBACd,WACA,eACA,OAAe,QAAQ,IAAI,GACX;CAChB,MAAM,WAA2B,CAAC;CAClC,MAAM,YAAY;CAElB,MAAM,cACJ,eAAe,GAAG,aAClB,4BAA4B,WAAW,IAAI,GAAG,aAAa,SAAS;CACtE,IAAI,eAAe,WAAW,KAAK,aAAa,cAAc,CAAC,GAC7D,SAAS,KAAK;EAAE,MAAM;EAAM,KAAK;CAAY,CAAC;CAGhD,MAAM,eACJ,eAAe,IAAI,aACnB,4BAA4B,WAAW,IAAI,IAAI,aAAa,SAAS;CACvE,IAAI,gBAAgB,WAAW,KAAK,cAAc,cAAc,CAAC,GAC/D,SAAS,KAAK;EAAE,MAAM;EAAO,KAAK;CAAa,CAAC;CAGlD,MAAM,gBACJ,eAAe,MAAM,aACrB,4BAA4B,WAAW,IAAI,KAAK,aAAa,SAAS;CACxE,IAAI,iBAAiB,WAAW,KAAK,eAAe,cAAc,CAAC,GACjE,SAAS,KAAK;EAAE,MAAM;EAAQ,KAAK;CAAc,CAAC;MAC7C,IAAI,WAAW,KAAK,WAAW,QAAQ,cAAc,CAAC,GAC3D,SAAS,KAAK;EAAE,MAAM;EAAQ,KAAK,KAAK,WAAW,MAAM;CAAE,CAAC;CAG9D,KAAK,MAAM,CAAC,UAAU,iBAAiB,OAAO,QAAQ,eAAe,WAAW,CAAC,CAAC,GAAG;EACnF,IAAI,aAAa,aAAa,WAAW,KAAK,aAAa,WAAW,cAAc,CAAC,GACnF,SAAS,KAAK;GAAE,MAAM,UAAU;GAAY,KAAK,aAAa;EAAU,CAAC;EAE3E,IAAI,aAAa,IAAI,aAAa,WAAW,KAAK,aAAa,GAAG,WAAW,cAAc,CAAC,GAC1F,SAAS,KAAK;GAAE,MAAM,aAAa;GAAY,KAAK,aAAa,GAAG;EAAU,CAAC;CAEnF;CAEA,MAAM,gBACJ,eAAe,MAAM,aACrB,4BAA4B,WAAW,IAAI,MAAM,aAAa,SAAS;CACzE,IAAI,iBAAiB,WAAW,KAAK,eAAe,cAAc,CAAC,GACjE,SAAS,KAAK;EAAE,MAAM;EAAQ,KAAK;CAAc,CAAC;CAGpD,OAAO;AACT;AAEA,MAAM,mBAAmB,IAAY,OACnC,WAAW,IAAI,EAAE;AAEnB,SAAgB,kBAAkB,MAAsC;CACtE,OAAO,OAAO,UAAmB,WAAW;EAC1C,MAAM,SAAS,aAAa;EAE5B,OAAO,KAAK,mBAAmB;GAC7B,OAAO,YAAY;IACjB,OAAO,OAAO,QAAQ,IAAI,CAAC;GAC7B,CAAC;EACH,CAAC;EAED,OAAO,KAAK,eAAe;GACzB,OAAO,mBAAmB;GAE1B,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;EAED,OAAO,OAAO,MAAM,WAAW;EAE/B,MAAM,QAAQ,gBAAgB,wBAAwB;GACpD,OAAO,mBAAmB;GAC1B,IAAI;IACF,OAAO,MAAM;GACf,QAAQ,CAER;GACA,OAAO,OAAO,QAAQ,KAAK,CAAC;EAC9B,CAAC;EAED,OAAO,KAAK,mBAAmB,aAAa,KAAK,CAAC;EAClD,OAAO,KAAK,eAAe,aAAa,KAAK,CAAC;CAChD,CAAC;AACH;AAEA,SAAS,kBACP,WACA,WACA,QAC4C;CAC5C,OAAO,OAAO,IAAI,aAAa;EAC7B,MAAM,UAAU,cACd,CAAC,UAAW,aAAa,OAAO,OAAO,aAAa,OAAO;EAE7D,IAAI,OAAO;EACX,IAAI,CAAC,OAAO,IAAI,GACd,OAAO,SAAS,OAAO,MAAM;EAG/B,MAAM,UAAU,SAAS,OAAO,MAAM,IAAI,OAAO;EACjD,IAAI,QAAQ;EAEZ,MAAM,aACJ,OAAO,KACL,IAAI,oBAAoB;GACtB;GACA;GACA,OAAO,SACH,2BAA2B,OAAO,IAAI,IAAI,OAAO,IAAI,kBAAkB,cACvE,oCAAoC,UAAU,UAAU,oBAAoB;EAClF,CAAC,CACH;EAEF,OAAO,MAAM;GACX,IAAI,QAAQ,WAAW,QAAQ,qBAC7B,OAAO,OAAO,KAAK;GAGrB,MAAM,aAAuB,CAAC;GAC9B,KAAK,IAAI,IAAI,GAAG,IAAI,yBAAyB,OAAO,IAAI,SAAS,KAAK;IACpE,MAAM,YAAY,OAAO;IACzB,IAAI,CAAC,UAAU,IAAI,SAAS,GAC1B,WAAW,KAAK,SAAS;GAE7B;GAEA,IAAI,WAAW,WAAW,GAAG;IAC3B,QAAQ;IACR,SAAS;IACT;GACF;GAQA,MAAM,aAAY,OANK,OAAO,QAC5B,aACC,MAAM,kBAAkB,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU;IAAE,MAAM;IAAG;GAAK,EAAE,CAAC,GAC1E,EAAE,aAAa,YAAY,CAC7B,EAEyB,CAAC,MAAM,MAAM,EAAE,IAAI;GAC5C,IAAI,WAAW;IACb,UAAU,IAAI,UAAU,IAAI;IAC5B,OAAO,UAAU;GACnB;GAEA,QAAQ;GACR,SAAS;EACX;CACF,CAAC;AACH;AAEA,MAAa,oBAAgD,MAAM,KAAK,qBAAqB;CAC3F,MAAM,YAAY,aAAa;CAC/B,OAAO;EACL,gBAAgB,WAAW,WAAW,kBAAkB,WAAW,WAAW,MAAM;EACpF,eAAe,YAAY,iBAAiB,SAAS,SAAS;CAChE;AACF,CAAC;AAQD,SAAS,iBACP,SACA,WACyD;CACzD,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,UACZ,OAAO,KACL,IAAI,oBAAoB;EACtB,WAAW,QAAQ;EACnB;CACF,CAAC,CACH;CAEF,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,OAAO,QAAQ;EACnB,IAAI,QAAQ;EACZ,IAAI,iBAAmD,CAAC;EACxD,OAAO,SAAS,qBAAqB;GACnC,MAAM,QAAQ,OAAO,QAAQ;GAC7B,MAAM,aAAa,QAAQ,QAAQ,KAAK,WAAW;IACjD,GAAG;IACH,MAAM,MAAM,SAAS,MAAM,YAAY,MAAM,YAAY;GAC3D,EAAE;GAOF,IAAI;GACJ,KAAK,MAAM,aAAa,WAAW,QAAQ,MAAM,EAAE,MAAM,GAAG;IAE1D,IAAI,EAAC,OADmB,kBAAkB,UAAU,IAAI,IACzC;KACb,uBAAuB;KACvB;IACF;IACA,UAAU,OAAO,UAAU,IAAI;GACjC;GACA,IAAI,sBACF,OAAO,OAAO,KACZ,6BAA6B,qBAAqB,KAAK,IAAI,qBAAqB,IAAI,4BACtF;GAGF,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,EAAE,MAAM;GACnD,MAAM,iBAAiB,SACpB,QAAQ,MAAM,UAAU,IAAI,EAAE,IAAI,CAAC,CAAC,CACpC,KAAK,OAAO;IAAE,KAAK,EAAE;IAAK,MAAM,EAAE;IAAM,SAAS;GAAK,EAAE;GAC3D,IAAI,UAAU,GACZ,iBAAiB;GAGnB,IAAI,eAAe,WAAW,GAAG;IAM/B,MAAM,QAAO,OALU,OAAO,QAC5B,WACC,MAAM,kBAAkB,EAAE,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK,UAAU;KAAE,GAAG;KAAG;IAAK,EAAE,CAAC,GAC5E,EAAE,aAAa,YAAY,CAC7B,EACoB,CAAC,QAAQ,MAAM,CAAC,EAAE,IAAI;IAC1C,IAAI,UAAU,GACZ,iBAAiB,KAAK,KAAK,OAAO;KAAE,KAAK,EAAE;KAAK,MAAM,EAAE;KAAM,SAAS;IAAM,EAAE;IAEjF,IAAI,KAAK,WAAW,GAAG;KACrB,KAAK,MAAM,aAAa,YAAY,UAAU,IAAI,UAAU,IAAI;KAChE,OAAO;MACL;MACA,OAAO,OAAO,YAAY,WAAW,KAAK,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;MAChE,WAAW;KACb;IACF;GACF;GAEA,QAAQ;GACR,SAAS;EACX;EACA,OAAO,OAAO,KACZ,6BAA6B,oBAAoB,iBAAiB,QAAQ,KAAK,SAAS,KAAK,EAC/F;CACF,CAAC;AACH"}

package/dist/auth-login.cjs

@@ -0,0 +1,163 @@
+let node_os = require("node:os");
+let execa = require("execa");
+
+//#region src/auth-login.ts
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const DEFAULT_CLIENT_ID = "bos-cli";
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_PENALTY_SECONDS = 5;
+async function authFetch(siteUrl, path, body, cookiePair) {
+	const headers = {
+		"content-type": "application/json",
+		origin: new URL(siteUrl).origin
+	};
+	if (cookiePair) headers.cookie = cookiePair;
+	const response = await fetch(`${siteUrl.replace(/\/$/, "")}/api/auth${path}`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(body)
+	});
+	return {
+		status: response.status,
+		json: await response.json().catch(() => ({})),
+		setCookie: response.headers.get("set-cookie")
+	};
+}
+/**
+* CLI login via the OAuth 2.0 Device Flow (RFC 8628) — the same flow the
+* site's QR pairing uses. The CLI requests a device code, the user approves
+* at `/login/device` in any browser (same machine or not), and the CLI polls
+* the token endpoint until the grant completes.
+*/
+async function startDeviceLogin(opts) {
+	const siteUrl = opts.siteUrl.replace(/\/$/, "");
+	const clientId = DEFAULT_CLIENT_ID;
+	const codeResponse = await fetch(`${siteUrl}/api/auth/device/code`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ client_id: clientId })
+	});
+	if (!codeResponse.ok) throw new Error(`Device login could not start (${codeResponse.status}) — is ${siteUrl} running the platform auth plugin?`);
+	const code = await codeResponse.json();
+	const verificationUrl = buildVerificationUrl(siteUrl, code, opts);
+	let abortReason = null;
+	let rejectPending;
+	const pendingReject = new Promise((_, reject) => {
+		rejectPending = reject;
+	});
+	const waitForApproval = (timeoutMs = 6e5) => {
+		const deadline = Date.now() + timeoutMs;
+		let intervalSeconds = code.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
+		const poll = async () => {
+			if (abortReason) throw new Error(abortReason);
+			if (Date.now() > deadline) throw new Error("Login timed out — the device code expired before approval");
+			const { status, json } = await authFetch(siteUrl, "/device/token", {
+				grant_type: DEVICE_CODE_GRANT_TYPE,
+				device_code: code.device_code,
+				client_id: clientId
+			});
+			if (status === 200) {
+				const { access_token: sessionToken } = json;
+				return await completeLogin(siteUrl, sessionToken, opts);
+			}
+			const error = json.error;
+			if (error === "authorization_pending") {} else if (error === "slow_down") intervalSeconds += SLOW_DOWN_PENALTY_SECONDS;
+			else if (error === "expired_token") throw new Error("Login timed out — the device code expired before approval");
+			else if (error === "access_denied") throw new Error("Login request was denied on the approval page");
+			else throw new Error(json.error_description ?? `Login failed (${error ?? status})`);
+			await new Promise((resolve) => setTimeout(resolve, intervalSeconds * 1e3));
+			return poll();
+		};
+		return Promise.race([pendingReject, poll()]);
+	};
+	return {
+		userCode: code.user_code,
+		verificationUrl,
+		waitForApproval,
+		abort: (reason) => {
+			abortReason = reason ?? "Login aborted";
+			rejectPending(new Error(abortReason));
+		}
+	};
+}
+function buildVerificationUrl(siteUrl, code, opts) {
+	const base = code.verification_uri_complete ?? code.verification_uri ?? "/login/device";
+	const url = new URL(base, siteUrl);
+	const params = url.searchParams;
+	params.set("user_code", code.user_code);
+	if (opts.account) params.set("account", opts.account);
+	if (opts.device) params.set("device", opts.device);
+	if (opts.delegate) {
+		params.set("pubKey", opts.delegate.pubKey);
+		params.set("contract", opts.delegate.contract);
+		params.set("network", opts.delegate.network);
+	}
+	return url.toString();
+}
+async function completeLogin(siteUrl, sessionToken, opts) {
+	const claim = await authFetch(siteUrl, "/device-link/claim", {
+		token: sessionToken,
+		client_id: DEFAULT_CLIENT_ID
+	});
+	if (claim.status !== 200) {
+		const detail = claim.json.message;
+		throw new Error(`Approved session could not be claimed${detail ? `: ${detail}` : ` (${claim.status})`}`);
+	}
+	const cookiePair = claim.setCookie?.split(";")[0];
+	if (!cookiePair?.includes("=")) throw new Error("Session claim returned no session cookie");
+	const apiKey = await mintApiKey(siteUrl, cookiePair, opts);
+	return {
+		sessionToken,
+		accountId: await resolveNearAccount(siteUrl, cookiePair),
+		apiKey
+	};
+}
+async function mintApiKey(siteUrl, cookiePair, opts) {
+	const { status, json } = await authFetch(siteUrl, "/api-key/create", {
+		configId: "user-keys",
+		name: `bos login — ${opts.device ?? "cli"} — ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace("T", " ")}`,
+		...opts.expiresIn ? { expiresIn: opts.expiresIn } : {}
+	}, cookiePair);
+	if (status !== 200) {
+		const detail = json.message;
+		throw new Error(`CLI credential could not be created${detail ? `: ${detail}` : ` (${status})`}`);
+	}
+	const created = json;
+	if (!created.key) throw new Error("API key creation returned no key");
+	return {
+		key: created.key,
+		id: created.id
+	};
+}
+async function resolveNearAccount(siteUrl, cookiePair) {
+	try {
+		const response = await fetch(`${siteUrl.replace(/\/$/, "")}/api/auth/near/list-accounts`, { headers: { cookie: cookiePair } });
+		if (!response.ok) return null;
+		return (await response.json()).activeAccount?.accountId ?? null;
+	} catch {
+		return null;
+	}
+}
+async function openInBrowser(url) {
+	const os = (0, node_os.platform)();
+	try {
+		if (os === "darwin") await (0, execa.execa)("open", [url], { stdio: "ignore" });
+		else if (os === "win32") await (0, execa.execa)("cmd", [
+			"/c",
+			"start",
+			"",
+			url
+		], {
+			stdio: "ignore",
+			windowsVerbatimArguments: true
+		});
+		else await (0, execa.execa)("xdg-open", [url], { stdio: "ignore" });
+	} catch {
+		throw new Error(`Failed to open browser. Open this URL manually:\n  ${url}`);
+	}
+}
+
+//#endregion
+exports.openInBrowser = openInBrowser;
+exports.startDeviceLogin = startDeviceLogin;
+//# sourceMappingURL=auth-login.cjs.map

package/dist/auth-login.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.cjs","names":["platform"],"sources":["../src/auth-login.ts"],"sourcesContent":["import { platform } from \"node:os\";\nimport { execa } from \"execa\";\n\nconst DEVICE_CODE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:device_code\";\nconst DEFAULT_CLIENT_ID = \"bos-cli\";\nconst DEFAULT_POLL_INTERVAL_SECONDS = 5;\nconst SLOW_DOWN_PENALTY_SECONDS = 5;\n\nexport interface DeviceLoginOptions {\n  siteUrl: string;\n  /** label for the approving device, shown on the approval page */\n  device?: string;\n  /** the NEAR account the CLI expects to authenticate as (approval-page copy only) */\n  account?: string;\n  /** delegate mode — the approval page adds this scoped function-call key to the user's account */\n  delegate?: { pubKey: string; contract: string; network: string };\n  /** seconds the minted API key stays valid (login mode) */\n  expiresIn?: number;\n}\n\nexport interface DeviceApproval {\n  sessionToken: string;\n  /** the NEAR account signed in on the approving browser (login mode) */\n  accountId: string | null;\n  /** the minted CLI credential (login mode) */\n  apiKey: { key: string; id: string } | null;\n}\n\nexport interface DeviceLoginHandle {\n  userCode: string;\n  verificationUrl: string;\n  waitForApproval: (timeoutMs?: number) => Promise<DeviceApproval>;\n  abort: (reason?: string) => void;\n}\n\ninterface DeviceCodeResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri?: string;\n  verification_uri_complete?: string;\n  expires_in?: number;\n  interval?: number;\n}\n\ninterface DeviceTokenSuccess {\n  access_token: string;\n  token_type: \"Bearer\";\n}\n\ninterface DeviceTokenError {\n  error:\n    | \"authorization_pending\"\n    | \"slow_down\"\n    | \"expired_token\"\n    | \"access_denied\"\n    | \"invalid_grant\"\n    | \"invalid_request\"\n    | \"invalid_client\";\n  error_description?: string;\n}\n\ninterface ApiKeyCreated {\n  id: string;\n  key: string;\n}\n\ninterface NearAccountsResponse {\n  accounts: { accountId: string }[];\n  activeAccount: { accountId: string } | null;\n}\n\nasync function authFetch(\n  siteUrl: string,\n  path: string,\n  body: unknown,\n  cookiePair?: string,\n): Promise<{ status: number; json: unknown; setCookie: string | null }> {\n  // Better Auth's origin check demands an Origin on cookie-bearing\n  // requests — present the site's own origin, exactly as a browser would.\n  const origin = new URL(siteUrl).origin;\n  const headers: Record<string, string> = { \"content-type\": \"application/json\", origin };\n  if (cookiePair) headers.cookie = cookiePair;\n  const response = await fetch(`${siteUrl.replace(/\\/$/, \"\")}/api/auth${path}`, {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify(body),\n  });\n  return {\n    status: response.status,\n    json: await response.json().catch(() => ({})),\n    setCookie: response.headers.get(\"set-cookie\"),\n  };\n}\n\n/**\n * CLI login via the OAuth 2.0 Device Flow (RFC 8628) — the same flow the\n * site's QR pairing uses. The CLI requests a device code, the user approves\n * at `/login/device` in any browser (same machine or not), and the CLI polls\n * the token endpoint until the grant completes.\n */\nexport async function startDeviceLogin(opts: DeviceLoginOptions): Promise<DeviceLoginHandle> {\n  const siteUrl = opts.siteUrl.replace(/\\/$/, \"\");\n  const clientId = DEFAULT_CLIENT_ID;\n\n  const codeResponse = await fetch(`${siteUrl}/api/auth/device/code`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({ client_id: clientId }),\n  });\n  if (!codeResponse.ok) {\n    throw new Error(\n      `Device login could not start (${codeResponse.status}) — is ${siteUrl} running the platform auth plugin?`,\n    );\n  }\n  const code = (await codeResponse.json()) as DeviceCodeResponse;\n\n  const verificationUrl = buildVerificationUrl(siteUrl, code, opts);\n\n  let abortReason: string | null = null;\n  let rejectPending!: (reason?: Error) => void;\n  const pendingReject = new Promise<never>((_, reject) => {\n    rejectPending = reject;\n  });\n\n  const waitForApproval = (timeoutMs = 10 * 60_000): Promise<DeviceApproval> => {\n    const deadline = Date.now() + timeoutMs;\n    let intervalSeconds = code.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;\n\n    const poll = async (): Promise<DeviceApproval> => {\n      if (abortReason) throw new Error(abortReason);\n      if (Date.now() > deadline) {\n        throw new Error(\"Login timed out — the device code expired before approval\");\n      }\n\n      const { status, json } = await authFetch(siteUrl, \"/device/token\", {\n        grant_type: DEVICE_CODE_GRANT_TYPE,\n        device_code: code.device_code,\n        client_id: clientId,\n      });\n\n      if (status === 200) {\n        const { access_token: sessionToken } = json as DeviceTokenSuccess;\n        return await completeLogin(siteUrl, sessionToken, opts);\n      }\n\n      const error = (json as DeviceTokenError).error;\n      if (error === \"authorization_pending\") {\n        // keep polling\n      } else if (error === \"slow_down\") {\n        intervalSeconds += SLOW_DOWN_PENALTY_SECONDS;\n      } else if (error === \"expired_token\") {\n        throw new Error(\"Login timed out — the device code expired before approval\");\n      } else if (error === \"access_denied\") {\n        throw new Error(\"Login request was denied on the approval page\");\n      } else {\n        throw new Error(\n          (json as DeviceTokenError).error_description ?? `Login failed (${error ?? status})`,\n        );\n      }\n\n      await new Promise((resolve) => setTimeout(resolve, intervalSeconds * 1000));\n      return poll();\n    };\n\n    return Promise.race([pendingReject, poll()]);\n  };\n\n  return {\n    userCode: code.user_code,\n    verificationUrl,\n    waitForApproval,\n    abort: (reason) => {\n      abortReason = reason ?? \"Login aborted\";\n      rejectPending(new Error(abortReason));\n    },\n  };\n}\n\nfunction buildVerificationUrl(\n  siteUrl: string,\n  code: DeviceCodeResponse,\n  opts: DeviceLoginOptions,\n): string {\n  const base = code.verification_uri_complete ?? code.verification_uri ?? \"/login/device\";\n  const url = new URL(base, siteUrl);\n  const params = url.searchParams;\n  params.set(\"user_code\", code.user_code);\n  if (opts.account) params.set(\"account\", opts.account);\n  if (opts.device) params.set(\"device\", opts.device);\n  if (opts.delegate) {\n    params.set(\"pubKey\", opts.delegate.pubKey);\n    params.set(\"contract\", opts.delegate.contract);\n    params.set(\"network\", opts.delegate.network);\n  }\n  return url.toString();\n}\n\nasync function completeLogin(\n  siteUrl: string,\n  sessionToken: string,\n  opts: DeviceLoginOptions,\n): Promise<DeviceApproval> {\n  // The token endpoint returns the raw session token; Better Auth session\n  // cookies carry an HMAC signature, so exchange the token for a signed\n  // session cookie via the device-link claim endpoint (the QR pairing path).\n  const claim = await authFetch(siteUrl, \"/device-link/claim\", {\n    token: sessionToken,\n    client_id: DEFAULT_CLIENT_ID,\n  });\n  if (claim.status !== 200) {\n    const detail = (claim.json as { message?: string }).message;\n    throw new Error(\n      `Approved session could not be claimed${detail ? `: ${detail}` : ` (${claim.status})`}`,\n    );\n  }\n  const cookiePair = claim.setCookie?.split(\";\")[0];\n  if (!cookiePair?.includes(\"=\")) {\n    throw new Error(\"Session claim returned no session cookie\");\n  }\n\n  const apiKey = await mintApiKey(siteUrl, cookiePair, opts);\n  const accountId = await resolveNearAccount(siteUrl, cookiePair);\n  return { sessionToken, accountId, apiKey };\n}\n\nasync function mintApiKey(\n  siteUrl: string,\n  cookiePair: string,\n  opts: DeviceLoginOptions,\n): Promise<DeviceApproval[\"apiKey\"]> {\n  const { status, json } = await authFetch(\n    siteUrl,\n    \"/api-key/create\",\n    {\n      configId: \"user-keys\",\n      name: `bos login — ${opts.device ?? \"cli\"} — ${new Date().toISOString().slice(0, 16).replace(\"T\", \" \")}`,\n      ...(opts.expiresIn ? { expiresIn: opts.expiresIn } : {}),\n    },\n    cookiePair,\n  );\n  if (status !== 200) {\n    const detail = (json as { message?: string }).message;\n    throw new Error(\n      `CLI credential could not be created${detail ? `: ${detail}` : ` (${status})`}`,\n    );\n  }\n  const created = json as ApiKeyCreated;\n  if (!created.key) throw new Error(\"API key creation returned no key\");\n  return { key: created.key, id: created.id };\n}\n\nasync function resolveNearAccount(siteUrl: string, cookiePair: string): Promise<string | null> {\n  try {\n    const response = await fetch(`${siteUrl.replace(/\\/$/, \"\")}/api/auth/near/list-accounts`, {\n      headers: { cookie: cookiePair },\n    });\n    if (!response.ok) return null;\n    const data = (await response.json()) as NearAccountsResponse;\n    return data.activeAccount?.accountId ?? null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function openInBrowser(url: string): Promise<void> {\n  const os = platform();\n  try {\n    if (os === \"darwin\") {\n      await execa(\"open\", [url], { stdio: \"ignore\" });\n    } else if (os === \"win32\") {\n      await execa(\"cmd\", [\"/c\", \"start\", \"\", url], {\n        stdio: \"ignore\",\n        windowsVerbatimArguments: true,\n      });\n    } else {\n      await execa(\"xdg-open\", [url], { stdio: \"ignore\" });\n    }\n  } catch {\n    throw new Error(`Failed to open browser. Open this URL manually:\\n  ${url}`);\n  }\n}\n"],"mappings":";;;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;AAC1B,MAAM,gCAAgC;AACtC,MAAM,4BAA4B;AAiElC,eAAe,UACb,SACA,MACA,MACA,YACsE;CAItE,MAAM,UAAkC;EAAE,gBAAgB;EAAoB,QAD/D,IAAI,IAAI,OAAO,CAAC,CAAC;CACqD;CACrF,IAAI,YAAY,QAAQ,SAAS;CACjC,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,OAAO,EAAE,EAAE,WAAW,QAAQ;EAC5E,QAAQ;EACR;EACA,MAAM,KAAK,UAAU,IAAI;CAC3B,CAAC;CACD,OAAO;EACL,QAAQ,SAAS;EACjB,MAAM,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;EAC5C,WAAW,SAAS,QAAQ,IAAI,YAAY;CAC9C;AACF;;;;;;;AAQA,eAAsB,iBAAiB,MAAsD;CAC3F,MAAM,UAAU,KAAK,QAAQ,QAAQ,OAAO,EAAE;CAC9C,MAAM,WAAW;CAEjB,MAAM,eAAe,MAAM,MAAM,GAAG,QAAQ,wBAAwB;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU,EAAE,WAAW,SAAS,CAAC;CAC9C,CAAC;CACD,IAAI,CAAC,aAAa,IAChB,MAAM,IAAI,MACR,iCAAiC,aAAa,OAAO,SAAS,QAAQ,mCACxE;CAEF,MAAM,OAAQ,MAAM,aAAa,KAAK;CAEtC,MAAM,kBAAkB,qBAAqB,SAAS,MAAM,IAAI;CAEhE,IAAI,cAA6B;CACjC,IAAI;CACJ,MAAM,gBAAgB,IAAI,SAAgB,GAAG,WAAW;EACtD,gBAAgB;CAClB,CAAC;CAED,MAAM,mBAAmB,YAAY,QAAyC;EAC5E,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,kBAAkB,KAAK,YAAY;EAEvC,MAAM,OAAO,YAAqC;GAChD,IAAI,aAAa,MAAM,IAAI,MAAM,WAAW;GAC5C,IAAI,KAAK,IAAI,IAAI,UACf,MAAM,IAAI,MAAM,2DAA2D;GAG7E,MAAM,EAAE,QAAQ,SAAS,MAAM,UAAU,SAAS,iBAAiB;IACjE,YAAY;IACZ,aAAa,KAAK;IAClB,WAAW;GACb,CAAC;GAED,IAAI,WAAW,KAAK;IAClB,MAAM,EAAE,cAAc,iBAAiB;IACvC,OAAO,MAAM,cAAc,SAAS,cAAc,IAAI;GACxD;GAEA,MAAM,QAAS,KAA0B;GACzC,IAAI,UAAU,yBAAyB,CAEvC,OAAO,IAAI,UAAU,aACnB,mBAAmB;QACd,IAAI,UAAU,iBACnB,MAAM,IAAI,MAAM,2DAA2D;QACtE,IAAI,UAAU,iBACnB,MAAM,IAAI,MAAM,+CAA+C;QAE/D,MAAM,IAAI,MACP,KAA0B,qBAAqB,iBAAiB,SAAS,OAAO,EACnF;GAGF,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,kBAAkB,GAAI,CAAC;GAC1E,OAAO,KAAK;EACd;EAEA,OAAO,QAAQ,KAAK,CAAC,eAAe,KAAK,CAAC,CAAC;CAC7C;CAEA,OAAO;EACL,UAAU,KAAK;EACf;EACA;EACA,QAAQ,WAAW;GACjB,cAAc,UAAU;GACxB,cAAc,IAAI,MAAM,WAAW,CAAC;EACtC;CACF;AACF;AAEA,SAAS,qBACP,SACA,MACA,MACQ;CACR,MAAM,OAAO,KAAK,6BAA6B,KAAK,oBAAoB;CACxE,MAAM,MAAM,IAAI,IAAI,MAAM,OAAO;CACjC,MAAM,SAAS,IAAI;CACnB,OAAO,IAAI,aAAa,KAAK,SAAS;CACtC,IAAI,KAAK,SAAS,OAAO,IAAI,WAAW,KAAK,OAAO;CACpD,IAAI,KAAK,QAAQ,OAAO,IAAI,UAAU,KAAK,MAAM;CACjD,IAAI,KAAK,UAAU;EACjB,OAAO,IAAI,UAAU,KAAK,SAAS,MAAM;EACzC,OAAO,IAAI,YAAY,KAAK,SAAS,QAAQ;EAC7C,OAAO,IAAI,WAAW,KAAK,SAAS,OAAO;CAC7C;CACA,OAAO,IAAI,SAAS;AACtB;AAEA,eAAe,cACb,SACA,cACA,MACyB;CAIzB,MAAM,QAAQ,MAAM,UAAU,SAAS,sBAAsB;EAC3D,OAAO;EACP,WAAW;CACb,CAAC;CACD,IAAI,MAAM,WAAW,KAAK;EACxB,MAAM,SAAU,MAAM,KAA8B;EACpD,MAAM,IAAI,MACR,wCAAwC,SAAS,KAAK,WAAW,KAAK,MAAM,OAAO,IACrF;CACF;CACA,MAAM,aAAa,MAAM,WAAW,MAAM,GAAG,CAAC,CAAC;CAC/C,IAAI,CAAC,YAAY,SAAS,GAAG,GAC3B,MAAM,IAAI,MAAM,0CAA0C;CAG5D,MAAM,SAAS,MAAM,WAAW,SAAS,YAAY,IAAI;CAEzD,OAAO;EAAE;EAAc,iBADC,mBAAmB,SAAS,UAAU;EAC5B;CAAO;AAC3C;AAEA,eAAe,WACb,SACA,YACA,MACmC;CACnC,MAAM,EAAE,QAAQ,SAAS,MAAM,UAC7B,SACA,mBACA;EACE,UAAU;EACV,MAAM,eAAe,KAAK,UAAU,MAAM,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,GAAG;EACrG,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;CACxD,GACA,UACF;CACA,IAAI,WAAW,KAAK;EAClB,MAAM,SAAU,KAA8B;EAC9C,MAAM,IAAI,MACR,sCAAsC,SAAS,KAAK,WAAW,KAAK,OAAO,IAC7E;CACF;CACA,MAAM,UAAU;CAChB,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,kCAAkC;CACpE,OAAO;EAAE,KAAK,QAAQ;EAAK,IAAI,QAAQ;CAAG;AAC5C;AAEA,eAAe,mBAAmB,SAAiB,YAA4C;CAC7F,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,OAAO,EAAE,EAAE,+BAA+B,EACxF,SAAS,EAAE,QAAQ,WAAW,EAChC,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO;EAEzB,QAAO,MADa,SAAS,KAAK,EACvB,CAAC,eAAe,aAAa;CAC1C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,cAAc,KAA4B;CAC9D,MAAM,SAAKA,kBAAS;CACpB,IAAI;EACF,IAAI,OAAO,UACT,UAAM,aAAM,QAAQ,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;OACzC,IAAI,OAAO,SAChB,UAAM,aAAM,OAAO;GAAC;GAAM;GAAS;GAAI;EAAG,GAAG;GAC3C,OAAO;GACP,0BAA0B;EAC5B,CAAC;OAED,UAAM,aAAM,YAAY,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;CAEtD,QAAQ;EACN,MAAM,IAAI,MAAM,sDAAsD,KAAK;CAC7E;AACF"}

package/dist/auth-login.mjs

@@ -0,0 +1,162 @@
+import { platform } from "node:os";
+import { execa } from "execa";
+
+//#region src/auth-login.ts
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const DEFAULT_CLIENT_ID = "bos-cli";
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_PENALTY_SECONDS = 5;
+async function authFetch(siteUrl, path, body, cookiePair) {
+	const headers = {
+		"content-type": "application/json",
+		origin: new URL(siteUrl).origin
+	};
+	if (cookiePair) headers.cookie = cookiePair;
+	const response = await fetch(`${siteUrl.replace(/\/$/, "")}/api/auth${path}`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(body)
+	});
+	return {
+		status: response.status,
+		json: await response.json().catch(() => ({})),
+		setCookie: response.headers.get("set-cookie")
+	};
+}
+/**
+* CLI login via the OAuth 2.0 Device Flow (RFC 8628) — the same flow the
+* site's QR pairing uses. The CLI requests a device code, the user approves
+* at `/login/device` in any browser (same machine or not), and the CLI polls
+* the token endpoint until the grant completes.
+*/
+async function startDeviceLogin(opts) {
+	const siteUrl = opts.siteUrl.replace(/\/$/, "");
+	const clientId = DEFAULT_CLIENT_ID;
+	const codeResponse = await fetch(`${siteUrl}/api/auth/device/code`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ client_id: clientId })
+	});
+	if (!codeResponse.ok) throw new Error(`Device login could not start (${codeResponse.status}) — is ${siteUrl} running the platform auth plugin?`);
+	const code = await codeResponse.json();
+	const verificationUrl = buildVerificationUrl(siteUrl, code, opts);
+	let abortReason = null;
+	let rejectPending;
+	const pendingReject = new Promise((_, reject) => {
+		rejectPending = reject;
+	});
+	const waitForApproval = (timeoutMs = 6e5) => {
+		const deadline = Date.now() + timeoutMs;
+		let intervalSeconds = code.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
+		const poll = async () => {
+			if (abortReason) throw new Error(abortReason);
+			if (Date.now() > deadline) throw new Error("Login timed out — the device code expired before approval");
+			const { status, json } = await authFetch(siteUrl, "/device/token", {
+				grant_type: DEVICE_CODE_GRANT_TYPE,
+				device_code: code.device_code,
+				client_id: clientId
+			});
+			if (status === 200) {
+				const { access_token: sessionToken } = json;
+				return await completeLogin(siteUrl, sessionToken, opts);
+			}
+			const error = json.error;
+			if (error === "authorization_pending") {} else if (error === "slow_down") intervalSeconds += SLOW_DOWN_PENALTY_SECONDS;
+			else if (error === "expired_token") throw new Error("Login timed out — the device code expired before approval");
+			else if (error === "access_denied") throw new Error("Login request was denied on the approval page");
+			else throw new Error(json.error_description ?? `Login failed (${error ?? status})`);
+			await new Promise((resolve) => setTimeout(resolve, intervalSeconds * 1e3));
+			return poll();
+		};
+		return Promise.race([pendingReject, poll()]);
+	};
+	return {
+		userCode: code.user_code,
+		verificationUrl,
+		waitForApproval,
+		abort: (reason) => {
+			abortReason = reason ?? "Login aborted";
+			rejectPending(new Error(abortReason));
+		}
+	};
+}
+function buildVerificationUrl(siteUrl, code, opts) {
+	const base = code.verification_uri_complete ?? code.verification_uri ?? "/login/device";
+	const url = new URL(base, siteUrl);
+	const params = url.searchParams;
+	params.set("user_code", code.user_code);
+	if (opts.account) params.set("account", opts.account);
+	if (opts.device) params.set("device", opts.device);
+	if (opts.delegate) {
+		params.set("pubKey", opts.delegate.pubKey);
+		params.set("contract", opts.delegate.contract);
+		params.set("network", opts.delegate.network);
+	}
+	return url.toString();
+}
+async function completeLogin(siteUrl, sessionToken, opts) {
+	const claim = await authFetch(siteUrl, "/device-link/claim", {
+		token: sessionToken,
+		client_id: DEFAULT_CLIENT_ID
+	});
+	if (claim.status !== 200) {
+		const detail = claim.json.message;
+		throw new Error(`Approved session could not be claimed${detail ? `: ${detail}` : ` (${claim.status})`}`);
+	}
+	const cookiePair = claim.setCookie?.split(";")[0];
+	if (!cookiePair?.includes("=")) throw new Error("Session claim returned no session cookie");
+	const apiKey = await mintApiKey(siteUrl, cookiePair, opts);
+	return {
+		sessionToken,
+		accountId: await resolveNearAccount(siteUrl, cookiePair),
+		apiKey
+	};
+}
+async function mintApiKey(siteUrl, cookiePair, opts) {
+	const { status, json } = await authFetch(siteUrl, "/api-key/create", {
+		configId: "user-keys",
+		name: `bos login — ${opts.device ?? "cli"} — ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace("T", " ")}`,
+		...opts.expiresIn ? { expiresIn: opts.expiresIn } : {}
+	}, cookiePair);
+	if (status !== 200) {
+		const detail = json.message;
+		throw new Error(`CLI credential could not be created${detail ? `: ${detail}` : ` (${status})`}`);
+	}
+	const created = json;
+	if (!created.key) throw new Error("API key creation returned no key");
+	return {
+		key: created.key,
+		id: created.id
+	};
+}
+async function resolveNearAccount(siteUrl, cookiePair) {
+	try {
+		const response = await fetch(`${siteUrl.replace(/\/$/, "")}/api/auth/near/list-accounts`, { headers: { cookie: cookiePair } });
+		if (!response.ok) return null;
+		return (await response.json()).activeAccount?.accountId ?? null;
+	} catch {
+		return null;
+	}
+}
+async function openInBrowser(url) {
+	const os = platform();
+	try {
+		if (os === "darwin") await execa("open", [url], { stdio: "ignore" });
+		else if (os === "win32") await execa("cmd", [
+			"/c",
+			"start",
+			"",
+			url
+		], {
+			stdio: "ignore",
+			windowsVerbatimArguments: true
+		});
+		else await execa("xdg-open", [url], { stdio: "ignore" });
+	} catch {
+		throw new Error(`Failed to open browser. Open this URL manually:\n  ${url}`);
+	}
+}
+
+//#endregion
+export { openInBrowser, startDeviceLogin };
+//# sourceMappingURL=auth-login.mjs.map

package/dist/auth-login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.mjs","names":[],"sources":["../src/auth-login.ts"],"sourcesContent":["import { platform } from \"node:os\";\nimport { execa } from \"execa\";\n\nconst DEVICE_CODE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:device_code\";\nconst DEFAULT_CLIENT_ID = \"bos-cli\";\nconst DEFAULT_POLL_INTERVAL_SECONDS = 5;\nconst SLOW_DOWN_PENALTY_SECONDS = 5;\n\nexport interface DeviceLoginOptions {\n  siteUrl: string;\n  /** label for the approving device, shown on the approval page */\n  device?: string;\n  /** the NEAR account the CLI expects to authenticate as (approval-page copy only) */\n  account?: string;\n  /** delegate mode — the approval page adds this scoped function-call key to the user's account */\n  delegate?: { pubKey: string; contract: string; network: string };\n  /** seconds the minted API key stays valid (login mode) */\n  expiresIn?: number;\n}\n\nexport interface DeviceApproval {\n  sessionToken: string;\n  /** the NEAR account signed in on the approving browser (login mode) */\n  accountId: string | null;\n  /** the minted CLI credential (login mode) */\n  apiKey: { key: string; id: string } | null;\n}\n\nexport interface DeviceLoginHandle {\n  userCode: string;\n  verificationUrl: string;\n  waitForApproval: (timeoutMs?: number) => Promise<DeviceApproval>;\n  abort: (reason?: string) => void;\n}\n\ninterface DeviceCodeResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri?: string;\n  verification_uri_complete?: string;\n  expires_in?: number;\n  interval?: number;\n}\n\ninterface DeviceTokenSuccess {\n  access_token: string;\n  token_type: \"Bearer\";\n}\n\ninterface DeviceTokenError {\n  error:\n    | \"authorization_pending\"\n    | \"slow_down\"\n    | \"expired_token\"\n    | \"access_denied\"\n    | \"invalid_grant\"\n    | \"invalid_request\"\n    | \"invalid_client\";\n  error_description?: string;\n}\n\ninterface ApiKeyCreated {\n  id: string;\n  key: string;\n}\n\ninterface NearAccountsResponse {\n  accounts: { accountId: string }[];\n  activeAccount: { accountId: string } | null;\n}\n\nasync function authFetch(\n  siteUrl: string,\n  path: string,\n  body: unknown,\n  cookiePair?: string,\n): Promise<{ status: number; json: unknown; setCookie: string | null }> {\n  // Better Auth's origin check demands an Origin on cookie-bearing\n  // requests — present the site's own origin, exactly as a browser would.\n  const origin = new URL(siteUrl).origin;\n  const headers: Record<string, string> = { \"content-type\": \"application/json\", origin };\n  if (cookiePair) headers.cookie = cookiePair;\n  const response = await fetch(`${siteUrl.replace(/\\/$/, \"\")}/api/auth${path}`, {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify(body),\n  });\n  return {\n    status: response.status,\n    json: await response.json().catch(() => ({})),\n    setCookie: response.headers.get(\"set-cookie\"),\n  };\n}\n\n/**\n * CLI login via the OAuth 2.0 Device Flow (RFC 8628) — the same flow the\n * site's QR pairing uses. The CLI requests a device code, the user approves\n * at `/login/device` in any browser (same machine or not), and the CLI polls\n * the token endpoint until the grant completes.\n */\nexport async function startDeviceLogin(opts: DeviceLoginOptions): Promise<DeviceLoginHandle> {\n  const siteUrl = opts.siteUrl.replace(/\\/$/, \"\");\n  const clientId = DEFAULT_CLIENT_ID;\n\n  const codeResponse = await fetch(`${siteUrl}/api/auth/device/code`, {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/json\" },\n    body: JSON.stringify({ client_id: clientId }),\n  });\n  if (!codeResponse.ok) {\n    throw new Error(\n      `Device login could not start (${codeResponse.status}) — is ${siteUrl} running the platform auth plugin?`,\n    );\n  }\n  const code = (await codeResponse.json()) as DeviceCodeResponse;\n\n  const verificationUrl = buildVerificationUrl(siteUrl, code, opts);\n\n  let abortReason: string | null = null;\n  let rejectPending!: (reason?: Error) => void;\n  const pendingReject = new Promise<never>((_, reject) => {\n    rejectPending = reject;\n  });\n\n  const waitForApproval = (timeoutMs = 10 * 60_000): Promise<DeviceApproval> => {\n    const deadline = Date.now() + timeoutMs;\n    let intervalSeconds = code.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;\n\n    const poll = async (): Promise<DeviceApproval> => {\n      if (abortReason) throw new Error(abortReason);\n      if (Date.now() > deadline) {\n        throw new Error(\"Login timed out — the device code expired before approval\");\n      }\n\n      const { status, json } = await authFetch(siteUrl, \"/device/token\", {\n        grant_type: DEVICE_CODE_GRANT_TYPE,\n        device_code: code.device_code,\n        client_id: clientId,\n      });\n\n      if (status === 200) {\n        const { access_token: sessionToken } = json as DeviceTokenSuccess;\n        return await completeLogin(siteUrl, sessionToken, opts);\n      }\n\n      const error = (json as DeviceTokenError).error;\n      if (error === \"authorization_pending\") {\n        // keep polling\n      } else if (error === \"slow_down\") {\n        intervalSeconds += SLOW_DOWN_PENALTY_SECONDS;\n      } else if (error === \"expired_token\") {\n        throw new Error(\"Login timed out — the device code expired before approval\");\n      } else if (error === \"access_denied\") {\n        throw new Error(\"Login request was denied on the approval page\");\n      } else {\n        throw new Error(\n          (json as DeviceTokenError).error_description ?? `Login failed (${error ?? status})`,\n        );\n      }\n\n      await new Promise((resolve) => setTimeout(resolve, intervalSeconds * 1000));\n      return poll();\n    };\n\n    return Promise.race([pendingReject, poll()]);\n  };\n\n  return {\n    userCode: code.user_code,\n    verificationUrl,\n    waitForApproval,\n    abort: (reason) => {\n      abortReason = reason ?? \"Login aborted\";\n      rejectPending(new Error(abortReason));\n    },\n  };\n}\n\nfunction buildVerificationUrl(\n  siteUrl: string,\n  code: DeviceCodeResponse,\n  opts: DeviceLoginOptions,\n): string {\n  const base = code.verification_uri_complete ?? code.verification_uri ?? \"/login/device\";\n  const url = new URL(base, siteUrl);\n  const params = url.searchParams;\n  params.set(\"user_code\", code.user_code);\n  if (opts.account) params.set(\"account\", opts.account);\n  if (opts.device) params.set(\"device\", opts.device);\n  if (opts.delegate) {\n    params.set(\"pubKey\", opts.delegate.pubKey);\n    params.set(\"contract\", opts.delegate.contract);\n    params.set(\"network\", opts.delegate.network);\n  }\n  return url.toString();\n}\n\nasync function completeLogin(\n  siteUrl: string,\n  sessionToken: string,\n  opts: DeviceLoginOptions,\n): Promise<DeviceApproval> {\n  // The token endpoint returns the raw session token; Better Auth session\n  // cookies carry an HMAC signature, so exchange the token for a signed\n  // session cookie via the device-link claim endpoint (the QR pairing path).\n  const claim = await authFetch(siteUrl, \"/device-link/claim\", {\n    token: sessionToken,\n    client_id: DEFAULT_CLIENT_ID,\n  });\n  if (claim.status !== 200) {\n    const detail = (claim.json as { message?: string }).message;\n    throw new Error(\n      `Approved session could not be claimed${detail ? `: ${detail}` : ` (${claim.status})`}`,\n    );\n  }\n  const cookiePair = claim.setCookie?.split(\";\")[0];\n  if (!cookiePair?.includes(\"=\")) {\n    throw new Error(\"Session claim returned no session cookie\");\n  }\n\n  const apiKey = await mintApiKey(siteUrl, cookiePair, opts);\n  const accountId = await resolveNearAccount(siteUrl, cookiePair);\n  return { sessionToken, accountId, apiKey };\n}\n\nasync function mintApiKey(\n  siteUrl: string,\n  cookiePair: string,\n  opts: DeviceLoginOptions,\n): Promise<DeviceApproval[\"apiKey\"]> {\n  const { status, json } = await authFetch(\n    siteUrl,\n    \"/api-key/create\",\n    {\n      configId: \"user-keys\",\n      name: `bos login — ${opts.device ?? \"cli\"} — ${new Date().toISOString().slice(0, 16).replace(\"T\", \" \")}`,\n      ...(opts.expiresIn ? { expiresIn: opts.expiresIn } : {}),\n    },\n    cookiePair,\n  );\n  if (status !== 200) {\n    const detail = (json as { message?: string }).message;\n    throw new Error(\n      `CLI credential could not be created${detail ? `: ${detail}` : ` (${status})`}`,\n    );\n  }\n  const created = json as ApiKeyCreated;\n  if (!created.key) throw new Error(\"API key creation returned no key\");\n  return { key: created.key, id: created.id };\n}\n\nasync function resolveNearAccount(siteUrl: string, cookiePair: string): Promise<string | null> {\n  try {\n    const response = await fetch(`${siteUrl.replace(/\\/$/, \"\")}/api/auth/near/list-accounts`, {\n      headers: { cookie: cookiePair },\n    });\n    if (!response.ok) return null;\n    const data = (await response.json()) as NearAccountsResponse;\n    return data.activeAccount?.accountId ?? null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function openInBrowser(url: string): Promise<void> {\n  const os = platform();\n  try {\n    if (os === \"darwin\") {\n      await execa(\"open\", [url], { stdio: \"ignore\" });\n    } else if (os === \"win32\") {\n      await execa(\"cmd\", [\"/c\", \"start\", \"\", url], {\n        stdio: \"ignore\",\n        windowsVerbatimArguments: true,\n      });\n    } else {\n      await execa(\"xdg-open\", [url], { stdio: \"ignore\" });\n    }\n  } catch {\n    throw new Error(`Failed to open browser. Open this URL manually:\\n  ${url}`);\n  }\n}\n"],"mappings":";;;;AAGA,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;AAC1B,MAAM,gCAAgC;AACtC,MAAM,4BAA4B;AAiElC,eAAe,UACb,SACA,MACA,MACA,YACsE;CAItE,MAAM,UAAkC;EAAE,gBAAgB;EAAoB,QAD/D,IAAI,IAAI,OAAO,CAAC,CAAC;CACqD;CACrF,IAAI,YAAY,QAAQ,SAAS;CACjC,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,OAAO,EAAE,EAAE,WAAW,QAAQ;EAC5E,QAAQ;EACR;EACA,MAAM,KAAK,UAAU,IAAI;CAC3B,CAAC;CACD,OAAO;EACL,QAAQ,SAAS;EACjB,MAAM,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;EAC5C,WAAW,SAAS,QAAQ,IAAI,YAAY;CAC9C;AACF;;;;;;;AAQA,eAAsB,iBAAiB,MAAsD;CAC3F,MAAM,UAAU,KAAK,QAAQ,QAAQ,OAAO,EAAE;CAC9C,MAAM,WAAW;CAEjB,MAAM,eAAe,MAAM,MAAM,GAAG,QAAQ,wBAAwB;EAClE,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;EAC9C,MAAM,KAAK,UAAU,EAAE,WAAW,SAAS,CAAC;CAC9C,CAAC;CACD,IAAI,CAAC,aAAa,IAChB,MAAM,IAAI,MACR,iCAAiC,aAAa,OAAO,SAAS,QAAQ,mCACxE;CAEF,MAAM,OAAQ,MAAM,aAAa,KAAK;CAEtC,MAAM,kBAAkB,qBAAqB,SAAS,MAAM,IAAI;CAEhE,IAAI,cAA6B;CACjC,IAAI;CACJ,MAAM,gBAAgB,IAAI,SAAgB,GAAG,WAAW;EACtD,gBAAgB;CAClB,CAAC;CAED,MAAM,mBAAmB,YAAY,QAAyC;EAC5E,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,kBAAkB,KAAK,YAAY;EAEvC,MAAM,OAAO,YAAqC;GAChD,IAAI,aAAa,MAAM,IAAI,MAAM,WAAW;GAC5C,IAAI,KAAK,IAAI,IAAI,UACf,MAAM,IAAI,MAAM,2DAA2D;GAG7E,MAAM,EAAE,QAAQ,SAAS,MAAM,UAAU,SAAS,iBAAiB;IACjE,YAAY;IACZ,aAAa,KAAK;IAClB,WAAW;GACb,CAAC;GAED,IAAI,WAAW,KAAK;IAClB,MAAM,EAAE,cAAc,iBAAiB;IACvC,OAAO,MAAM,cAAc,SAAS,cAAc,IAAI;GACxD;GAEA,MAAM,QAAS,KAA0B;GACzC,IAAI,UAAU,yBAAyB,CAEvC,OAAO,IAAI,UAAU,aACnB,mBAAmB;QACd,IAAI,UAAU,iBACnB,MAAM,IAAI,MAAM,2DAA2D;QACtE,IAAI,UAAU,iBACnB,MAAM,IAAI,MAAM,+CAA+C;QAE/D,MAAM,IAAI,MACP,KAA0B,qBAAqB,iBAAiB,SAAS,OAAO,EACnF;GAGF,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,kBAAkB,GAAI,CAAC;GAC1E,OAAO,KAAK;EACd;EAEA,OAAO,QAAQ,KAAK,CAAC,eAAe,KAAK,CAAC,CAAC;CAC7C;CAEA,OAAO;EACL,UAAU,KAAK;EACf;EACA;EACA,QAAQ,WAAW;GACjB,cAAc,UAAU;GACxB,cAAc,IAAI,MAAM,WAAW,CAAC;EACtC;CACF;AACF;AAEA,SAAS,qBACP,SACA,MACA,MACQ;CACR,MAAM,OAAO,KAAK,6BAA6B,KAAK,oBAAoB;CACxE,MAAM,MAAM,IAAI,IAAI,MAAM,OAAO;CACjC,MAAM,SAAS,IAAI;CACnB,OAAO,IAAI,aAAa,KAAK,SAAS;CACtC,IAAI,KAAK,SAAS,OAAO,IAAI,WAAW,KAAK,OAAO;CACpD,IAAI,KAAK,QAAQ,OAAO,IAAI,UAAU,KAAK,MAAM;CACjD,IAAI,KAAK,UAAU;EACjB,OAAO,IAAI,UAAU,KAAK,SAAS,MAAM;EACzC,OAAO,IAAI,YAAY,KAAK,SAAS,QAAQ;EAC7C,OAAO,IAAI,WAAW,KAAK,SAAS,OAAO;CAC7C;CACA,OAAO,IAAI,SAAS;AACtB;AAEA,eAAe,cACb,SACA,cACA,MACyB;CAIzB,MAAM,QAAQ,MAAM,UAAU,SAAS,sBAAsB;EAC3D,OAAO;EACP,WAAW;CACb,CAAC;CACD,IAAI,MAAM,WAAW,KAAK;EACxB,MAAM,SAAU,MAAM,KAA8B;EACpD,MAAM,IAAI,MACR,wCAAwC,SAAS,KAAK,WAAW,KAAK,MAAM,OAAO,IACrF;CACF;CACA,MAAM,aAAa,MAAM,WAAW,MAAM,GAAG,CAAC,CAAC;CAC/C,IAAI,CAAC,YAAY,SAAS,GAAG,GAC3B,MAAM,IAAI,MAAM,0CAA0C;CAG5D,MAAM,SAAS,MAAM,WAAW,SAAS,YAAY,IAAI;CAEzD,OAAO;EAAE;EAAc,iBADC,mBAAmB,SAAS,UAAU;EAC5B;CAAO;AAC3C;AAEA,eAAe,WACb,SACA,YACA,MACmC;CACnC,MAAM,EAAE,QAAQ,SAAS,MAAM,UAC7B,SACA,mBACA;EACE,UAAU;EACV,MAAM,eAAe,KAAK,UAAU,MAAM,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,GAAG;EACrG,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;CACxD,GACA,UACF;CACA,IAAI,WAAW,KAAK;EAClB,MAAM,SAAU,KAA8B;EAC9C,MAAM,IAAI,MACR,sCAAsC,SAAS,KAAK,WAAW,KAAK,OAAO,IAC7E;CACF;CACA,MAAM,UAAU;CAChB,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,kCAAkC;CACpE,OAAO;EAAE,KAAK,QAAQ;EAAK,IAAI,QAAQ;CAAG;AAC5C;AAEA,eAAe,mBAAmB,SAAiB,YAA4C;CAC7F,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,QAAQ,OAAO,EAAE,EAAE,+BAA+B,EACxF,SAAS,EAAE,QAAQ,WAAW,EAChC,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,OAAO;EAEzB,QAAO,MADa,SAAS,KAAK,EACvB,CAAC,eAAe,aAAa;CAC1C,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,cAAc,KAA4B;CAC9D,MAAM,KAAK,SAAS;CACpB,IAAI;EACF,IAAI,OAAO,UACT,MAAM,MAAM,QAAQ,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;OACzC,IAAI,OAAO,SAChB,MAAM,MAAM,OAAO;GAAC;GAAM;GAAS;GAAI;EAAG,GAAG;GAC3C,OAAO;GACP,0BAA0B;EAC5B,CAAC;OAED,MAAM,MAAM,YAAY,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;CAEtD,QAAQ;EACN,MAAM,IAAI,MAAM,sDAAsD,KAAK;CAC7E;AACF"}