@agentuity/core 2.0.0-beta.0 → 2.0.0

package/dist/services/oauth/flow.js

@@ -0,0 +1,308 @@
+import { getEnv } from "../env.js";
+import { OAuthResponseError } from "./util.js";
+import { OAuthTokenResponseSchema, OAuthUserInfoSchema } from "./types.js";
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Resolve OAuth configuration by merging explicit config with environment variables.
+ * Priority: explicit config > env vars > issuer-derived URLs > defaults.
+ */
+function resolveConfig(config) {
+    const clientId = config?.clientId ?? getEnv('OAUTH_CLIENT_ID');
+    const clientSecret = config?.clientSecret ?? getEnv('OAUTH_CLIENT_SECRET');
+    const issuer = config?.issuer ?? getEnv('OAUTH_ISSUER');
+    const authorizeUrl = config?.authorizeUrl ??
+        getEnv('OAUTH_AUTHORIZE_URL') ??
+        (issuer ? `${issuer}/authorize` : undefined);
+    const tokenUrl = config?.tokenUrl ??
+        getEnv('OAUTH_TOKEN_URL') ??
+        (issuer ? `${issuer}/oauth/token` : undefined);
+    const userinfoUrl = config?.userinfoUrl ??
+        getEnv('OAUTH_USERINFO_URL') ??
+        (issuer ? `${issuer}/userinfo` : undefined);
+    const revokeUrl = config?.revokeUrl ?? getEnv('OAUTH_REVOKE_URL') ?? (issuer ? `${issuer}/revoke` : undefined);
+    const endSessionUrl = config?.endSessionUrl ??
+        getEnv('OAUTH_END_SESSION_URL') ??
+        (issuer ? `${issuer}/end_session` : undefined);
+    const scopes = config?.scopes ?? getEnv('OAUTH_SCOPES') ?? 'openid profile email';
+    const prompt = config?.prompt;
+    return {
+        clientId,
+        clientSecret,
+        issuer,
+        authorizeUrl,
+        tokenUrl,
+        userinfoUrl,
+        revokeUrl,
+        endSessionUrl,
+        scopes,
+        prompt,
+    };
+}
+/**
+ * Build an OAuth 2.0 authorization URL for redirecting the user to the OIDC provider.
+ *
+ * @param redirectUri - The callback URL the provider will redirect to after authentication
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ * @returns The full authorization URL to redirect the user to
+ *
+ * @example
+ * ```typescript
+ * // Uses OAUTH_CLIENT_ID, OAUTH_AUTHORIZE_URL (or OAUTH_ISSUER) from env
+ * const url = buildAuthorizeUrl('http://localhost:3500/api/oauth/login');
+ *
+ * // Or with explicit config
+ * const url = buildAuthorizeUrl('http://localhost:3500/api/oauth/login', {
+ *   issuer: 'https://auth.agentuity.cloud',
+ *   clientId: 'my-client-id',
+ * });
+ * ```
+ */
+export function buildAuthorizeUrl(redirectUri, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.authorizeUrl) {
+        throw new OAuthResponseError({
+            message: 'No authorize URL configured. Set OAUTH_AUTHORIZE_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    if (!resolved.clientId) {
+        throw new OAuthResponseError({
+            message: 'No client ID configured. Set OAUTH_CLIENT_ID environment variable.',
+        });
+    }
+    const params = new URLSearchParams({
+        client_id: resolved.clientId,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope: resolved.scopes,
+    });
+    if (resolved.prompt) {
+        params.set('prompt', resolved.prompt);
+    }
+    return `${resolved.authorizeUrl}?${params.toString()}`;
+}
+/**
+ * Exchange an authorization code for an access token.
+ *
+ * @param code - The authorization code received from the OAuth callback
+ * @param redirectUri - The same redirect URI used in the authorization request
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ * @returns The token response including access_token, and optionally refresh_token, id_token, etc.
+ *
+ * @example
+ * ```typescript
+ * const token = await exchangeToken(code, 'http://localhost:3500/api/oauth/login');
+ * console.log(token.access_token);
+ * ```
+ */
+export async function exchangeToken(code, redirectUri, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.tokenUrl) {
+        throw new OAuthResponseError({
+            message: 'No token URL configured. Set OAUTH_TOKEN_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    if (!resolved.clientId) {
+        throw new OAuthResponseError({
+            message: 'No client ID configured. Set OAUTH_CLIENT_ID environment variable.',
+        });
+    }
+    if (!resolved.clientSecret) {
+        throw new OAuthResponseError({
+            message: 'No client secret configured. Set OAUTH_CLIENT_SECRET environment variable.',
+        });
+    }
+    let response;
+    try {
+        response = await fetch(resolved.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: redirectUri,
+                client_id: resolved.clientId,
+                client_secret: resolved.clientSecret,
+            }),
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
+            throw new OAuthResponseError({
+                message: `Token exchange timed out after ${DEFAULT_TIMEOUT_MS}ms`,
+            });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const error = await response.text();
+        throw new OAuthResponseError({
+            message: `Token exchange failed (${response.status}): ${error}`,
+        });
+    }
+    const data = await response.json();
+    return OAuthTokenResponseSchema.parse(data);
+}
+/**
+ * Refresh an access token using a refresh token.
+ *
+ * @param refreshTokenValue - The refresh token obtained from a previous token exchange
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ * @returns The token response including a new access_token, and optionally a new refresh_token
+ *
+ * @example
+ * ```typescript
+ * const newToken = await refreshToken(previousToken.refresh_token!);
+ * console.log(newToken.access_token);
+ * ```
+ */
+export async function refreshToken(refreshTokenValue, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.tokenUrl) {
+        throw new OAuthResponseError({
+            message: 'No token URL configured. Set OAUTH_TOKEN_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    if (!resolved.clientId) {
+        throw new OAuthResponseError({
+            message: 'No client ID configured. Set OAUTH_CLIENT_ID environment variable.',
+        });
+    }
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: refreshTokenValue,
+        client_id: resolved.clientId,
+    });
+    if (resolved.clientSecret) {
+        params.set('client_secret', resolved.clientSecret);
+    }
+    let response;
+    try {
+        response = await fetch(resolved.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
+            throw new OAuthResponseError({
+                message: `Token refresh timed out after ${DEFAULT_TIMEOUT_MS}ms`,
+            });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const error = await response.text();
+        throw new OAuthResponseError({
+            message: `Token refresh failed (${response.status}): ${error}`,
+        });
+    }
+    const data = await response.json();
+    return OAuthTokenResponseSchema.parse(data);
+}
+/**
+ * Revoke an OAuth token (access token or refresh token) to log the user out.
+ *
+ * Calls the token revocation endpoint (RFC 7009). The server will invalidate
+ * the token so it can no longer be used. Per the spec, the endpoint returns
+ * a success response even if the token was already invalid.
+ *
+ * @param token - The access token or refresh token to revoke
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ *
+ * @example
+ * ```typescript
+ * // Revoke the refresh token to fully log out
+ * await logout(token.refresh_token!);
+ * ```
+ */
+export async function logout(token, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.revokeUrl) {
+        throw new OAuthResponseError({
+            message: 'No revoke URL configured. Set OAUTH_REVOKE_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    if (!resolved.clientId) {
+        throw new OAuthResponseError({
+            message: 'No client ID configured. Set OAUTH_CLIENT_ID environment variable.',
+        });
+    }
+    const params = new URLSearchParams({
+        token,
+        client_id: resolved.clientId,
+    });
+    if (resolved.clientSecret) {
+        params.set('client_secret', resolved.clientSecret);
+    }
+    let response;
+    try {
+        response = await fetch(resolved.revokeUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
+            throw new OAuthResponseError({
+                message: `Token revocation timed out after ${DEFAULT_TIMEOUT_MS}ms`,
+            });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const error = await response.text();
+        throw new OAuthResponseError({
+            message: `Token revocation failed (${response.status}): ${error}`,
+        });
+    }
+}
+/**
+ * Fetch user information from the OIDC userinfo endpoint using an access token.
+ *
+ * @param accessToken - The access token obtained from the token exchange
+ * @param config - Optional OAuth configuration. Falls back to environment variables.
+ * @returns The user info including sub, name, email, and any additional claims
+ *
+ * @example
+ * ```typescript
+ * const user = await fetchUserInfo(token.access_token);
+ * console.log(user.name, user.email);
+ * ```
+ */
+export async function fetchUserInfo(accessToken, config) {
+    const resolved = resolveConfig(config);
+    if (!resolved.userinfoUrl) {
+        throw new OAuthResponseError({
+            message: 'No userinfo URL configured. Set OAUTH_USERINFO_URL or OAUTH_ISSUER environment variable.',
+        });
+    }
+    let response;
+    try {
+        response = await fetch(resolved.userinfoUrl, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+            signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof DOMException && err.name === 'TimeoutError') {
+            throw new OAuthResponseError({
+                message: `Userinfo request timed out after ${DEFAULT_TIMEOUT_MS}ms`,
+            });
+        }
+        throw err;
+    }
+    if (!response.ok) {
+        const error = await response.text();
+        throw new OAuthResponseError({
+            message: `Failed to fetch user info (${response.status}): ${error}`,
+        });
+    }
+    const data = await response.json();
+    return OAuthUserInfoSchema.parse(data);
+}
+//# sourceMappingURL=flow.js.map

package/dist/services/oauth/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/services/oauth/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAG3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAwB;IAC9C,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,YAAY,GACjB,MAAM,EAAE,YAAY;QACpB,MAAM,CAAC,qBAAqB,CAAC;QAC7B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,MAAM,CAAC,iBAAiB,CAAC;QACzB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,WAAW,GAChB,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,oBAAoB,CAAC;QAC5B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GACd,MAAM,EAAE,SAAS,IAAI,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,aAAa,GAClB,MAAM,EAAE,aAAa;QACrB,MAAM,CAAC,uBAAuB,CAAC;QAC/B,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,sBAAsB,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAE9B,OAAO;QACN,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,WAAW;QACX,SAAS;QACT,aAAa;QACb,MAAM;QACN,MAAM;KACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,MAAwB;IAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,4FAA4F;SAC7F,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,SAAS,EAAE,QAAQ,CAAC,QAAQ;QAC5B,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,QAAQ,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,IAAY,EACZ,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,oFAAoF;SACrF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,4EAA4E;SACrF,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,QAAQ,CAAC,QAAQ;gBAC5B,aAAa,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,kCAAkC,kBAAkB,IAAI;aACjE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SAC/D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,iBAAyB,EACzB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,oFAAoF;SACrF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,iBAAiB;QAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,iCAAiC,kBAAkB,IAAI;aAChE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,yBAAyB,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SAC9D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,MAAwB;IACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,sFAAsF;SACvF,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QAClC,KAAK;QACL,SAAS,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,oCAAoC,kBAAkB,IAAI;aACnE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,4BAA4B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SACjE,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,WAAmB,EACnB,MAAwB;IAExB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EACN,0FAA0F;SAC3F,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,oCAAoC,kBAAkB,IAAI;aACnE,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC5B,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE;SACnE,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/services/oauth/index.d.ts

@@ -6,4 +6,6 @@ export * from './scopes.ts';
 export * from './members.ts';
 export * from './keys.ts';
 export * from './util.ts';
+export * from './flow.ts';
+export * from './token-storage.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC"}

package/dist/services/oauth/index.js

@@ -6,4 +6,6 @@ export * from "./scopes.js";
 export * from "./members.js";
 export * from "./keys.js";
 export * from "./util.js";
+export * from "./flow.js";
+export * from "./token-storage.js";
 //# sourceMappingURL=index.js.map

package/dist/services/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/oauth/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC"}

package/dist/services/oauth/token-storage.d.ts

@@ -0,0 +1,109 @@
+import type { KeyValueStorage } from '../keyvalue/service.ts';
+import type { OAuthFlowConfig, OAuthTokenResponse, StoredToken } from './types.ts';
+/**
+ * Check whether a stored token's access token has expired.
+ *
+ * @param token - The stored token to check
+ * @returns true if the token has an expires_at timestamp that is in the past
+ *
+ * @example
+ * ```typescript
+ * const token = await storage.get('user:123');
+ * if (token && isTokenExpired(token)) {
+ *   // Token is expired and auto-refresh wasn't available
+ * }
+ * ```
+ */
+export declare function isTokenExpired(token: StoredToken): boolean;
+/**
+ * Options for configuring a TokenStorage instance.
+ */
+export interface TokenStorageOptions {
+    /**
+     * OAuth configuration for auto-refresh and token revocation.
+     * If not provided, auto-refresh on get() and server-side revocation on invalidate() are disabled.
+     */
+    config?: OAuthFlowConfig;
+    /**
+     * KV namespace for storing tokens. Defaults to 'oauth-tokens'.
+     */
+    namespace?: string;
+    /**
+     * Key prefix prepended to all storage keys.
+     * Useful for scoping tokens by application or tenant.
+     */
+    prefix?: string;
+}
+/**
+ * Interface for storing, retrieving, and invalidating OAuth tokens.
+ *
+ * Implementations handle persistence and may support automatic token refresh
+ * on retrieval and server-side revocation on invalidation.
+ */
+export interface TokenStorage {
+    /**
+     * Retrieve a stored token by key.
+     *
+     * If the token is expired and a refresh_token is available (and config is provided),
+     * the token is automatically refreshed, stored, and the new token is returned.
+     * If auto-refresh fails, the expired token is returned so the caller can decide
+     * how to handle it (check with {@link isTokenExpired}).
+     *
+     * @param key - The storage key (e.g. a user ID or session ID)
+     * @returns The stored token, or null if no token exists for the key
+     */
+    get(key: string): Promise<StoredToken | null>;
+    /**
+     * Store a token response from a token exchange or refresh.
+     *
+     * Automatically computes `expires_at` from `expires_in` if present.
+     *
+     * @param key - The storage key (e.g. a user ID or session ID)
+     * @param token - The OAuth token response to store
+     */
+    set(key: string, token: OAuthTokenResponse): Promise<void>;
+    /**
+     * Invalidate a stored token: revoke it server-side and remove from storage.
+     *
+     * If config is provided, the refresh token (or access token as fallback)
+     * is revoked via the token revocation endpoint. Revocation is best-effort —
+     * the token is removed from storage regardless of whether revocation succeeds.
+     *
+     * @param key - The storage key to invalidate
+     * @returns The token that was removed, or null if no token existed
+     */
+    invalidate(key: string): Promise<StoredToken | null>;
+}
+/**
+ * Token storage backed by Agentuity's Key-Value storage service.
+ *
+ * Stores tokens as JSON in a KV namespace. Supports automatic token refresh
+ * on retrieval when tokens expire (if OAuth config is provided).
+ *
+ * @example
+ * ```typescript
+ * import { KeyValueTokenStorage } from '@agentuity/core/oauth';
+ *
+ * // Create storage with auto-refresh enabled
+ * const storage = new KeyValueTokenStorage(ctx.kv, {
+ *   config: { issuer: 'https://auth.example.com' },
+ * });
+ *
+ * // Store a token after initial exchange
+ * await storage.set('user:123', tokenResponse);
+ *
+ * // Retrieve — auto-refreshes if expired
+ * const token = await storage.get('user:123');
+ *
+ * // Logout — revokes server-side and removes from storage
+ * await storage.invalidate('user:123');
+ * ```
+ */
+export declare class KeyValueTokenStorage implements TokenStorage {
+    #private;
+    constructor(kv: KeyValueStorage, options?: TokenStorageOptions);
+    get(key: string): Promise<StoredToken | null>;
+    set(key: string, token: OAuthTokenResponse): Promise<void>;
+    invalidate(key: string): Promise<StoredToken | null>;
+}
+//# sourceMappingURL=token-storage.d.ts.map

package/dist/services/oauth/token-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.d.ts","sourceRoot":"","sources":["../../../src/services/oauth/token-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAMnF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAG1D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;OAGG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;OAUG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9C;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D;;;;;;;;;OASG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACrD;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,oBAAqB,YAAW,YAAY;;gBAM5C,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB;IAOxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyB7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;CA8C1D"}

package/dist/services/oauth/token-storage.js

@@ -0,0 +1,140 @@
+import { StoredTokenSchema } from "./types.js";
+import { refreshToken, logout } from "./flow.js";
+const DEFAULT_NAMESPACE = 'oauth-tokens';
+/**
+ * Check whether a stored token's access token has expired.
+ *
+ * @param token - The stored token to check
+ * @returns true if the token has an expires_at timestamp that is in the past
+ *
+ * @example
+ * ```typescript
+ * const token = await storage.get('user:123');
+ * if (token && isTokenExpired(token)) {
+ *   // Token is expired and auto-refresh wasn't available
+ * }
+ * ```
+ */
+export function isTokenExpired(token) {
+    if (!token.expires_at)
+        return false;
+    return Math.floor(Date.now() / 1000) >= token.expires_at;
+}
+/**
+ * Convert an OAuth token response to a StoredToken with computed expires_at.
+ */
+function toStoredToken(token) {
+    return {
+        access_token: token.access_token,
+        token_type: token.token_type,
+        refresh_token: token.refresh_token,
+        scope: token.scope,
+        id_token: token.id_token,
+        expires_at: token.expires_in ? Math.floor(Date.now() / 1000) + token.expires_in : undefined,
+    };
+}
+/**
+ * Token storage backed by Agentuity's Key-Value storage service.
+ *
+ * Stores tokens as JSON in a KV namespace. Supports automatic token refresh
+ * on retrieval when tokens expire (if OAuth config is provided).
+ *
+ * @example
+ * ```typescript
+ * import { KeyValueTokenStorage } from '@agentuity/core/oauth';
+ *
+ * // Create storage with auto-refresh enabled
+ * const storage = new KeyValueTokenStorage(ctx.kv, {
+ *   config: { issuer: 'https://auth.example.com' },
+ * });
+ *
+ * // Store a token after initial exchange
+ * await storage.set('user:123', tokenResponse);
+ *
+ * // Retrieve — auto-refreshes if expired
+ * const token = await storage.get('user:123');
+ *
+ * // Logout — revokes server-side and removes from storage
+ * await storage.invalidate('user:123');
+ * ```
+ */
+export class KeyValueTokenStorage {
+    #kv;
+    #namespace;
+    #prefix;
+    #config;
+    constructor(kv, options) {
+        this.#kv = kv;
+        this.#namespace = options?.namespace ?? DEFAULT_NAMESPACE;
+        this.#prefix = options?.prefix ?? '';
+        this.#config = options?.config;
+    }
+    async get(key) {
+        const result = await this.#kv.get(this.#namespace, this.#resolveKey(key));
+        if (!result.exists)
+            return null;
+        const parsed = StoredTokenSchema.safeParse(result.data);
+        if (!parsed.success)
+            return null;
+        const token = parsed.data;
+        // Auto-refresh if expired and refresh_token + config are available
+        if (isTokenExpired(token) && token.refresh_token && this.#config) {
+            try {
+                const newTokenResponse = await refreshToken(token.refresh_token, this.#config);
+                const newStored = toStoredToken(newTokenResponse);
+                await this.#store(key, newStored);
+                return newStored;
+            }
+            catch {
+                // Refresh failed — return the expired token, caller can check isTokenExpired()
+                return token;
+            }
+        }
+        return token;
+    }
+    async set(key, token) {
+        const stored = toStoredToken(token);
+        await this.#store(key, stored);
+    }
+    async invalidate(key) {
+        const resolvedKey = this.#resolveKey(key);
+        const result = await this.#kv.get(this.#namespace, resolvedKey);
+        if (!result.exists)
+            return null;
+        const parsed = StoredTokenSchema.safeParse(result.data);
+        const token = parsed.success ? parsed.data : null;
+        // Revoke server-side (best effort)
+        if (token && this.#config) {
+            const tokenToRevoke = token.refresh_token ?? token.access_token;
+            try {
+                await logout(tokenToRevoke, this.#config);
+            }
+            catch {
+                // Best effort — continue with storage cleanup
+            }
+        }
+        // Remove from storage regardless of revocation result
+        await this.#kv.delete(this.#namespace, resolvedKey);
+        return token;
+    }
+    async #store(key, token) {
+        // Only set explicit TTL for tokens without a refresh_token.
+        // Tokens with refresh capability persist until explicitly invalidated
+        // (auto-refresh on get() will keep them fresh).
+        let ttl;
+        if (!token.refresh_token && token.expires_at) {
+            const remaining = token.expires_at - Math.floor(Date.now() / 1000);
+            if (remaining > 0) {
+                ttl = Math.max(remaining, 60); // KV minimum is 60 seconds
+            }
+        }
+        await this.#kv.set(this.#namespace, this.#resolveKey(key), token, {
+            ttl,
+            contentType: 'application/json',
+        });
+    }
+    #resolveKey(key) {
+        return this.#prefix ? `${this.#prefix}${key}` : key;
+    }
+}
+//# sourceMappingURL=token-storage.js.map

package/dist/services/oauth/token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-storage.js","sourceRoot":"","sources":["../../../src/services/oauth/token-storage.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC;AAC1D,CAAC;AAmED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC/C,OAAO;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KAC3F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,oBAAoB;IAChC,GAAG,CAAkB;IACrB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,OAAO,CAAmB;IAE1B,YAAY,EAAmB,EAAE,OAA6B;QAC7D,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,SAAS,IAAI,iBAAiB,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAc,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QAE1B,mEAAmE;QACnE,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClE,IAAI,CAAC;gBACJ,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/E,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAClC,OAAO,SAAS,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACR,+EAA+E;gBAC/E,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAyB;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAc,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAElD,mCAAmC;QACnC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,CAAC;YAChE,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACR,8CAA8C;YAC/C,CAAC;QACF,CAAC;QAED,sDAAsD;QACtD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAEpD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAkB;QAC3C,4DAA4D;QAC5D,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,GAAuB,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACnE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBACnB,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,2BAA2B;YAC3D,CAAC;QACF,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;YACjE,GAAG;YACH,WAAW,EAAE,kBAAkB;SAC/B,CAAC,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC;CACD"}