migros-mcp 0.2.0 → 0.3.0

package/README.md

@@ -1,92 +1,175 @@
 # migros-mcp
 
-Search [Migros](https://www.migros.ch) products, get nutrition facts, find stores, and browse promotions with Claude.
+Search [Migros](https://www.migros.ch) products and (optionally) manage your basket, addresses, and orders through Claude.
 
 > **Important**
 > This is **not affiliated with Migros** in any way.
-> It uses publicly accessible API endpoints -- there is no official Migros API.
+> It uses publicly accessible API endpoints. There is no official Migros API.
 > It can **break at any time** if Migros changes their endpoints.
-> No authentication required -- uses guest access only.
 > **Use at your own risk.**
 
 ## What you can do
 
-Once installed, just talk to Claude naturally:
-
+**Without an account (anonymous access):**
 - "Search Migros for protein bars"
 - "What's the nutrition info for this Migros product?"
 - "Find Migros stores near Zurich"
 - "What promotions does Migros have right now?"
 - "Compare the protein content of these two products"
-- "Which Migros products are gluten-free?"
+- "Find me a recipe for risotto and add the ingredients to my basket" (combines anonymous recipe search with authenticated cart write)
+
+**With your Migros account (optional):**
+- "What's currently in my Migros basket?"
+- "Add 2 liters of milk to my basket"
+- "Remove the bananas from my basket"
+- "Where will my order be delivered to?"
+- "Show me my last 5 Migros orders"
+- "Give me the link to finish my checkout"
+- "How much did I spend at Migros last month?"
+- "What was on my last in-store receipt?"
+- "Which Cumulus coupons do I have right now?"
+- "How many Cumulus points do I have?"
+
+The basket and order tools require your Migros account credentials. They're optional — if you skip them at install, the anonymous tools still work.
 
 ## Install
 
-No accounts or credentials needed. This server uses Migros guest access.
-
 ### Claude Desktop (recommended)
 
 1. Download [migros-mcp.mcpb](https://github.com/lewpgs/migros-mcp/releases/latest/download/migros-mcp.mcpb)
 2. Install it:
 
-   **macOS** - Double-click the file, or drag and drop it onto the Claude Desktop app icon
+   **macOS** — Double-click the file, or drag and drop it onto the Claude Desktop app icon
+
+   **Windows** — In Claude Desktop, go to File > Settings > Extensions > Advanced Settings > Install Extension and select the file
+
+3. Optional: enter your Migros email, password, and TOTP secret if you want the basket/order tools. Leave all three blank for anonymous access only. Credentials are stored in your OS keychain by Claude Desktop.
+
+   **About the TOTP secret.** This is **NOT** the rotating 6-digit code your authenticator app shows. It is the **static base32 seed** given to you (or scanned via QR code) when you originally set up the authenticator. It's a one-time value, typically ~32 characters of `A-Z2-7` (for example: `JBSWY3DPEHPK3PXP3PXP3PXP3PXP3PXP`), and it doesn't change every 30 seconds.
+
+   How to find it:
 
-   **Windows** - In Claude Desktop, go to File > Settings > Extensions > Advanced Settings > Install Extension and select the file
+   - **If you saved it during enrollment** — copy it from your password manager. In 1Password / Bitwarden / Proton Pass, open the Migros entry, edit the OTP field, choose *"View one-time password secret"* (or similar). The string after `secret=` is what you want.
+   - **If you didn't save it** — Migros only shows the seed during initial 2FA setup, on the same screen as the QR code, in a box labeled *"Or enter the following key in the authenticator app:"*. Once enrollment completes, the seed is gone for good.
 
-That's it. No credentials needed.
+     To recover it: in Migros account settings, **remove** your existing 2FA, then **set it up again**. The new setup screen will show the new seed text below the QR code — copy it before completing enrollment, and re-add the new entry to your authenticator app.
+
+   Leave the field blank entirely if your Migros account doesn't have 2FA enabled.
+
+That's it.
 
 ---
 
 ## Advanced setup
 
-These methods require [Node.js 18+](https://nodejs.org) installed on your machine.
+These methods require [Node.js 18+](https://nodejs.org).
 
 ### Claude Code
 
 ```bash
+# Anonymous (search/browse only)
 claude mcp add migros -- npx -y migros-mcp
+
+# With your account (basket + orders)
+claude mcp add migros \
+  -e MIGROS_EMAIL=you@example.com \
+  -e MIGROS_PASSWORD='your-password' \
+  -e MIGROS_TOTP_SECRET=ABCDEFGHIJKLMNOP \
+  -- npx -y migros-mcp
 ```
 
 ### Claude Desktop (manual) / Cursor
 
-Add the following to your config file:
+Add to your config:
 
-- **Claude Desktop** - `claude_desktop_config.json`
-- **Cursor** - `.cursor/mcp.json` (project) or `~/.cursor/mcp.json` (global)
+- **Claude Desktop** — `claude_desktop_config.json`
+- **Cursor** — `.cursor/mcp.json` (project) or `~/.cursor/mcp.json` (global)
 
 ```json
 {
   "mcpServers": {
     "migros": {
       "command": "npx",
-      "args": ["-y", "migros-mcp"]
+      "args": ["-y", "migros-mcp"],
+      "env": {
+        "MIGROS_EMAIL": "you@example.com",
+        "MIGROS_PASSWORD": "your-password",
+        "MIGROS_TOTP_SECRET": "ABCDEFGHIJKLMNOP"
+      }
     }
   }
 }
 ```
 
+The `env` block is optional. Omit it to use anonymous tools only.
+
 ### Test connection
 
 ```bash
-npx migros-mcp
+npx migros-mcp                                                # anonymous
+MIGROS_EMAIL=... MIGROS_PASSWORD=... MIGROS_TOTP_SECRET=... npx migros-mcp   # authenticated
 ```
 
 ## Available tools
 
+### Anonymous (no credentials needed)
+
 | Tool | Description |
 |---|---|
 | `search_products` | Search Migros products by name or keyword. Returns product IDs. |
-| `get_product_details` | Get full product info: nutrition, ingredients, allergens, price, ratings. |
+| `get_product_details` | Full product info: nutrition, ingredients, allergens, price, ratings. |
 | `get_stock` | Check product availability at a specific Migros store. Updated once daily. |
 | `get_categories` | List all Migros product categories. |
 | `search_stores` | Find Migros stores by location with addresses and opening hours. |
 | `get_promotions` | Search current Migros promotions and deals. |
+| `search_recipes` | Search Migusto (Migros' recipe site) by query and/or ingredients. German/French/Italian only. |
+| `get_recipe_details` | Full recipe by slug: ingredients, instructions, photos, nutrition. |
+| `get_recipe_products` | Migros product UIDs for a recipe — feed directly into `add_to_basket`. |
+
+### Authenticated (require credentials)
+
+| Tool | Description |
+|---|---|
+| `get_profile` | Logged-in customer's basic profile (name, email, language). |
+| `get_addresses` | Saved delivery and billing addresses. |
+| `get_basket` | Items currently in the user's basket. |
+| `add_to_basket` | Add a product (sets target quantity, default 1). |
+| `update_basket_quantity` | Set an item's exact quantity (0 to remove). |
+| `remove_from_basket` | Remove an item entirely. |
+| `get_orders` | List your online orders, paginated, filterable by status. |
+| `get_order_details` | Full details of a single order by id. |
+| `get_checkout_link` | Returns the URL to open in your browser to complete checkout. |
+| `get_cumulus_status` | Cumulus loyalty card status: points balance, level, cardholder. |
+| `get_in_store_receipts` | List in-store receipts (Kassenbons) over a date range. |
+| `get_receipt_details` | URL to view a single in-store receipt's line items in the browser. |
+| `get_cumulus_coupons` | Active personalized Cumulus coupons. |
 
 ## How it works
 
-Migros does not offer a public API. This MCP server uses the [migros-api-wrapper](https://www.npmjs.com/package/migros-api-wrapper) package, which wraps the same endpoints that the Migros website and app use internally. A guest token is obtained at startup (no login required) and cached for the session.
+### Anonymous tools
+Use the [migros-api-wrapper](https://www.npmjs.com/package/migros-api-wrapper) which calls the same endpoints the Migros website uses internally. A guest token is fetched at startup and cached.
+
+### Authenticated tools
+Use OAuth 2.0 against `login.migros.ch`. The first call runs a credentialed login (email → password → TOTP) and caches the resulting cookies + access token. Every 30 minutes the token is refreshed silently using cached cookies — no login form re-submission.
+
+The cache is persisted across MCP process restarts (Claude Desktop launches, Mac reboots, etc.) so we re-authenticate maybe twice a year instead of dozens of times a day. Migros' login endpoint is behind Cloudflare bot detection that throttles frequent logins, so persistence is what keeps the MCP from getting rate-limited.
+
+The session lives at:
+
+- macOS: `~/Library/Application Support/migros-mcp/session.json`
+- Linux: `$XDG_CONFIG_HOME/migros-mcp/session.json`
+- Windows: `%APPDATA%/migros-mcp/session.json`
+
+If the cached session expires (typically a few weeks), the MCP automatically re-runs the credentialed login.
+
+### Order placement
+For safety, this MCP **does not** place orders programmatically. The `get_checkout_link` tool returns a URL the user opens in their real browser to confirm address, delivery slot, and payment via Migros' own checkout flow. Real money requires a real human click.
+
+## Known limitations
 
-Product searches return IDs that you then pass to `get_product_details` for full nutrition tables, ingredients, allergens, and pricing.
+- **2FA support is TOTP-only.** Accounts secured with a passkey (and no TOTP fallback) are not supported in v0.3.0. If your Migros account uses passkey as the only second factor, add a TOTP authenticator app in Migros account settings, then provide the TOTP secret to this MCP.
+- **No automatic order placement.** See above — `get_checkout_link` hands off to your browser for the actual placement.
+- **Cloudflare rate limits.** If the MCP fails the credentialed login repeatedly in a short window (e.g., wrong password retries), Cloudflare may briefly throttle the IP. Wait an hour and retry, or log in via your browser to refresh the session.
 
 ## Development
 
@@ -106,10 +189,11 @@ npx -y @modelcontextprotocol/inspector npx migros-mcp
 
 ## Disclaimers
 
-- **Unofficial** - This project is not affiliated with, endorsed by, or connected to Migros in any way.
-- **No official API** - This server uses publicly accessible API endpoints that power the Migros website. These are not documented or officially supported. Changes to Migros infrastructure could break this server without notice.
-- **No authentication required** - Uses guest access only. No credentials are stored or transmitted.
-- **Use at your own risk** - No guarantees of functionality, availability, or compatibility.
+- **Unofficial** — Not affiliated with, endorsed by, or connected to Migros in any way.
+- **No official API** — Uses endpoints that power the Migros website. They are not documented or supported. Migros can change them without notice.
+- **Credentials** — When you provide credentials, they're used only to authenticate against `login.migros.ch`. Resulting session cookies and access tokens are stored locally in your OS user config directory. They are never sent anywhere except Migros' own servers.
+- **No order placement** — This server does not place orders programmatically. Orders are completed in the user's own browser via the URL returned by `get_checkout_link`.
+- **Use at your own risk** — No guarantees of functionality, availability, or compatibility.
 
 ## License
 

package/dist/auth/api.d.ts

@@ -0,0 +1,19 @@
+import type { Credentials } from "./login.js";
+export interface AuthOptions {
+    /** Credentials used only when no cached session exists. */
+    creds?: Credentials;
+    /** Override the user's locale for migros-language / accept-language headers. */
+    language?: string;
+}
+/**
+ * Make an authenticated request against any www.migros.ch path. Reuses the
+ * persisted session, refreshes the JWT silently when needed, and falls back
+ * to a full credentialed login if cookies have expired.
+ *
+ * On 401 (token rejected mid-request — e.g., user changed their password,
+ * or the server invalidated the token early for any reason), forces a fresh
+ * silent OAuth and retries once before giving up.
+ *
+ * Returns the parsed response body. Throws with a descriptive error on non-2xx.
+ */
+export declare function api(method: "GET" | "POST" | "PUT" | "DELETE", path: string, body?: unknown, opts?: AuthOptions): Promise<unknown>;

package/dist/auth/api.js

@@ -0,0 +1,63 @@
+import { client, silentOAuth, uniformHeaders } from "./oauth.js";
+import { ingestSetCookie, loadSession, saveSession } from "./cookies.js";
+import { getJwt } from "./index.js";
+const BASE = "https://www.migros.ch";
+async function makeRequest(method, path, body, jwt, language, session) {
+    const headers = uniformHeaders("www.migros.ch", session, {
+        Accept: "application/json, text/plain, */*",
+        Authorization: `Bearer ${jwt}`,
+        "migros-language": language,
+        "accept-language": language,
+        "peer-id": "website-js-1143.0.0",
+        Origin: BASE,
+        Referer: `${BASE}/en`,
+        ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+    });
+    return client().request({
+        method,
+        url: `${BASE}${path}`,
+        data: body,
+        headers,
+    });
+}
+/**
+ * Make an authenticated request against any www.migros.ch path. Reuses the
+ * persisted session, refreshes the JWT silently when needed, and falls back
+ * to a full credentialed login if cookies have expired.
+ *
+ * On 401 (token rejected mid-request — e.g., user changed their password,
+ * or the server invalidated the token early for any reason), forces a fresh
+ * silent OAuth and retries once before giving up.
+ *
+ * Returns the parsed response body. Throws with a descriptive error on non-2xx.
+ */
+export async function api(method, path, body, opts = {}) {
+    const language = opts.language ?? "en";
+    // First attempt with current cached / refreshed JWT.
+    let jwt = await getJwt(opts.creds);
+    let session = loadSession();
+    let r = await makeRequest(method, path, body, jwt, language, session);
+    ingestSetCookie(session, "www.migros.ch", r.headers["set-cookie"]);
+    saveSession(session);
+    // Token rejected? Force a silent refresh and retry once.
+    if (r.status === 401) {
+        try {
+            session = loadSession();
+            jwt = await silentOAuth(session);
+            saveSession(session);
+            r = await makeRequest(method, path, body, jwt, language, session);
+            ingestSetCookie(session, "www.migros.ch", r.headers["set-cookie"]);
+            saveSession(session);
+        }
+        catch (e) {
+            // Silent refresh failed (cookies actually expired). Surface the original
+            // 401 since that's more actionable than the silent-refresh error.
+        }
+    }
+    if (r.status < 200 || r.status >= 300) {
+        const snippet = typeof r.data === "string" ? r.data.slice(0, 200) : JSON.stringify(r.data).slice(0, 200);
+        throw new Error(`${method} ${path} -> ${r.status}: ${snippet}`);
+    }
+    return typeof r.data === "string" ? JSON.parse(r.data) : r.data;
+}
+//# sourceMappingURL=api.js.map

package/dist/auth/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/auth/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGpC,MAAM,IAAI,GAAG,uBAAuB,CAAC;AASrC,KAAK,UAAU,WAAW,CACxB,MAAyC,EACzC,IAAY,EACZ,IAAa,EACb,GAAW,EACX,QAAgB,EAChB,OAAgB;IAEhB,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE;QACvD,MAAM,EAAE,mCAAmC;QAC3C,aAAa,EAAE,UAAU,GAAG,EAAE;QAC9B,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,QAAQ;QAC3B,SAAS,EAAE,qBAAqB;QAChC,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,GAAG,IAAI,KAAK;QACrB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;IACH,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC;QACtB,MAAM;QACN,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,MAAyC,EACzC,IAAY,EACZ,IAAc,EACd,OAAoB,EAAE;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IAEvC,qDAAqD;IACrD,IAAI,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACnE,WAAW,CAAC,OAAO,CAAC,CAAC;IAErB,yDAAyD;IACzD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,EAAE,CAAC;YACxB,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACjC,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClE,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yEAAyE;YACzE,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Persisted auth state. Lives in the OS config dir, not in the project tree.
+ *
+ * - `cookies` is keyed by host so we can send the right Cookie header per request.
+ * - `jwt` is the access token from /authentication/.../oauth/login-success (Bearer
+ *   prefix already stripped by the caller).
+ * - `jwtExp` is the JWT's `exp` claim in unix seconds, used to decide when to
+ *   refresh proactively without parsing the token on every call.
+ */
+export interface Session {
+    cookies: Record<string, Record<string, string>>;
+    jwt: string | null;
+    jwtExp: number;
+}
+/** Read the persisted session, or return an empty one if no file exists. */
+export declare function loadSession(): Session;
+/** Write the session atomically (temp file + rename) to avoid partial writes. */
+export declare function saveSession(session: Session): void;
+/**
+ * Update the jar from a server's Set-Cookie response headers for a given host.
+ * Mutates `session.cookies[host]` in place. Caller decides when to persist.
+ */
+export declare function ingestSetCookie(session: Session, host: string, setCookies: string | string[] | undefined): void;
+/** Build the `Cookie:` request header for a host (empty string if no cookies). */
+export declare function cookieHeader(session: Session, host: string): string;

package/dist/auth/cookies.js

@@ -0,0 +1,66 @@
+import fs from "node:fs";
+import { configDir, sessionFile } from "./paths.js";
+const EMPTY = { cookies: {}, jwt: null, jwtExp: 0 };
+/** Read the persisted session, or return an empty one if no file exists. */
+export function loadSession() {
+    try {
+        const raw = fs.readFileSync(sessionFile(), "utf8");
+        const parsed = JSON.parse(raw);
+        return {
+            cookies: parsed.cookies ?? {},
+            jwt: parsed.jwt ?? null,
+            jwtExp: parsed.jwtExp ?? 0,
+        };
+    }
+    catch (err) {
+        // Missing file (ENOENT) or unreadable: treat as empty.
+        if (err.code === "ENOENT")
+            return { ...EMPTY, cookies: {} };
+        // Corrupted JSON: don't throw and crash the MCP — start fresh and let the user re-import.
+        return { ...EMPTY, cookies: {} };
+    }
+}
+/** Write the session atomically (temp file + rename) to avoid partial writes. */
+export function saveSession(session) {
+    const dir = configDir();
+    fs.mkdirSync(dir, { recursive: true });
+    const finalPath = sessionFile();
+    const tmpPath = `${finalPath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(session, null, 2), { mode: 0o600 });
+    fs.renameSync(tmpPath, finalPath);
+}
+/**
+ * Update the jar from a server's Set-Cookie response headers for a given host.
+ * Mutates `session.cookies[host]` in place. Caller decides when to persist.
+ */
+export function ingestSetCookie(session, host, setCookies) {
+    if (!setCookies)
+        return;
+    const list = Array.isArray(setCookies) ? setCookies : [setCookies];
+    const bag = (session.cookies[host] ??= {});
+    for (const sc of list) {
+        // Take only the "name=value" pair before the first semicolon. Attributes
+        // like Path, Domain, HttpOnly, etc. are intentionally discarded — we don't
+        // re-issue cookies, we just send what we got back to the same host.
+        const semi = sc.indexOf(";");
+        const pair = semi === -1 ? sc : sc.slice(0, semi);
+        const eq = pair.indexOf("=");
+        if (eq < 0)
+            continue;
+        const name = pair.slice(0, eq).trim();
+        const value = pair.slice(eq + 1).trim();
+        if (!name)
+            continue;
+        bag[name] = value;
+    }
+}
+/** Build the `Cookie:` request header for a host (empty string if no cookies). */
+export function cookieHeader(session, host) {
+    const bag = session.cookies[host];
+    if (!bag)
+        return "";
+    return Object.entries(bag)
+        .map(([k, v]) => `${k}=${v}`)
+        .join("; ");
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAiBpD,MAAM,KAAK,GAAY,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;SAC3B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACvF,0FAA0F;QAC1F,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,IAAY,EACZ,UAAyC;IAEzC,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,17 @@
+import { type Session } from "./cookies.js";
+import { silentOAuth } from "./oauth.js";
+import { fullLogin, type Credentials } from "./login.js";
+export type { Session, Credentials };
+export { silentOAuth, fullLogin };
+/**
+ * Returns a usable access token, doing whatever is needed:
+ *   1. Use the cached JWT if it's still valid (with a 60s buffer).
+ *   2. Else run silent OAuth using cached SSO cookies.
+ *   3. Else fall back to a full credentialed login (email -> password -> TOTP).
+ *
+ * Persists the session to disk after any refresh so subsequent calls are fast.
+ *
+ * Throws if `creds` is missing AND no cookies are cached (first-time install
+ * with no env vars set).
+ */
+export declare function getJwt(creds?: Credentials): Promise<string>;

package/dist/auth/index.js

@@ -0,0 +1,36 @@
+import { loadSession, saveSession } from "./cookies.js";
+import { getJwt as getJwtFromOauth, silentOAuth } from "./oauth.js";
+import { fullLogin } from "./login.js";
+export { silentOAuth, fullLogin };
+/**
+ * Returns a usable access token, doing whatever is needed:
+ *   1. Use the cached JWT if it's still valid (with a 60s buffer).
+ *   2. Else run silent OAuth using cached SSO cookies.
+ *   3. Else fall back to a full credentialed login (email -> password -> TOTP).
+ *
+ * Persists the session to disk after any refresh so subsequent calls are fast.
+ *
+ * Throws if `creds` is missing AND no cookies are cached (first-time install
+ * with no env vars set).
+ */
+export async function getJwt(creds) {
+    const session = loadSession();
+    // Path 1+2: try cached JWT, fall through to silent OAuth.
+    try {
+        const jwt = await getJwtFromOauth(session);
+        saveSession(session);
+        return jwt;
+    }
+    catch (e) {
+        // Silent OAuth failed (no cookies / expired cookies). Fall through.
+        if (!creds) {
+            throw new Error("no cached session and no credentials provided. " +
+                "Set MIGROS_EMAIL, MIGROS_PASSWORD, and MIGROS_TOTP_SECRET env vars to enable login.");
+        }
+    }
+    // Path 3: full credentialed login.
+    const jwt = await fullLogin(session, creds);
+    saveSession(session);
+    return jwt;
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAgB,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,SAAS,EAAoB,MAAM,YAAY,CAAC;AAGzD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAElC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAmB;IAC9C,MAAM,OAAO,GAAY,WAAW,EAAE,CAAC;IAEvC,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3C,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,oEAAoE;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,iDAAiD;gBAC/C,qFAAqF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,WAAW,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/login.d.ts

@@ -0,0 +1,20 @@
+import type { Session } from "./cookies.js";
+export interface Credentials {
+    email: string;
+    password: string;
+    /** Base32-encoded TOTP seed. Required if 2FA is enabled on the account. */
+    totpSecret?: string;
+}
+/**
+ * RFC 6238 TOTP code from a base32-encoded shared secret.
+ * Defaults match Google Authenticator / 1Password / Authy: SHA-1, 30s, 6 digits.
+ */
+export declare function totpCode(secretBase32: string, time?: number, step?: number, digits?: number): string;
+/**
+ * Run the full credentialed login (email → password → TOTP) and finish by
+ * minting a JWT via silent OAuth. Mutates `session` in place. Caller persists.
+ *
+ * Throws with a descriptive message if any step fails (bad password, server-
+ * imposed rate limit, Cloudflare challenge, etc.).
+ */
+export declare function fullLogin(session: Session, creds: Credentials): Promise<string>;

package/dist/auth/login.js

@@ -0,0 +1,138 @@
+import crypto from "node:crypto";
+import { ingestSetCookie } from "./cookies.js";
+import { client, uniformHeaders, silentOAuth } from "./oauth.js";
+const LOGIN = "https://login.migros.ch";
+/**
+ * RFC 6238 TOTP code from a base32-encoded shared secret.
+ * Defaults match Google Authenticator / 1Password / Authy: SHA-1, 30s, 6 digits.
+ */
+export function totpCode(secretBase32, time = Math.floor(Date.now() / 1000), step = 30, digits = 6) {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+    const cleaned = secretBase32.replace(/=+$/g, "").replace(/\s+/g, "").toUpperCase();
+    let bits = "";
+    for (const c of cleaned) {
+        const v = alphabet.indexOf(c);
+        if (v < 0)
+            throw new Error(`invalid base32 char in TOTP secret: ${c}`);
+        bits += v.toString(2).padStart(5, "0");
+    }
+    const key = Buffer.alloc(Math.floor(bits.length / 8));
+    for (let i = 0; i < key.length; i++) {
+        key[i] = parseInt(bits.slice(i * 8, i * 8 + 8), 2);
+    }
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(Math.floor(time / step)));
+    const hmac = crypto.createHmac("sha1", key).update(counter).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const slice = hmac.readUInt32BE(offset) & 0x7fffffff;
+    return String(slice % 10 ** digits).padStart(digits, "0");
+}
+function findCsrf(html) {
+    const m = html.match(/name="_csrf"[^>]*value="([^"]+)"/);
+    if (!m)
+        throw new Error("could not find CSRF token in form");
+    return m[1];
+}
+function findError(html) {
+    // The Migros login form renders errors in a div with class "info-message-error".
+    const m = html.match(/info-message-error[^>]*>[\s\S]*?<div[^>]*>([\s\S]{0,200})</);
+    return m ? m[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim() : null;
+}
+async function get(url, session, extra = {}) {
+    const host = new URL(url).host;
+    const r = await client().get(url, { headers: uniformHeaders(host, session, { Accept: "text/html", ...extra }) });
+    ingestSetCookie(session, host, r.headers["set-cookie"]);
+    return r;
+}
+async function postForm(url, session, body) {
+    const host = new URL(url).host;
+    const formBody = Object.entries(body)
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+        .join("&");
+    const r = await client().post(url, formBody, {
+        headers: uniformHeaders(host, session, {
+            Accept: "text/html",
+            "Content-Type": "application/x-www-form-urlencoded",
+            Origin: `https://${host}`,
+            Referer: url,
+        }),
+    });
+    ingestSetCookie(session, host, r.headers["set-cookie"]);
+    return r;
+}
+function locationOf(r, base) {
+    const loc = r.headers.location;
+    return loc ? new URL(loc, base).toString() : null;
+}
+/**
+ * Run the full credentialed login (email → password → TOTP) and finish by
+ * minting a JWT via silent OAuth. Mutates `session` in place. Caller persists.
+ *
+ * Throws with a descriptive message if any step fails (bad password, server-
+ * imposed rate limit, Cloudflare challenge, etc.).
+ */
+export async function fullLogin(session, creds) {
+    // 1. Land on /login/email and capture initial cookies + CSRF.
+    let r = await get(`${LOGIN}/login`, session);
+    if (r.status >= 300 && r.status < 400) {
+        const next = locationOf(r, LOGIN);
+        if (next)
+            r = await get(next, session);
+    }
+    let csrf = findCsrf(r.data);
+    // 2. POST email.
+    r = await postForm(`${LOGIN}/login/email`, session, {
+        _csrf: csrf,
+        authenticationPayload: "",
+        email: creds.email,
+    });
+    let nextUrl = locationOf(r, LOGIN);
+    if (!nextUrl) {
+        throw new Error(`email step failed: ${findError(r.data) ?? `status ${r.status}`}`);
+    }
+    // 3. Server may steer to /login/passkey if the account has one. Force password.
+    if (nextUrl.includes("/login/passkey"))
+        nextUrl = `${LOGIN}/login/password`;
+    // 4. GET password page → capture new CSRF + form action.
+    r = await get(nextUrl, session);
+    csrf = findCsrf(r.data);
+    const passwordAction = r.data.match(/<form[^>]+action="([^"]*)"/)?.[1] || nextUrl;
+    const passwordUrl = new URL(passwordAction, nextUrl).toString();
+    // 5. POST password.
+    r = await postForm(passwordUrl, session, { _csrf: csrf, password: creds.password });
+    nextUrl = locationOf(r, LOGIN);
+    if (!nextUrl) {
+        throw new Error(`password step failed: ${findError(r.data) ?? `status ${r.status}`}`);
+    }
+    // 6. Server may steer to /login/passkey for the second factor too. Force authenticator.
+    if (nextUrl.includes("/login/passkey"))
+        nextUrl = `${LOGIN}/login/authenticator`;
+    // 7. If a 2FA step is in the chain, handle it. Otherwise skip.
+    const needsOtp = /\/login\/(authenticator|second|totp|otp)/.test(nextUrl);
+    if (needsOtp) {
+        if (!creds.totpSecret)
+            throw new Error("server requires 2FA but no TOTP secret was provided");
+        r = await get(nextUrl, session);
+        csrf = findCsrf(r.data);
+        const otpAction = r.data.match(/<form[^>]+action="([^"]*)"/)?.[1] || nextUrl;
+        const otpUrl = new URL(otpAction, nextUrl).toString();
+        r = await postForm(otpUrl, session, { _csrf: csrf, code: totpCode(creds.totpSecret) });
+        nextUrl = locationOf(r, LOGIN);
+        if (!nextUrl) {
+            throw new Error(`OTP step failed: ${findError(r.data) ?? `status ${r.status}`}`);
+        }
+    }
+    // 8. Follow the post-login redirect chain to settle SSO state.
+    let hops = 0;
+    while (nextUrl && hops < 10) {
+        r = await get(nextUrl, session, { Accept: "text/html,application/json" });
+        const loc = locationOf(r, nextUrl);
+        if (!loc)
+            break;
+        nextUrl = loc;
+        hops++;
+    }
+    // 9. Mint the JWT via silent OAuth using the cookies we just collected.
+    return silentOAuth(session);
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASjE,MAAM,KAAK,GAAG,yBAAyB,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,YAAoB,EACpB,OAAe,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC5C,IAAI,GAAG,EAAE,EACT,MAAM,GAAG,CAAC;IAEV,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnF,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;IACrD,OAAO,MAAM,CAAC,KAAK,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,iFAAiF;IACjF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACnF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,OAAgB,EAAE,QAAgC,EAAE;IAClF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,OAAgB,EAAE,IAA4B;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;QAC3C,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACrC,MAAM,EAAE,WAAW;YACnB,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,WAAW,IAAI,EAAE;YACzB,OAAO,EAAE,GAAG;SACb,CAAC;KACH,CAAC,CAAC;IACH,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,CAAgB,EAAE,IAAY;IAChD,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,QAA8B,CAAC;IACrD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,KAAkB;IAClE,8DAA8D;IAC9D,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAEtC,iBAAiB;IACjB,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,KAAK,cAAc,EAAE,OAAO,EAAE;QAClD,KAAK,EAAE,IAAI;QACX,qBAAqB,EAAE,EAAE;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,CAAC,CAAC,CAAC,IAAc,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,gFAAgF;IAChF,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,iBAAiB,CAAC;IAE5E,yDAAyD;IACzD,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAClC,MAAM,cAAc,GAAI,CAAC,CAAC,IAAe,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IAC9F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEhE,oBAAoB;IACpB,CAAC,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpF,OAAO,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,SAAS,CAAC,CAAC,CAAC,IAAc,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,wFAAwF;IACxF,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,sBAAsB,CAAC;IAEjF,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC9F,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;QAClC,MAAM,SAAS,GAAI,CAAC,CAAC,IAAe,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,CAAC,CAAC,CAAC,IAAc,CAAC,IAAI,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QAC5B,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM;QAChB,OAAO,GAAG,GAAG,CAAC;QACd,IAAI,EAAE,CAAC;IACT,CAAC;IAED,wEAAwE;IACxE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}