synorch 0.2.0 → 0.4.0-beta.0

package/dist/harness/auth/openai-chatgpt.js

@@ -0,0 +1,446 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { credentialSecretSchema, HarnessError, PROVIDER_ERROR_RETRYABLE, ProviderFailure, providerIdSchema, } from "../contracts/index.js";
+import { claimString, decodeJwtClaims, maskEmail, openAiAuthClaims } from "./jwt.js";
+import { CHATGPT_SUBSCRIPTION_NOTICE } from "./notices.js";
+import { createResolvedCredential } from "./resolved-credential.js";
+/** Constants verified in research/provider-auth/openai-chatgpt-oauth.md §2–§6. */
+export const OPENAI_AUTH_ISSUER = "https://auth.openai.com";
+export const CODEX_PUBLIC_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export const CHATGPT_LOOPBACK_PORT = 1455;
+export const CHATGPT_OAUTH_SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+export const CHATGPT_ORIGINATOR = "synorch";
+/** Refresh when fewer than five minutes remain (Codex `CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES`). */
+export const REFRESH_WINDOW_MS = 5 * 60_000;
+const DEFAULT_TOKEN_LIFETIME_S = 3600;
+const BROWSER_TIMEOUT_MS = 10 * 60_000;
+const DEVICE_TIMEOUT_MS = 15 * 60_000;
+const PERMANENT_REFRESH_CODES = new Set(["invalid_grant", "refresh_token_expired", "refresh_token_reused", "refresh_token_invalidated"]);
+function base64url(bytes) {
+    return bytes.toString("base64url");
+}
+function failure(code, message, providerCode) {
+    return new ProviderFailure({
+        code,
+        message,
+        retryable: PROVIDER_ERROR_RETRYABLE[code],
+        ...(providerCode === undefined ? {} : { provider_code: providerCode.slice(0, 200) }),
+    });
+}
+async function defaultSleep(ms, signal) {
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(done, ms);
+        function done() {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }
+        function onAbort() {
+            clearTimeout(timer);
+            reject(failure("cancelled", "login aborted"));
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+async function readErrorCode(response) {
+    try {
+        const body = (await response.json());
+        if (typeof body.error === "string")
+            return body.error;
+        if (typeof body.error === "object" && body.error !== null) {
+            const error = body.error;
+            if (typeof error.code === "string")
+                return error.code;
+            if (typeof error.type === "string")
+                return error.type;
+        }
+        return typeof body.code === "string" ? body.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * `openai` / `oauth-subscription`: Synorch's own "Sign in with ChatGPT" (PKCE loopback on
+ * `localhost:1455`, device-code fallback), identifying honestly as `originator=synorch`. Tokens go
+ * only to Synorch's credential store; the Codex CLI's own token file is never read or written.
+ */
+export function createChatGPTAuthProvider(store, profile, options) {
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    const now = options.now ?? (() => new Date());
+    const issuer = (options.issuer ?? OPENAI_AUTH_ISSUER).replace(/\/+$/, "");
+    const clientId = options.clientId ?? CODEX_PUBLIC_CLIENT_ID;
+    const sleep = options.sleep ?? defaultSleep;
+    const ref = { provider_id: providerIdSchema.parse("openai"), method: "oauth-subscription", profile };
+    let inflight;
+    let lastIssuedAccess;
+    function secretFrom(tokens, previous) {
+        const prior = previous?.method === "oauth-subscription" ? previous : undefined;
+        const access = typeof tokens.access_token === "string" && tokens.access_token !== "" ? tokens.access_token : prior?.access_token;
+        const refresh = typeof tokens.refresh_token === "string" && tokens.refresh_token !== "" ? tokens.refresh_token : prior?.refresh_token;
+        const idToken = typeof tokens.id_token === "string" && tokens.id_token !== "" ? tokens.id_token : prior?.id_token;
+        if (access === undefined || refresh === undefined)
+            throw failure("protocol_mismatch", "token response is missing access or refresh token");
+        const idClaims = openAiAuthClaims(decodeJwtClaims(idToken));
+        const accessClaims = decodeJwtClaims(access);
+        const issuedAt = now();
+        let expiresAt;
+        if (typeof tokens.expires_in === "number" && tokens.expires_in > 0)
+            expiresAt = new Date(issuedAt.getTime() + tokens.expires_in * 1000);
+        else if (typeof accessClaims?.exp === "number")
+            expiresAt = new Date(accessClaims.exp * 1000);
+        else
+            expiresAt = new Date(issuedAt.getTime() + DEFAULT_TOKEN_LIFETIME_S * 1000);
+        const accountId = claimString(idClaims, "chatgpt_account_id") ?? claimString(openAiAuthClaims(accessClaims), "chatgpt_account_id") ?? prior?.account_id;
+        const planType = claimString(idClaims, "chatgpt_plan_type") ?? claimString(openAiAuthClaims(accessClaims), "chatgpt_plan_type") ?? prior?.plan_type;
+        return credentialSecretSchema.parse({
+            method: "oauth-subscription",
+            access_token: access,
+            refresh_token: refresh,
+            ...(idToken === undefined ? {} : { id_token: idToken }),
+            expires_at: expiresAt.toISOString(),
+            ...(accountId === undefined ? {} : { account_id: accountId }),
+            ...(planType === undefined ? {} : { plan_type: planType }),
+            originator: CHATGPT_ORIGINATOR,
+            obtained_at: prior?.obtained_at ?? issuedAt.toISOString(),
+            ...(prior === undefined ? {} : { last_refresh_at: issuedAt.toISOString() }),
+        });
+    }
+    async function exchangeCode(code, redirectUri, verifier, signal) {
+        const response = await fetchImpl(`${issuer}/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "authorization_code",
+                client_id: clientId,
+                code,
+                redirect_uri: redirectUri,
+                code_verifier: verifier,
+            }).toString(),
+            signal,
+        });
+        if (!response.ok) {
+            const errorCode = await readErrorCode(response);
+            if (errorCode === "missing_codex_entitlement")
+                throw failure("entitlement_missing", "your ChatGPT plan does not include Codex", errorCode);
+            throw failure("unauthenticated", `token exchange failed (HTTP ${response.status}${errorCode === undefined ? "" : `, ${errorCode}`})`, errorCode);
+        }
+        return (await response.json());
+    }
+    async function browserLogin(interaction, signal) {
+        const verifier = base64url(randomBytes(64));
+        const challenge = base64url(createHash("sha256").update(verifier).digest());
+        const state = base64url(randomBytes(32));
+        const server = createServer();
+        const port = await listen(server, options.loopbackPort ?? CHATGPT_LOOPBACK_PORT);
+        if (port === undefined)
+            return "port-busy";
+        const redirectUri = `http://localhost:${port}/auth/callback`;
+        const url = new URL(`${issuer}/oauth/authorize`);
+        for (const [key, value] of Object.entries({
+            response_type: "code",
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            scope: CHATGPT_OAUTH_SCOPE,
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+            id_token_add_organizations: "true",
+            codex_cli_simplified_flow: "true",
+            originator: CHATGPT_ORIGINATOR,
+        })) {
+            url.searchParams.set(key, value);
+        }
+        try {
+            const code = new Promise((resolve, reject) => {
+                server.on("request", (request, response) => {
+                    const target = new URL(request.url ?? "/", "http://localhost");
+                    if (target.pathname !== "/auth/callback") {
+                        respond(response, 404, "Not found.");
+                        return;
+                    }
+                    if (target.searchParams.get("state") !== state) {
+                        respond(response, 400, "Sign-in state did not match. Return to the terminal and try again.");
+                        return;
+                    }
+                    const error = target.searchParams.get("error");
+                    if (error !== null) {
+                        const description = target.searchParams.get("error_description") ?? "";
+                        const entitlement = `${error} ${description}`.includes("missing_codex_entitlement");
+                        respond(response, 400, entitlement ? "Your ChatGPT plan does not include Codex." : "Sign-in was not completed.");
+                        reject(entitlement
+                            ? failure("entitlement_missing", "your ChatGPT plan does not include Codex", "missing_codex_entitlement")
+                            : failure("unauthenticated", `sign-in failed: ${error}`, error));
+                        return;
+                    }
+                    const value = target.searchParams.get("code");
+                    if (value === null || value === "") {
+                        respond(response, 400, "The sign-in response carried no code.");
+                        return;
+                    }
+                    respond(response, 200, "Signed in to Synorch. You can close this tab.");
+                    resolve(value);
+                });
+            });
+            const opened = await interaction.openBrowser(url.toString());
+            if (!opened)
+                interaction.notify(`Open this URL in a browser to sign in:\n${url.toString()}`);
+            const authorizationCode = await withDeadline(code, options.browserTimeoutMs ?? BROWSER_TIMEOUT_MS, signal, "browser sign-in");
+            return await exchangeCode(authorizationCode, redirectUri, verifier, signal);
+        }
+        finally {
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+    }
+    async function deviceLogin(interaction, signal) {
+        const started = await fetchImpl(`${issuer}/api/accounts/deviceauth/usercode`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ client_id: clientId }),
+            signal,
+        });
+        if (!started.ok)
+            throw failure("unauthenticated", `device sign-in could not start (HTTP ${started.status})`);
+        const grant = (await started.json());
+        const deviceAuthId = typeof grant.device_auth_id === "string" ? grant.device_auth_id : undefined;
+        const userCode = typeof grant.user_code === "string" ? grant.user_code : typeof grant.usercode === "string" ? grant.usercode : undefined;
+        if (deviceAuthId === undefined || userCode === undefined)
+            throw failure("protocol_mismatch", "device sign-in response is incomplete");
+        const intervalSeconds = Math.max(1, Number(grant.interval) || 5);
+        const timeout = options.deviceTimeoutMs ?? DEVICE_TIMEOUT_MS;
+        const deadline = now().getTime() + timeout;
+        interaction.showDeviceCode({
+            verificationUri: `${issuer}/codex/device`,
+            userCode,
+            expiresAt: new Date(deadline).toISOString(),
+        });
+        while (true) {
+            if (signal.aborted)
+                throw failure("cancelled", "login aborted");
+            if (now().getTime() > deadline)
+                throw failure("timeout", "device sign-in timed out");
+            await sleep(intervalSeconds * 1000, signal);
+            const polled = await fetchImpl(`${issuer}/api/accounts/deviceauth/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),
+                signal,
+            });
+            if (polled.status === 403 || polled.status === 404)
+                continue;
+            if (!polled.ok) {
+                const errorCode = await readErrorCode(polled);
+                if (errorCode === "missing_codex_entitlement")
+                    throw failure("entitlement_missing", "your ChatGPT plan does not include Codex", errorCode);
+                throw failure("unauthenticated", `device sign-in failed (HTTP ${polled.status})`, errorCode);
+            }
+            const approved = (await polled.json());
+            if (typeof approved.authorization_code !== "string" || typeof approved.code_verifier !== "string") {
+                throw failure("protocol_mismatch", "device sign-in approval is incomplete");
+            }
+            return exchangeCode(approved.authorization_code, `${issuer}/deviceauth/callback`, approved.code_verifier, signal);
+        }
+    }
+    async function refreshTokens(current, signal) {
+        if (current.method !== "oauth-subscription")
+            throw failure("invalid_request", "profile does not hold an OAuth secret");
+        let response;
+        try {
+            response = await fetchImpl(`${issuer}/oauth/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ grant_type: "refresh_token", client_id: clientId, refresh_token: current.refresh_token }),
+                signal,
+            });
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw failure("cancelled", "refresh aborted");
+            throw failure("provider_internal", `token refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!response.ok) {
+            const errorCode = await readErrorCode(response);
+            const permanent = response.status === 401 || (errorCode !== undefined && PERMANENT_REFRESH_CODES.has(errorCode));
+            if (permanent) {
+                await options.state.markLoginRequired(ref, errorCode ?? `HTTP ${response.status}`, now());
+                throw failure("auth_expired", "the ChatGPT sign-in expired; run `syn login openai`", errorCode);
+            }
+            throw failure(response.status >= 500 ? "provider_internal" : "unauthenticated", `token refresh failed (HTTP ${response.status})`, errorCode);
+        }
+        const next = secretFrom((await response.json()), current);
+        await store.set(ref, next);
+        return next;
+    }
+    function needsRefresh(secret) {
+        return secret.method === "oauth-subscription" && Date.parse(secret.expires_at) - now().getTime() < REFRESH_WINDOW_MS;
+    }
+    async function current() {
+        const marker = await options.state.loginRequired(ref);
+        if (marker !== undefined)
+            throw failure("auth_expired", "the ChatGPT sign-in expired; run `syn login openai`", marker.reason);
+        const secret = await store.get(ref);
+        if (secret === undefined)
+            throw failure("unauthenticated", "not signed in to ChatGPT; run `syn login openai`");
+        return secret;
+    }
+    function singleFlight(task) {
+        if (inflight !== undefined)
+            return inflight;
+        const running = task().finally(() => {
+            if (inflight === running)
+                inflight = undefined;
+        });
+        inflight = running;
+        return running;
+    }
+    function issue(secret) {
+        if (secret.method === "oauth-subscription")
+            lastIssuedAccess = secret.access_token;
+        return createResolvedCredential(ref, secret, (headers, value) => {
+            if (value.method !== "oauth-subscription")
+                return;
+            headers.set("authorization", `Bearer ${value.access_token}`);
+            if (value.account_id !== undefined)
+                headers.set("chatgpt-account-id", value.account_id);
+        });
+    }
+    async function status() {
+        const base = {
+            provider_id: ref.provider_id,
+            method: ref.method,
+            profile,
+            billing: "subscription",
+            store_backend: store.backend,
+        };
+        const marker = await options.state.loginRequired(ref);
+        let secret;
+        try {
+            secret = await store.get(ref);
+        }
+        catch {
+            return { ...base, state: "error", entitlement: "unknown", detail: "stored credential is unreadable" };
+        }
+        if (secret === undefined || secret.method !== "oauth-subscription")
+            return { ...base, state: "disconnected", entitlement: "unknown" };
+        const email = maskEmail(claimString(decodeJwtClaims(secret.id_token), "email"));
+        const labels = {
+            ...(email === undefined ? {} : { account_label: email }),
+            ...(secret.plan_type === undefined ? {} : { plan_label: secret.plan_type.slice(0, 100) }),
+            expires_at: secret.expires_at,
+            entitlement: secret.plan_type === undefined ? "unknown" : "verified",
+        };
+        if (marker !== undefined)
+            return { ...base, ...labels, state: "login_required", detail: `refresh failed permanently (${marker.reason})` };
+        const expired = Date.parse(secret.expires_at) <= now().getTime();
+        return { ...base, ...labels, state: expired ? "expired" : "connected", ...(expired ? { detail: "access token expired; it is refreshed on next use" } : {}) };
+    }
+    async function forceRefresh(signal) {
+        const refreshed = await singleFlight(() => store.withRefreshLock(ref, async () => {
+            const latest = await current();
+            if (latest.method === "oauth-subscription" && latest.access_token !== lastIssuedAccess)
+                return latest;
+            return refreshTokens(latest, signal);
+        }, signal));
+        return issue(refreshed);
+    }
+    return {
+        providerId: ref.provider_id,
+        method: "oauth-subscription",
+        profile,
+        notices: [CHATGPT_SUBSCRIPTION_NOTICE],
+        status: () => status(),
+        async login(interaction, signal) {
+            if (!interaction.interactive) {
+                throw new HarnessError({
+                    code: "auth_required",
+                    message: "ChatGPT sign-in needs an interactive terminal",
+                    workspace_effect: "none",
+                    retry_safe: true,
+                    next_command: "syn login openai --device-code",
+                });
+            }
+            if (!(await options.state.isAcknowledged(CHATGPT_SUBSCRIPTION_NOTICE.id, ref))) {
+                const accepted = await interaction.acknowledge(CHATGPT_SUBSCRIPTION_NOTICE, signal);
+                if (!accepted) {
+                    throw new HarnessError({ code: "auth_required", message: "the ChatGPT subscription notice was not accepted", workspace_effect: "none", retry_safe: true });
+                }
+                await options.state.acknowledge(CHATGPT_SUBSCRIPTION_NOTICE.id, ref, now());
+            }
+            let tokens = "port-busy";
+            if (options.deviceCode !== true)
+                tokens = await browserLogin(interaction, signal);
+            if (tokens === "port-busy") {
+                if (options.deviceCode !== true)
+                    interaction.notify(`Port ${options.loopbackPort ?? CHATGPT_LOOPBACK_PORT} is busy; using device-code sign-in.`);
+                tokens = await deviceLogin(interaction, signal);
+            }
+            await store.set(ref, secretFrom(tokens, undefined));
+            await options.state.clearLoginRequired(ref);
+            return status();
+        },
+        async logout() {
+            await store.delete(ref);
+            await options.state.clearLoginRequired(ref);
+        },
+        async resolve(signal, resolveOptions) {
+            if (resolveOptions?.forceRefresh === true)
+                return forceRefresh(signal);
+            const secret = await current();
+            if (!needsRefresh(secret))
+                return issue(secret);
+            const refreshed = await singleFlight(() => store.withRefreshLock(ref, async () => {
+                const latest = await current();
+                return needsRefresh(latest) ? refreshTokens(latest, signal) : latest;
+            }, signal));
+            return issue(refreshed);
+        },
+    };
+}
+async function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            if (error.code === "EADDRINUSE" || error.code === "EACCES")
+                resolve(undefined);
+            else
+                reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            const address = server.address();
+            resolve(typeof address === "object" && address !== null ? address.port : port);
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, "127.0.0.1");
+    });
+}
+function respond(response, status, message) {
+    const body = `<!doctype html><html><head><meta charset="utf-8"><title>Synorch</title></head><body><p>${message}</p></body></html>`;
+    response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+    response.end(body);
+}
+async function withDeadline(promise, timeoutMs, signal, what) {
+    let timer;
+    let onAbort;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(failure("timeout", `${what} timed out`)), timeoutMs);
+                onAbort = () => reject(failure("cancelled", `${what} aborted`));
+                if (signal.aborted)
+                    onAbort();
+                else
+                    signal.addEventListener("abort", onAbort, { once: true });
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        if (onAbort !== undefined)
+            signal.removeEventListener("abort", onAbort);
+    }
+}
+//# sourceMappingURL=openai-chatgpt.js.map

package/dist/harness/auth/openai-chatgpt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-chatgpt.js","sourceRoot":"","sources":["../../../src/harness/auth/openai-chatgpt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,wBAAwB,EACxB,eAAe,EACf,gBAAgB,GASjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,+EAA+E,CAAC;AACnH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAC5C,yGAAyG;AACzG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC5C,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AACtC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AA0BzI,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAuB,EAAE,OAAe,EAAE,YAAqB;IAC9E,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI;QACJ,OAAO;QACP,SAAS,EAAE,wBAAwB,CAAC,IAAI,CAAC;QACzC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,MAAmB;IACzD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,SAAS,IAAI;YACX,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwC,CAAC;QAC5E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QACtD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAA2C,CAAC;YAC/D,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC;YACtD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QACxD,CAAC;QACD,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAsB,EAAE,OAAe,EAAE,OAA2B;IAC5G,MAAM,SAAS,GAAc,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,GAAG,GAAkB,EAAE,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;IACpH,IAAI,QAA+C,CAAC;IACpD,IAAI,gBAAoC,CAAC;IAEzC,SAAS,UAAU,CAAC,MAAqB,EAAE,QAAsC;QAC/E,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC;QACjI,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC;QACtI,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;QAClH,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,mBAAmB,EAAE,mDAAmD,CAAC,CAAC;QAC3I,MAAM,QAAQ,GAAG,gBAAgB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;QACvB,IAAI,SAAe,CAAC;QACpB,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;YAAE,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;aACnI,IAAI,OAAO,YAAY,EAAE,GAAG,KAAK,QAAQ;YAAE,SAAS,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;;YACzF,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,wBAAwB,GAAG,IAAI,CAAC,CAAC;QAChF,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,oBAAoB,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC,IAAI,KAAK,EAAE,UAAU,CAAC;QACxJ,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,IAAI,KAAK,EAAE,SAAS,CAAC;QACpJ,OAAO,sBAAsB,CAAC,KAAK,CAAC;YAClC,MAAM,EAAE,oBAAoB;YAC5B,YAAY,EAAE,MAAM;YACpB,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACvD,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;YACnC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YAC1D,UAAU,EAAE,kBAAkB;YAC9B,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,QAAQ,CAAC,WAAW,EAAE;YACzD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,WAAmB,EAAE,QAAgB,EAAE,MAAmB;QAClG,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,cAAc,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,QAAQ;aACxB,CAAC,CAAC,QAAQ,EAAE;YACb,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,2BAA2B;gBAAE,MAAM,OAAO,CAAC,qBAAqB,EAAE,0CAA0C,EAAE,SAAS,CAAC,CAAC;YAC3I,MAAM,OAAO,CAAC,iBAAiB,EAAE,+BAA+B,QAAQ,CAAC,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACnJ,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;IAClD,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,WAA4B,EAAE,MAAmB;QAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;QACjF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,WAAW,GAAG,oBAAoB,IAAI,gBAAgB,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YACxC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,mBAAmB;YAC1B,cAAc,EAAE,SAAS;YACzB,qBAAqB,EAAE,MAAM;YAC7B,KAAK;YACL,0BAA0B,EAAE,MAAM;YAClC,yBAAyB,EAAE,MAAM;YACjC,UAAU,EAAE,kBAAkB;SAC/B,CAAC,EAAE,CAAC;YACH,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACnD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;oBAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;oBAC/D,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;wBACzC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;wBACrC,OAAO;oBACT,CAAC;oBACD,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;wBAC/C,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,oEAAoE,CAAC,CAAC;wBAC7F,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;wBACvE,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;wBACpF,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;wBACjH,MAAM,CACJ,WAAW;4BACT,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,0CAA0C,EAAE,2BAA2B,CAAC;4BACzG,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,KAAK,EAAE,EAAE,KAAK,CAAC,CAClE,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;wBACnC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;wBAChE,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,+CAA+C,CAAC,CAAC;oBACxE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM;gBAAE,WAAW,CAAC,MAAM,CAAC,2CAA2C,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7F,MAAM,iBAAiB,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAC9H,OAAO,MAAM,YAAY,CAAC,iBAAiB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,WAA4B,EAAE,MAAmB;QAC1E,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,mCAAmC,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YAC7C,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,wCAAwC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA8F,CAAC;QAClI,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACzI,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QACtI,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC;QAC3C,WAAW,CAAC,cAAc,CAAC;YACzB,eAAe,EAAE,GAAG,MAAM,eAAe;YACzC,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAChE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ;gBAAE,MAAM,OAAO,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,gCAAgC,EAAE;gBACxE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;gBAC3E,MAAM;aACP,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;gBAAE,SAAS;YAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC9C,IAAI,SAAS,KAAK,2BAA2B;oBAAE,MAAM,OAAO,CAAC,qBAAqB,EAAE,0CAA0C,EAAE,SAAS,CAAC,CAAC;gBAC3I,MAAM,OAAO,CAAC,iBAAiB,EAAE,+BAA+B,MAAM,CAAC,MAAM,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA8D,CAAC;YACpG,IAAI,OAAO,QAAQ,CAAC,kBAAkB,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAClG,MAAM,OAAO,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,YAAY,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,MAAM,sBAAsB,EAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAAyB,EAAE,MAAmB;QACzE,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;QACvH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,cAAc,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;gBAChH,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YAClE,MAAM,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACjH,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,SAAS,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1F,MAAM,OAAO,CAAC,cAAc,EAAE,qDAAqD,EAAE,SAAS,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,EAAE,8BAA8B,QAAQ,CAAC,MAAM,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,YAAY,CAAC,MAAwB;QAC5C,OAAO,MAAM,CAAC,MAAM,KAAK,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC;IACvH,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,cAAc,EAAE,qDAAqD,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9H,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,YAAY,CAAC,IAAqC;QACzD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,IAAI,QAAQ,KAAK,OAAO;gBAAE,QAAQ,GAAG,SAAS,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,KAAK,CAAC,MAAwB;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB;YAAE,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC;QACnF,OAAO,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,oBAAoB;gBAAE,OAAO;YAClD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,OAAO,EAAE,cAAuB;YAChC,aAAa,EAAE,KAAK,CAAC,OAAO;SAC7B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACtI,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YACxD,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACzF,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,UAAoB;SAC3F,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QAC1I,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/J,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAmB;QAC7C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CACxC,KAAK,CAAC,eAAe,CACnB,GAAG,EACH,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB;gBAAE,OAAO,MAAM,CAAC;YACtG,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC,EACD,MAAM,CACP,CACF,CAAC;QACF,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,MAAM,EAAE,oBAAoB;QAC5B,OAAO;QACP,OAAO,EAAE,CAAC,2BAA2B,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE;QACtB,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM;YAC7B,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,+CAA+C;oBACxD,gBAAgB,EAAE,MAAM;oBACxB,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,gCAAgC;iBAC/C,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;gBACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kDAAkD,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7J,CAAC;gBACD,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,2BAA2B,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,MAAM,GAAgC,WAAW,CAAC;YACtD,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI;gBAAE,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAClF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI;oBAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,YAAY,IAAI,qBAAqB,sCAAsC,CAAC,CAAC;gBACjJ,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC5C,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc;YAClC,IAAI,cAAc,EAAE,YAAY,KAAK,IAAI;gBAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CACxC,KAAK,CAAC,eAAe,CACnB,GAAG,EACH,KAAK,IAAI,EAAE;gBACT,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC/B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,CAAC,EACD,MAAM,CACP,CACF,CAAC;YACF,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,IAAY;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC/C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAC;;gBAC1E,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjF,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAe;IACxE,MAAM,IAAI,GAAG,0FAA0F,OAAO,oBAAoB,CAAC;IACnI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACxG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,YAAY,CAAI,OAAmB,EAAE,SAAiB,EAAE,MAAmB,EAAE,IAAY;IACtG,IAAI,KAAiC,CAAC;IACtC,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACrF,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC;gBAChE,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;;oBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/harness/auth/profile-state.d.ts

@@ -0,0 +1,25 @@
+import { type CredentialRef } from "../contracts/index.ts";
+export declare const PROFILE_STATE_FILE_NAME = "auth-state.json";
+/**
+ * Non-secret per-profile state in `<home>/auth-state.json`: the `login_required` marker set by a
+ * permanent refresh failure and the one-time notice acknowledgements. Never holds a token.
+ */
+export declare class ProfileStateStore {
+    private readonly filePath;
+    private memory;
+    private readonly mutex;
+    /** `home === undefined` keeps state in memory only. */
+    constructor(home: string | undefined);
+    loginRequired(ref: CredentialRef): Promise<{
+        readonly since: string;
+        readonly reason: string;
+    } | undefined>;
+    markLoginRequired(ref: CredentialRef, reason: string, at: Date): Promise<void>;
+    clearLoginRequired(ref: CredentialRef): Promise<void>;
+    isAcknowledged(noticeId: string, ref: CredentialRef): Promise<boolean>;
+    acknowledge(noticeId: string, ref: CredentialRef, at: Date): Promise<void>;
+    revokeAcknowledgement(noticeId: string, ref: CredentialRef): Promise<void>;
+    private load;
+    private update;
+}
+//# sourceMappingURL=profile-state.d.ts.map

package/dist/harness/auth/profile-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-state.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/profile-state.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAIjF,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAUzD;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAE1C,uDAAuD;gBACpC,IAAI,EAAE,MAAM,GAAG,SAAS;IAI9B,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAI3G,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9E,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YAOzE,IAAI;YAeJ,MAAM;CAQrB"}

package/dist/harness/auth/profile-state.js

@@ -0,0 +1,77 @@
+import path from "node:path";
+import { credentialAccountKey } from "../contracts/index.js";
+import { readJsonFile, writeJsonAtomic } from "./json-file.js";
+import { KeyedMutex } from "./locks.js";
+export const PROFILE_STATE_FILE_NAME = "auth-state.json";
+/**
+ * Non-secret per-profile state in `<home>/auth-state.json`: the `login_required` marker set by a
+ * permanent refresh failure and the one-time notice acknowledgements. Never holds a token.
+ */
+export class ProfileStateStore {
+    filePath;
+    memory = empty();
+    mutex = new KeyedMutex();
+    /** `home === undefined` keeps state in memory only. */
+    constructor(home) {
+        this.filePath = home === undefined ? undefined : path.join(home, PROFILE_STATE_FILE_NAME);
+    }
+    async loginRequired(ref) {
+        return (await this.load()).login_required[credentialAccountKey(ref)];
+    }
+    async markLoginRequired(ref, reason, at) {
+        await this.update((state) => {
+            state.login_required[credentialAccountKey(ref)] = { since: at.toISOString(), reason: reason.slice(0, 200) };
+        });
+    }
+    async clearLoginRequired(ref) {
+        await this.update((state) => {
+            delete state.login_required[credentialAccountKey(ref)];
+        });
+    }
+    async isAcknowledged(noticeId, ref) {
+        return (await this.load()).acknowledged[noticeId]?.[credentialAccountKey(ref)] !== undefined;
+    }
+    async acknowledge(noticeId, ref, at) {
+        await this.update((state) => {
+            state.acknowledged[noticeId] = { ...(state.acknowledged[noticeId] ?? {}), [credentialAccountKey(ref)]: at.toISOString() };
+        });
+    }
+    async revokeAcknowledgement(noticeId, ref) {
+        await this.update((state) => {
+            const entries = state.acknowledged[noticeId];
+            if (entries !== undefined)
+                delete entries[credentialAccountKey(ref)];
+        });
+    }
+    async load() {
+        if (this.filePath === undefined)
+            return structuredClone(this.memory);
+        try {
+            const raw = (await readJsonFile(this.filePath));
+            if (raw?.schema_version !== 1)
+                return empty();
+            return {
+                schema_version: 1,
+                login_required: typeof raw.login_required === "object" && raw.login_required !== null ? raw.login_required : {},
+                acknowledged: typeof raw.acknowledged === "object" && raw.acknowledged !== null ? raw.acknowledged : {},
+            };
+        }
+        catch {
+            return empty();
+        }
+    }
+    async update(mutate) {
+        await this.mutex.run("state", async () => {
+            const state = await this.load();
+            mutate(state);
+            if (this.filePath === undefined)
+                this.memory = state;
+            else
+                await writeJsonAtomic(this.filePath, state);
+        });
+    }
+}
+function empty() {
+    return { schema_version: 1, login_required: {}, acknowledged: {} };
+}
+//# sourceMappingURL=profile-state.js.map

package/dist/harness/auth/profile-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-state.js","sourceRoot":"","sources":["../../../src/harness/auth/profile-state.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAUzD;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAqB;IACtC,MAAM,GAAc,KAAK,EAAE,CAAC;IACnB,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAE1C,uDAAuD;IACvD,YAAmB,IAAwB;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC5F,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,GAAkB;QAC3C,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,GAAkB,EAAE,MAAc,EAAE,EAAQ;QACzE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9G,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,GAAkB;QAChD,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,OAAO,KAAK,CAAC,cAAc,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,GAAkB;QAC9D,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;IAC/F,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,GAAkB,EAAE,EAAQ;QACrE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5H,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAAC,QAAgB,EAAE,GAAkB;QACrE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAmC,CAAC;YAClF,IAAI,GAAG,EAAE,cAAc,KAAK,CAAC;gBAAE,OAAO,KAAK,EAAE,CAAC;YAC9C,OAAO;gBACL,cAAc,EAAE,CAAC;gBACjB,cAAc,EAAE,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;gBAC/G,YAAY,EAAE,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;aACxG,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAkC;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;;gBAChD,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,KAAK;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AACrE,CAAC"}

package/dist/harness/auth/providers.d.ts

@@ -0,0 +1,27 @@
+import { type AuthMethodKind, type AuthProvider, type CredentialRef, type CredentialStore } from "../contracts/index.ts";
+import { type ClaudeCliProbe } from "./claude-bridge.ts";
+import { type AuthFetch } from "./openai-chatgpt.ts";
+import { ProfileStateStore } from "./profile-state.ts";
+export interface AuthProvidersOptions {
+    /** Non-secret auth state (login_required markers, notice acknowledgements). Defaults to the store's home. */
+    readonly state?: ProfileStateStore;
+    readonly fetch?: AuthFetch;
+    readonly now?: () => Date;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly loopbackPort?: number;
+    readonly deviceCode?: boolean;
+    readonly claudeProbe?: ClaudeCliProbe;
+    readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    /** Extra profiles to expose besides `default`. */
+    readonly profiles?: readonly string[];
+}
+/** The (provider, method) pairs Synorch supports in v1 (ADR-05). */
+export declare const SUPPORTED_AUTH_METHODS: readonly {
+    readonly provider: "openai" | "anthropic";
+    readonly method: AuthMethodKind;
+}[];
+/** Builds the auth provider for one identity; `undefined` for an unsupported (provider, method) pair. */
+export declare function authProviderFor(store: CredentialStore, ref: CredentialRef, options?: AuthProvidersOptions): AuthProvider | undefined;
+/** Every supported identity for the `default` profile (and any extra configured profiles). */
+export declare function createAuthProviders(store: CredentialStore, options?: AuthProvidersOptions): readonly AuthProvider[];
+//# sourceMappingURL=providers.d.ts.map

package/dist/harness/auth/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/harness/auth/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC,6GAA6G;IAC7G,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,EAAE,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,EAK3H,CAAC;AAQF,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyB,GAAG,YAAY,GAAG,SAAS,CA+BxI;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,GAAE,oBAAyB,GAAG,SAAS,YAAY,EAAE,CAWvH"}