offrouter-core 0.2.1 → 0.3.0

package/dist/auth/oauth-pkce.js

@@ -0,0 +1,558 @@
+/**
+ * OAuth PKCE and device code flow for OffRouter.
+ *
+ * Supports PKCE browser callback flow (Anthropic, OpenAI) and
+ * device code flow (xAI/Grok, GitHub Copilot).
+ * Gemini/Z.ai are API-key only and do NOT implement OAuth.
+ *
+ * Never auto-triggers OAuth. Requires explicit user configuration.
+ * Tokens are stored in the SecretStore (keychain or file fallback).
+ */
+import { randomBytes } from "node:crypto";
+import { Redacted } from "./credential-chain.js";
+import { setOAuthTokens } from "./keychain.js";
+import { startCallbackServer } from "./oauth-server.js";
+// ---------------------------------------------------------------------------
+// PKCE code generation
+// ---------------------------------------------------------------------------
+/**
+ * Generate a random code verifier for PKCE (RFC 7636).
+ * Uses base64url encoding of 32 random bytes (43 chars).
+ */
+export function generateCodeVerifier() {
+    const bytes = randomBytes(32);
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+/**
+ * Generate a S256 code challenge from a verifier (RFC 7636).
+ * Uses Web Crypto API (available in Node >= 22, Workers, browsers).
+ */
+export async function generateCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    const base64 = btoa(String.fromCharCode(...new Uint8Array(digest)));
+    return base64
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+/**
+ * OAuth PKCE configurations for supported providers.
+ * Anthropic and OpenAI use PKCE browser callback flow.
+ * xAI (Grok) and GitHub Copilot use device code flow.
+ */
+export const PKCE_CONFIGS = {
+    anthropic: {
+        authorizeUrl: "https://claude.ai/oauth/authorize",
+        tokenUrl: "https://platform.claude.com/v1/oauth/token",
+        scopes: [
+            "org:create_api_key",
+            "user:profile",
+            "user:inference",
+            "user:sessions:claude_code",
+            "user:mcp_servers",
+            "user:file_upload",
+        ],
+        clientIdEnvVar: "OFFROUTER_ANTHROPIC_CLIENT_ID",
+        defaultClientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+        callbackPort: 53692,
+        callbackPath: "/callback",
+    },
+    openai: {
+        authorizeUrl: "https://auth.openai.com/oauth/authorize",
+        tokenUrl: "https://auth.openai.com/oauth/token",
+        scopes: ["openid", "profile", "email", "offline_access"],
+        clientIdEnvVar: "OFFROUTER_OPENAI_CLIENT_ID",
+        defaultClientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+        callbackPort: 1455,
+        callbackPath: "/auth/callback",
+    },
+    xai: {
+        tokenUrl: "https://auth.x.ai/oauth2/token",
+        scopes: ["openid", "profile", "email", "offline_access", "grok-cli:access", "api:access"],
+        clientIdEnvVar: "OFFROUTER_XAI_CLIENT_ID",
+        defaultClientId: "b1a00492-073a-47ea-816f-4c329264a828",
+        deviceCodeUrl: "https://auth.x.ai/oauth2/device/code",
+    },
+    "github-copilot": {
+        tokenUrl: "https://github.com/login/oauth/access_token",
+        scopes: [],
+        clientIdEnvVar: "OFFROUTER_GITHUB_COPILOT_CLIENT_ID",
+        defaultClientId: "Iv1.b507a08c87ecfe98",
+        deviceCodeUrl: "https://github.com/login/device/code",
+    },
+};
+/**
+ * Returns true if the provider supports OAuth (opt-in).
+ */
+export function isOAuthProvider(providerId) {
+    return providerId in PKCE_CONFIGS;
+}
+/**
+ * Returns true if the provider uses device code flow instead of PKCE browser callback.
+ */
+export function isDeviceCodeProvider(providerId) {
+    const config = PKCE_CONFIGS[providerId];
+    return !!config?.deviceCodeUrl;
+}
+// ---------------------------------------------------------------------------
+// OAuth session store (in-memory, out-of-band — NOT embedded in state)
+// ---------------------------------------------------------------------------
+/** Time-to-live for a stored OAuth session (10 minutes). */
+const SESSION_TTL_MS = 10 * 60 * 1000;
+/** Module-level session store: nonce → session. */
+const sessions = new Map();
+/**
+ * Retrieve and delete a session by nonce (one-shot consume).
+ * Returns null if the nonce is unknown, already consumed, or expired.
+ */
+export function consumeOAuthSession(nonce) {
+    const session = sessions.get(nonce);
+    if (!session)
+        return null;
+    sessions.delete(nonce);
+    if (Date.now() - session.createdAt > SESSION_TTL_MS) {
+        return null; // expired
+    }
+    return session;
+}
+/**
+ * Cancel / discard a session without consuming it.
+ */
+export function cancelOAuthSession(nonce) {
+    sessions.delete(nonce);
+}
+/**
+ * Create an OAuth state string that encodes provider metadata.
+ * Used to validate the callback matches the initiated flow.
+ */
+export function createOAuthState(_provider) {
+    // Simple nonce string (not JSON) - some providers reject complex state values.
+    void _provider;
+    return randomBytes(16).toString("hex");
+}
+/**
+ * Start an OAuth PKCE flow for the given provider.
+ * Returns the authorization URL and state for redirect.
+ * Never auto-triggers; requires explicit user configuration.
+ */
+export async function startOAuthFlow(provider, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config || !config.authorizeUrl) {
+        throw new Error(`OAuth not supported for provider: ${provider}. ` +
+            `OAuth is only available for anthropic and openai providers.`);
+    }
+    const clientId = options.clientId ??
+        (config.clientIdEnvVar ? process.env[config.clientIdEnvVar] : undefined) ??
+        config.defaultClientId;
+    if (!clientId) {
+        throw new Error(`Client ID required for ${provider} OAuth. ` +
+            `Set the ${config.clientIdEnvVar ?? "client id"} environment variable ` +
+            `or pass it explicitly.`);
+    }
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    // Use the verifier as the state (same pattern as pi/other CLIs).
+    // The callback server validates state === verifier.
+    const state = codeVerifier;
+    const params = new URLSearchParams({
+        code: "true",
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: options.redirectUri,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+        state,
+        scope: config.scopes.join(" "),
+    });
+    const authorizeUrl = `${config.authorizeUrl}?${params.toString()}`;
+    // Store the verifier in the session, keyed by the state (= verifier).
+    // The callback validates state === verifier, then we consume the session.
+    sessions.set(state, {
+        codeVerifier,
+        redirectUri: options.redirectUri,
+        nonce: state,
+        createdAt: Date.now(),
+    });
+    return {
+        authorizeUrl,
+        state, // simple nonce string, no secrets
+    };
+}
+/**
+ * Exchange an authorization code for tokens.
+ * Called after the user completes the OAuth flow in their browser.
+ */
+export async function exchangeCodeForTokens(provider, code, statePayload, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${provider}`);
+    }
+    // statePayload is now a simple nonce string (not JSON).
+    const session = consumeOAuthSession(statePayload);
+    if (!session) {
+        throw new Error("OAuth session expired, already consumed, or not found. Please restart the OAuth flow.");
+    }
+    if (!session.codeVerifier) {
+        throw new Error("Missing code verifier in OAuth session");
+    }
+    const clientId = options.clientId ??
+        resolveClientId(provider) ??
+        "";
+    // Anthropic uses JSON body; all others use form-encoded.
+    // Anthropic requires the state field in the token exchange to match the
+    // state sent in the authorize URL.
+    const useJson = provider === "anthropic";
+    const tokenBody = useJson
+        ? JSON.stringify({
+            grant_type: "authorization_code",
+            client_id: clientId,
+            code,
+            state: statePayload,
+            redirect_uri: session.redirectUri,
+            code_verifier: session.codeVerifier,
+        })
+        : new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: session.redirectUri,
+            client_id: clientId,
+            code_verifier: session.codeVerifier,
+        }).toString();
+    const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+    const response = await fetchImpl(config.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": useJson
+                ? "application/json"
+                : "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body: tokenBody,
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        throw new Error(`Token exchange failed for ${provider}: HTTP ${response.status} ${body}`);
+    }
+    const json = (await response.json());
+    if (!json.access_token) {
+        throw new Error(`Token exchange for ${provider} returned no access_token`);
+    }
+    // Store tokens in secret store (structured)
+    if (options.store) {
+        const obtainedAt = Date.now();
+        await setOAuthTokens(provider, {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token,
+            expiresAt: json.expires_in
+                ? obtainedAt + json.expires_in * 1000
+                : undefined,
+            scope: json.scope,
+            obtainedAt,
+        }, options.store);
+    }
+    return {
+        accessToken: new Redacted(json.access_token),
+        refreshToken: json.refresh_token
+            ? new Redacted(json.refresh_token)
+            : undefined,
+        expiresIn: json.expires_in,
+        scope: json.scope,
+    };
+}
+// ---------------------------------------------------------------------------
+// Login orchestration (callback server + browser + token exchange)
+// ---------------------------------------------------------------------------
+/** Default loopback ports for supported providers. */
+const DEFAULT_CALLBACK_PORTS = {
+    anthropic: 53692,
+    openai: 1455,
+};
+/**
+ * Return the default callback port for a provider, or 0 (OS-assigned).
+ */
+export function defaultCallbackPort(provider) {
+    return DEFAULT_CALLBACK_PORTS[provider] ?? 0;
+}
+/**
+ * Resolve the client id for a provider from process env (or a provided env
+ * override). Returns undefined if the env var is not set.
+ */
+export function resolveClientId(provider, env = process.env) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config)
+        return undefined;
+    return env[config.clientIdEnvVar ?? ""] ?? config.defaultClientId;
+}
+/**
+ * Run the full OAuth PKCE login flow:
+ * 1. Start a local callback server on 127.0.0.1
+ * 2. Build the authorize URL with PKCE challenge + state
+ * 3. Notify caller (onAuthorizeUrl) and attempt browser open
+ * 4. Wait for the provider callback (code + state)
+ * 5. Exchange code for tokens
+ * 6. Store structured tokens in the secret store
+ * 7. Clean up the server
+ */
+export async function runOAuthLogin(opts) {
+    const config = PKCE_CONFIGS[opts.provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${opts.provider}. ` +
+            `OAuth is only available for anthropic and openai providers.`);
+    }
+    const clientId = opts.clientId ?? resolveClientId(opts.provider) ?? undefined;
+    if (!clientId) {
+        const envHint = config.clientIdEnvVar
+            ? `Set the ${config.clientIdEnvVar} environment variable or pass it explicitly.`
+            : "A client id is required for this provider.";
+        throw new Error(`Client ID required for ${opts.provider} OAuth. ${envHint}`);
+    }
+    // 1. Start callback server
+    const port = opts.port ?? defaultCallbackPort(opts.provider);
+    const callbackPath = config.callbackPath ?? "/callback";
+    const server = await startCallbackServer(port, { callbackPath });
+    try {
+        const redirectUri = server.url;
+        // 2. Build the authorize URL with PKCE
+        const flow = await startOAuthFlow(opts.provider, {
+            redirectUri,
+            clientId,
+        });
+        // 3. Notify and attempt to open browser
+        opts.onAuthorizeUrl?.(flow.authorizeUrl);
+        if (opts.openBrowser) {
+            try {
+                await opts.openBrowser(flow.authorizeUrl);
+            }
+            catch {
+                // Best-effort only.
+            }
+        }
+        // 4. Wait for callback (validates expected state)
+        const { code } = await server.waitForCode({
+            expectedState: flow.state,
+            timeoutMs: opts.timeoutMs,
+            signal: opts.signal,
+        });
+        // 5. Exchange code for tokens (also stores them)
+        const tokens = await exchangeCodeForTokens(opts.provider, code, flow.state, {
+            store: opts.store,
+            fetch: opts.fetch,
+        });
+        // 6. Tokens are already stored by exchangeCodeForTokens.
+        //    Compute expiresAt from expiresIn for the result.
+        const expiresAt = tokens.expiresIn
+            ? Date.now() + tokens.expiresIn * 1000
+            : undefined;
+        return {
+            provider: opts.provider,
+            redirectUri,
+            expiresAt,
+            scope: tokens.scope,
+        };
+    }
+    finally {
+        // 7. Clean up
+        await server.close();
+    }
+}
+// ---------------------------------------------------------------------------
+// Device code flow (xAI, GitHub Copilot)
+// ---------------------------------------------------------------------------
+/**
+ * Run the device code flow for providers that don't support PKCE browser callback.
+ *
+ * 1. Requests a device code from the provider
+ * 2. Prints the user code and verification URL
+ * 3. Attempts to open the browser to the verification URL
+ * 4. Polls the token endpoint until the user authorizes
+ * 5. Stores tokens in the secret store
+ */
+export async function startDeviceCodeFlow(provider, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config || !config.deviceCodeUrl) {
+        throw new Error(`Device code flow not supported for provider: ${provider}`);
+    }
+    const clientId = options.clientId ??
+        (config.clientIdEnvVar ? process.env[config.clientIdEnvVar] : undefined) ??
+        config.defaultClientId;
+    if (!clientId) {
+        throw new Error(`Client ID required for ${provider} device code flow. ` +
+            `Set the ${config.clientIdEnvVar ?? "client id"} environment variable ` +
+            `or pass it explicitly.`);
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+    // 1. Request device code
+    const deviceCodeParams = new URLSearchParams({
+        client_id: clientId,
+        scope: config.scopes.join(" "),
+    });
+    const deviceResponse = await fetchImpl(config.deviceCodeUrl, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body: deviceCodeParams.toString(),
+    });
+    if (!deviceResponse.ok) {
+        const body = await deviceResponse.text().catch(() => "");
+        throw new Error(`Device code request failed for ${provider}: HTTP ${deviceResponse.status} ${body}`);
+    }
+    const deviceData = (await deviceResponse.json());
+    if (!deviceData.device_code || !deviceData.user_code) {
+        throw new Error(`Device code request for ${provider} returned incomplete data`);
+    }
+    // 2. Notify caller with device code data
+    options.onDeviceCode?.(deviceData);
+    // 3. Attempt to open browser to verification URL
+    const verificationUrl = deviceData.verification_uri_complete ?? deviceData.verification_uri;
+    if (options.openBrowser) {
+        try {
+            await options.openBrowser(verificationUrl);
+        }
+        catch {
+            // Best-effort only.
+        }
+    }
+    // 4. Poll for token
+    const pollInterval = (deviceData.interval ?? 5) * 1000;
+    const maxWaitMs = 5 * 60 * 1000; // 5 minutes
+    const startTime = Date.now();
+    while (true) {
+        if (options.signal?.aborted) {
+            throw new Error("Device code flow was aborted.");
+        }
+        if (Date.now() - startTime > maxWaitMs) {
+            throw new Error(`Device code flow timed out for ${provider} after ${maxWaitMs / 1000}s`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        const tokenParams = new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            device_code: deviceData.device_code,
+            client_id: clientId,
+        });
+        const tokenResponse = await fetchImpl(config.tokenUrl, {
+            method: "POST",
+            headers: {
+                "content-type": "application/x-www-form-urlencoded",
+                accept: "application/json",
+            },
+            body: tokenParams.toString(),
+        });
+        if (!tokenResponse.ok) {
+            const body = await tokenResponse.text().catch(() => "");
+            // Handle expected polling errors
+            if (body.includes("authorization_pending")) {
+                continue; // Keep polling
+            }
+            if (body.includes("slow_down")) {
+                // Increase interval by 5 seconds as per RFC
+                await new Promise((resolve) => setTimeout(resolve, 5000));
+                continue;
+            }
+            if (body.includes("expired_token")) {
+                throw new Error(`Device code expired for ${provider}. Please restart the login flow.`);
+            }
+            if (body.includes("access_denied")) {
+                throw new Error(`Device code flow denied for ${provider}.`);
+            }
+            throw new Error(`Token polling failed for ${provider}: HTTP ${tokenResponse.status} ${body}`);
+        }
+        const json = (await tokenResponse.json());
+        if (!json.access_token) {
+            throw new Error(`Token polling for ${provider} returned no access_token`);
+        }
+        // 5. Store tokens in secret store
+        const obtainedAt = Date.now();
+        await setOAuthTokens(provider, {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token,
+            expiresAt: json.expires_in
+                ? obtainedAt + json.expires_in * 1000
+                : undefined,
+            scope: json.scope,
+            obtainedAt,
+        }, options.store);
+        return {
+            provider,
+            expiresAt: json.expires_in
+                ? obtainedAt + json.expires_in * 1000
+                : undefined,
+            scope: json.scope,
+        };
+    }
+}
+/**
+ * Refresh an OAuth token using a refresh token.
+ * Updates the stored tokens on success.
+ */
+export async function refreshTokens(provider, refreshToken, store, options) {
+    const config = PKCE_CONFIGS[provider];
+    if (!config) {
+        throw new Error(`OAuth not supported for provider: ${provider}`);
+    }
+    if (!store) {
+        throw new Error("SecretStore is required for token refresh");
+    }
+    const clientId = config.clientIdEnvVar
+        ? (process.env[config.clientIdEnvVar] ?? "")
+        : "";
+    // Anthropic uses JSON body; OpenAI uses form-encoded.
+    const useJson = provider === "anthropic";
+    const refreshBody = useJson
+        ? JSON.stringify({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: clientId,
+        })
+        : new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: clientId,
+        }).toString();
+    const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+    const response = await fetchImpl(config.tokenUrl, {
+        method: "POST",
+        headers: {
+            "content-type": useJson
+                ? "application/json"
+                : "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body: refreshBody,
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        throw new Error(`Token refresh failed for ${provider}: HTTP ${response.status} ${body}`);
+    }
+    const json = (await response.json());
+    if (!json.access_token) {
+        throw new Error(`Token refresh for ${provider} returned no access_token`);
+    }
+    // Update stored tokens (structured)
+    const obtainedAt = Date.now();
+    await setOAuthTokens(provider, {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        expiresAt: json.expires_in
+            ? obtainedAt + json.expires_in * 1000
+            : undefined,
+        scope: json.scope,
+        obtainedAt,
+    }, store);
+    return {
+        accessToken: new Redacted(json.access_token),
+        refreshToken: json.refresh_token
+            ? new Redacted(json.refresh_token)
+            : undefined,
+        expiresIn: json.expires_in,
+        scope: json.scope,
+    };
+}
+//# sourceMappingURL=oauth-pkce.js.map

package/dist/auth/oauth-pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-pkce.js","sourceRoot":"","sources":["../../src/auth/oauth-pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CACjB,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAC;IACF,OAAO,MAAM;SACV,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAkBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAwC;IAC/D,SAAS,EAAE;QACT,YAAY,EAAE,mCAAmC;QACjD,QAAQ,EAAE,4CAA4C;QACtD,MAAM,EAAE;YACN,oBAAoB;YACpB,cAAc;YACd,gBAAgB;YAChB,2BAA2B;YAC3B,kBAAkB;YAClB,kBAAkB;SACnB;QACD,cAAc,EAAE,+BAA+B;QAC/C,eAAe,EAAE,sCAAsC;QACvD,YAAY,EAAE,KAAK;QACnB,YAAY,EAAE,WAAW;KAC1B;IACD,MAAM,EAAE;QACN,YAAY,EAAE,yCAAyC;QACvD,QAAQ,EAAE,qCAAqC;QAC/C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QACxD,cAAc,EAAE,4BAA4B;QAC5C,eAAe,EAAE,8BAA8B;QAC/C,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,gBAAgB;KAC/B;IACD,GAAG,EAAE;QACH,QAAQ,EAAE,gCAAgC;QAC1C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,CAAC;QACzF,cAAc,EAAE,yBAAyB;QACzC,eAAe,EAAE,sCAAsC;QACvD,aAAa,EAAE,sCAAsC;KACtD;IACD,gBAAgB,EAAE;QAChB,QAAQ,EAAE,6CAA6C;QACvD,MAAM,EAAE,EAAE;QACV,cAAc,EAAE,oCAAoC;QACpD,eAAe,EAAE,sBAAsB;QACvC,aAAa,EAAE,sCAAsC;KACtD;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,UAAU,IAAI,YAAY,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,4DAA4D;AAC5D,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAatC,mDAAmD;AACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC,UAAU;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAiED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,+EAA+E;IAC/E,KAAK,SAAS,CAAC;IACf,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,OAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,IAAI;YAC/C,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,CAAC,eAAe,CAAC;IAEzB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,UAAU;YAC1C,WAAW,MAAM,CAAC,cAAc,IAAI,WAAW,wBAAwB;YACvE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAChE,iEAAiE;IACjE,oDAAoD;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC;IAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEnE,sEAAsE;IACtE,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE;QAClB,YAAY;QACZ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,kCAAkC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,IAAY,EACZ,YAAoB,EACpB,OAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,eAAe,CAAC,QAAQ,CAAC;QACzB,EAAE,CAAC;IAEL,yDAAyD;IACzD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,OAAO,GAAG,QAAQ,KAAK,WAAW,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO;QACvB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YACb,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,IAAI;YACJ,KAAK,EAAE,YAAY;YACnB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC;QACJ,CAAC,CAAC,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAElB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,OAAO;gBACrB,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,mCAAmC;YACvC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,UAAU,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sBAAsB,QAAQ,2BAA2B,CAC1D,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,cAAc,CAClB,QAAQ,EACR;YACE,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU;SACX,EACD,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,aAAa;YAC9B,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAClC,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,sBAAsB,GAA2B;IACrD,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,IAAI;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC;AACpE,CAAC;AA4BD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,QAAQ,IAAI;YACpD,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,GACX,MAAM,CAAC,cAAc;YACnB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAc,8CAA8C;YAChF,CAAC,CAAC,4CAA4C,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,QAAQ,WAAW,OAAO,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,2BAA2B;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC;QAE/B,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC/C,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,wCAAwC;QACxC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACxC,aAAa,EAAE,IAAI,CAAC,KAAK;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,iDAAiD;QACjD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YAC1E,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,yDAAyD;QACzD,sDAAsD;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI;YACtC,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW;YACX,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc;QACd,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,OAA8B;IAE9B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gDAAgD,QAAQ,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,CAAC,eAAe,CAAC;IAEzB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,qBAAqB;YACrD,WAAW,MAAM,CAAC,cAAc,IAAI,WAAW,wBAAwB;YACvE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAErE,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,IAAI,eAAe,CAAC;QAC3C,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,UAAU,cAAc,CAAC,MAAM,IAAI,IAAI,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAuB,CAAC;IAEvE,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,2BAA2B,CAC/D,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;IAEnC,iDAAiD;IACjD,MAAM,eAAe,GACnB,UAAU,CAAC,yBAAyB,IAAI,UAAU,CAAC,gBAAgB,CAAC;IACtE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACvD,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,UAAU,SAAS,GAAG,IAAI,GAAG,CACxE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;YACtC,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAExD,iCAAiC;YACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC3C,SAAS,CAAC,eAAe;YAC3B,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,4CAA4C;gBAC5C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,kCAAkC,CACtE,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,GAAG,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,UAAU,aAAa,CAAC,MAAM,IAAI,IAAI,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAKvC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,2BAA2B,CACzD,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,cAAc,CAClB,QAAQ,EACR;YACE,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU;SACX,EACD,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,UAAU;gBACxB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;gBACrC,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,YAAoB,EACpB,KAAkB,EAClB,OAA6C;IAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc;QACnB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IAET,sDAAsD;IACtD,MAAM,OAAO,GAAG,QAAQ,KAAK,WAAW,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO;QACzB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YACb,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,QAAQ;SACpB,CAAC;QACJ,CAAC,CAAC,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC,QAAQ,EAAE,CAAC;IAElB,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,OAAO;gBACrB,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,mCAAmC;YACvC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,WAAW;KAClB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,UAAU,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,2BAA2B,CACzD,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,cAAc,CAClB,QAAQ,EACR;QACE,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YACxB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;YACrC,CAAC,CAAC,SAAS;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;KACX,EACD,KAAK,CACN,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,aAAa;YAC9B,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAClC,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC"}

package/dist/auth/oauth-server.d.ts

@@ -0,0 +1,38 @@
+export interface CallbackServerOptions {
+    /**
+     * State value expected from the provider. Validated in waitForCode against
+     * the state returned by the redirect; a mismatch rejects the promise.
+     * May also be supplied per-call to waitForCode.
+     */
+    expectedState?: string;
+    /** Callback path (default: /callback). OpenAI uses /auth/callback. */
+    callbackPath?: string;
+}
+export interface WaitForCodeOptions {
+    /** Overrides the server-level expectedState for this call. */
+    expectedState?: string;
+    /** How long to wait for a callback before rejecting (default 5 minutes). */
+    timeoutMs?: number;
+    /** Optional abort signal to cancel the wait early. */
+    signal?: AbortSignal;
+}
+export interface CallbackCode {
+    code: string;
+    state: string;
+}
+export interface CallbackServerHandle {
+    /** Full redirect_uri to register with the provider (http://localhost:PORT/callback). */
+    url: string;
+    /** Actual bound port (useful when 0 was requested). */
+    port: number;
+    /** Resolve with {code, state} on a valid callback; reject on timeout/state mismatch. */
+    waitForCode(options?: WaitForCodeOptions): Promise<CallbackCode>;
+    /** Stop listening and free the port. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * Start a loopback HTTP server that captures an OAuth authorization code.
+ * Pass port 0 to let the OS choose a free port (read handle.port afterwards).
+ */
+export declare function startCallbackServer(port: number, options?: CallbackServerOptions): Promise<CallbackServerHandle>;
+//# sourceMappingURL=oauth-server.d.ts.map

package/dist/auth/oauth-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,oDAAoD;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CA8K/B"}