npm - @agent-native/core - Versions diffs - 0.114.15 → 0.115.1 - Mend

@agent-native/core 0.114.15 → 0.115.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (467) hide show

package/dist/server/workspace-provider-oauth.js CHANGED Viewed

@@ -14,6 +14,7 @@ const SUPPORTED_PROVIDERS = new Set([
     "google_drive",
     "github",
     "hubspot",
+    "salesforce",
     "jira",
     "sentry",
     "notion",
@@ -21,6 +22,8 @@ const SUPPORTED_PROVIDERS = new Set([
 const FLOW_TTL_SECONDS = 10 * 60;
 const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
 const PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;
+const SALESFORCE_PRODUCTION_LOGIN_URL = "https://login.salesforce.com";
+const SALESFORCE_SANDBOX_LOGIN_URL = "https://test.salesforce.com";
 export function workspaceProviderOAuthPath(provider, phase) {
     return `/_agent-native/connections/oauth/${provider}/${phase}`;
 }
@@ -53,6 +56,13 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
     }
     const provider = requiredProvider(providerId);
     const query = getQuery(event);
+    const salesforceLoginUrl = providerId === "salesforce"
+        ? resolveSalesforceOAuthLoginUrl(text(query.environment))
+        : undefined;
+    if (providerId === "salesforce" && !salesforceLoginUrl) {
+        setResponseStatus(event, 400);
+        return { error: "Salesforce environment must be production or sandbox." };
+    }
     const appId = normalizeAppId(text(query.appId) ??
         process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??
         process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??
@@ -96,6 +106,7 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
             owner: session.email,
             orgId,
             appId,
+            ...(salesforceLoginUrl ? { salesforceLoginUrl } : {}),
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
         setCookie(event, flowCookieName(providerId), encryptSecretValue(JSON.stringify(flow)), {
@@ -111,6 +122,11 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
             redirectUri,
             state,
             challenge,
+            ...(salesforceLoginUrl
+                ? {
+                    authorizationUrl: salesforceOAuthEndpoint(salesforceLoginUrl, "authorize"),
+                }
+                : {}),
         });
         return Response.redirect(authorizationUrl, 302);
     });
@@ -177,6 +193,11 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             code,
             verifier: flow.verifier,
             redirectUri: flow.redirectUri,
+            ...(providerId === "salesforce"
+                ? {
+                    tokenUrl: salesforceOAuthEndpoint(flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL, "token"),
+                }
+                : {}),
         });
         const identities = await resolveWorkspaceProviderIdentities(providerId, tokens);
         if (!identities.length) {
@@ -194,10 +215,17 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             const scopes = mergeWorkspaceOAuthValues(existing?.scopes ?? [], identity.scopes ?? tokenScopes(tokens, provider.oauth.scopes));
             const connectionConfig = {
                 credentialMode: "oauth",
-                ...(providerId === "hubspot" || providerId === "jira"
+                ...(providerId === "hubspot" ||
+                    providerId === "salesforce" ||
+                    providerId === "jira"
                     ? { externalAccountId: identity.accountId }
                     : {}),
                 ...(identity.config ?? {}),
+                ...(providerId === "salesforce"
+                    ? {
+                        salesforceLoginUrl: flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL,
+                    }
+                    : {}),
             };
             const connection = await upsertWorkspaceConnection({
                 ...(existing ? { id: existing.id } : {}),
@@ -228,7 +256,7 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
 export function buildWorkspaceProviderAuthorizationUrl(input) {
     if (!input.provider.oauth)
         throw new Error("Provider does not support OAuth.");
-    const url = new URL(input.provider.oauth.authorizationUrl);
+    const url = new URL(input.authorizationUrl ?? input.provider.oauth.authorizationUrl);
     url.searchParams.set("client_id", input.clientId);
     url.searchParams.set("redirect_uri", input.redirectUri);
     url.searchParams.set("response_type", "code");
@@ -257,7 +285,7 @@ export function buildWorkspaceProviderAuthorizationUrl(input) {
     return url.href;
 }
 export async function exchangeWorkspaceProviderOAuthCode(input) {
-    const tokenUrl = input.provider.oauth?.tokenUrl;
+    const tokenUrl = input.tokenUrl ?? input.provider.oauth?.tokenUrl;
     if (!tokenUrl)
         throw new Error("Provider does not support OAuth.");
     const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`;
@@ -311,6 +339,30 @@ export async function exchangeWorkspaceProviderOAuthCode(input) {
                 : {}),
         };
     }
+    if (input.providerId === "salesforce") {
+        const { response, body } = await fetchBoundedProviderJson(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "authorization_code",
+                client_id: input.clientId,
+                client_secret: input.clientSecret,
+                code: input.code,
+                redirect_uri: input.redirectUri,
+            }),
+        }, input.provider.label);
+        const accessToken = text(body.access_token);
+        if (!response.ok || !accessToken) {
+            throw new Error(`${input.provider.label} OAuth token exchange failed (${response.status}).`);
+        }
+        const expiresIn = Number(body.expires_in);
+        return {
+            ...body,
+            ...(Number.isFinite(expiresIn) && expiresIn > 0
+                ? { expiry_date: Date.now() + expiresIn * 1_000 }
+                : {}),
+        };
+    }
     if (input.providerId === "jira") {
         const { response, body } = await fetchBoundedProviderJsonValue(tokenUrl, {
             method: "POST",
@@ -486,6 +538,22 @@ async function resolveWorkspaceProviderIdentitySingle(providerId, tokens) {
             label: text(body.hub_domain) ?? `HubSpot portal ${accountId}`,
         };
     }
+    if (providerId === "salesforce") {
+        const instanceUrl = normalizeSalesforceInstanceUrl(text(tokens.instance_url));
+        const identity = parseSalesforceIdentityUrl(text(tokens.id));
+        if (!instanceUrl || !identity) {
+            throw new Error("Salesforce OAuth response did not identify the connected organization.");
+        }
+        return {
+            accountId: identity.organizationId,
+            label: instanceUrl.hostname,
+            config: {
+                salesforceInstanceUrl: instanceUrl.origin,
+                salesforceIdentityUrl: identity.url.href,
+                salesforceOrganizationId: identity.organizationId,
+            },
+        };
+    }
     if (providerId === "sentry") {
         const accessToken = text(tokens.access_token);
         const { response, body: user } = await fetchBoundedProviderJson("https://sentry.io/api/0/users/me/", {
@@ -561,8 +629,11 @@ export function canConnectWorkspaceProviderOAuth(orgId, role) {
     return Boolean(orgId) && (role === "owner" || role === "admin");
 }
 export function scopedOAuthAccountId(provider, owner, accountId) {
-    if (provider !== "hubspot" && provider !== "jira")
+    if (provider !== "hubspot" &&
+        provider !== "salesforce" &&
+        provider !== "jira") {
         return accountId;
+    }
     const ownerKey = crypto
         .createHash("sha256")
         .update(`${provider}:${owner.trim().toLowerCase()}`)
@@ -641,8 +712,74 @@ function clientCredentialKeys(provider, field) {
         const integrationPrefix = `HUBSPOT_INTEGRATION_CLIENT_${suffix}`;
         return [integrationPrefix, `HUBSPOT_CLIENT_${suffix}`];
     }
+    if (provider === "salesforce") {
+        const integrationPrefix = `SALESFORCE_INTEGRATION_CLIENT_${suffix}`;
+        const consumerCredential = `SALESFORCE_CONSUMER_${field === "id" ? "KEY" : "SECRET"}`;
+        return [
+            integrationPrefix,
+            `SALESFORCE_CLIENT_${suffix}`,
+            consumerCredential,
+        ];
+    }
     return [`${prefix}_CLIENT_${suffix}`];
 }
+function normalizeSalesforceInstanceUrl(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        const host = url.hostname.toLowerCase();
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.port ||
+            (host !== "salesforce.com" && !host.endsWith(".salesforce.com"))) {
+            return null;
+        }
+        return new URL(url.origin);
+    }
+    catch {
+        return null;
+    }
+}
+function parseSalesforceIdentityUrl(value) {
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        const host = url.hostname.toLowerCase();
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.port ||
+            (host !== "salesforce.com" && !host.endsWith(".salesforce.com"))) {
+            return null;
+        }
+        const match = url.pathname.match(/^\/id\/([^/]+)\/[^/]+\/?$/);
+        if (!match?.[1])
+            return null;
+        return { organizationId: match[1], url };
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveSalesforceOAuthLoginUrl(environment) {
+    const normalized = environment?.trim().toLowerCase();
+    if (!normalized || normalized === "production") {
+        return SALESFORCE_PRODUCTION_LOGIN_URL;
+    }
+    if (normalized === "sandbox")
+        return SALESFORCE_SANDBOX_LOGIN_URL;
+    return null;
+}
+export function salesforceOAuthEndpoint(loginUrl, phase) {
+    if (loginUrl !== SALESFORCE_PRODUCTION_LOGIN_URL &&
+        loginUrl !== SALESFORCE_SANDBOX_LOGIN_URL) {
+        throw new Error("Invalid Salesforce OAuth login URL.");
+    }
+    return `${loginUrl}/services/oauth2/${phase}`;
+}
 async function resolveProviderClientCredentials(provider) {
     const [clientId, clientSecret] = await Promise.all(["id", "secret"].map(async (field) => {
         for (const key of clientCredentialKeys(provider, field)) {

package/dist/server/workspace-provider-oauth.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"workspace-provider-oauth.js","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAW7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAgC;IACjE,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,CAAC;AAa/C,MAAM,UAAU,0BAA0B,CACxC,QAAuC,EACvC,KAA2B;IAE3B,OAAO,oCAAoC,QAAQ,IAAI,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAuC,EACvC,KAA2B;IAE3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC;QACpD,CAAC,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,kBAAkB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACnC,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,GAAG,EAAE,KAAK;YACV,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAA+B;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CACP,KAAK,EACL,cAAc,CAAC,UAAU,CAAC,EAC1B,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EACxC;YACE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;YAC9D,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,IACE,CAAC,IAAI;QACL,CAAC,iCAAiC,CAAC;YACjC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,YAAY,EAAE,KAAK;SACpB,CAAC,EACF,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACnC,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC;YACtD,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,UAAU,EACV,MAAM,CACP,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,KAAK,8CAA8C,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC;YACzD,QAAQ,EAAE,UAAU;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,oBAAoB,CACpC,UAAU,EACV,OAAO,CAAC,KAAK,EACb,QAAQ,CAAC,SAAS,CACnB,CAAC;YACF,MAAM,eAAe,CACnB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,SAAS,EACT,MAAM,EACN,OAAO,CAAC,KAAK,CACd,CAAC;YACF,MAAM,mBAAmB,CACvB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,SAAS,EACT,QAAQ,CAAC,KAAK,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CACnD,CAAC;YACF,MAAM,MAAM,GAAG,yBAAyB,CACtC,QAAQ,EAAE,MAAM,IAAI,EAAE,EACtB,QAAQ,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,CAC/D,CAAC;YACF,MAAM,gBAAgB,GAAG;gBACvB,cAAc,EAAE,OAAO;gBACvB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM;oBACnD,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;aAC3B,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxC,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE;gBAC7C,SAAS;gBACT,YAAY,EAAE,QAAQ,CAAC,KAAK;gBAC5B,MAAM,EAAE,WAAW;gBACnB,MAAM;gBACN,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE;gBACxC,MAAM,EAAE,gBAAgB;gBACxB,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,MAAM,8BAA8B,CAAC;gBACnC,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,UAAU;gBACpB,MAAM;gBACN,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GACd,KAAK,CAAC,SAAS;YACf,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAQxD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3G,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/C,OAAO;YACL,GAAG,SAAS;YACZ,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;gBAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/B,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EACL,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC;gBACE,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO;gBAC5B,CAAC,CAAC;oBACE,aAAa,EAAE,aAAa;oBAC5B,cAAc,EAAE,mCAAmC;iBACpD;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC/D,IAAI,EACF,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAyC,EACzC,MAA+B;IAE/B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,kCAAkC,CACzD,UAAU,EACV,MAAM,CACP,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,8CAA8C,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,4DAA4D,EAC5D;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,EACD,MAAM,CACP,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YACpC,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IACE,SAAS,CAAC,QAAQ,KAAK,QAAQ;gBAC/B,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC9C,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CACjB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL;oBACE,SAAS,EAAE,OAAO;oBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,MAAM,EAAE;wBACN,gBAAgB,EAAE,OAAO;wBACzB,mBAAmB,EAAE,qCAAqC,kBAAkB,CAAC,OAAO,CAAC,EAAE;wBACvF,OAAO,EAAE,SAAS,CAAC,MAAM;qBAC1B;iBACF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,MAAM,sCAAsC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AASD,KAAK,UAAU,sCAAsC,CACnD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC3B,kBAAkB;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAC7D,6BAA6B,EAC7B;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,sBAAsB,EAAE,YAAY;aACrC;SACF,EACD,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,iDAAiD,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAClF,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,kBAAkB,SAAS,EAAE;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAC7D,mCAAmC,EACnC;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,EACD,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,8FAA8F,EAC9F,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,cAAc,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBACvB,sBAAsB;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,wBAAwB,CAC3D,6BAA6B,EAC7B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyC;IAEzC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,KAAK;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,QAAuC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,kBAAkB,CAAC,SAAS,CAAC,CACA,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAOjD;IACC,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACtC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QACxC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAClD,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAgC,EAChC,IAA+B;IAE/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAuC,EACvC,KAAa,EACb,SAAiB;IAEjB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SACnD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,GAAG,EACH,IAAI,EACJ,aAAa,CACd,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,cAAc,GAAG,2BAA2B,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,QAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,QAA2B;IAE3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAuC,EACvC,KAAsB;IAEtB,MAAM,MAAM,GACV,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAG,6BAA6B,MAAM,EAAE,CAAC;QAChE,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,iBAAiB,GAAG,8BAA8B,MAAM,EAAE,CAAC;QACjE,OAAO,CAAC,iBAAiB,EAAE,kBAAkB,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,WAAW,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,QAAuC;IAEvC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/C,CAAC,IAAI,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,QAAuC;IAC7D,OAAO,sBAAsB,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,KAAc;IAC9D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7D,IACE,CAAC,OAAO;QACR,CAAC,gCAAgC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAC9D,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n deleteCookie,\n defineEventHandler,\n getCookie,\n getMethod,\n getQuery,\n setCookie,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport {\n getWorkspaceConnectionProvider,\n type WorkspaceConnectionProvider,\n} from \"../connections/catalog.js\";\nimport { saveOAuthTokens, setOAuthDisplayName } from \"../oauth-tokens/store.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport {\n listWorkspaceConnections,\n upsertWorkspaceConnection,\n upsertWorkspaceConnectionGrant,\n} from \"../workspace-connections/store.js\";\nimport { getSession, safeReturnPath } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport {\n decodeOAuthState,\n encodeOAuthState,\n getAppUrl,\n resolveOAuthRedirectUri,\n type OAuthStatePayload,\n} from \"./google-oauth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport type GenericWorkspaceOAuthProvider =\n \| \"figma\"\n \| \"google_drive\"\n \| \"github\"\n \| \"hubspot\"\n \| \"jira\"\n \| \"sentry\"\n \| \"notion\";\n\nconst SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([\n \"figma\",\n \"google_drive\",\n \"github\",\n \"hubspot\",\n \"jira\",\n \"sentry\",\n \"notion\",\n]);\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst PROVIDER_REQUEST_TIMEOUT_MS = 10_000;\nconst PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;\n\nexport interface WorkspaceProviderOAuthFlow {\n provider: GenericWorkspaceOAuthProvider;\n flowId: string;\n verifier: string;\n redirectUri: string;\n owner: string;\n orgId?: string;\n appId: string;\n expiresAt: number;\n}\n\nexport function workspaceProviderOAuthPath(\n provider: GenericWorkspaceOAuthProvider,\n phase: \"start\" \| \"callback\",\n): string {\n return `/_agent-native/connections/oauth/${provider}/${phase}`;\n}\n\nexport function createWorkspaceProviderOAuthHandler(\n provider: GenericWorkspaceOAuthProvider,\n phase: \"start\" \| \"callback\",\n) {\n if (!SUPPORTED_PROVIDERS.has(provider)) {\n throw new Error(`Unsupported workspace OAuth provider: ${provider}`);\n }\n return defineEventHandler((event) =>\n phase === \"start\"\n ? handleWorkspaceProviderOAuthStart(event, provider)\n : handleWorkspaceProviderOAuthCallback(event, provider),\n );\n}\n\nexport async function handleWorkspaceProviderOAuthStart(\n event: H3Event,\n providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response \| Record<string, unknown>> {\n if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return unauthorized(event);\n const orgContext = await requireWorkspaceProviderOAuthAdmin(event);\n if (!orgContext) {\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const orgId = orgContext.orgId;\n if (!orgId) {\n setResponseStatus(event, 403);\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const provider = requiredProvider(providerId);\n const query = getQuery(event);\n const appId = normalizeAppId(\n text(query.appId) ??\n process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??\n process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??\n \"creative-context\",\n );\n const redirectUri = resolveOAuthRedirectUri(\n event,\n workspaceProviderOAuthPath(providerId, \"callback\"),\n );\n if (!redirectUri) {\n setResponseStatus(event, 400);\n return { error: \"Invalid OAuth redirect URI.\" };\n }\n return runWithRequestContext(\n { userEmail: session.email, orgId },\n async () => {\n const [clientId, clientSecret] =\n await resolveProviderClientCredentials(providerId);\n if (!clientId \|\| !clientSecret) {\n setResponseStatus(event, 503);\n return {\n error: `${provider.label} OAuth client credentials are not configured.`,\n };\n }\n const verifier = crypto.randomBytes(48).toString(\"base64url\");\n const challenge = crypto\n .createHash(\"sha256\")\n .update(verifier)\n .digest(\"base64url\");\n const flowId = crypto.randomUUID();\n const requestedReturnUrl = text(query.return);\n const returnUrl = requestedReturnUrl\n ? safeReturnPath(requestedReturnUrl)\n : undefined;\n const state = encodeOAuthState({\n redirectUri,\n owner: session.email,\n orgId,\n app: appId,\n returnUrl,\n flowId,\n });\n const flow: WorkspaceProviderOAuthFlow = {\n provider: providerId,\n flowId,\n verifier,\n redirectUri,\n owner: session.email,\n orgId,\n appId,\n expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n };\n setCookie(\n event,\n flowCookieName(providerId),\n encryptSecretValue(JSON.stringify(flow)),\n {\n httpOnly: true,\n secure: redirectUri.startsWith(\"https://\"),\n sameSite: \"lax\",\n path: \"/\",\n maxAge: FLOW_TTL_SECONDS,\n },\n );\n const authorizationUrl = buildWorkspaceProviderAuthorizationUrl({\n provider,\n clientId,\n redirectUri,\n state,\n challenge,\n });\n return Response.redirect(authorizationUrl, 302);\n },\n );\n}\n\nexport async function handleWorkspaceProviderOAuthCallback(\n event: H3Event,\n providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response \| Record<string, unknown>> {\n if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return unauthorized(event);\n const orgContext = await requireWorkspaceProviderOAuthAdmin(event);\n if (!orgContext) {\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const orgId = orgContext.orgId;\n if (!orgId) {\n setResponseStatus(event, 403);\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const query = getQuery(event);\n const code = text(query.code);\n const stateParam = text(query.state);\n const providerError = text(query.error);\n if (providerError) {\n setResponseStatus(event, 400);\n return { error: \"OAuth authorization was not completed.\" };\n }\n if (!code \|\| !stateParam) {\n setResponseStatus(event, 400);\n return { error: \"OAuth callback is missing code or state.\" };\n }\n const flow = readStoredFlow(event, providerId);\n deleteCookie(event, flowCookieName(providerId), { path: \"/\" });\n const state = decodeOAuthState(stateParam, \"\");\n if (\n !flow \|\|\n !isWorkspaceProviderOAuthFlowValid({\n flow,\n state,\n provider: providerId,\n sessionEmail: session.email,\n sessionOrgId: orgId,\n })\n ) {\n setResponseStatus(event, 400);\n return { error: \"OAuth state is invalid or expired.\" };\n }\n const provider = requiredProvider(providerId);\n return runWithRequestContext(\n { userEmail: session.email, orgId },\n async () => {\n const [clientId, clientSecret] =\n await resolveProviderClientCredentials(providerId);\n if (!clientId \|\| !clientSecret) {\n setResponseStatus(event, 503);\n return {\n error: `${provider.label} OAuth client credentials are not configured.`,\n };\n }\n const tokens = await exchangeWorkspaceProviderOAuthCode({\n providerId,\n provider,\n clientId,\n clientSecret,\n code,\n verifier: flow.verifier,\n redirectUri: flow.redirectUri,\n });\n const identities = await resolveWorkspaceProviderIdentities(\n providerId,\n tokens,\n );\n if (!identities.length) {\n throw new Error(\n `${provider.label} OAuth did not return an accessible account.`,\n );\n }\n const existingConnections = await listWorkspaceConnections({\n provider: providerId,\n includeDisabled: true,\n });\n for (const identity of identities) {\n const accountId = scopedOAuthAccountId(\n providerId,\n session.email,\n identity.accountId,\n );\n await saveOAuthTokens(\n provider.oauth!.provider,\n accountId,\n tokens,\n session.email,\n );\n await setOAuthDisplayName(\n provider.oauth!.provider,\n accountId,\n identity.label,\n );\n const existing = existingConnections.find(\n (connection) => connection.accountId === accountId,\n );\n const scopes = mergeWorkspaceOAuthValues(\n existing?.scopes ?? [],\n identity.scopes ?? tokenScopes(tokens, provider.oauth!.scopes),\n );\n const connectionConfig = {\n credentialMode: \"oauth\",\n ...(providerId === \"hubspot\" \|\| providerId === \"jira\"\n ? { externalAccountId: identity.accountId }\n : {}),\n ...(identity.config ?? {}),\n };\n const connection = await upsertWorkspaceConnection({\n ...(existing ? { id: existing.id } : {}),\n provider: providerId,\n label: `${provider.label}: ${identity.label}`,\n accountId,\n accountLabel: identity.label,\n status: \"connected\",\n scopes,\n allowedApps: existing?.allowedApps ?? [],\n config: connectionConfig,\n lastCheckedAt: new Date(),\n lastError: null,\n });\n await upsertWorkspaceConnectionGrant({\n connectionId: connection.id,\n appId: flow.appId,\n provider: providerId,\n scopes,\n config: connectionConfig,\n });\n }\n const returnPath =\n state.returnUrl ??\n `/settings/connections?connected=${encodeURIComponent(providerId)}`;\n return Response.redirect(getAppUrl(event, returnPath), 302);\n },\n );\n}\n\nexport function buildWorkspaceProviderAuthorizationUrl(input: {\n provider: WorkspaceConnectionProvider;\n clientId: string;\n redirectUri: string;\n state: string;\n challenge: string;\n}): string {\n if (!input.provider.oauth)\n throw new Error(\"Provider does not support OAuth.\");\n const url = new URL(input.provider.oauth.authorizationUrl);\n url.searchParams.set(\"client_id\", input.clientId);\n url.searchParams.set(\"redirect_uri\", input.redirectUri);\n url.searchParams.set(\"response_type\", \"code\");\n url.searchParams.set(\"state\", input.state);\n if (input.provider.id === \"figma\" \|\| input.provider.id === \"sentry\") {\n url.searchParams.set(\"code_challenge\", input.challenge);\n url.searchParams.set(\"code_challenge_method\", \"S256\");\n }\n if (input.provider.id === \"github\") {\n url.searchParams.set(\"allow_signup\", \"true\");\n }\n if (input.provider.id === \"jira\") {\n url.searchParams.set(\"audience\", \"api.atlassian.com\");\n url.searchParams.set(\"prompt\", \"consent\");\n }\n if (input.provider.id === \"google_drive\") {\n url.searchParams.set(\"access_type\", \"offline\");\n url.searchParams.set(\"include_granted_scopes\", \"true\");\n url.searchParams.set(\"prompt\", \"consent\");\n }\n if (input.provider.oauth.scopes.length) {\n url.searchParams.set(\"scope\", input.provider.oauth.scopes.join(\" \"));\n }\n if (input.provider.id === \"notion\") url.searchParams.set(\"owner\", \"user\");\n return url.href;\n}\n\nexport async function exchangeWorkspaceProviderOAuthCode(input: {\n providerId: GenericWorkspaceOAuthProvider;\n provider: WorkspaceConnectionProvider;\n clientId: string;\n clientSecret: string;\n code: string;\n verifier: string;\n redirectUri: string;\n}): Promise<Record<string, unknown>> {\n const tokenUrl = input.provider.oauth?.tokenUrl;\n if (!tokenUrl) throw new Error(\"Provider does not support OAuth.\");\n const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString(\"base64\")}`;\n if (input.providerId === \"github\") {\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n return {\n ...body,\n ...(Number.isFinite(Number(body.expires_in)) &&\n Number(body.expires_in) > 0\n ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }\n : {}),\n };\n }\n if (input.providerId === \"hubspot\") {\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n return {\n ...body,\n ...(Number.isFinite(Number(body.expires_in)) &&\n Number(body.expires_in) > 0\n ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }\n : {}),\n };\n }\n if (input.providerId === \"jira\") {\n const { response, body } = await fetchBoundedProviderJsonValue(\n tokenUrl,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n grant_type: \"authorization_code\",\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const tokenBody = record(body) ?? {};\n const accessToken = text(tokenBody.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n const expiresIn = Number(tokenBody.expires_in);\n return {\n ...tokenBody,\n ...(Number.isFinite(expiresIn) && expiresIn > 0\n ? { expiry_date: Date.now() + expiresIn * 1_000 }\n : {}),\n };\n }\n const fields = {\n grant_type: \"authorization_code\",\n code: input.code,\n redirect_uri: input.redirectUri,\n ...(input.providerId === \"figma\" \|\| input.providerId === \"sentry\"\n ? { code_verifier: input.verifier }\n : {}),\n ...(input.providerId === \"sentry\"\n ? { client_id: input.clientId, client_secret: input.clientSecret }\n : {}),\n ...(input.providerId === \"google_drive\"\n ? { client_id: input.clientId, client_secret: input.clientSecret }\n : {}),\n };\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers:\n input.providerId === \"notion\"\n ? {\n Authorization: authorization,\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\",\n }\n : input.providerId === \"figma\"\n ? {\n Authorization: authorization,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n }\n : { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body:\n input.providerId === \"notion\"\n ? JSON.stringify(fields)\n : new URLSearchParams(fields),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n const expiresIn = Number(body.expires_in);\n return {\n ...body,\n ...(Number.isFinite(expiresIn) && expiresIn > 0\n ? { expiry_date: Date.now() + expiresIn * 1_000 }\n : {}),\n };\n}\n\nexport async function resolveWorkspaceProviderIdentity(\n providerId: GenericWorkspaceOAuthProvider,\n tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity> {\n const [identity] = await resolveWorkspaceProviderIdentities(\n providerId,\n tokens,\n );\n if (!identity) {\n throw new Error(\n `${providerId} OAuth response did not identify an account.`,\n );\n }\n return identity;\n}\n\nexport async function resolveWorkspaceProviderIdentities(\n providerId: GenericWorkspaceOAuthProvider,\n tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity[]> {\n if (providerId === \"jira\") {\n const accessToken = text(tokens.access_token);\n if (!accessToken) {\n throw new Error(\"Jira OAuth response did not include an access token.\");\n }\n const { response, body } = await fetchBoundedProviderJsonValue(\n \"https://api.atlassian.com/oauth/token/accessible-resources\",\n {\n headers: {\n Accept: \"application/json\",\n Authorization: `Bearer ${accessToken}`,\n },\n },\n \"Jira\",\n );\n if (!response.ok \|\| !Array.isArray(body)) {\n throw new Error(\"Jira OAuth response did not identify accessible sites.\");\n }\n return body.flatMap((resource) => {\n const entry = record(resource);\n const cloudId = text(entry?.id);\n const siteUrl = text(entry?.url);\n if (!cloudId \|\| !siteUrl) return [];\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(siteUrl);\n } catch {\n return [];\n }\n if (\n parsedUrl.protocol !== \"https:\" \|\|\n !parsedUrl.hostname.endsWith(\".atlassian.net\")\n ) {\n return [];\n }\n const scopes = Array.isArray(entry?.scopes)\n ? entry.scopes.filter(\n (scope): scope is string => typeof scope === \"string\",\n )\n : undefined;\n return [\n {\n accountId: cloudId,\n label: text(entry?.name) ?? parsedUrl.hostname,\n ...(scopes?.length ? { scopes } : {}),\n config: {\n atlassianCloudId: cloudId,\n atlassianApiBaseUrl: `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId)}`,\n siteUrl: parsedUrl.origin,\n },\n },\n ];\n });\n }\n return [await resolveWorkspaceProviderIdentitySingle(providerId, tokens)];\n}\n\ntype WorkspaceProviderIdentity = {\n accountId: string;\n label: string;\n scopes?: string[];\n config?: Record<string, unknown>;\n};\n\nasync function resolveWorkspaceProviderIdentitySingle(\n providerId: GenericWorkspaceOAuthProvider,\n tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity> {\n if (providerId === \"notion\") {\n const owner = record(tokens.owner);\n const user = record(owner?.user);\n const person = record(user?.person);\n const accountId =\n text(user?.id) ??\n text(person?.email) ??\n text(tokens.workspace_id) ??\n text(tokens.bot_id);\n if (!accountId)\n throw new Error(\n \"Notion OAuth response did not identify the connected user.\",\n );\n return {\n accountId,\n label:\n text(person?.email) ??\n text(tokens.workspace_name) ??\n \"Notion workspace\",\n };\n }\n if (providerId === \"github\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body: user } = await fetchBoundedProviderJson(\n \"https://api.github.com/user\",\n {\n headers: {\n Accept: \"application/vnd.github+json\",\n Authorization: `Bearer ${accessToken}`,\n \"X-GitHub-Api-Version\": \"2022-11-28\",\n },\n },\n \"GitHub\",\n );\n const accountId = text(user.login) ?? text(user.id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"GitHub OAuth response did not identify the connected user.\",\n );\n }\n return {\n accountId,\n label: text(user.name) ?? text(user.login) ?? \"GitHub account\",\n };\n }\n if (providerId === \"hubspot\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body } = await fetchBoundedProviderJson(\n `https://api.hubapi.com/oauth/v1/access-tokens/${encodeURIComponent(accessToken)}`,\n { headers: { Accept: \"application/json\" } },\n \"HubSpot\",\n );\n const accountId = scalarText(body.hub_id) ?? scalarText(body.user_id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"HubSpot OAuth response did not identify the connected portal.\",\n );\n }\n return {\n accountId,\n label: text(body.hub_domain) ?? `HubSpot portal ${accountId}`,\n };\n }\n if (providerId === \"sentry\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body: user } = await fetchBoundedProviderJson(\n \"https://sentry.io/api/0/users/me/\",\n {\n headers: {\n Accept: \"application/json\",\n Authorization: `Bearer ${accessToken}`,\n },\n },\n \"Sentry\",\n );\n const accountId = text(user.id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"Sentry OAuth response did not identify the connected account.\",\n );\n }\n return {\n accountId,\n label: text(user?.email) ?? text(user?.name) ?? \"Sentry account\",\n };\n }\n if (providerId === \"google_drive\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body } = await fetchBoundedProviderJson(\n \"https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)\",\n { headers: { Authorization: `Bearer ${accessToken}` } },\n \"Google Drive\",\n );\n const user = record(body.user);\n const accountId = text(user?.permissionId) ?? text(user?.emailAddress);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"Google Drive OAuth response did not identify the connected account.\",\n );\n }\n return {\n accountId,\n label:\n text(user?.emailAddress) ??\n text(user?.displayName) ??\n \"Google Drive account\",\n };\n }\n const accessToken = text(tokens.access_token)!;\n const { response, body: me } = await fetchBoundedProviderJson(\n \"https://api.figma.com/v1/me\",\n { headers: { Authorization: `Bearer ${accessToken}` } },\n \"Figma\",\n );\n const accountId = text(me.id) ?? text(me.email) ?? text(tokens.user_id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"Figma OAuth response did not identify the connected user.\",\n );\n }\n return {\n accountId,\n label: text(me.email) ?? text(me.handle) ?? \"Figma account\",\n };\n}\n\nfunction requiredProvider(\n providerId: GenericWorkspaceOAuthProvider,\n): WorkspaceConnectionProvider {\n const provider = getWorkspaceConnectionProvider(providerId);\n if (!provider?.oauth)\n throw new Error(`${providerId} OAuth is not configured.`);\n return provider;\n}\n\nfunction readStoredFlow(\n event: H3Event,\n provider: GenericWorkspaceOAuthProvider,\n): WorkspaceProviderOAuthFlow \| null {\n const encrypted = getCookie(event, flowCookieName(provider));\n if (!encrypted) return null;\n try {\n return JSON.parse(\n decryptSecretValue(encrypted),\n ) as WorkspaceProviderOAuthFlow;\n } catch {\n return null;\n }\n}\n\nexport function isWorkspaceProviderOAuthFlowValid(input: {\n flow: WorkspaceProviderOAuthFlow;\n state: OAuthStatePayload;\n provider: GenericWorkspaceOAuthProvider;\n sessionEmail: string;\n sessionOrgId?: string;\n now?: number;\n}): boolean {\n return (\n input.flow.expiresAt >= (input.now ?? Date.now()) &&\n input.flow.provider === input.provider &&\n input.state.flowId === input.flow.flowId &&\n input.state.redirectUri === input.flow.redirectUri &&\n input.state.owner === input.flow.owner &&\n input.sessionEmail === input.flow.owner &&\n input.state.orgId === input.flow.orgId &&\n input.sessionOrgId === input.flow.orgId &&\n input.state.app === input.flow.appId\n );\n}\n\nexport function canConnectWorkspaceProviderOAuth(\n orgId: string \| null \| undefined,\n role: string \| null \| undefined,\n): boolean {\n return Boolean(orgId) && (role === \"owner\" \|\| role === \"admin\");\n}\n\nexport function scopedOAuthAccountId(\n provider: GenericWorkspaceOAuthProvider,\n owner: string,\n accountId: string,\n): string {\n if (provider !== \"hubspot\" && provider !== \"jira\") return accountId;\n const ownerKey = crypto\n .createHash(\"sha256\")\n .update(`${provider}:${owner.trim().toLowerCase()}`)\n .digest(\"hex\")\n .slice(0, 24);\n return `${accountId}::${ownerKey}`;\n}\n\nasync function fetchBoundedProviderJson(\n url: string,\n init: RequestInit,\n providerLabel: string,\n): Promise<{ response: Response; body: Record<string, unknown> }> {\n const { response, body } = await fetchBoundedProviderJsonValue(\n url,\n init,\n providerLabel,\n );\n return { response, body: record(body) ?? {} };\n}\n\nasync function fetchBoundedProviderJsonValue(\n url: string,\n init: RequestInit,\n providerLabel: string,\n): Promise<{ response: Response; body: unknown }> {\n let response: Response;\n try {\n response = await fetch(url, {\n ...init,\n signal: AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS),\n });\n } catch {\n throw new Error(`${providerLabel} OAuth request failed.`);\n }\n const declaredLength = Number(response.headers.get(\"content-length\"));\n if (\n Number.isFinite(declaredLength) &&\n declaredLength > PROVIDER_RESPONSE_MAX_BYTES\n ) {\n throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n }\n if (!response.body) return { response, body: {} };\n const reader = response.body.getReader();\n const chunks: Uint8Array[] = [];\n let length = 0;\n try {\n while (true) {\n const chunk = await reader.read();\n if (chunk.done) break;\n length += chunk.value.byteLength;\n if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n await reader.cancel();\n break;\n }\n chunks.push(chunk.value);\n }\n } catch {\n throw new Error(`${providerLabel} OAuth request failed.`);\n }\n if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n }\n try {\n const json = Buffer.concat(chunks).toString(\"utf8\");\n const body = JSON.parse(json) as unknown;\n return { response, body };\n } catch {\n return { response, body: {} };\n }\n}\n\nfunction tokenScopes(\n tokens: Record<string, unknown>,\n fallback: readonly string[],\n): string[] {\n const scope = text(tokens.scope);\n return scope ? scope.split(/[ ,]+/).filter(Boolean) : [...fallback];\n}\n\nexport function mergeWorkspaceOAuthValues(\n existing: readonly string[],\n incoming: readonly string[],\n): string[] {\n return [...new Set([...existing, ...incoming])];\n}\n\nfunction clientCredentialKeys(\n provider: GenericWorkspaceOAuthProvider,\n field: \"id\" \| \"secret\",\n): string[] {\n const prefix =\n provider === \"google_drive\" ? \"GOOGLE\" : provider.toUpperCase();\n const suffix = field === \"id\" ? \"ID\" : \"SECRET\";\n if (provider === \"github\") {\n const integrationPrefix = `GITHUB_INTEGRATION_CLIENT_${suffix}`;\n return [integrationPrefix, `GITHUB_CLIENT_${suffix}`];\n }\n if (provider === \"hubspot\") {\n const integrationPrefix = `HUBSPOT_INTEGRATION_CLIENT_${suffix}`;\n return [integrationPrefix, `HUBSPOT_CLIENT_${suffix}`];\n }\n return [`${prefix}_CLIENT_${suffix}`];\n}\n\nasync function resolveProviderClientCredentials(\n provider: GenericWorkspaceOAuthProvider,\n): Promise<[string \| null, string \| null]> {\n const [clientId, clientSecret] = await Promise.all(\n ([\"id\", \"secret\"] as const).map(async (field) => {\n for (const key of clientCredentialKeys(provider, field)) {\n const value = await resolveSecret(key);\n if (value) return value;\n }\n return null;\n }),\n );\n return [clientId, clientSecret];\n}\n\nfunction flowCookieName(provider: GenericWorkspaceOAuthProvider): string {\n return `an_workspace_oauth_${provider}`;\n}\n\nfunction normalizeAppId(value: string): string {\n const normalized = value.trim().toLowerCase();\n if (!/^[a-z0-9][a-z0-9_-]{0,99}$/.test(normalized)) {\n throw new Error(\"OAuth appId is invalid.\");\n }\n return normalized;\n}\n\nfunction text(value: unknown): string \| undefined {\n return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction scalarText(value: unknown): string \| undefined {\n if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n return text(value);\n}\n\nfunction record(value: unknown): Record<string, unknown> \| null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record<string, unknown>)\n : null;\n}\n\nfunction methodNotAllowed(event: H3Event) {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n}\n\nfunction unauthorized(event: H3Event) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n}\n\nasync function requireWorkspaceProviderOAuthAdmin(event: H3Event) {\n const context = await getOrgContext(event).catch(() => null);\n if (\n !context \|\|\n !canConnectWorkspaceProviderOAuth(context.orgId, context.role)\n ) {\n setResponseStatus(event, 403);\n return null;\n }\n return context;\n}\n"]}
1	+ {"version":3,"file":"workspace-provider-oauth.js","sourceRoot":"","sources":["../../src/server/workspace-provider-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,8BAA8B,GAE/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAY7D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAgC;IACjE,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAC;AACjC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,CAAC;AAC/C,MAAM,+BAA+B,GAAG,8BAA8B,CAAC;AACvE,MAAM,4BAA4B,GAAG,6BAA6B,CAAC;AAcnE,MAAM,UAAU,0BAA0B,CACxC,QAAuC,EACvC,KAA2B;IAE3B,OAAO,oCAAoC,QAAQ,IAAI,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,QAAuC,EACvC,KAA2B;IAE3B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC;QACpD,CAAC,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,kBAAkB,GACtB,UAAU,KAAK,YAAY;QACzB,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU,KAAK,YAAY,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,kBAAkB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,uBAAuB,CACzC,KAAK,EACL,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CACnD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACnC,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,kBAAkB;YAClC,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,GAAG,EAAE,KAAK;YACV,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAA+B;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM;YACN,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,KAAK;YACL,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK;SACjD,CAAC;QACF,SAAS,CACP,KAAK,EACL,cAAc,CAAC,UAAU,CAAC,EAC1B,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EACxC;YACE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;YAC1C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,gBAAgB;SACzB,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;YAC9D,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;YACT,GAAG,CAAC,kBAAkB;gBACpB,CAAC,CAAC;oBACE,gBAAgB,EAAE,uBAAuB,CACvC,kBAAkB,EAClB,WAAW,CACZ;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAAc,EACd,UAAyC;IAEzC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,wEAAwE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,IACE,CAAC,IAAI;QACL,CAAC,iCAAiC,CAAC;YACjC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,UAAU;YACpB,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,YAAY,EAAE,KAAK;SACpB,CAAC,EACF,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,qBAAqB,CAC1B,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EACnC,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAC5B,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,+CAA+C;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kCAAkC,CAAC;YACtD,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,UAAU,KAAK,YAAY;gBAC7B,CAAC,CAAC;oBACE,QAAQ,EAAE,uBAAuB,CAC/B,IAAI,CAAC,kBAAkB,IAAI,+BAA+B,EAC1D,OAAO,CACR;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,kCAAkC,CACzD,UAAU,EACV,MAAM,CACP,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,KAAK,8CAA8C,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CAAC;YACzD,QAAQ,EAAE,UAAU;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,oBAAoB,CACpC,UAAU,EACV,OAAO,CAAC,KAAK,EACb,QAAQ,CAAC,SAAS,CACnB,CAAC;YACF,MAAM,eAAe,CACnB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,SAAS,EACT,MAAM,EACN,OAAO,CAAC,KAAK,CACd,CAAC;YACF,MAAM,mBAAmB,CACvB,QAAQ,CAAC,KAAM,CAAC,QAAQ,EACxB,SAAS,EACT,QAAQ,CAAC,KAAK,CACf,CAAC;YACF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CACnD,CAAC;YACF,MAAM,MAAM,GAAG,yBAAyB,CACtC,QAAQ,EAAE,MAAM,IAAI,EAAE,EACtB,QAAQ,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAM,CAAC,MAAM,CAAC,CAC/D,CAAC;YACF,MAAM,gBAAgB,GAAG;gBACvB,cAAc,EAAE,OAAO;gBACvB,GAAG,CAAC,UAAU,KAAK,SAAS;oBAC5B,UAAU,KAAK,YAAY;oBAC3B,UAAU,KAAK,MAAM;oBACnB,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC1B,GAAG,CAAC,UAAU,KAAK,YAAY;oBAC7B,CAAC,CAAC;wBACE,kBAAkB,EAChB,IAAI,CAAC,kBAAkB,IAAI,+BAA+B;qBAC7D;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC;gBACjD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxC,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE;gBAC7C,SAAS;gBACT,YAAY,EAAE,QAAQ,CAAC,KAAK;gBAC5B,MAAM,EAAE,WAAW;gBACnB,MAAM;gBACN,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE;gBACxC,MAAM,EAAE,gBAAgB;gBACxB,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,MAAM,8BAA8B,CAAC;gBACnC,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,UAAU;gBACpB,MAAM;gBACN,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GACd,KAAK,CAAC,SAAS;YACf,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAOtD;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;QACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAChE,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KASxD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAClE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3G,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;gBAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,QAAQ,EACR;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,KAAK,CAAC,YAAY;gBACjC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;aAChC,CAAC;SACH,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/C,OAAO;YACL,GAAG,SAAS;YACZ,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;gBAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC/B,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,cAAc;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EACL,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC;gBACE,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACH,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,OAAO;gBAC5B,CAAC,CAAC;oBACE,aAAa,EAAE,aAAa;oBAC5B,cAAc,EAAE,mCAAmC;iBACpD;gBACH,CAAC,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC/D,IAAI,EACF,KAAK,CAAC,UAAU,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,EACD,KAAK,CAAC,QAAQ,CAAC,KAAK,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,iCAAiC,QAAQ,CAAC,MAAM,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,UAAyC,EACzC,MAA+B;IAE/B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,kCAAkC,CACzD,UAAU,EACV,MAAM,CACP,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,8CAA8C,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,4DAA4D,EAC5D;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,EACD,MAAM,CACP,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YACpC,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IACE,SAAS,CAAC,QAAQ,KAAK,QAAQ;gBAC/B,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC9C,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CACjB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL;oBACE,SAAS,EAAE,OAAO;oBAClB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,MAAM,EAAE;wBACN,gBAAgB,EAAE,OAAO;wBACzB,mBAAmB,EAAE,qCAAqC,kBAAkB,CAAC,OAAO,CAAC,EAAE;wBACvF,OAAO,EAAE,SAAS,CAAC,MAAM;qBAC1B;iBACF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,MAAM,sCAAsC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AASD,KAAK,UAAU,sCAAsC,CACnD,UAAyC,EACzC,MAA+B;IAE/B,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC3B,kBAAkB;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAC7D,6BAA6B,EAC7B;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,sBAAsB,EAAE,YAAY;aACrC;SACF,EACD,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,iDAAiD,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAClF,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC3C,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,kBAAkB,SAAS,EAAE;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,8BAA8B,CAChD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAC1B,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,cAAc;YAClC,KAAK,EAAE,WAAW,CAAC,QAAQ;YAC3B,MAAM,EAAE;gBACN,qBAAqB,EAAE,WAAW,CAAC,MAAM;gBACzC,qBAAqB,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI;gBACxC,wBAAwB,EAAE,QAAQ,CAAC,cAAc;aAClD;SACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAC7D,mCAAmC,EACnC;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,EACD,QAAQ,CACT,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CACvD,8FAA8F,EAC9F,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,cAAc,CACf,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS;YACT,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;gBACxB,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;gBACvB,sBAAsB;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,wBAAwB,CAC3D,6BAA6B,EAC7B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,EAAE,EACvD,OAAO,CACR,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyC;IAEzC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,KAAK;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,QAAuC;IAEvC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,kBAAkB,CAAC,SAAS,CAAC,CACA,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAOjD;IACC,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACtC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;QACxC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAClD,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACtC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK;QACvC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAgC,EAChC,IAA+B;IAE/B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAuC,EACvC,KAAa,EACb,SAAiB;IAEjB,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SACnD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,6BAA6B,CAC5D,GAAG,EACH,IAAI,EACJ,aAAa,CACd,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,GAAW,EACX,IAAiB,EACjB,aAAqB;IAErB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,cAAc,GAAG,2BAA2B,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,QAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAA2B,EAC3B,QAA2B;IAE3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAuC,EACvC,KAAsB;IAEtB,MAAM,MAAM,GACV,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAG,6BAA6B,MAAM,EAAE,CAAC;QAChE,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,iBAAiB,GAAG,8BAA8B,MAAM,EAAE,CAAC;QACjE,OAAO,CAAC,iBAAiB,EAAE,kBAAkB,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,MAAM,iBAAiB,GAAG,iCAAiC,MAAM,EAAE,CAAC;QACpE,MAAM,kBAAkB,GAAG,uBACzB,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAC3B,EAAE,CAAC;QACH,OAAO;YACL,iBAAiB;YACjB,qBAAqB,MAAM,EAAE;YAC7B,kBAAkB;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,WAAW,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAyB;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI;YACR,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAChE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI;YACR,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAChE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,WAA+B;IAE/B,MAAM,UAAU,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC/C,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,4BAA4B,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,KAA4B;IAE5B,IACE,QAAQ,KAAK,+BAA+B;QAC5C,QAAQ,KAAK,4BAA4B,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,QAAQ,oBAAoB,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,QAAuC;IAEvC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/C,CAAC,IAAI,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,QAAuC;IAC7D,OAAO,sBAAsB,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,KAAc;IAC9D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7D,IACE,CAAC,OAAO;QACR,CAAC,gCAAgC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAC9D,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n deleteCookie,\n defineEventHandler,\n getCookie,\n getMethod,\n getQuery,\n setCookie,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport {\n getWorkspaceConnectionProvider,\n type WorkspaceConnectionProvider,\n} from \"../connections/catalog.js\";\nimport { saveOAuthTokens, setOAuthDisplayName } from \"../oauth-tokens/store.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { decryptSecretValue, encryptSecretValue } from \"../secrets/crypto.js\";\nimport {\n listWorkspaceConnections,\n upsertWorkspaceConnection,\n upsertWorkspaceConnectionGrant,\n} from \"../workspace-connections/store.js\";\nimport { getSession, safeReturnPath } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport {\n decodeOAuthState,\n encodeOAuthState,\n getAppUrl,\n resolveOAuthRedirectUri,\n type OAuthStatePayload,\n} from \"./google-oauth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport type GenericWorkspaceOAuthProvider =\n \| \"figma\"\n \| \"google_drive\"\n \| \"github\"\n \| \"hubspot\"\n \| \"salesforce\"\n \| \"jira\"\n \| \"sentry\"\n \| \"notion\";\n\nconst SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([\n \"figma\",\n \"google_drive\",\n \"github\",\n \"hubspot\",\n \"salesforce\",\n \"jira\",\n \"sentry\",\n \"notion\",\n]);\nconst FLOW_TTL_SECONDS = 10 * 60;\nconst PROVIDER_REQUEST_TIMEOUT_MS = 10_000;\nconst PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;\nconst SALESFORCE_PRODUCTION_LOGIN_URL = \"https://login.salesforce.com\";\nconst SALESFORCE_SANDBOX_LOGIN_URL = \"https://test.salesforce.com\";\n\nexport interface WorkspaceProviderOAuthFlow {\n provider: GenericWorkspaceOAuthProvider;\n flowId: string;\n verifier: string;\n redirectUri: string;\n owner: string;\n orgId?: string;\n appId: string;\n salesforceLoginUrl?: string;\n expiresAt: number;\n}\n\nexport function workspaceProviderOAuthPath(\n provider: GenericWorkspaceOAuthProvider,\n phase: \"start\" \| \"callback\",\n): string {\n return `/_agent-native/connections/oauth/${provider}/${phase}`;\n}\n\nexport function createWorkspaceProviderOAuthHandler(\n provider: GenericWorkspaceOAuthProvider,\n phase: \"start\" \| \"callback\",\n) {\n if (!SUPPORTED_PROVIDERS.has(provider)) {\n throw new Error(`Unsupported workspace OAuth provider: ${provider}`);\n }\n return defineEventHandler((event) =>\n phase === \"start\"\n ? handleWorkspaceProviderOAuthStart(event, provider)\n : handleWorkspaceProviderOAuthCallback(event, provider),\n );\n}\n\nexport async function handleWorkspaceProviderOAuthStart(\n event: H3Event,\n providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response \| Record<string, unknown>> {\n if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return unauthorized(event);\n const orgContext = await requireWorkspaceProviderOAuthAdmin(event);\n if (!orgContext) {\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const orgId = orgContext.orgId;\n if (!orgId) {\n setResponseStatus(event, 403);\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const provider = requiredProvider(providerId);\n const query = getQuery(event);\n const salesforceLoginUrl =\n providerId === \"salesforce\"\n ? resolveSalesforceOAuthLoginUrl(text(query.environment))\n : undefined;\n if (providerId === \"salesforce\" && !salesforceLoginUrl) {\n setResponseStatus(event, 400);\n return { error: \"Salesforce environment must be production or sandbox.\" };\n }\n const appId = normalizeAppId(\n text(query.appId) ??\n process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??\n process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??\n \"creative-context\",\n );\n const redirectUri = resolveOAuthRedirectUri(\n event,\n workspaceProviderOAuthPath(providerId, \"callback\"),\n );\n if (!redirectUri) {\n setResponseStatus(event, 400);\n return { error: \"Invalid OAuth redirect URI.\" };\n }\n return runWithRequestContext(\n { userEmail: session.email, orgId },\n async () => {\n const [clientId, clientSecret] =\n await resolveProviderClientCredentials(providerId);\n if (!clientId \|\| !clientSecret) {\n setResponseStatus(event, 503);\n return {\n error: `${provider.label} OAuth client credentials are not configured.`,\n };\n }\n const verifier = crypto.randomBytes(48).toString(\"base64url\");\n const challenge = crypto\n .createHash(\"sha256\")\n .update(verifier)\n .digest(\"base64url\");\n const flowId = crypto.randomUUID();\n const requestedReturnUrl = text(query.return);\n const returnUrl = requestedReturnUrl\n ? safeReturnPath(requestedReturnUrl)\n : undefined;\n const state = encodeOAuthState({\n redirectUri,\n owner: session.email,\n orgId,\n app: appId,\n returnUrl,\n flowId,\n });\n const flow: WorkspaceProviderOAuthFlow = {\n provider: providerId,\n flowId,\n verifier,\n redirectUri,\n owner: session.email,\n orgId,\n appId,\n ...(salesforceLoginUrl ? { salesforceLoginUrl } : {}),\n expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,\n };\n setCookie(\n event,\n flowCookieName(providerId),\n encryptSecretValue(JSON.stringify(flow)),\n {\n httpOnly: true,\n secure: redirectUri.startsWith(\"https://\"),\n sameSite: \"lax\",\n path: \"/\",\n maxAge: FLOW_TTL_SECONDS,\n },\n );\n const authorizationUrl = buildWorkspaceProviderAuthorizationUrl({\n provider,\n clientId,\n redirectUri,\n state,\n challenge,\n ...(salesforceLoginUrl\n ? {\n authorizationUrl: salesforceOAuthEndpoint(\n salesforceLoginUrl,\n \"authorize\",\n ),\n }\n : {}),\n });\n return Response.redirect(authorizationUrl, 302);\n },\n );\n}\n\nexport async function handleWorkspaceProviderOAuthCallback(\n event: H3Event,\n providerId: GenericWorkspaceOAuthProvider,\n): Promise<Response \| Record<string, unknown>> {\n if (getMethod(event) !== \"GET\") return methodNotAllowed(event);\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return unauthorized(event);\n const orgContext = await requireWorkspaceProviderOAuthAdmin(event);\n if (!orgContext) {\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const orgId = orgContext.orgId;\n if (!orgId) {\n setResponseStatus(event, 403);\n return {\n error:\n \"Only organization owners and admins can connect shared OAuth accounts.\",\n };\n }\n const query = getQuery(event);\n const code = text(query.code);\n const stateParam = text(query.state);\n const providerError = text(query.error);\n if (providerError) {\n setResponseStatus(event, 400);\n return { error: \"OAuth authorization was not completed.\" };\n }\n if (!code \|\| !stateParam) {\n setResponseStatus(event, 400);\n return { error: \"OAuth callback is missing code or state.\" };\n }\n const flow = readStoredFlow(event, providerId);\n deleteCookie(event, flowCookieName(providerId), { path: \"/\" });\n const state = decodeOAuthState(stateParam, \"\");\n if (\n !flow \|\|\n !isWorkspaceProviderOAuthFlowValid({\n flow,\n state,\n provider: providerId,\n sessionEmail: session.email,\n sessionOrgId: orgId,\n })\n ) {\n setResponseStatus(event, 400);\n return { error: \"OAuth state is invalid or expired.\" };\n }\n const provider = requiredProvider(providerId);\n return runWithRequestContext(\n { userEmail: session.email, orgId },\n async () => {\n const [clientId, clientSecret] =\n await resolveProviderClientCredentials(providerId);\n if (!clientId \|\| !clientSecret) {\n setResponseStatus(event, 503);\n return {\n error: `${provider.label} OAuth client credentials are not configured.`,\n };\n }\n const tokens = await exchangeWorkspaceProviderOAuthCode({\n providerId,\n provider,\n clientId,\n clientSecret,\n code,\n verifier: flow.verifier,\n redirectUri: flow.redirectUri,\n ...(providerId === \"salesforce\"\n ? {\n tokenUrl: salesforceOAuthEndpoint(\n flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL,\n \"token\",\n ),\n }\n : {}),\n });\n const identities = await resolveWorkspaceProviderIdentities(\n providerId,\n tokens,\n );\n if (!identities.length) {\n throw new Error(\n `${provider.label} OAuth did not return an accessible account.`,\n );\n }\n const existingConnections = await listWorkspaceConnections({\n provider: providerId,\n includeDisabled: true,\n });\n for (const identity of identities) {\n const accountId = scopedOAuthAccountId(\n providerId,\n session.email,\n identity.accountId,\n );\n await saveOAuthTokens(\n provider.oauth!.provider,\n accountId,\n tokens,\n session.email,\n );\n await setOAuthDisplayName(\n provider.oauth!.provider,\n accountId,\n identity.label,\n );\n const existing = existingConnections.find(\n (connection) => connection.accountId === accountId,\n );\n const scopes = mergeWorkspaceOAuthValues(\n existing?.scopes ?? [],\n identity.scopes ?? tokenScopes(tokens, provider.oauth!.scopes),\n );\n const connectionConfig = {\n credentialMode: \"oauth\",\n ...(providerId === \"hubspot\" \|\|\n providerId === \"salesforce\" \|\|\n providerId === \"jira\"\n ? { externalAccountId: identity.accountId }\n : {}),\n ...(identity.config ?? {}),\n ...(providerId === \"salesforce\"\n ? {\n salesforceLoginUrl:\n flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL,\n }\n : {}),\n };\n const connection = await upsertWorkspaceConnection({\n ...(existing ? { id: existing.id } : {}),\n provider: providerId,\n label: `${provider.label}: ${identity.label}`,\n accountId,\n accountLabel: identity.label,\n status: \"connected\",\n scopes,\n allowedApps: existing?.allowedApps ?? [],\n config: connectionConfig,\n lastCheckedAt: new Date(),\n lastError: null,\n });\n await upsertWorkspaceConnectionGrant({\n connectionId: connection.id,\n appId: flow.appId,\n provider: providerId,\n scopes,\n config: connectionConfig,\n });\n }\n const returnPath =\n state.returnUrl ??\n `/settings/connections?connected=${encodeURIComponent(providerId)}`;\n return Response.redirect(getAppUrl(event, returnPath), 302);\n },\n );\n}\n\nexport function buildWorkspaceProviderAuthorizationUrl(input: {\n provider: WorkspaceConnectionProvider;\n clientId: string;\n redirectUri: string;\n state: string;\n challenge: string;\n authorizationUrl?: string;\n}): string {\n if (!input.provider.oauth)\n throw new Error(\"Provider does not support OAuth.\");\n const url = new URL(\n input.authorizationUrl ?? input.provider.oauth.authorizationUrl,\n );\n url.searchParams.set(\"client_id\", input.clientId);\n url.searchParams.set(\"redirect_uri\", input.redirectUri);\n url.searchParams.set(\"response_type\", \"code\");\n url.searchParams.set(\"state\", input.state);\n if (input.provider.id === \"figma\" \|\| input.provider.id === \"sentry\") {\n url.searchParams.set(\"code_challenge\", input.challenge);\n url.searchParams.set(\"code_challenge_method\", \"S256\");\n }\n if (input.provider.id === \"github\") {\n url.searchParams.set(\"allow_signup\", \"true\");\n }\n if (input.provider.id === \"jira\") {\n url.searchParams.set(\"audience\", \"api.atlassian.com\");\n url.searchParams.set(\"prompt\", \"consent\");\n }\n if (input.provider.id === \"google_drive\") {\n url.searchParams.set(\"access_type\", \"offline\");\n url.searchParams.set(\"include_granted_scopes\", \"true\");\n url.searchParams.set(\"prompt\", \"consent\");\n }\n if (input.provider.oauth.scopes.length) {\n url.searchParams.set(\"scope\", input.provider.oauth.scopes.join(\" \"));\n }\n if (input.provider.id === \"notion\") url.searchParams.set(\"owner\", \"user\");\n return url.href;\n}\n\nexport async function exchangeWorkspaceProviderOAuthCode(input: {\n providerId: GenericWorkspaceOAuthProvider;\n provider: WorkspaceConnectionProvider;\n clientId: string;\n clientSecret: string;\n code: string;\n verifier: string;\n redirectUri: string;\n tokenUrl?: string;\n}): Promise<Record<string, unknown>> {\n const tokenUrl = input.tokenUrl ?? input.provider.oauth?.tokenUrl;\n if (!tokenUrl) throw new Error(\"Provider does not support OAuth.\");\n const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString(\"base64\")}`;\n if (input.providerId === \"github\") {\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n return {\n ...body,\n ...(Number.isFinite(Number(body.expires_in)) &&\n Number(body.expires_in) > 0\n ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }\n : {}),\n };\n }\n if (input.providerId === \"hubspot\") {\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n return {\n ...body,\n ...(Number.isFinite(Number(body.expires_in)) &&\n Number(body.expires_in) > 0\n ? { expiry_date: Date.now() + Number(body.expires_in) * 1_000 }\n : {}),\n };\n }\n if (input.providerId === \"salesforce\") {\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"authorization_code\",\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n const expiresIn = Number(body.expires_in);\n return {\n ...body,\n ...(Number.isFinite(expiresIn) && expiresIn > 0\n ? { expiry_date: Date.now() + expiresIn * 1_000 }\n : {}),\n };\n }\n if (input.providerId === \"jira\") {\n const { response, body } = await fetchBoundedProviderJsonValue(\n tokenUrl,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n grant_type: \"authorization_code\",\n client_id: input.clientId,\n client_secret: input.clientSecret,\n code: input.code,\n redirect_uri: input.redirectUri,\n }),\n },\n input.provider.label,\n );\n const tokenBody = record(body) ?? {};\n const accessToken = text(tokenBody.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n const expiresIn = Number(tokenBody.expires_in);\n return {\n ...tokenBody,\n ...(Number.isFinite(expiresIn) && expiresIn > 0\n ? { expiry_date: Date.now() + expiresIn * 1_000 }\n : {}),\n };\n }\n const fields = {\n grant_type: \"authorization_code\",\n code: input.code,\n redirect_uri: input.redirectUri,\n ...(input.providerId === \"figma\" \|\| input.providerId === \"sentry\"\n ? { code_verifier: input.verifier }\n : {}),\n ...(input.providerId === \"sentry\"\n ? { client_id: input.clientId, client_secret: input.clientSecret }\n : {}),\n ...(input.providerId === \"google_drive\"\n ? { client_id: input.clientId, client_secret: input.clientSecret }\n : {}),\n };\n const { response, body } = await fetchBoundedProviderJson(\n tokenUrl,\n {\n method: \"POST\",\n headers:\n input.providerId === \"notion\"\n ? {\n Authorization: authorization,\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\",\n }\n : input.providerId === \"figma\"\n ? {\n Authorization: authorization,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n }\n : { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body:\n input.providerId === \"notion\"\n ? JSON.stringify(fields)\n : new URLSearchParams(fields),\n },\n input.provider.label,\n );\n const accessToken = text(body.access_token);\n if (!response.ok \|\| !accessToken) {\n throw new Error(\n `${input.provider.label} OAuth token exchange failed (${response.status}).`,\n );\n }\n const expiresIn = Number(body.expires_in);\n return {\n ...body,\n ...(Number.isFinite(expiresIn) && expiresIn > 0\n ? { expiry_date: Date.now() + expiresIn * 1_000 }\n : {}),\n };\n}\n\nexport async function resolveWorkspaceProviderIdentity(\n providerId: GenericWorkspaceOAuthProvider,\n tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity> {\n const [identity] = await resolveWorkspaceProviderIdentities(\n providerId,\n tokens,\n );\n if (!identity) {\n throw new Error(\n `${providerId} OAuth response did not identify an account.`,\n );\n }\n return identity;\n}\n\nexport async function resolveWorkspaceProviderIdentities(\n providerId: GenericWorkspaceOAuthProvider,\n tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity[]> {\n if (providerId === \"jira\") {\n const accessToken = text(tokens.access_token);\n if (!accessToken) {\n throw new Error(\"Jira OAuth response did not include an access token.\");\n }\n const { response, body } = await fetchBoundedProviderJsonValue(\n \"https://api.atlassian.com/oauth/token/accessible-resources\",\n {\n headers: {\n Accept: \"application/json\",\n Authorization: `Bearer ${accessToken}`,\n },\n },\n \"Jira\",\n );\n if (!response.ok \|\| !Array.isArray(body)) {\n throw new Error(\"Jira OAuth response did not identify accessible sites.\");\n }\n return body.flatMap((resource) => {\n const entry = record(resource);\n const cloudId = text(entry?.id);\n const siteUrl = text(entry?.url);\n if (!cloudId \|\| !siteUrl) return [];\n let parsedUrl: URL;\n try {\n parsedUrl = new URL(siteUrl);\n } catch {\n return [];\n }\n if (\n parsedUrl.protocol !== \"https:\" \|\|\n !parsedUrl.hostname.endsWith(\".atlassian.net\")\n ) {\n return [];\n }\n const scopes = Array.isArray(entry?.scopes)\n ? entry.scopes.filter(\n (scope): scope is string => typeof scope === \"string\",\n )\n : undefined;\n return [\n {\n accountId: cloudId,\n label: text(entry?.name) ?? parsedUrl.hostname,\n ...(scopes?.length ? { scopes } : {}),\n config: {\n atlassianCloudId: cloudId,\n atlassianApiBaseUrl: `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId)}`,\n siteUrl: parsedUrl.origin,\n },\n },\n ];\n });\n }\n return [await resolveWorkspaceProviderIdentitySingle(providerId, tokens)];\n}\n\ntype WorkspaceProviderIdentity = {\n accountId: string;\n label: string;\n scopes?: string[];\n config?: Record<string, unknown>;\n};\n\nasync function resolveWorkspaceProviderIdentitySingle(\n providerId: GenericWorkspaceOAuthProvider,\n tokens: Record<string, unknown>,\n): Promise<WorkspaceProviderIdentity> {\n if (providerId === \"notion\") {\n const owner = record(tokens.owner);\n const user = record(owner?.user);\n const person = record(user?.person);\n const accountId =\n text(user?.id) ??\n text(person?.email) ??\n text(tokens.workspace_id) ??\n text(tokens.bot_id);\n if (!accountId)\n throw new Error(\n \"Notion OAuth response did not identify the connected user.\",\n );\n return {\n accountId,\n label:\n text(person?.email) ??\n text(tokens.workspace_name) ??\n \"Notion workspace\",\n };\n }\n if (providerId === \"github\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body: user } = await fetchBoundedProviderJson(\n \"https://api.github.com/user\",\n {\n headers: {\n Accept: \"application/vnd.github+json\",\n Authorization: `Bearer ${accessToken}`,\n \"X-GitHub-Api-Version\": \"2022-11-28\",\n },\n },\n \"GitHub\",\n );\n const accountId = text(user.login) ?? text(user.id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"GitHub OAuth response did not identify the connected user.\",\n );\n }\n return {\n accountId,\n label: text(user.name) ?? text(user.login) ?? \"GitHub account\",\n };\n }\n if (providerId === \"hubspot\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body } = await fetchBoundedProviderJson(\n `https://api.hubapi.com/oauth/v1/access-tokens/${encodeURIComponent(accessToken)}`,\n { headers: { Accept: \"application/json\" } },\n \"HubSpot\",\n );\n const accountId = scalarText(body.hub_id) ?? scalarText(body.user_id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"HubSpot OAuth response did not identify the connected portal.\",\n );\n }\n return {\n accountId,\n label: text(body.hub_domain) ?? `HubSpot portal ${accountId}`,\n };\n }\n if (providerId === \"salesforce\") {\n const instanceUrl = normalizeSalesforceInstanceUrl(\n text(tokens.instance_url),\n );\n const identity = parseSalesforceIdentityUrl(text(tokens.id));\n if (!instanceUrl \|\| !identity) {\n throw new Error(\n \"Salesforce OAuth response did not identify the connected organization.\",\n );\n }\n return {\n accountId: identity.organizationId,\n label: instanceUrl.hostname,\n config: {\n salesforceInstanceUrl: instanceUrl.origin,\n salesforceIdentityUrl: identity.url.href,\n salesforceOrganizationId: identity.organizationId,\n },\n };\n }\n if (providerId === \"sentry\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body: user } = await fetchBoundedProviderJson(\n \"https://sentry.io/api/0/users/me/\",\n {\n headers: {\n Accept: \"application/json\",\n Authorization: `Bearer ${accessToken}`,\n },\n },\n \"Sentry\",\n );\n const accountId = text(user.id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"Sentry OAuth response did not identify the connected account.\",\n );\n }\n return {\n accountId,\n label: text(user?.email) ?? text(user?.name) ?? \"Sentry account\",\n };\n }\n if (providerId === \"google_drive\") {\n const accessToken = text(tokens.access_token)!;\n const { response, body } = await fetchBoundedProviderJson(\n \"https://www.googleapis.com/drive/v3/about?fields=user(displayName,emailAddress,permissionId)\",\n { headers: { Authorization: `Bearer ${accessToken}` } },\n \"Google Drive\",\n );\n const user = record(body.user);\n const accountId = text(user?.permissionId) ?? text(user?.emailAddress);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"Google Drive OAuth response did not identify the connected account.\",\n );\n }\n return {\n accountId,\n label:\n text(user?.emailAddress) ??\n text(user?.displayName) ??\n \"Google Drive account\",\n };\n }\n const accessToken = text(tokens.access_token)!;\n const { response, body: me } = await fetchBoundedProviderJson(\n \"https://api.figma.com/v1/me\",\n { headers: { Authorization: `Bearer ${accessToken}` } },\n \"Figma\",\n );\n const accountId = text(me.id) ?? text(me.email) ?? text(tokens.user_id);\n if (!response.ok \|\| !accountId) {\n throw new Error(\n \"Figma OAuth response did not identify the connected user.\",\n );\n }\n return {\n accountId,\n label: text(me.email) ?? text(me.handle) ?? \"Figma account\",\n };\n}\n\nfunction requiredProvider(\n providerId: GenericWorkspaceOAuthProvider,\n): WorkspaceConnectionProvider {\n const provider = getWorkspaceConnectionProvider(providerId);\n if (!provider?.oauth)\n throw new Error(`${providerId} OAuth is not configured.`);\n return provider;\n}\n\nfunction readStoredFlow(\n event: H3Event,\n provider: GenericWorkspaceOAuthProvider,\n): WorkspaceProviderOAuthFlow \| null {\n const encrypted = getCookie(event, flowCookieName(provider));\n if (!encrypted) return null;\n try {\n return JSON.parse(\n decryptSecretValue(encrypted),\n ) as WorkspaceProviderOAuthFlow;\n } catch {\n return null;\n }\n}\n\nexport function isWorkspaceProviderOAuthFlowValid(input: {\n flow: WorkspaceProviderOAuthFlow;\n state: OAuthStatePayload;\n provider: GenericWorkspaceOAuthProvider;\n sessionEmail: string;\n sessionOrgId?: string;\n now?: number;\n}): boolean {\n return (\n input.flow.expiresAt >= (input.now ?? Date.now()) &&\n input.flow.provider === input.provider &&\n input.state.flowId === input.flow.flowId &&\n input.state.redirectUri === input.flow.redirectUri &&\n input.state.owner === input.flow.owner &&\n input.sessionEmail === input.flow.owner &&\n input.state.orgId === input.flow.orgId &&\n input.sessionOrgId === input.flow.orgId &&\n input.state.app === input.flow.appId\n );\n}\n\nexport function canConnectWorkspaceProviderOAuth(\n orgId: string \| null \| undefined,\n role: string \| null \| undefined,\n): boolean {\n return Boolean(orgId) && (role === \"owner\" \|\| role === \"admin\");\n}\n\nexport function scopedOAuthAccountId(\n provider: GenericWorkspaceOAuthProvider,\n owner: string,\n accountId: string,\n): string {\n if (\n provider !== \"hubspot\" &&\n provider !== \"salesforce\" &&\n provider !== \"jira\"\n ) {\n return accountId;\n }\n const ownerKey = crypto\n .createHash(\"sha256\")\n .update(`${provider}:${owner.trim().toLowerCase()}`)\n .digest(\"hex\")\n .slice(0, 24);\n return `${accountId}::${ownerKey}`;\n}\n\nasync function fetchBoundedProviderJson(\n url: string,\n init: RequestInit,\n providerLabel: string,\n): Promise<{ response: Response; body: Record<string, unknown> }> {\n const { response, body } = await fetchBoundedProviderJsonValue(\n url,\n init,\n providerLabel,\n );\n return { response, body: record(body) ?? {} };\n}\n\nasync function fetchBoundedProviderJsonValue(\n url: string,\n init: RequestInit,\n providerLabel: string,\n): Promise<{ response: Response; body: unknown }> {\n let response: Response;\n try {\n response = await fetch(url, {\n ...init,\n signal: AbortSignal.timeout(PROVIDER_REQUEST_TIMEOUT_MS),\n });\n } catch {\n throw new Error(`${providerLabel} OAuth request failed.`);\n }\n const declaredLength = Number(response.headers.get(\"content-length\"));\n if (\n Number.isFinite(declaredLength) &&\n declaredLength > PROVIDER_RESPONSE_MAX_BYTES\n ) {\n throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n }\n if (!response.body) return { response, body: {} };\n const reader = response.body.getReader();\n const chunks: Uint8Array[] = [];\n let length = 0;\n try {\n while (true) {\n const chunk = await reader.read();\n if (chunk.done) break;\n length += chunk.value.byteLength;\n if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n await reader.cancel();\n break;\n }\n chunks.push(chunk.value);\n }\n } catch {\n throw new Error(`${providerLabel} OAuth request failed.`);\n }\n if (length > PROVIDER_RESPONSE_MAX_BYTES) {\n throw new Error(`${providerLabel} OAuth response exceeded the size limit.`);\n }\n try {\n const json = Buffer.concat(chunks).toString(\"utf8\");\n const body = JSON.parse(json) as unknown;\n return { response, body };\n } catch {\n return { response, body: {} };\n }\n}\n\nfunction tokenScopes(\n tokens: Record<string, unknown>,\n fallback: readonly string[],\n): string[] {\n const scope = text(tokens.scope);\n return scope ? scope.split(/[ ,]+/).filter(Boolean) : [...fallback];\n}\n\nexport function mergeWorkspaceOAuthValues(\n existing: readonly string[],\n incoming: readonly string[],\n): string[] {\n return [...new Set([...existing, ...incoming])];\n}\n\nfunction clientCredentialKeys(\n provider: GenericWorkspaceOAuthProvider,\n field: \"id\" \| \"secret\",\n): string[] {\n const prefix =\n provider === \"google_drive\" ? \"GOOGLE\" : provider.toUpperCase();\n const suffix = field === \"id\" ? \"ID\" : \"SECRET\";\n if (provider === \"github\") {\n const integrationPrefix = `GITHUB_INTEGRATION_CLIENT_${suffix}`;\n return [integrationPrefix, `GITHUB_CLIENT_${suffix}`];\n }\n if (provider === \"hubspot\") {\n const integrationPrefix = `HUBSPOT_INTEGRATION_CLIENT_${suffix}`;\n return [integrationPrefix, `HUBSPOT_CLIENT_${suffix}`];\n }\n if (provider === \"salesforce\") {\n const integrationPrefix = `SALESFORCE_INTEGRATION_CLIENT_${suffix}`;\n const consumerCredential = `SALESFORCE_CONSUMER_${\n field === \"id\" ? \"KEY\" : \"SECRET\"\n }`;\n return [\n integrationPrefix,\n `SALESFORCE_CLIENT_${suffix}`,\n consumerCredential,\n ];\n }\n return [`${prefix}_CLIENT_${suffix}`];\n}\n\nfunction normalizeSalesforceInstanceUrl(value: string \| undefined): URL \| null {\n if (!value) return null;\n try {\n const url = new URL(value);\n const host = url.hostname.toLowerCase();\n if (\n url.protocol !== \"https:\" \|\|\n url.username \|\|\n url.password \|\|\n url.port \|\|\n (host !== \"salesforce.com\" && !host.endsWith(\".salesforce.com\"))\n ) {\n return null;\n }\n return new URL(url.origin);\n } catch {\n return null;\n }\n}\n\nfunction parseSalesforceIdentityUrl(\n value: string \| undefined,\n): { organizationId: string; url: URL } \| null {\n if (!value) return null;\n try {\n const url = new URL(value);\n const host = url.hostname.toLowerCase();\n if (\n url.protocol !== \"https:\" \|\|\n url.username \|\|\n url.password \|\|\n url.port \|\|\n (host !== \"salesforce.com\" && !host.endsWith(\".salesforce.com\"))\n ) {\n return null;\n }\n const match = url.pathname.match(/^\\/id\\/([^/]+)\\/[^/]+\\/?$/);\n if (!match?.[1]) return null;\n return { organizationId: match[1], url };\n } catch {\n return null;\n }\n}\n\nexport function resolveSalesforceOAuthLoginUrl(\n environment: string \| undefined,\n): string \| null {\n const normalized = environment?.trim().toLowerCase();\n if (!normalized \|\| normalized === \"production\") {\n return SALESFORCE_PRODUCTION_LOGIN_URL;\n }\n if (normalized === \"sandbox\") return SALESFORCE_SANDBOX_LOGIN_URL;\n return null;\n}\n\nexport function salesforceOAuthEndpoint(\n loginUrl: string,\n phase: \"authorize\" \| \"token\",\n): string {\n if (\n loginUrl !== SALESFORCE_PRODUCTION_LOGIN_URL &&\n loginUrl !== SALESFORCE_SANDBOX_LOGIN_URL\n ) {\n throw new Error(\"Invalid Salesforce OAuth login URL.\");\n }\n return `${loginUrl}/services/oauth2/${phase}`;\n}\n\nasync function resolveProviderClientCredentials(\n provider: GenericWorkspaceOAuthProvider,\n): Promise<[string \| null, string \| null]> {\n const [clientId, clientSecret] = await Promise.all(\n ([\"id\", \"secret\"] as const).map(async (field) => {\n for (const key of clientCredentialKeys(provider, field)) {\n const value = await resolveSecret(key);\n if (value) return value;\n }\n return null;\n }),\n );\n return [clientId, clientSecret];\n}\n\nfunction flowCookieName(provider: GenericWorkspaceOAuthProvider): string {\n return `an_workspace_oauth_${provider}`;\n}\n\nfunction normalizeAppId(value: string): string {\n const normalized = value.trim().toLowerCase();\n if (!/^[a-z0-9][a-z0-9_-]{0,99}$/.test(normalized)) {\n throw new Error(\"OAuth appId is invalid.\");\n }\n return normalized;\n}\n\nfunction text(value: unknown): string \| undefined {\n return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction scalarText(value: unknown): string \| undefined {\n if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n return text(value);\n}\n\nfunction record(value: unknown): Record<string, unknown> \| null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record<string, unknown>)\n : null;\n}\n\nfunction methodNotAllowed(event: H3Event) {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n}\n\nfunction unauthorized(event: H3Event) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n}\n\nasync function requireWorkspaceProviderOAuthAdmin(event: H3Event) {\n const context = await getOrgContext(event).catch(() => null);\n if (\n !context \|\|\n !canConnectWorkspaceProviderOAuth(context.orgId, context.role)\n ) {\n setResponseStatus(event, 403);\n return null;\n }\n return context;\n}\n"]}

package/dist/styles/agent-native.css CHANGED Viewed

@@ -771,6 +771,7 @@
 .agent-composer-missing-key-trigger {
   display: flex;
+  cursor: pointer;
   min-height: 4.5rem;
   width: 100%;
   flex: 1;
@@ -783,6 +784,9 @@
   text-align: start;
   color: hsl(var(--foreground));
   outline: none;
+  transition:
+    background-color 150ms ease-out,
+    box-shadow 150ms ease-out;
 }
 .agent-composer-missing-key-trigger:hover {
@@ -793,6 +797,14 @@
   box-shadow: inset 0 0 0 2px hsl(var(--ring));
 }
+.agent-composer-missing-key-content {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 0.5rem;
+}
 .agent-composer-missing-key-copy {
   display: flex;
   min-width: 0;
@@ -812,6 +824,31 @@
   color: hsl(var(--muted-foreground));
 }
+.agent-composer-missing-key-cta {
+  display: inline-flex;
+  min-height: 2rem;
+  align-items: center;
+  justify-content: center;
+  border-radius: 0.375rem;
+  background: hsl(var(--foreground));
+  padding: 0.5rem 0.75rem;
+  color: hsl(var(--background));
+  font-size: 0.75rem;
+  font-weight: 600;
+  line-height: 1rem;
+  transition:
+    opacity 150ms ease-out,
+    transform 150ms ease-out;
+}
+.agent-composer-missing-key-trigger:hover .agent-composer-missing-key-cta {
+  opacity: 0.9;
+}
+.agent-composer-missing-key-trigger:active .agent-composer-missing-key-cta {
+  transform: scale(0.98);
+}
 .agent-composer-root--hero .agent-composer-missing-key-trigger {
   min-height: 7.5rem;
   justify-content: center;
@@ -824,6 +861,10 @@
   line-height: 1.375rem;
 }
+.agent-composer-root--hero .agent-composer-missing-key-content {
+  align-items: center;
+}
 .agent-composer-stack {
   position: relative;
   flex-shrink: 0;
@@ -881,13 +922,15 @@
   line-height: 1.125rem;
 }
-.agent-thinking-indicator__text {
+.agent-thinking-indicator__text,
+.agent-running-shimmer {
   display: inline-block;
 }
 @media (prefers-reduced-motion: no-preference) {
   @supports ((background-clip: text) or (-webkit-background-clip: text)) {
-    .agent-thinking-indicator__text {
+    .agent-thinking-indicator__text,
+    .agent-running-shimmer {
       color: transparent;
       background: linear-gradient(
         90deg,