opencode-auth-proxy 1.0.0 → 1.0.1

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { opencodeAuthProxy, opencodeAuthProxy as default } from "./opencode-auth-proxy.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,IAAI,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { opencodeAuthProxy, opencodeAuthProxy as default } from "./opencode-auth-proxy.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,IAAI,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/opencode-auth-proxy.d.ts

@@ -0,0 +1,5 @@
+import type { Plugin } from "@opencode-ai/plugin";
+declare const opencodeAuthProxy: Plugin;
+export { opencodeAuthProxy };
+export default opencodeAuthProxy;
+//# sourceMappingURL=opencode-auth-proxy.d.ts.map

package/dist/opencode-auth-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-auth-proxy.d.ts","sourceRoot":"","sources":["../opencode-auth-proxy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAoQjD,QAAA,MAAM,iBAAiB,EAAE,MAoUxB,CAAA;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAC5B,eAAe,iBAAiB,CAAA"}

package/dist/opencode-auth-proxy.js

@@ -0,0 +1,508 @@
+import http from "http";
+import httpProxy from "http-proxy";
+import fs from "fs";
+import path from "path";
+import crypto from "crypto";
+import os from "os";
+const GOOGLE_SCOPES = [
+    "https://www.googleapis.com/auth/cloud-platform",
+    "https://www.googleapis.com/auth/userinfo.email",
+    "https://www.googleapis.com/auth/userinfo.profile",
+];
+function base64url(buf) {
+    return buf
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function encodeState(payload) {
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+function decodeState(state) {
+    const normalized = state.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=");
+    const json = Buffer.from(padded, "base64").toString("utf8");
+    const parsed = JSON.parse(json);
+    return { verifier: parsed.verifier || "", projectId: parsed.projectId || "" };
+}
+function generatePkce() {
+    const verifier = base64url(crypto.randomBytes(32));
+    const challenge = base64url(crypto.createHash("sha256").update(verifier).digest());
+    return { verifier, challenge };
+}
+function parseCookies(req) {
+    const header = req.headers.cookie;
+    if (!header)
+        return {};
+    return header.split(";").reduce((acc, part) => {
+        const [key, ...valueParts] = part.trim().split("=");
+        if (!key)
+            return acc;
+        acc[key] = valueParts.join("=");
+        return acc;
+    }, {});
+}
+function signSession(sessionSecret) {
+    const sessionData = Buffer.from("authenticated", "utf8").toString("base64url");
+    const signature = crypto.createHmac("sha256", sessionSecret).update(sessionData).digest("hex");
+    return `${sessionData}.${signature}`;
+}
+function verifySession(token, sessionSecret) {
+    const [sessionPart, signature] = token.split(".");
+    if (!sessionPart || !signature)
+        return false;
+    const expected = crypto.createHmac("sha256", sessionSecret).update(sessionPart).digest("hex");
+    return crypto.timingSafeEqual(Buffer.from(signature, "utf8"), Buffer.from(expected, "utf8"));
+}
+function expandPath(filePath) {
+    if (filePath.startsWith("~/")) {
+        return path.join(os.homedir(), filePath.slice(2));
+    }
+    return filePath;
+}
+function loadToken(tokenPath) {
+    try {
+        const expandedPath = expandPath(tokenPath);
+        const raw = fs.readFileSync(expandedPath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || !parsed)
+            return null;
+        if ("access" in parsed && "refresh" in parsed) {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function persistToken(token, tokenPath) {
+    const expandedPath = expandPath(tokenPath);
+    const dir = path.dirname(expandedPath);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(expandedPath, JSON.stringify(token, null, 2));
+}
+async function fetchWithTimeout(url, options, timeoutMs = 10000) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...options, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function authorizeGoogle(clientId, redirectUri, projectId = "") {
+    const pkce = generatePkce();
+    const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+    url.searchParams.set("client_id", clientId);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("scope", GOOGLE_SCOPES.join(" "));
+    url.searchParams.set("code_challenge", pkce.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", encodeState({ verifier: pkce.verifier, projectId: projectId || "" }));
+    url.searchParams.set("access_type", "offline");
+    url.searchParams.set("prompt", "consent");
+    return { url: url.toString(), verifier: pkce.verifier, projectId: projectId || "" };
+}
+async function exchangeGoogle(code, state, clientId, clientSecret, redirectUri, log) {
+    try {
+        const { verifier } = decodeState(state || "");
+        const startTime = Date.now();
+        const requestBody = new URLSearchParams({
+            client_id: clientId,
+            client_secret: clientSecret,
+            code,
+            grant_type: "authorization_code",
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+        });
+        await log({
+            service: "opencode-auth-proxy",
+            level: "info",
+            message: "OAuth token exchange request",
+            extra: {
+                redirect_uri: redirectUri,
+                client_id: clientId,
+                client_secret_length: clientSecret?.length || 0,
+                code_length: code?.length || 0,
+                has_verifier: !!verifier,
+            },
+        });
+        const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: requestBody,
+        });
+        if (!tokenResponse.ok) {
+            const errorText = await tokenResponse.text();
+            let parsedError = {};
+            try {
+                parsedError = JSON.parse(errorText);
+            }
+            catch {
+                parsedError = { raw: errorText };
+            }
+            await log({
+                service: "opencode-auth-proxy",
+                level: "error",
+                message: "OAuth token exchange failed",
+                extra: {
+                    status: tokenResponse.status,
+                    statusText: tokenResponse.statusText,
+                    error: parsedError,
+                    redirect_uri: redirectUri,
+                    redirect_uri_length: redirectUri.length,
+                    client_id: clientId,
+                    client_id_length: clientId.length,
+                    client_secret_set: !!clientSecret,
+                    client_secret_length: clientSecret?.length || 0,
+                },
+            });
+            const errorMessage = parsedError.error_description || parsedError.error || errorText;
+            return { type: "failed", error: errorMessage };
+        }
+        const tokenPayload = (await tokenResponse.json());
+        const userInfoResponse = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
+            headers: { Authorization: `Bearer ${tokenPayload.access_token}` },
+        });
+        const userInfo = userInfoResponse.ok ? (await userInfoResponse.json()) : {};
+        const refreshToken = tokenPayload.refresh_token;
+        if (!refreshToken)
+            return { type: "failed", error: "Missing refresh token in response" };
+        return {
+            type: "success",
+            refresh: refreshToken,
+            access: tokenPayload.access_token,
+            expires: startTime + (tokenPayload.expires_in || 0) * 1000,
+            email: userInfo.email,
+            projectId: "",
+        };
+    }
+    catch (error) {
+        return { type: "failed", error: error instanceof Error ? error.message : "Unknown error" };
+    }
+}
+function normalizeRedirectUri(uri, defaultPort) {
+    const defaultUri = `http://localhost:${defaultPort}/auth/google/callback`;
+    const rawUri = uri?.trim() || defaultUri;
+    try {
+        const url = new URL(rawUri);
+        if (url.pathname.endsWith("/") && url.pathname !== "/") {
+            url.pathname = url.pathname.replace(/\/+$/, "");
+            return url.toString();
+        }
+        return rawUri;
+    }
+    catch (err) {
+        return rawUri;
+    }
+}
+function getCallbackPath(redirectUri) {
+    try {
+        const url = new URL(redirectUri);
+        return url.pathname || "/auth/google/callback";
+    }
+    catch {
+        return "/auth/google/callback";
+    }
+}
+const opencodeAuthProxy = async ({ client, directory }) => {
+    await client.app.log({
+        service: "opencode-auth-proxy",
+        level: "info",
+        message: "Plugin initializing",
+        extra: {
+            hasEnvPort: !!process.env.PORT,
+            hasEnvSessionSecret: !!process.env.SESSION_SECRET,
+            hasEnvGoogleId: !!process.env.GOOGLE_REDIRECT_CLIENT_ID,
+            directory,
+        },
+    });
+    const config = client.app.config?.authProxy;
+    const PORT = config?.port ?? Number(process.env.PORT ?? 4096);
+    const TARGET_HOST = config?.targetHost ?? (process.env.TARGET_HOST ?? "127.0.0.1");
+    const TARGET_PORT = config?.targetPort ?? Number(process.env.TARGET_PORT ?? 4097);
+    const GOOGLE_CLIENT_ID = process.env.GOOGLE_REDIRECT_CLIENT_ID?.trim() ?? config?.googleClientId?.trim() ?? "";
+    const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_REDIRECT_CLIENT_SECRET?.trim() ?? config?.googleClientSecret?.trim() ?? "";
+    const GOOGLE_REDIRECT_URI = normalizeRedirectUri(config?.googleRedirectUri ?? process.env.GOOGLE_REDIRECT_URI, PORT);
+    const providedSessionSecret = process.env.SESSION_SECRET?.trim() ?? config?.sessionSecret?.trim();
+    const SESSION_SECRET = providedSessionSecret ?? crypto.randomBytes(32).toString("hex");
+    if (!providedSessionSecret) {
+        await client.app.log({
+            service: "opencode-auth-proxy",
+            level: "warn",
+            message: "SESSION_SECRET not provided, auto-generating. Sessions will not persist across restarts.",
+        });
+    }
+    const SESSION_COOKIE_NAME = config?.sessionCookieName ?? process.env.SESSION_COOKIE_NAME ?? "opencode_session";
+    const TOKEN_PATH = config?.tokenPath || process.env.TOKEN_PATH || path.join(os.homedir(), ".opencode-proxy", "google-auth.json");
+    const COOKIE_SECURE = (() => {
+        if (config?.cookieSecure !== undefined)
+            return config.cookieSecure;
+        if (process.env.COOKIE_SECURE !== undefined)
+            return process.env.COOKIE_SECURE !== "false";
+        try {
+            const redirectUrl = new URL(GOOGLE_REDIRECT_URI);
+            return redirectUrl.protocol === "https:";
+        }
+        catch {
+            return false;
+        }
+    })();
+    if (!GOOGLE_CLIENT_ID || !GOOGLE_CLIENT_SECRET) {
+        await client.app.log({
+            service: "opencode-auth-proxy",
+            level: "error",
+            message: "Google OAuth credentials are required (GOOGLE_REDIRECT_CLIENT_ID and GOOGLE_REDIRECT_CLIENT_SECRET)",
+            extra: {
+                hasClientId: !!GOOGLE_CLIENT_ID,
+                hasClientSecret: !!GOOGLE_CLIENT_SECRET,
+                hasEnvClientId: !!process.env.GOOGLE_REDIRECT_CLIENT_ID,
+                hasEnvClientSecret: !!process.env.GOOGLE_REDIRECT_CLIENT_SECRET,
+            },
+        });
+        return {};
+    }
+    const target = `http://${TARGET_HOST}:${TARGET_PORT}`;
+    const CALLBACK_PATH = getCallbackPath(GOOGLE_REDIRECT_URI);
+    const PUBLIC_PATHS = new Set([
+        "/health",
+        "/global/health",
+        "/auth/google/start",
+        "/auth/google/config",
+        CALLBACK_PATH,
+        "/auth/google/callback",
+    ]);
+    function isPublicPath(pathname) {
+        return PUBLIC_PATHS.has(pathname);
+    }
+    const proxy = httpProxy.createProxyServer({
+        target,
+        changeOrigin: true,
+        ws: true,
+    });
+    proxy.on("error", async (err, req, res) => {
+        const url = req.url || "/";
+        const method = req.method || "UNKNOWN";
+        await client.app.log({
+            service: "opencode-auth-proxy",
+            level: "error",
+            message: "Proxy error",
+            extra: {
+                message: err?.message,
+                code: err?.code,
+                errno: err?.errno,
+                syscall: err?.syscall,
+                target,
+                url,
+                method,
+                stack: err?.stack,
+            },
+        });
+        const response = res;
+        if (response && !response.headersSent) {
+            response.writeHead(502, { "Content-Type": "application/json" });
+            response.end(JSON.stringify({
+                error: "Proxy error",
+                message: err?.message,
+                code: err?.code,
+                target,
+            }));
+        }
+    });
+    const server = http.createServer(async (req, res) => {
+        const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+        const pathname = url.pathname || "/";
+        const accept = String(req.headers.accept || "");
+        const isSSE = accept.includes("text/event-stream") || pathname === "/event" || pathname === "/global/event";
+        const rejectRequest = async () => {
+            if (isSSE) {
+                await client.app.log({
+                    service: "opencode-auth-proxy",
+                    level: "warn",
+                    message: "Unauthorized request",
+                    extra: { method: req.method, path: pathname, kind: "sse" },
+                });
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.write(JSON.stringify({ error: "unauthorized" }));
+            }
+            else if (req.method && req.method.toUpperCase() === "GET") {
+                await client.app.log({
+                    service: "opencode-auth-proxy",
+                    level: "warn",
+                    message: "Unauthorized request",
+                    extra: { method: req.method, path: pathname, kind: "redirect" },
+                });
+                res.writeHead(302, { Location: "/auth/google/start" });
+            }
+            else {
+                await client.app.log({
+                    service: "opencode-auth-proxy",
+                    level: "warn",
+                    message: "Unauthorized request",
+                    extra: { method: req.method, path: pathname, kind: "api" },
+                });
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.write(JSON.stringify({ error: "unauthorized" }));
+            }
+            res.end();
+        };
+        if (!isPublicPath(pathname)) {
+            const cookies = parseCookies(req);
+            const isAuthenticated = cookies[SESSION_COOKIE_NAME]
+                ? verifySession(cookies[SESSION_COOKIE_NAME], SESSION_SECRET)
+                : false;
+            if (!isAuthenticated) {
+                await rejectRequest();
+                return;
+            }
+        }
+        if (pathname === "/health" || pathname === "/global/health") {
+            const upstream = await (async () => {
+                try {
+                    const response = await fetchWithTimeout(`${target}/global/health`, { method: "GET" }, 2000);
+                    const body = await response
+                        .json()
+                        .catch(async () => ({ text: await response.text().catch(() => "") }));
+                    return { ok: response.ok, status: response.status, body };
+                }
+                catch (e) {
+                    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+                }
+            })();
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ status: "ok", healthy: true, target, upstream }));
+            return;
+        }
+        if (pathname === "/auth/google/config") {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                redirect_uri: GOOGLE_REDIRECT_URI,
+                callback_path: CALLBACK_PATH,
+                client_id: GOOGLE_CLIENT_ID.substring(0, 20) + "...",
+                client_secret_set: !!GOOGLE_CLIENT_SECRET,
+                scopes: GOOGLE_SCOPES,
+            }));
+            return;
+        }
+        if (pathname === "/auth/google/start") {
+            try {
+                const projectId = url.searchParams.get("project") || "";
+                const result = await authorizeGoogle(GOOGLE_CLIENT_ID, GOOGLE_REDIRECT_URI, projectId);
+                res.writeHead(302, { Location: result.url });
+                res.end();
+            }
+            catch (err) {
+                await client.app.log({
+                    service: "opencode-auth-proxy",
+                    level: "error",
+                    message: "Auth start error",
+                    extra: { error: err instanceof Error ? err.message : String(err) },
+                });
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: err?.message || "auth start failed" }));
+            }
+            return;
+        }
+        if (pathname === CALLBACK_PATH || pathname === "/auth/google/callback") {
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state") || "";
+            if (!code) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "missing code" }));
+                return;
+            }
+            try {
+                const result = await exchangeGoogle(code, state, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI, client.app.log.bind(client.app));
+                if (result.type !== "success") {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify(result));
+                    return;
+                }
+                const payload = { ...result, storedAt: new Date().toISOString() };
+                persistToken(payload, TOKEN_PATH);
+                const cookie = `${SESSION_COOKIE_NAME}=${signSession(SESSION_SECRET)}; Path=/; HttpOnly; SameSite=Lax${COOKIE_SECURE ? "; Secure" : ""}`;
+                const redirectTo = url.searchParams.get("redirect");
+                const targetPath = redirectTo && redirectTo.startsWith("/") ? redirectTo : "/";
+                res.writeHead(302, { Location: targetPath, "Set-Cookie": cookie });
+                res.end();
+            }
+            catch (err) {
+                await client.app.log({
+                    service: "opencode-auth-proxy",
+                    level: "error",
+                    message: "Auth callback error",
+                    extra: { error: err instanceof Error ? err.message : String(err) },
+                });
+                res.writeHead(500, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: err?.message || "auth callback failed" }));
+            }
+            return;
+        }
+        if (url.pathname === "/auth/google/token") {
+            const token = loadToken(TOKEN_PATH);
+            if (!token) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "token not found" }));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ token }));
+            return;
+        }
+        proxy.web(req, res, { target });
+    });
+    server.on("upgrade", async (req, socket, head) => {
+        const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+        if (!isPublicPath(url.pathname || "/")) {
+            const cookies = parseCookies(req);
+            const isAuthenticated = cookies[SESSION_COOKIE_NAME]
+                ? verifySession(cookies[SESSION_COOKIE_NAME], SESSION_SECRET)
+                : false;
+            if (!isAuthenticated) {
+                await client.app.log({
+                    service: "opencode-auth-proxy",
+                    level: "warn",
+                    message: "Unauthorized WebSocket upgrade",
+                    extra: { method: "UPGRADE", path: url.pathname || "/" },
+                });
+                socket.destroy();
+                return;
+            }
+        }
+        proxy.ws(req, socket, head);
+    });
+    try {
+        server.listen(PORT, async () => {
+            await client.app.log({
+                service: "opencode-auth-proxy",
+                level: "info",
+                message: `Proxy server started`,
+                extra: {
+                    port: PORT,
+                    target,
+                },
+            });
+        });
+    }
+    catch (error) {
+        await client.app.log({
+            service: "opencode-auth-proxy",
+            level: "error",
+            message: "Failed to start proxy server",
+            extra: {
+                error: error instanceof Error ? error.message : String(error),
+                port: PORT,
+            },
+        });
+    }
+    return {
+        event: async () => { },
+    };
+};
+export { opencodeAuthProxy };
+export default opencodeAuthProxy;
+//# sourceMappingURL=opencode-auth-proxy.js.map

package/dist/opencode-auth-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-auth-proxy.js","sourceRoot":"","sources":["../opencode-auth-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,IAAyC,MAAM,MAAM,CAAA;AAC5D,OAAO,SAAS,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,MAAM,IAAI,CAAA;AA0BnB,MAAM,aAAa,GAAG;IACpB,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;CACnD,CAAA;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,OAAgD;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAA;AAC/E,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,MAAM,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAA;QACpB,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAA;IACZ,CAAC,EAAE,EAAE,CAAC,CAAA;AACR,CAAC;AAED,SAAS,WAAW,CAAC,aAAqB;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9F,OAAO,GAAG,WAAW,IAAI,SAAS,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,aAAqB;IACzD,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7F,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;AAC9F,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACtD,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YAC9C,OAAO,MAAsB,CAAA;QAC/B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB,EAAE,SAAiB;IAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACtC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACtC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAoB,EAAE,SAAS,GAAG,KAAK;IAClF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC/D,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,WAAmB,EACnB,SAAS,GAAG,EAAE;IAEd,MAAM,IAAI,GAAG,YAAY,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,8CAA8C,CAAC,CAAA;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IACnG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACzC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,IAAI,EAAE,EAAE,CAAA;AACrF,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,KAAa,EACb,QAAgB,EAChB,YAAoB,EACpB,WAAmB,EACnB,GAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;YACtC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,QAAQ;SACxB,CAAC,CAAA;QACF,MAAM,GAAG,CAAC;YACR,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE;gBACL,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ;gBACnB,oBAAoB,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;gBAC/C,WAAW,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;gBAC9B,YAAY,EAAE,CAAC,CAAC,QAAQ;aACzB;SACF,CAAC,CAAA;QACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,WAAW;SAClB,CAAC,CAAA;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAA;YAC5C,IAAI,WAAW,GAAQ,EAAE,CAAA;YACzB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,GAAG,CAAC;gBACR,OAAO,EAAE,qBAAqB;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,6BAA6B;gBACtC,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa,CAAC,MAAM;oBAC5B,UAAU,EAAE,aAAa,CAAC,UAAU;oBACpC,KAAK,EAAE,WAAW;oBAClB,YAAY,EAAE,WAAW;oBACzB,mBAAmB,EAAE,WAAW,CAAC,MAAM;oBACvC,SAAS,EAAE,QAAQ;oBACnB,gBAAgB,EAAE,QAAQ,CAAC,MAAM;oBACjC,iBAAiB,EAAE,CAAC,CAAC,YAAY;oBACjC,oBAAoB,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;iBAChD;aACF,CAAC,CAAA;YACF,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,IAAI,WAAW,CAAC,KAAK,IAAI,SAAS,CAAA;YACpF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;QAChD,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAI/C,CAAA;QACD,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wDAAwD,EAAE;YAC7F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,CAAC,YAAY,EAAE,EAAE;SAClE,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAwB,CAAC,CAAC,CAAC,EAAE,CAAA;QAEnG,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAA;QAC/C,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAA;QAExF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,YAAY,CAAC,YAAY;YACjC,OAAO,EAAE,SAAS,GAAG,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,IAAI;YAC1D,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,EAAE;SACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAuB,EAAE,WAAmB;IACxE,MAAM,UAAU,GAAG,oBAAoB,WAAW,uBAAuB,CAAA;IACzE,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,UAAU,CAAA;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACvD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC/C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;QAChC,OAAO,GAAG,CAAC,QAAQ,IAAI,uBAAuB,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAA;IAChC,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAW,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;IAChE,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,OAAO,EAAE,qBAAqB;QAC9B,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,qBAAqB;QAC9B,KAAK,EAAE;YACL,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;YAC9B,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;YACjD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;YACvD,SAAS;SACV;KACF,CAAC,CAAA;IAEF,MAAM,MAAM,GAAI,MAAM,CAAC,GAAG,CAAC,MAA0C,EAAE,SAAS,CAAA;IAEhF,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,CAAA;IAClF,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;IACjF,MAAM,gBAAgB,GACpB,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACvF,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC/F,MAAM,mBAAmB,GAAG,oBAAoB,CAC9C,MAAM,EAAE,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAC5D,IAAI,CACL,CAAA;IACD,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;IACjG,MAAM,cAAc,GAAG,qBAAqB,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACtF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,0FAA0F;SACpG,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,EAAE,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,kBAAkB,CAAA;IAC9G,MAAM,UAAU,GACd,MAAM,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAA;IAE/G,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,YAAY,CAAA;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,OAAO,CAAA;QACzF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAChD,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAA;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IAGJ,IAAI,CAAC,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/C,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,qGAAqG;YAC9G,KAAK,EAAE;gBACL,WAAW,EAAE,CAAC,CAAC,gBAAgB;gBAC/B,eAAe,EAAE,CAAC,CAAC,oBAAoB;gBACvC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB;gBACvD,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B;aAChE;SACF,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,WAAW,IAAI,WAAW,EAAE,CAAA;IACrD,MAAM,aAAa,GAAG,eAAe,CAAC,mBAAmB,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,SAAS;QACT,gBAAgB;QAChB,oBAAoB;QACpB,qBAAqB;QACrB,aAAa;QACb,uBAAuB;KACxB,CAAC,CAAA;IAEF,SAAS,YAAY,CAAC,QAAgB;QACpC,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAC;QACxC,MAAM;QACN,YAAY,EAAE,IAAI;QAClB,EAAE,EAAE,IAAI;KACT,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAoB,EAAE,GAAQ,EAAE,EAAE;QACnE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAA;QACtC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE;gBACL,OAAO,EAAE,GAAG,EAAE,OAAO;gBACrB,IAAI,EAAE,GAAG,EAAE,IAAI;gBACf,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,OAAO,EAAE,GAAG,EAAE,OAAO;gBACrB,MAAM;gBACN,GAAG;gBACH,MAAM;gBACN,KAAK,EAAE,GAAG,EAAE,KAAK;aAClB;SACF,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,GAAiC,CAAA;QAClD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC/D,QAAQ,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,GAAG,EAAE,OAAO;gBACrB,IAAI,EAAE,GAAG,EAAE,IAAI;gBACf,MAAM;aACP,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,eAAe,CAAA;QAE3G,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,sBAAsB;oBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;iBAC3D,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC5D,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,sBAAsB;oBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE;iBAChE,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAA;YACxD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,sBAAsB;oBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;iBAC3D,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,GAAG,CAAC,GAAG,EAAE,CAAA;QACX,CAAC,CAAA;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YACjC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;gBAClD,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC;gBAC7D,CAAC,CAAC,KAAK,CAAA;YACT,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,aAAa,EAAE,CAAA;gBACrB,OAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;gBACjC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,MAAM,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC3F,MAAM,IAAI,GAAG,MAAM,QAAQ;yBACxB,IAAI,EAAE;yBACN,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;oBACvE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;gBAC3D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;gBACzE,CAAC;YACH,CAAC,CAAC,EAAE,CAAA;YACJ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;YAC1E,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,YAAY,EAAE,mBAAmB;gBACjC,aAAa,EAAE,aAAa;gBAC5B,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACpD,iBAAiB,EAAE,CAAC,CAAC,oBAAoB;gBACzC,MAAM,EAAE,aAAa;aACtB,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;gBACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;gBACtF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC5C,GAAG,CAAC,GAAG,EAAE,CAAA;YACX,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,kBAAkB;oBAC3B,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACnE,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAA;YACpF,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;gBAClD,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,KAAK,EACL,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAChC,CAAA;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;oBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;oBAC/B,OAAM;gBACR,CAAC;gBACD,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;gBACjE,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;gBAEjC,MAAM,MAAM,GAAG,GAAG,mBAAmB,IAAI,WAAW,CAAC,cAAc,CAAC,mCAAmC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;gBACxI,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACnD,MAAM,UAAU,GAAG,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAA;gBAE9E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;gBAClE,GAAG,CAAC,GAAG,EAAE,CAAA;YACX,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACnE,CAAC,CAAA;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAA;YACvF,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAA;gBACrD,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;YAClC,OAAM;QACR,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YACjC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;gBAClD,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC;gBAC7D,CAAC,CAAC,KAAK,CAAA;YACT,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACnB,OAAO,EAAE,qBAAqB;oBAC9B,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,gCAAgC;oBACzC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,EAAE;iBACxD,CAAC,CAAA;gBACF,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,OAAM;YACR,CAAC;QACH,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAC7B,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnB,OAAO,EAAE,qBAAqB;gBAC9B,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,sBAAsB;gBAC/B,KAAK,EAAE;oBACL,IAAI,EAAE,IAAI;oBACV,MAAM;iBACP;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,OAAO,EAAE,qBAAqB;YAC9B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,IAAI,EAAE,IAAI;aACX;SACF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACtB,CAAA;AACH,CAAC,CAAA;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAC5B,eAAe,iBAAiB,CAAA"}

package/package.json

@@ -1,15 +1,18 @@
 {
   "name": "opencode-auth-proxy",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Google OAuth authentication proxy plugin for OpenCode - provides secure OAuth flow with session management",
   "type": "module",
-  "module": "opencode-auth-proxy.ts",
-  "main": "opencode-auth-proxy.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./opencode-auth-proxy.ts"
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
   },
   "files": [
-    "opencode-auth-proxy.ts",
+    "dist/",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"
@@ -32,6 +35,10 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build"
+  },
   "peerDependencies": {
     "typescript": "^5"
   },
@@ -40,6 +47,8 @@
     "http-proxy": "^1.18.1"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0"
+    "@types/http-proxy": "^1.17.17",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.9.3"
   }
 }

package/opencode-auth-proxy.ts

@@ -1,588 +0,0 @@
-import type { Plugin } from "@opencode-ai/plugin"
-import http, { IncomingMessage, ServerResponse } from "http"
-import httpProxy from "http-proxy"
-import fs from "fs"
-import path from "path"
-import crypto from "crypto"
-import os from "os"
-
-type AuthProxyConfig = {
-  port?: number
-  targetPort?: number
-  targetHost?: string
-  googleClientId?: string
-  googleClientSecret?: string
-  googleRedirectUri?: string
-  sessionSecret?: string
-  sessionCookieName?: string
-  cookieSecure?: boolean
-  tokenPath?: string
-}
-
-type TokenSuccess = {
-  type: "success"
-  refresh: string
-  access: string
-  expires: number
-  email?: string
-  projectId: string
-}
-
-type TokenPayload = TokenSuccess | { type: "failed"; error: string }
-
-const GOOGLE_SCOPES = [
-  "https://www.googleapis.com/auth/cloud-platform",
-  "https://www.googleapis.com/auth/userinfo.email",
-  "https://www.googleapis.com/auth/userinfo.profile",
-]
-
-function base64url(buf: Buffer): string {
-  return buf
-    .toString("base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/, "")
-}
-
-function encodeState(payload: { verifier: string; projectId: string }): string {
-  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url")
-}
-
-function decodeState(state: string): { verifier: string; projectId: string } {
-  const normalized = state.replace(/-/g, "+").replace(/_/g, "/")
-  const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=")
-  const json = Buffer.from(padded, "base64").toString("utf8")
-  const parsed = JSON.parse(json)
-  return { verifier: parsed.verifier || "", projectId: parsed.projectId || "" }
-}
-
-function generatePkce() {
-  const verifier = base64url(crypto.randomBytes(32))
-  const challenge = base64url(crypto.createHash("sha256").update(verifier).digest())
-  return { verifier, challenge }
-}
-
-function parseCookies(req: IncomingMessage): Record<string, string> {
-  const header = req.headers.cookie
-  if (!header) return {}
-  return header.split(";").reduce<Record<string, string>>((acc, part) => {
-    const [key, ...valueParts] = part.trim().split("=")
-    if (!key) return acc
-    acc[key] = valueParts.join("=")
-    return acc
-  }, {})
-}
-
-function signSession(sessionSecret: string): string {
-  const sessionData = Buffer.from("authenticated", "utf8").toString("base64url")
-  const signature = crypto.createHmac("sha256", sessionSecret).update(sessionData).digest("hex")
-  return `${sessionData}.${signature}`
-}
-
-function verifySession(token: string, sessionSecret: string): boolean {
-  const [sessionPart, signature] = token.split(".")
-  if (!sessionPart || !signature) return false
-  const expected = crypto.createHmac("sha256", sessionSecret).update(sessionPart).digest("hex")
-  return crypto.timingSafeEqual(Buffer.from(signature, "utf8"), Buffer.from(expected, "utf8"))
-}
-
-function expandPath(filePath: string): string {
-  if (filePath.startsWith("~/")) {
-    return path.join(os.homedir(), filePath.slice(2))
-  }
-  return filePath
-}
-
-function loadToken(tokenPath: string): TokenSuccess | null {
-  try {
-    const expandedPath = expandPath(tokenPath)
-    const raw = fs.readFileSync(expandedPath, "utf8")
-    const parsed = JSON.parse(raw)
-    if (typeof parsed !== "object" || !parsed) return null
-    if ("access" in parsed && "refresh" in parsed) {
-      return parsed as TokenSuccess
-    }
-    return null
-  } catch {
-    return null
-  }
-}
-
-function persistToken(token: TokenSuccess, tokenPath: string) {
-  const expandedPath = expandPath(tokenPath)
-  const dir = path.dirname(expandedPath)
-  fs.mkdirSync(dir, { recursive: true })
-  fs.writeFileSync(expandedPath, JSON.stringify(token, null, 2))
-}
-
-async function fetchWithTimeout(url: string, options: RequestInit, timeoutMs = 10000): Promise<Response> {
-  const controller = new AbortController()
-  const timeout = setTimeout(() => controller.abort(), timeoutMs)
-  try {
-    return await fetch(url, { ...options, signal: controller.signal })
-  } finally {
-    clearTimeout(timeout)
-  }
-}
-
-async function authorizeGoogle(
-  clientId: string,
-  redirectUri: string,
-  projectId = "",
-): Promise<{ url: string; verifier: string; projectId: string }> {
-  const pkce = generatePkce()
-  const url = new URL("https://accounts.google.com/o/oauth2/v2/auth")
-  url.searchParams.set("client_id", clientId)
-  url.searchParams.set("response_type", "code")
-  url.searchParams.set("redirect_uri", redirectUri)
-  url.searchParams.set("scope", GOOGLE_SCOPES.join(" "))
-  url.searchParams.set("code_challenge", pkce.challenge)
-  url.searchParams.set("code_challenge_method", "S256")
-  url.searchParams.set("state", encodeState({ verifier: pkce.verifier, projectId: projectId || "" }))
-  url.searchParams.set("access_type", "offline")
-  url.searchParams.set("prompt", "consent")
-  return { url: url.toString(), verifier: pkce.verifier, projectId: projectId || "" }
-}
-
-async function exchangeGoogle(
-  code: string,
-  state: string,
-  clientId: string,
-  clientSecret: string,
-  redirectUri: string,
-  log: (data: any) => Promise<void>,
-): Promise<TokenPayload> {
-  try {
-    const { verifier } = decodeState(state || "")
-    const startTime = Date.now()
-    const requestBody = new URLSearchParams({
-      client_id: clientId,
-      client_secret: clientSecret,
-      code,
-      grant_type: "authorization_code",
-      redirect_uri: redirectUri,
-      code_verifier: verifier,
-    })
-    await log({
-      service: "opencode-auth-proxy",
-      level: "info",
-      message: "OAuth token exchange request",
-      extra: {
-        redirect_uri: redirectUri,
-        client_id: clientId,
-        client_secret_length: clientSecret?.length || 0,
-        code_length: code?.length || 0,
-        has_verifier: !!verifier,
-      },
-    })
-    const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: requestBody,
-    })
-    if (!tokenResponse.ok) {
-      const errorText = await tokenResponse.text()
-      let parsedError: any = {}
-      try {
-        parsedError = JSON.parse(errorText)
-      } catch {
-        parsedError = { raw: errorText }
-      }
-      await log({
-        service: "opencode-auth-proxy",
-        level: "error",
-        message: "OAuth token exchange failed",
-        extra: {
-          status: tokenResponse.status,
-          statusText: tokenResponse.statusText,
-          error: parsedError,
-          redirect_uri: redirectUri,
-          redirect_uri_length: redirectUri.length,
-          client_id: clientId,
-          client_id_length: clientId.length,
-          client_secret_set: !!clientSecret,
-          client_secret_length: clientSecret?.length || 0,
-        },
-      })
-      const errorMessage = parsedError.error_description || parsedError.error || errorText
-      return { type: "failed", error: errorMessage }
-    }
-
-    const tokenPayload = (await tokenResponse.json()) as {
-      access_token: string
-      expires_in: number
-      refresh_token?: string
-    }
-    const userInfoResponse = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
-      headers: { Authorization: `Bearer ${tokenPayload.access_token}` },
-    })
-    const userInfo = userInfoResponse.ok ? ((await userInfoResponse.json()) as { email?: string }) : {}
-
-    const refreshToken = tokenPayload.refresh_token
-    if (!refreshToken) return { type: "failed", error: "Missing refresh token in response" }
-
-    return {
-      type: "success",
-      refresh: refreshToken,
-      access: tokenPayload.access_token,
-      expires: startTime + (tokenPayload.expires_in || 0) * 1000,
-      email: userInfo.email,
-      projectId: "",
-    }
-  } catch (error) {
-    return { type: "failed", error: error instanceof Error ? error.message : "Unknown error" }
-  }
-}
-
-function normalizeRedirectUri(uri: string | undefined, defaultPort: number): string {
-  const defaultUri = `http://localhost:${defaultPort}/auth/google/callback`
-  const rawUri = uri?.trim() || defaultUri
-  try {
-    const url = new URL(rawUri)
-    if (url.pathname.endsWith("/") && url.pathname !== "/") {
-      url.pathname = url.pathname.replace(/\/+$/, "")
-      return url.toString()
-    }
-    return rawUri
-  } catch (err) {
-    return rawUri
-  }
-}
-
-function getCallbackPath(redirectUri: string): string {
-  try {
-    const url = new URL(redirectUri)
-    return url.pathname || "/auth/google/callback"
-  } catch {
-    return "/auth/google/callback"
-  }
-}
-
-const opencodeAuthProxy: Plugin = async ({ client, directory }) => {
-  await client.app.log({
-    service: "opencode-auth-proxy",
-    level: "info",
-    message: "Plugin initializing",
-    extra: {
-      hasEnvPort: !!process.env.PORT,
-      hasEnvSessionSecret: !!process.env.SESSION_SECRET,
-      hasEnvGoogleId: !!process.env.GOOGLE_REDIRECT_CLIENT_ID,
-      directory,
-    },
-  })
-
-  const config = (client.app.config as { authProxy?: AuthProxyConfig })?.authProxy
-
-  const PORT = config?.port ?? Number(process.env.PORT ?? 4096)
-  const TARGET_HOST = config?.targetHost ?? (process.env.TARGET_HOST ?? "127.0.0.1")
-  const TARGET_PORT = config?.targetPort ?? Number(process.env.TARGET_PORT ?? 4097)
-  const GOOGLE_CLIENT_ID =
-    process.env.GOOGLE_REDIRECT_CLIENT_ID?.trim() ?? config?.googleClientId?.trim() ?? ""
-  const GOOGLE_CLIENT_SECRET =
-    process.env.GOOGLE_REDIRECT_CLIENT_SECRET?.trim() ?? config?.googleClientSecret?.trim() ?? ""
-  const GOOGLE_REDIRECT_URI = normalizeRedirectUri(
-    config?.googleRedirectUri ?? process.env.GOOGLE_REDIRECT_URI,
-    PORT,
-  )
-  const providedSessionSecret = process.env.SESSION_SECRET?.trim() ?? config?.sessionSecret?.trim()
-  const SESSION_SECRET = providedSessionSecret ?? crypto.randomBytes(32).toString("hex")
-  if (!providedSessionSecret) {
-    await client.app.log({
-      service: "opencode-auth-proxy",
-      level: "warn",
-      message: "SESSION_SECRET not provided, auto-generating. Sessions will not persist across restarts.",
-    })
-  }
-  const SESSION_COOKIE_NAME = config?.sessionCookieName ?? process.env.SESSION_COOKIE_NAME ?? "opencode_session"
-  const TOKEN_PATH =
-    config?.tokenPath || process.env.TOKEN_PATH || path.join(os.homedir(), ".opencode-proxy", "google-auth.json")
-
-  const COOKIE_SECURE = (() => {
-    if (config?.cookieSecure !== undefined) return config.cookieSecure
-    if (process.env.COOKIE_SECURE !== undefined) return process.env.COOKIE_SECURE !== "false"
-    try {
-      const redirectUrl = new URL(GOOGLE_REDIRECT_URI)
-      return redirectUrl.protocol === "https:"
-    } catch {
-      return false
-    }
-  })()
-
-
-  if (!GOOGLE_CLIENT_ID || !GOOGLE_CLIENT_SECRET) {
-    await client.app.log({
-      service: "opencode-auth-proxy",
-      level: "error",
-      message: "Google OAuth credentials are required (GOOGLE_REDIRECT_CLIENT_ID and GOOGLE_REDIRECT_CLIENT_SECRET)",
-      extra: {
-        hasClientId: !!GOOGLE_CLIENT_ID,
-        hasClientSecret: !!GOOGLE_CLIENT_SECRET,
-        hasEnvClientId: !!process.env.GOOGLE_REDIRECT_CLIENT_ID,
-        hasEnvClientSecret: !!process.env.GOOGLE_REDIRECT_CLIENT_SECRET,
-      },
-    })
-    return {}
-  }
-
-  const target = `http://${TARGET_HOST}:${TARGET_PORT}`
-  const CALLBACK_PATH = getCallbackPath(GOOGLE_REDIRECT_URI)
-  const PUBLIC_PATHS = new Set([
-    "/health",
-    "/global/health",
-    "/auth/google/start",
-    "/auth/google/config",
-    CALLBACK_PATH,
-    "/auth/google/callback",
-  ])
-
-  function isPublicPath(pathname: string): boolean {
-    return PUBLIC_PATHS.has(pathname)
-  }
-
-  const proxy = httpProxy.createProxyServer({
-    target,
-    changeOrigin: true,
-    ws: true,
-  })
-
-  proxy.on("error", async (err: any, req: IncomingMessage, res: any) => {
-    const url = req.url || "/"
-    const method = req.method || "UNKNOWN"
-    await client.app.log({
-      service: "opencode-auth-proxy",
-      level: "error",
-      message: "Proxy error",
-      extra: {
-        message: err?.message,
-        code: err?.code,
-        errno: err?.errno,
-        syscall: err?.syscall,
-        target,
-        url,
-        method,
-        stack: err?.stack,
-      },
-    })
-    const response = res as ServerResponse | undefined
-    if (response && !response.headersSent) {
-      response.writeHead(502, { "Content-Type": "application/json" })
-      response.end(
-        JSON.stringify({
-          error: "Proxy error",
-          message: err?.message,
-          code: err?.code,
-          target,
-        }),
-      )
-    }
-  })
-
-  const server = http.createServer(async (req: IncomingMessage, res: ServerResponse) => {
-    const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`)
-    const pathname = url.pathname || "/"
-    const accept = String(req.headers.accept || "")
-    const isSSE = accept.includes("text/event-stream") || pathname === "/event" || pathname === "/global/event"
-
-    const rejectRequest = async () => {
-      if (isSSE) {
-        await client.app.log({
-          service: "opencode-auth-proxy",
-          level: "warn",
-          message: "Unauthorized request",
-          extra: { method: req.method, path: pathname, kind: "sse" },
-        })
-        res.writeHead(401, { "Content-Type": "application/json" })
-        res.write(JSON.stringify({ error: "unauthorized" }))
-      } else if (req.method && req.method.toUpperCase() === "GET") {
-        await client.app.log({
-          service: "opencode-auth-proxy",
-          level: "warn",
-          message: "Unauthorized request",
-          extra: { method: req.method, path: pathname, kind: "redirect" },
-        })
-        res.writeHead(302, { Location: "/auth/google/start" })
-      } else {
-        await client.app.log({
-          service: "opencode-auth-proxy",
-          level: "warn",
-          message: "Unauthorized request",
-          extra: { method: req.method, path: pathname, kind: "api" },
-        })
-        res.writeHead(401, { "Content-Type": "application/json" })
-        res.write(JSON.stringify({ error: "unauthorized" }))
-      }
-      res.end()
-    }
-
-    if (!isPublicPath(pathname)) {
-      const cookies = parseCookies(req)
-      const isAuthenticated = cookies[SESSION_COOKIE_NAME]
-        ? verifySession(cookies[SESSION_COOKIE_NAME], SESSION_SECRET)
-        : false
-      if (!isAuthenticated) {
-        await rejectRequest()
-        return
-      }
-    }
-
-    if (pathname === "/health" || pathname === "/global/health") {
-      const upstream = await (async () => {
-        try {
-          const response = await fetchWithTimeout(`${target}/global/health`, { method: "GET" }, 2000)
-          const body = await response
-            .json()
-            .catch(async () => ({ text: await response.text().catch(() => "") }))
-          return { ok: response.ok, status: response.status, body }
-        } catch (e) {
-          return { ok: false, error: e instanceof Error ? e.message : String(e) }
-        }
-      })()
-      res.writeHead(200, { "Content-Type": "application/json" })
-      res.end(JSON.stringify({ status: "ok", healthy: true, target, upstream }))
-      return
-    }
-
-    if (pathname === "/auth/google/config") {
-      res.writeHead(200, { "Content-Type": "application/json" })
-      res.end(
-        JSON.stringify({
-          redirect_uri: GOOGLE_REDIRECT_URI,
-          callback_path: CALLBACK_PATH,
-          client_id: GOOGLE_CLIENT_ID.substring(0, 20) + "...",
-          client_secret_set: !!GOOGLE_CLIENT_SECRET,
-          scopes: GOOGLE_SCOPES,
-        }),
-      )
-      return
-    }
-
-    if (pathname === "/auth/google/start") {
-      try {
-        const projectId = url.searchParams.get("project") || ""
-        const result = await authorizeGoogle(GOOGLE_CLIENT_ID, GOOGLE_REDIRECT_URI, projectId)
-        res.writeHead(302, { Location: result.url })
-        res.end()
-      } catch (err) {
-        await client.app.log({
-          service: "opencode-auth-proxy",
-          level: "error",
-          message: "Auth start error",
-          extra: { error: err instanceof Error ? err.message : String(err) },
-        })
-        res.writeHead(500, { "Content-Type": "application/json" })
-        res.end(JSON.stringify({ error: (err as Error)?.message || "auth start failed" }))
-      }
-      return
-    }
-
-    if (pathname === CALLBACK_PATH || pathname === "/auth/google/callback") {
-      const code = url.searchParams.get("code")
-      const state = url.searchParams.get("state") || ""
-      if (!code) {
-        res.writeHead(400, { "Content-Type": "application/json" })
-        res.end(JSON.stringify({ error: "missing code" }))
-        return
-      }
-      try {
-        const result = await exchangeGoogle(
-          code,
-          state,
-          GOOGLE_CLIENT_ID,
-          GOOGLE_CLIENT_SECRET,
-          GOOGLE_REDIRECT_URI,
-          client.app.log.bind(client.app),
-        )
-        if (result.type !== "success") {
-          res.writeHead(500, { "Content-Type": "application/json" })
-          res.end(JSON.stringify(result))
-          return
-        }
-        const payload = { ...result, storedAt: new Date().toISOString() }
-        persistToken(payload, TOKEN_PATH)
-
-        const cookie = `${SESSION_COOKIE_NAME}=${signSession(SESSION_SECRET)}; Path=/; HttpOnly; SameSite=Lax${COOKIE_SECURE ? "; Secure" : ""}`
-        const redirectTo = url.searchParams.get("redirect")
-        const targetPath = redirectTo && redirectTo.startsWith("/") ? redirectTo : "/"
-
-        res.writeHead(302, { Location: targetPath, "Set-Cookie": cookie })
-        res.end()
-      } catch (err) {
-        await client.app.log({
-          service: "opencode-auth-proxy",
-          level: "error",
-          message: "Auth callback error",
-          extra: { error: err instanceof Error ? err.message : String(err) },
-        })
-        res.writeHead(500, { "Content-Type": "application/json" })
-        res.end(JSON.stringify({ error: (err as Error)?.message || "auth callback failed" }))
-      }
-      return
-    }
-
-    if (url.pathname === "/auth/google/token") {
-      const token = loadToken(TOKEN_PATH)
-      if (!token) {
-        res.writeHead(404, { "Content-Type": "application/json" })
-        res.end(JSON.stringify({ error: "token not found" }))
-        return
-      }
-      res.writeHead(200, { "Content-Type": "application/json" })
-      res.end(JSON.stringify({ token }))
-      return
-    }
-
-    proxy.web(req, res, { target })
-  })
-
-  server.on("upgrade", async (req, socket, head) => {
-    const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`)
-    if (!isPublicPath(url.pathname || "/")) {
-      const cookies = parseCookies(req)
-      const isAuthenticated = cookies[SESSION_COOKIE_NAME]
-        ? verifySession(cookies[SESSION_COOKIE_NAME], SESSION_SECRET)
-        : false
-      if (!isAuthenticated) {
-        await client.app.log({
-          service: "opencode-auth-proxy",
-          level: "warn",
-          message: "Unauthorized WebSocket upgrade",
-          extra: { method: "UPGRADE", path: url.pathname || "/" },
-        })
-        socket.destroy()
-        return
-      }
-    }
-    proxy.ws(req, socket, head)
-  })
-
-  try {
-    server.listen(PORT, async () => {
-      await client.app.log({
-        service: "opencode-auth-proxy",
-        level: "info",
-        message: `Proxy server started`,
-        extra: {
-          port: PORT,
-          target,
-        },
-      })
-    })
-  } catch (error) {
-    await client.app.log({
-      service: "opencode-auth-proxy",
-      level: "error",
-      message: "Failed to start proxy server",
-      extra: {
-        error: error instanceof Error ? error.message : String(error),
-        port: PORT,
-      },
-    })
-  }
-
-  return {
-    event: async () => {},
-  }
-}
-
-export { opencodeAuthProxy }
-export default opencodeAuthProxy