offrouter-core 0.2.1 → 0.2.2

package/dist/auth/oauth-pkce.js

@@ -0,0 +1,375 @@
+/**
+ * OAuth PKCE flow for OffRouter.
+ *
+ * Supports Anthropic and OpenAI/Codex only (opt-in, bring-your-own-client-id).
+ * Gemini/xAI/Z.ai are API-key only and do NOT implement OAuth.
+ *
+ * Never auto-triggers OAuth. Requires explicit user configuration.
+ * Tokens are stored in the SecretStore (keychain or file fallback).
+ */
+import { randomBytes } from "node:crypto";
+import { Redacted } from "./credential-chain.js";
+import { setOAuthTokens } from "./keychain.js";
+import { startCallbackServer } from "./oauth-server.js";
+// ---------------------------------------------------------------------------
+// PKCE code generation
+// ---------------------------------------------------------------------------
+const VERIFIER_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+/**
+ * Generate a random code verifier for PKCE (RFC 7636).
+ * Length is between 43 and 128 characters.
+ */
+export function generateCodeVerifier() {
+    const length = 64 + (randomBytes(1)[0] % 32); // 64-95 chars
+    const bytes = randomBytes(length);
+    let verifier = "";
+    for (let i = 0; i < length; i++) {
+        verifier += VERIFIER_CHARS[bytes[i] % VERIFIER_CHARS.length];
+    }
+    return verifier;
+}
+/**
+ * Generate a S256 code challenge from a verifier (RFC 7636).
+ * Uses Web Crypto API (available in Node >= 22, Workers, browsers).
+ */
+export async function generateCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    const base64 = btoa(String.fromCharCode(...new Uint8Array(digest)));
+    return base64
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+/**
+ * OAuth PKCE configurations for supported providers.
+ * Only Anthropic and OpenAI/Codex are supported.
+ * Gemini/xAI/Z.ai are API-key only.
+ */
+export const PKCE_CONFIGS = {
+    anthropic: {
+        authorizeUrl: "https://console.anthropic.com/oauth/authorize",
+        tokenUrl: "https://console.anthropic.com/oauth/token",
+        scopes: ["api", "offline_access"],
+        clientIdEnvVar: "OFFROUTER_ANTHROPIC_CLIENT_ID",
+        // No default client id; users must bring their own.
+    },
+    openai: {
+        authorizeUrl: "https://auth.openai.com/oauth/authorize",
+        tokenUrl: "https://auth.openai.com/oauth/token",
+        scopes: ["offline_access"],
+        clientIdEnvVar: "OFFROUTER_OPENAI_CLIENT_ID",
+        // Note: reuses Codex client id; documented as fragile.
+    },
+};
+/**
+ * Returns true if the provider supports OAuth (opt-in).
+ */
+export function isOAuthProvider(providerId) {
+    return providerId in PKCE_CONFIGS;
+}
+// ---------------------------------------------------------------------------
+// OAuth session store (in-memory, out-of-band — NOT embedded in state)
+// ---------------------------------------------------------------------------
+/** Time-to-live for a stored OAuth session (10 minutes). */
+const SESSION_TTL_MS = 10 * 60 * 1000;
+/** Module-level session store: nonce → session. */
+const sessions = new Map();
+/**
+ * Retrieve and delete a session by nonce (one-shot consume).
+ * Returns null if the nonce is unknown, already consumed, or expired.
+ */
+export function consumeOAuthSession(nonce) {
+    const session = sessions.get(nonce);
+    if (!session)
+        return null;
+    sessions.delete(nonce);
+    if (Date.now() - session.createdAt > SESSION_TTL_MS) {
+        return null; // expired
+    }
+    return session;
+}
+/**
+ * Cancel / discard a session without consuming it.
+ */
+export function cancelOAuthSession(nonce) {
+    sessions.delete(nonce);
+}
+/**
+ * Create an OAuth state string that encodes provider metadata.
+ * Used to validate the callback matches the initiated flow.
+ */
+export function createOAuthState(provider) {
+    const nonce = randomBytes(16).toString("hex");
+    return JSON.stringify({ provider, nonce });
+}
+/**
+ * Start an OAuth PKCE flow for the given provider.
+ * Returns the authorization URL and state for redirect.
+ * Never auto-triggers; requires explicit user configuration.
+ */
+export async function startOAuthFlow(provider, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${provider}. ` +
+            `OAuth is only available for anthropic and openai providers.`);
+    }
+    const clientId = options.clientId ??
+        (config.clientIdEnvVar ? process.env[config.clientIdEnvVar] : undefined);
+    if (!clientId) {
+        throw new Error(`Client ID required for ${provider} OAuth. ` +
+            `Set the ${config.clientIdEnvVar ?? "client id"} environment variable ` +
+            `or pass it explicitly.`);
+    }
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = createOAuthState(provider);
+    const params = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: options.redirectUri,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+        state,
+        scope: config.scopes.join(" "),
+    });
+    const authorizeUrl = `${config.authorizeUrl}?${params.toString()}`;
+    // Store the verifier OOB so it never appears in the caller-visible state
+    const parsed = JSON.parse(state);
+    sessions.set(parsed.nonce, {
+        codeVerifier,
+        redirectUri: options.redirectUri,
+        createdAt: Date.now(),
+    });
+    return {
+        authorizeUrl,
+        state, // clean — provider + nonce only, no secrets
+    };
+}
+/**
+ * Exchange an authorization code for tokens.
+ * Called after the user completes the OAuth flow in their browser.
+ */
+export async function exchangeCodeForTokens(provider, code, statePayload, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${provider}`);
+    }
+    let stateData;
+    try {
+        stateData = JSON.parse(statePayload);
+    }
+    catch {
+        throw new Error("Invalid OAuth state payload");
+    }
+    if (!stateData.nonce) {
+        throw new Error("Missing nonce in OAuth state");
+    }
+    const session = consumeOAuthSession(stateData.nonce);
+    if (!session) {
+        throw new Error("OAuth session expired, already consumed, or not found. Please restart the OAuth flow.");
+    }
+    if (!session.codeVerifier) {
+        throw new Error("Missing code verifier in OAuth session");
+    }
+    const clientId = config.clientIdEnvVar
+        ? (process.env[config.clientIdEnvVar] ?? "")
+        : "";
+    const tokenParams = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: session.redirectUri ?? "http://127.0.0.1:8765/callback",
+        client_id: clientId,
+        code_verifier: session.codeVerifier,
+    });
+    const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+    const response = await fetchImpl(config.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+        },
+        body: tokenParams.toString(),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        throw new Error(`Token exchange failed for ${provider}: HTTP ${response.status} ${body}`);
+    }
+    const json = (await response.json());
+    if (!json.access_token) {
+        throw new Error(`Token exchange for ${provider} returned no access_token`);
+    }
+    // Store tokens in secret store (structured)
+    if (options.store) {
+        const obtainedAt = Date.now();
+        await setOAuthTokens(provider, {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token,
+            expiresAt: json.expires_in
+                ? obtainedAt + json.expires_in * 1000
+                : undefined,
+            scope: json.scope,
+            obtainedAt,
+        }, options.store);
+    }
+    return {
+        accessToken: new Redacted(json.access_token),
+        refreshToken: json.refresh_token
+            ? new Redacted(json.refresh_token)
+            : undefined,
+        expiresIn: json.expires_in,
+        scope: json.scope,
+    };
+}
+// ---------------------------------------------------------------------------
+// Login orchestration (callback server + browser + token exchange)
+// ---------------------------------------------------------------------------
+/** Default loopback ports for supported providers. */
+const DEFAULT_CALLBACK_PORTS = {
+    anthropic: 1456,
+    openai: 1455,
+};
+/**
+ * Return the default callback port for a provider, or 0 (OS-assigned).
+ */
+export function defaultCallbackPort(provider) {
+    return DEFAULT_CALLBACK_PORTS[provider] ?? 0;
+}
+/**
+ * Resolve the client id for a provider from process env (or a provided env
+ * override). Returns undefined if the env var is not set.
+ */
+export function resolveClientId(provider, env = process.env) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config?.clientIdEnvVar)
+        return undefined;
+    return env[config.clientIdEnvVar] ?? undefined;
+}
+/**
+ * Run the full OAuth PKCE login flow:
+ * 1. Start a local callback server on 127.0.0.1
+ * 2. Build the authorize URL with PKCE challenge + state
+ * 3. Notify caller (onAuthorizeUrl) and attempt browser open
+ * 4. Wait for the provider callback (code + state)
+ * 5. Exchange code for tokens
+ * 6. Store structured tokens in the secret store
+ * 7. Clean up the server
+ */
+export async function runOAuthLogin(opts) {
+    const config = PKCE_CONFIGS[opts.provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${opts.provider}. ` +
+            `OAuth is only available for anthropic and openai providers.`);
+    }
+    const clientId = opts.clientId ?? resolveClientId(opts.provider) ?? undefined;
+    if (!clientId) {
+        const envHint = config.clientIdEnvVar
+            ? `Set the ${config.clientIdEnvVar} environment variable or pass it explicitly.`
+            : "A client id is required for this provider.";
+        throw new Error(`Client ID required for ${opts.provider} OAuth. ${envHint}`);
+    }
+    // 1. Start callback server
+    const port = opts.port ?? defaultCallbackPort(opts.provider);
+    const server = await startCallbackServer(port);
+    try {
+        const redirectUri = server.url;
+        // 2. Build the authorize URL with PKCE
+        const flow = await startOAuthFlow(opts.provider, {
+            redirectUri,
+            clientId,
+        });
+        // 3. Notify and attempt to open browser
+        opts.onAuthorizeUrl?.(flow.authorizeUrl);
+        if (opts.openBrowser) {
+            try {
+                await opts.openBrowser(flow.authorizeUrl);
+            }
+            catch {
+                // Best-effort only.
+            }
+        }
+        // 4. Wait for callback (validates expected state)
+        const { code } = await server.waitForCode({
+            expectedState: flow.state,
+            timeoutMs: opts.timeoutMs,
+            signal: opts.signal,
+        });
+        // 5. Exchange code for tokens (also stores them)
+        const tokens = await exchangeCodeForTokens(opts.provider, code, flow.state, {
+            store: opts.store,
+            fetch: opts.fetch,
+        });
+        // 6. Tokens are already stored by exchangeCodeForTokens.
+        //    Compute expiresAt from expiresIn for the result.
+        const expiresAt = tokens.expiresIn
+            ? Date.now() + tokens.expiresIn * 1000
+            : undefined;
+        return {
+            provider: opts.provider,
+            redirectUri,
+            expiresAt,
+            scope: tokens.scope,
+        };
+    }
+    finally {
+        // 7. Clean up
+        await server.close();
+    }
+}
+/**
+ * Refresh an OAuth token using a refresh token.
+ * Updates the stored tokens on success.
+ */
+export async function refreshTokens(provider, refreshToken, store, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${provider}`);
+    }
+    if (!store) {
+        throw new Error("SecretStore is required for token refresh");
+    }
+    const clientId = config.clientIdEnvVar
+        ? (process.env[config.clientIdEnvVar] ?? "")
+        : "";
+    const params = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: clientId,
+    });
+    const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+    const response = await fetchImpl(config.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        throw new Error(`Token refresh failed for ${provider}: HTTP ${response.status} ${body}`);
+    }
+    const json = (await response.json());
+    if (!json.access_token) {
+        throw new Error(`Token refresh for ${provider} returned no access_token`);
+    }
+    // Update stored tokens (structured)
+    const obtainedAt = Date.now();
+    await setOAuthTokens(provider, {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        expiresAt: json.expires_in
+            ? obtainedAt + json.expires_in * 1000
+            : undefined,
+        scope: json.scope,
+        obtainedAt,
+    }, store);
+    return {
+        accessToken: new Redacted(json.access_token),
+        refreshToken: json.refresh_token
+            ? new Redacted(json.refresh_token)
+            : undefined,
+        expiresIn: json.expires_in,
+        scope: json.scope,
+    };
+}
+//# sourceMappingURL=oauth-pkce.js.map

package/dist/auth/oauth-pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-pkce.js","sourceRoot":"","sources":["../../src/auth/oauth-pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,cAAc,GAClB,oEAAoE,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAC,cAAc;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CACjB,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAC;IACF,OAAO,MAAM;SACV,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAwC;IAC/D,SAAS,EAAE;QACT,YAAY,EAAE,+CAA+C;QAC7D,QAAQ,EAAE,2CAA2C;QACrD,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC;QACjC,cAAc,EAAE,+BAA+B;QAC/C,oDAAoD;KACrD;IACD,MAAM,EAAE;QACN,YAAY,EAAE,yCAAyC;QACvD,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,CAAC,gBAAgB,CAAC;QAC1B,cAAc,EAAE,4BAA4B;QAC5C,uDAAuD;KACxD;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,UAAU,IAAI,YAAY,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAYtC,mDAAmD;AACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAkCD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,OAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,IAAI;YAC/C,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,UAAU;YAC1C,WAAW,MAAM,CAAC,cAAc,IAAI,WAAW,wBAAwB;YACvE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEnE,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAwC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;QACzB,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,4CAA4C;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,OAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,SAAgD,CAAC;IACrD,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAqB,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc;QACnB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;QACtC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,OAAO,CAAC,WAAW,IAAI,gCAAgC;QACrE,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,UAAU,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sBAAsB,QAAQ,2BAA2B,CAC1D,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,cAAc,CAClB,QAAQ,EACR;YACE,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU;SACX,EACD,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,aAAa;YAC9B,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAClC,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,sBAAsB,GAA2B;IACrD,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,cAAc;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;AACjD,CAAC;AA4BD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,QAAQ,IAAI;YACpD,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,GACX,MAAM,CAAC,cAAc;YACnB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAc,8CAA8C;YAChF,CAAC,CAAC,4CAA4C,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,QAAQ,WAAW,OAAO,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;QAE/B,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC/C,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,wCAAwC;QACxC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACxC,aAAa,EAAE,IAAI,CAAC,KAAK;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,iDAAiD;QACjD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YAC1E,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,yDAAyD;QACzD,sDAAsD;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI;YACtC,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW;YACX,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc;QACd,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,YAAoB,EACpB,KAAkB,EAClB,OAA6C;IAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc;QACnB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,UAAU,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,2BAA2B,CACzD,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,cAAc,CAClB,QAAQ,EACR;QACE,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YACxB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;YACrC,CAAC,CAAC,SAAS;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;KACX,EACD,KAAK,CACN,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,aAAa;YAC9B,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAClC,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC"}

package/dist/auth/oauth-server.d.ts

@@ -0,0 +1,36 @@
+export interface CallbackServerOptions {
+    /**
+     * State value expected from the provider. Validated in waitForCode against
+     * the state returned by the redirect; a mismatch rejects the promise.
+     * May also be supplied per-call to waitForCode.
+     */
+    expectedState?: string;
+}
+export interface WaitForCodeOptions {
+    /** Overrides the server-level expectedState for this call. */
+    expectedState?: string;
+    /** How long to wait for a callback before rejecting (default 5 minutes). */
+    timeoutMs?: number;
+    /** Optional abort signal to cancel the wait early. */
+    signal?: AbortSignal;
+}
+export interface CallbackCode {
+    code: string;
+    state: string;
+}
+export interface CallbackServerHandle {
+    /** Full redirect_uri to register with the provider (http://127.0.0.1:PORT/callback). */
+    url: string;
+    /** Actual bound port (useful when 0 was requested). */
+    port: number;
+    /** Resolve with {code, state} on a valid callback; reject on timeout/state mismatch. */
+    waitForCode(options?: WaitForCodeOptions): Promise<CallbackCode>;
+    /** Stop listening and free the port. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * Start a loopback HTTP server that captures an OAuth authorization code.
+ * Pass port 0 to let the OS choose a free port (read handle.port afterwards).
+ */
+export declare function startCallbackServer(port: number, options?: CallbackServerOptions): Promise<CallbackServerHandle>;
+//# sourceMappingURL=oauth-server.d.ts.map

package/dist/auth/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,oDAAoD;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CA6K/B"}

package/dist/auth/oauth-server.js

@@ -0,0 +1,210 @@
+/**
+ * Local OAuth callback server for OffRouter's live PKCE login flow.
+ *
+ * Binds to 127.0.0.1 ONLY (never 0.0.0.0) so the provider can redirect back
+ * to this machine without exposing the callback to the network. The server
+ * captures the authorization `code` + `state` from the redirect and hands them
+ * to the caller; it never touches tokens, secrets, or the network beyond the
+ * single loopback HTTP socket.
+ */
+import { createServer } from "node:http";
+import { URL } from "node:url";
+/** Loopback-only hostname. Hardcoded to prevent accidental 0.0.0.0 binds. */
+const LOOPBACK_HOST = "127.0.0.1";
+/** Path the provider redirects to (http://127.0.0.1:PORT/callback). */
+const CALLBACK_PATH = "/callback";
+/**
+ * Start a loopback HTTP server that captures an OAuth authorization code.
+ * Pass port 0 to let the OS choose a free port (read handle.port afterwards).
+ */
+export function startCallbackServer(port, options = {}) {
+    return new Promise((resolve, reject) => {
+        const serverLevelState = options.expectedState;
+        // Deferred for the first valid callback (has a `code` param).
+        let captured = null;
+        const waiters = [];
+        const httpServer = createServer((req, res) => {
+            handleCallback(req, res);
+        });
+        function handleCallback(req, res) {
+            // Only respond to GET on the callback path; everything else 404s.
+            if (req.method !== "GET") {
+                res.writeHead(405, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Method Not Allowed");
+                return;
+            }
+            let parsedUrl;
+            try {
+                parsedUrl = new URL(req.url ?? "/", `http://${LOOPBACK_HOST}`);
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Bad Request");
+                return;
+            }
+            const pathname = parsedUrl.pathname;
+            const code = parsedUrl.searchParams.get("code");
+            const state = parsedUrl.searchParams.get("state");
+            const error = parsedUrl.searchParams.get("error");
+            // OAuth error from the provider (e.g. user denied consent).
+            if (error) {
+                res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                res.end(authorizationDeniedPage(error));
+                return;
+            }
+            if (pathname !== CALLBACK_PATH) {
+                res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Not Found");
+                return;
+            }
+            // Missing code -> provider returned nothing usable.
+            if (!code) {
+                res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                res.end(missingCodePage());
+                return;
+            }
+            // Capture the first valid callback exactly once.
+            const callback = { code, state: state ?? "" };
+            if (!captured) {
+                captured = callback;
+                // Resolve any pending waiters that accept this callback.
+                const pending = waiters.splice(0, waiters.length);
+                for (const w of pending) {
+                    w.resolve(callback);
+                }
+            }
+            // Always show the user a friendly page; security validation happens in
+            // waitForCode (state may not be known at request time).
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(successPage());
+        }
+        httpServer.on("error", (err) => {
+            reject(new Error(`Failed to start OAuth callback server on 127.0.0.1:${port}: ${err.message}`, { cause: err }));
+        });
+        httpServer.listen(port, LOOPBACK_HOST, () => {
+            const address = httpServer.address();
+            const boundPort = address && typeof address === "object" ? address.port : port;
+            const redirectUrl = `http://${LOOPBACK_HOST}:${boundPort}${CALLBACK_PATH}`;
+            const handle = {
+                url: redirectUrl,
+                port: boundPort,
+                waitForCode(waitOpts = {}) {
+                    const expected = waitOpts.expectedState !== undefined
+                        ? waitOpts.expectedState
+                        : serverLevelState;
+                    const timeoutMs = waitOpts.timeoutMs ?? 5 * 60 * 1000;
+                    return new Promise((resolveWait, rejectWait) => {
+                        let settled = false;
+                        const settle = (outcome, isReject) => {
+                            if (settled)
+                                return;
+                            settled = true;
+                            clearTimeout(timer);
+                            waitOpts.signal?.removeEventListener("abort", onAbort);
+                            if (isReject) {
+                                rejectWait(outcome);
+                            }
+                            else {
+                                resolveWait(outcome);
+                            }
+                        };
+                        const onAbort = () => {
+                            settle(new Error("OAuth callback wait was aborted."), true);
+                        };
+                        const timer = setTimeout(() => {
+                            settle(new Error("OAuth login timed out waiting for callback."), true);
+                        }, timeoutMs);
+                        if (waitOpts.signal?.aborted) {
+                            settle(new Error("OAuth callback wait was aborted."), true);
+                            return;
+                        }
+                        waitOpts.signal?.addEventListener("abort", onAbort);
+                        const resolveWith = (callback) => {
+                            if (expected !== undefined && callback.state !== expected) {
+                                settle(new Error(`OAuth state mismatch: expected "${redactState(expected)}" ` +
+                                    `but received "${redactState(callback.state)}". ` +
+                                    `This may indicate a CSRF attempt or a stale login tab.`), true);
+                                return;
+                            }
+                            settle(callback, false);
+                        };
+                        if (captured) {
+                            resolveWith(captured);
+                            return;
+                        }
+                        waiters.push({ resolve: resolveWith, reject: rejectWait });
+                    });
+                },
+                close() {
+                    return new Promise((resolveClose) => {
+                        httpServer.close(() => resolveClose());
+                        // close() waits for in-flight connections; closeAllConnections is
+                        // available on Node 18+ and speeds shutdown without dropping the
+                        // response the user's browser is mid-receiving.
+                        // (Not called here to keep the success page delivery intact.)
+                    });
+                },
+            };
+            resolve(handle);
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Static HTML pages (ASCII-only, no secret material)
+// ---------------------------------------------------------------------------
+function successPage() {
+    return [
+        "<!doctype html>",
+        "<html lang=\"en\">",
+        "<head><meta charset=\"utf-8\"><title>OffRouter login</title></head>",
+        "<body>",
+        "<h1>OffRouter login authorized</h1>",
+        "<p>You can close this tab and return to your terminal.</p>",
+        "</body>",
+        "</html>",
+        "",
+    ].join("\n");
+}
+function authorizationDeniedPage(error) {
+    const safe = escapeHtml(error);
+    return [
+        "<!doctype html>",
+        "<html lang=\"en\">",
+        "<head><meta charset=\"utf-8\"><title>OffRouter login</title></head>",
+        "<body>",
+        "<h1>OffRouter login not completed</h1>",
+        `<p>The provider reported: ${safe}</p>`,
+        "<p>You can close this tab and try again from your terminal.</p>",
+        "</body>",
+        "</html>",
+        "",
+    ].join("\n");
+}
+function missingCodePage() {
+    return [
+        "<!doctype html>",
+        "<html lang=\"en\">",
+        "<head><meta charset=\"utf-8\"><title>OffRouter login</title></head>",
+        "<body>",
+        "<h1>OffRouter login incomplete</h1>",
+        "<p>The callback did not include an authorization code.</p>",
+        "</body>",
+        "</html>",
+        "",
+    ].join("\n");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/** Truncate a state token for error messages so it is never echoed in full. */
+function redactState(state) {
+    if (state.length <= 8)
+        return "***";
+    return `${state.slice(0, 4)}...${state.slice(-4)}`;
+}
+//# sourceMappingURL=oauth-server.js.map

package/dist/auth/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,6EAA6E;AAC7E,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,uEAAuE;AACvE,MAAM,aAAa,GAAG,WAAW,CAAC;AAoClC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,UAAiC,EAAE;IAEnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;QAE/C,8DAA8D;QAC9D,IAAI,QAAQ,GAAwB,IAAI,CAAC;QACzC,MAAM,OAAO,GAGR,EAAE,CAAC;QAER,MAAM,UAAU,GAAW,YAAY,CACrC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAC5C,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CACF,CAAC;QAEF,SAAS,cAAc,CAAC,GAAoB,EAAE,GAAmB;YAC/D,kEAAkE;YAClE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,aAAa,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;YACpC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAElD,4DAA4D;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,oDAAoD;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,QAAQ,CAAC;gBACpB,yDAAyD;gBACzD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,wDAAwD;YACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACzB,CAAC;QAED,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YACpD,MAAM,CACJ,IAAI,KAAK,CACP,sDAAsD,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,EAC5E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE;YAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,SAAS,GACb,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,MAAM,WAAW,GAAG,UAAU,aAAa,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;YAE3E,MAAM,MAAM,GAAyB;gBACnC,GAAG,EAAE,WAAW;gBAChB,IAAI,EAAE,SAAS;gBACf,WAAW,CAAC,WAA+B,EAAE;oBAC3C,MAAM,QAAQ,GACZ,QAAQ,CAAC,aAAa,KAAK,SAAS;wBAClC,CAAC,CAAC,QAAQ,CAAC,aAAa;wBACxB,CAAC,CAAC,gBAAgB,CAAC;oBACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAEtD,OAAO,IAAI,OAAO,CAAe,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;wBAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;wBAEpB,MAAM,MAAM,GAAG,CACb,OAA6B,EAC7B,QAAiB,EACX,EAAE;4BACR,IAAI,OAAO;gCAAE,OAAO;4BACpB,OAAO,GAAG,IAAI,CAAC;4BACf,YAAY,CAAC,KAAK,CAAC,CAAC;4BACpB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;4BACvD,IAAI,QAAQ,EAAE,CAAC;gCACb,UAAU,CAAC,OAAgB,CAAC,CAAC;4BAC/B,CAAC;iCAAM,CAAC;gCACN,WAAW,CAAC,OAAuB,CAAC,CAAC;4BACvC,CAAC;wBACH,CAAC,CAAC;wBAEF,MAAM,OAAO,GAAG,GAAS,EAAE;4BACzB,MAAM,CACJ,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAC7C,IAAI,CACL,CAAC;wBACJ,CAAC,CAAC;wBAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;4BAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE,IAAI,CAAC,CAAC;wBACzE,CAAC,EAAE,SAAS,CAAC,CAAC;wBAEd,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;4BAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,CAAC;4BAC5D,OAAO;wBACT,CAAC;wBACD,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;wBAEpD,MAAM,WAAW,GAAG,CAAC,QAAsB,EAAQ,EAAE;4BACnD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCAC1D,MAAM,CACJ,IAAI,KAAK,CACP,mCAAmC,WAAW,CAAC,QAAQ,CAAC,IAAI;oCAC1D,iBAAiB,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;oCACjD,wDAAwD,CAC3D,EACD,IAAI,CACL,CAAC;gCACF,OAAO;4BACT,CAAC;4BACD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;wBAC1B,CAAC,CAAC;wBAEF,IAAI,QAAQ,EAAE,CAAC;4BACb,WAAW,CAAC,QAAQ,CAAC,CAAC;4BACtB,OAAO;wBACT,CAAC;wBAED,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC7D,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK;oBACH,OAAO,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,EAAE;wBACxC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;wBACvC,kEAAkE;wBAClE,iEAAiE;wBACjE,gDAAgD;wBAChD,8DAA8D;oBAChE,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;YAEF,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,SAAS,WAAW;IAClB,OAAO;QACL,iBAAiB;QACjB,oBAAoB;QACpB,qEAAqE;QACrE,QAAQ;QACR,qCAAqC;QACrC,4DAA4D;QAC5D,SAAS;QACT,SAAS;QACT,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO;QACL,iBAAiB;QACjB,oBAAoB;QACpB,qEAAqE;QACrE,QAAQ;QACR,wCAAwC;QACxC,6BAA6B,IAAI,MAAM;QACvC,iEAAiE;QACjE,SAAS;QACT,SAAS;QACT,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe;IACtB,OAAO;QACL,iBAAiB;QACjB,oBAAoB;QACpB,qEAAqE;QACrE,QAAQ;QACR,qCAAqC;QACrC,4DAA4D;QAC5D,SAAS;QACT,SAAS;QACT,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC"}