@capgo/capacitor-social-login 8.2.24 → 8.3.0

package/dist/esm/oauth2-provider.js

@@ -21,26 +21,106 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         this.TOKENS_KEY_PREFIX = 'capgo_social_login_oauth2_tokens_';
         this.STATE_PREFIX = 'capgo_social_login_oauth2_state_';
     }
+    normalizeScopeValue(scope) {
+        if (!scope)
+            return '';
+        if (typeof scope === 'string')
+            return scope;
+        if (Array.isArray(scope))
+            return scope.filter(Boolean).join(' ');
+        return '';
+    }
+    normalizeConfig(providerId, config) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        const appId = (_a = config.appId) !== null && _a !== void 0 ? _a : config.clientId;
+        const authorizationBaseUrl = (_b = config.authorizationBaseUrl) !== null && _b !== void 0 ? _b : config.authorizationEndpoint;
+        const accessTokenEndpoint = (_c = config.accessTokenEndpoint) !== null && _c !== void 0 ? _c : config.tokenEndpoint;
+        const logoutUrl = (_d = config.logoutUrl) !== null && _d !== void 0 ? _d : config.endSessionEndpoint;
+        const scopeSource = (_e = config.scope) !== null && _e !== void 0 ? _e : config.scopes;
+        if (!appId) {
+            throw new Error(`OAuth2 provider '${providerId}' requires appId (or clientId).`);
+        }
+        if (!config.redirectUrl) {
+            throw new Error(`OAuth2 provider '${providerId}' requires redirectUrl.`);
+        }
+        if (!authorizationBaseUrl && !config.issuerUrl) {
+            throw new Error(`OAuth2 provider '${providerId}' requires authorizationBaseUrl (or authorizationEndpoint) or issuerUrl.`);
+        }
+        return {
+            appId,
+            issuerUrl: config.issuerUrl,
+            authorizationBaseUrl,
+            accessTokenEndpoint,
+            redirectUrl: config.redirectUrl,
+            resourceUrl: config.resourceUrl,
+            responseType: ((_f = config.responseType) !== null && _f !== void 0 ? _f : 'code'),
+            pkceEnabled: (_g = config.pkceEnabled) !== null && _g !== void 0 ? _g : true,
+            scope: this.normalizeScopeValue(scopeSource),
+            additionalParameters: config.additionalParameters,
+            loginHint: config.loginHint,
+            prompt: config.prompt,
+            additionalTokenParameters: config.additionalTokenParameters,
+            additionalResourceHeaders: config.additionalResourceHeaders,
+            logoutUrl,
+            postLogoutRedirectUrl: config.postLogoutRedirectUrl,
+            additionalLogoutParameters: config.additionalLogoutParameters,
+            logsEnabled: (_h = config.logsEnabled) !== null && _h !== void 0 ? _h : false,
+        };
+    }
+    async ensureDiscovered(providerId) {
+        const config = this.providers.get(providerId);
+        if (!(config === null || config === void 0 ? void 0 : config.issuerUrl))
+            return;
+        // Resolve endpoints lazily.
+        if (config.authorizationBaseUrl && config.accessTokenEndpoint)
+            return;
+        const issuer = config.issuerUrl.replace(/\/+$/, '');
+        const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+        const resp = await fetch(discoveryUrl);
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            throw new Error(`OAuth2 discovery failed (${resp.status}): ${text || discoveryUrl}`);
+        }
+        const payload = (await resp.json());
+        const authorizationEndpoint = payload['authorization_endpoint'];
+        const tokenEndpoint = payload['token_endpoint'];
+        const endSessionEndpoint = payload['end_session_endpoint'];
+        if (!config.authorizationBaseUrl && typeof authorizationEndpoint === 'string') {
+            config.authorizationBaseUrl = authorizationEndpoint;
+        }
+        if (!config.accessTokenEndpoint && typeof tokenEndpoint === 'string') {
+            config.accessTokenEndpoint = tokenEndpoint;
+        }
+        if (!config.logoutUrl && typeof endSessionEndpoint === 'string') {
+            config.logoutUrl = endSessionEndpoint;
+        }
+        if (config.logsEnabled) {
+            console.log(`[OAuth2:${providerId}] Discovery resolved`, {
+                authorizationBaseUrl: config.authorizationBaseUrl,
+                accessTokenEndpoint: config.accessTokenEndpoint,
+                logoutUrl: config.logoutUrl,
+            });
+        }
+    }
     /**
      * Initialize multiple OAuth2 providers
      */
     async initializeProviders(configs) {
-        var _a, _b, _c, _d;
         for (const [providerId, config] of Object.entries(configs)) {
-            if (!config.appId || !config.authorizationBaseUrl || !config.redirectUrl) {
-                throw new Error(`OAuth2 provider '${providerId}' requires appId, authorizationBaseUrl, and redirectUrl`);
-            }
-            const internalConfig = Object.assign(Object.assign({}, config), { responseType: (_a = config.responseType) !== null && _a !== void 0 ? _a : 'code', pkceEnabled: (_b = config.pkceEnabled) !== null && _b !== void 0 ? _b : true, scope: (_c = config.scope) !== null && _c !== void 0 ? _c : '', logsEnabled: (_d = config.logsEnabled) !== null && _d !== void 0 ? _d : false });
+            const internalConfig = this.normalizeConfig(providerId, config);
             this.providers.set(providerId, internalConfig);
             if (internalConfig.logsEnabled) {
                 console.log(`[OAuth2:${providerId}] Initialized with config:`, {
-                    appId: config.appId,
-                    authorizationBaseUrl: config.authorizationBaseUrl,
-                    redirectUrl: config.redirectUrl,
+                    appId: internalConfig.appId,
+                    issuerUrl: internalConfig.issuerUrl,
+                    authorizationBaseUrl: internalConfig.authorizationBaseUrl,
+                    redirectUrl: internalConfig.redirectUrl,
                     responseType: internalConfig.responseType,
                     pkceEnabled: internalConfig.pkceEnabled,
                 });
             }
+            // Pre-resolve discovery on web if issuerUrl is provided.
+            await this.ensureDiscovered(providerId);
         }
     }
     getProvider(providerId) {
@@ -54,13 +134,14 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         return `${this.TOKENS_KEY_PREFIX}${providerId}`;
     }
     async login(options) {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         const { providerId } = options;
         const config = this.getProvider(providerId);
+        await this.ensureDiscovered(providerId);
         const redirectUri = (_a = options.redirectUrl) !== null && _a !== void 0 ? _a : config.redirectUrl;
-        const scope = (_b = options.scope) !== null && _b !== void 0 ? _b : config.scope;
-        const state = (_c = options.state) !== null && _c !== void 0 ? _c : this.generateState();
-        const codeVerifier = (_d = options.codeVerifier) !== null && _d !== void 0 ? _d : this.generateCodeVerifier();
+        const scope = this.normalizeScopeValue((_c = (_b = options.scope) !== null && _b !== void 0 ? _b : options.scopes) !== null && _c !== void 0 ? _c : config.scope);
+        const state = (_d = options.state) !== null && _d !== void 0 ? _d : this.generateState();
+        const codeVerifier = (_e = options.codeVerifier) !== null && _e !== void 0 ? _e : this.generateCodeVerifier();
         // Build authorization URL
         const params = new URLSearchParams({
             response_type: config.responseType,
@@ -71,21 +152,25 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         if (scope) {
             params.set('scope', scope);
         }
+        // Convenience OIDC options
+        const mergedAdditionalParams = Object.assign(Object.assign({}, ((_f = config.additionalParameters) !== null && _f !== void 0 ? _f : {})), ((_g = options.additionalParameters) !== null && _g !== void 0 ? _g : {}));
+        const loginHint = (_h = options.loginHint) !== null && _h !== void 0 ? _h : config.loginHint;
+        const prompt = (_j = options.prompt) !== null && _j !== void 0 ? _j : config.prompt;
+        if (loginHint && !('login_hint' in mergedAdditionalParams)) {
+            mergedAdditionalParams.login_hint = loginHint;
+        }
+        if (prompt && !('prompt' in mergedAdditionalParams)) {
+            mergedAdditionalParams.prompt = prompt;
+        }
         // Add PKCE for code flow
         if (config.responseType === 'code' && config.pkceEnabled) {
             const codeChallenge = await this.generateCodeChallenge(codeVerifier);
             params.set('code_challenge', codeChallenge);
             params.set('code_challenge_method', 'S256');
         }
-        // Add additional parameters from config
-        if (config.additionalParameters) {
-            for (const [key, value] of Object.entries(config.additionalParameters)) {
-                params.set(key, value);
-            }
-        }
-        // Add additional parameters from login options
-        if (options.additionalParameters) {
-            for (const [key, value] of Object.entries(options.additionalParameters)) {
+        // Add merged additional parameters
+        for (const [key, value] of Object.entries(mergedAdditionalParams)) {
+            if (value !== undefined) {
                 params.set(key, value);
             }
         }
@@ -97,10 +182,19 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
             scope,
         });
         localStorage.setItem(BaseSocialLogin.OAUTH_STATE_KEY, JSON.stringify({ provider: 'oauth2', providerId, state }));
+        if (!config.authorizationBaseUrl) {
+            throw new Error(`OAuth2 provider '${providerId}' is missing authorizationBaseUrl (discovery may have failed).`);
+        }
         const authUrl = `${config.authorizationBaseUrl}?${params.toString()}`;
         if (config.logsEnabled) {
             console.log(`[OAuth2:${providerId}] Opening authorization URL:`, authUrl);
         }
+        if (options.flow === 'redirect') {
+            // Trigger a full-page redirect. The promise will not resolve because the page navigates away.
+            window.location.assign(authUrl);
+            // eslint-disable-next-line @typescript-eslint/no-empty-function
+            return new Promise(() => { });
+        }
         // Open popup window
         const width = 500;
         const height = 650;
@@ -206,11 +300,31 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         });
     }
     async logout(providerId) {
+        await this.ensureDiscovered(providerId);
         const config = this.providers.get(providerId);
+        const stored = this.getStoredTokens(providerId);
         localStorage.removeItem(this.getTokensKey(providerId));
-        // If logout URL is configured, redirect to it
+        // If logout URL is configured, build an end-session URL (OIDC) when possible.
         if (config === null || config === void 0 ? void 0 : config.logoutUrl) {
-            window.open(config.logoutUrl, '_blank');
+            try {
+                const url = new URL(config.logoutUrl);
+                if (stored === null || stored === void 0 ? void 0 : stored.idToken) {
+                    url.searchParams.set('id_token_hint', stored.idToken);
+                }
+                const postLogout = config.postLogoutRedirectUrl;
+                if (postLogout) {
+                    url.searchParams.set('post_logout_redirect_uri', postLogout);
+                }
+                if (config.additionalLogoutParameters) {
+                    for (const [k, v] of Object.entries(config.additionalLogoutParameters)) {
+                        url.searchParams.set(k, v);
+                    }
+                }
+                window.open(url.toString(), '_blank');
+            }
+            catch (_a) {
+                window.open(config.logoutUrl, '_blank');
+            }
         }
     }
     async isLoggedIn(providerId) {
@@ -235,15 +349,52 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         };
     }
     async refresh(providerId) {
-        const tokens = this.getStoredTokens(providerId);
-        if (!(tokens === null || tokens === void 0 ? void 0 : tokens.refreshToken)) {
+        await this.refreshToken(providerId);
+    }
+    async refreshToken(providerId, refreshToken, additionalParameters) {
+        var _a, _b, _c, _d, _e, _f;
+        await this.ensureDiscovered(providerId);
+        const config = this.getProvider(providerId);
+        const stored = this.getStoredTokens(providerId);
+        const effectiveRefreshToken = refreshToken !== null && refreshToken !== void 0 ? refreshToken : stored === null || stored === void 0 ? void 0 : stored.refreshToken;
+        if (!effectiveRefreshToken) {
             throw new Error(`No OAuth2 refresh token is available for provider '${providerId}'. Include offline_access scope to receive one.`);
         }
-        const config = this.getProvider(providerId);
         if (!config.accessTokenEndpoint) {
             throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);
         }
-        await this.refreshWithRefreshToken(providerId, tokens.refreshToken);
+        const tokenResponse = await this.refreshWithRefreshToken(providerId, effectiveRefreshToken, additionalParameters);
+        const expiresAt = tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1000 : Date.now() + 3600000;
+        const scopeArray = (_c = (_b = (_a = tokenResponse.scope) === null || _a === void 0 ? void 0 : _a.split(' ').filter(Boolean)) !== null && _b !== void 0 ? _b : stored === null || stored === void 0 ? void 0 : stored.scope) !== null && _c !== void 0 ? _c : [];
+        // Fetch resource data if configured
+        let resourceData = null;
+        if (config.resourceUrl) {
+            resourceData = await this.fetchResource(providerId, tokenResponse.access_token);
+        }
+        const nextRefreshToken = (_d = tokenResponse.refresh_token) !== null && _d !== void 0 ? _d : effectiveRefreshToken;
+        this.persistTokens(providerId, {
+            accessToken: tokenResponse.access_token,
+            refreshToken: nextRefreshToken,
+            idToken: tokenResponse.id_token,
+            expiresAt,
+            scope: scopeArray,
+            tokenType: tokenResponse.token_type,
+        });
+        return {
+            providerId,
+            accessToken: {
+                token: tokenResponse.access_token,
+                tokenType: tokenResponse.token_type,
+                expires: new Date(expiresAt).toISOString(),
+                refreshToken: nextRefreshToken,
+            },
+            idToken: (_e = tokenResponse.id_token) !== null && _e !== void 0 ? _e : null,
+            refreshToken: nextRefreshToken !== null && nextRefreshToken !== void 0 ? nextRefreshToken : null,
+            resourceData,
+            scope: scopeArray,
+            tokenType: tokenResponse.token_type,
+            expiresIn: (_f = tokenResponse.expires_in) !== null && _f !== void 0 ? _f : null,
+        };
     }
     async handleOAuthRedirect(url, expectedState) {
         var _a, _b, _c, _d, _e;
@@ -264,6 +415,7 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
             return { error: 'OAuth2 login session expired or state mismatch.' };
         }
         const { providerId } = pending;
+        await this.ensureDiscovered(providerId);
         const config = this.providers.get(providerId);
         if (!config) {
             localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);
@@ -358,6 +510,11 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         if (config.pkceEnabled) {
             params.set('code_verifier', pending.codeVerifier);
         }
+        if (config.additionalTokenParameters) {
+            for (const [k, v] of Object.entries(config.additionalTokenParameters)) {
+                params.set(k, v);
+            }
+        }
         if (config.logsEnabled) {
             console.log(`[OAuth2:${providerId}] Exchanging code at:`, config.accessTokenEndpoint);
         }
@@ -374,8 +531,7 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         }
         return (await response.json());
     }
-    async refreshWithRefreshToken(providerId, refreshToken) {
-        var _a, _b, _c;
+    async refreshWithRefreshToken(providerId, refreshToken, additionalParameters) {
         const config = this.getProvider(providerId);
         if (!config.accessTokenEndpoint) {
             throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);
@@ -385,6 +541,16 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
             refresh_token: refreshToken,
             client_id: config.appId,
         });
+        if (config.additionalTokenParameters) {
+            for (const [k, v] of Object.entries(config.additionalTokenParameters)) {
+                params.set(k, v);
+            }
+        }
+        if (additionalParameters) {
+            for (const [k, v] of Object.entries(additionalParameters)) {
+                params.set(k, v);
+            }
+        }
         const response = await fetch(config.accessTokenEndpoint, {
             method: 'POST',
             headers: {
@@ -396,17 +562,7 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
             const text = await response.text();
             throw new Error(`OAuth2 refresh failed (${response.status}): ${text}`);
         }
-        const tokens = (await response.json());
-        const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : Date.now() + 3600000;
-        const scopeArray = (_b = (_a = tokens.scope) === null || _a === void 0 ? void 0 : _a.split(' ').filter(Boolean)) !== null && _b !== void 0 ? _b : [];
-        this.persistTokens(providerId, {
-            accessToken: tokens.access_token,
-            refreshToken: (_c = tokens.refresh_token) !== null && _c !== void 0 ? _c : refreshToken,
-            idToken: tokens.id_token,
-            expiresAt,
-            scope: scopeArray,
-            tokenType: tokens.token_type,
-        });
+        return (await response.json());
     }
     async fetchResource(providerId, accessToken) {
         const config = this.getProvider(providerId);
@@ -483,5 +639,36 @@ export class OAuth2SocialLogin extends BaseSocialLogin {
         buffer.forEach((b) => (binary += String.fromCharCode(b)));
         return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
     }
+    decodeIdToken(idToken) {
+        const parts = idToken.split('.');
+        if (parts.length < 2) {
+            throw new Error('Invalid JWT: missing parts');
+        }
+        const payload = parts[1];
+        const normalized = payload.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = normalized + '='.repeat((4 - (normalized.length % 4)) % 4);
+        const json = atob(padded);
+        return JSON.parse(json);
+    }
+    getAccessTokenExpirationDate(providerId) {
+        const tokens = this.getStoredTokens(providerId);
+        if (!(tokens === null || tokens === void 0 ? void 0 : tokens.expiresAt))
+            return { expirationDate: null };
+        return { expirationDate: new Date(tokens.expiresAt).toISOString() };
+    }
+    isAccessTokenAvailable(providerId) {
+        const tokens = this.getStoredTokens(providerId);
+        return { isAvailable: !!(tokens === null || tokens === void 0 ? void 0 : tokens.accessToken) };
+    }
+    isAccessTokenExpired(providerId) {
+        const tokens = this.getStoredTokens(providerId);
+        if (!(tokens === null || tokens === void 0 ? void 0 : tokens.expiresAt))
+            return { isExpired: true };
+        return { isExpired: tokens.expiresAt <= Date.now() };
+    }
+    isRefreshTokenAvailable(providerId) {
+        const tokens = this.getStoredTokens(providerId);
+        return { isAvailable: !!(tokens === null || tokens === void 0 ? void 0 : tokens.refreshToken) };
+    }
 }
 //# sourceMappingURL=oauth2-provider.js.map

package/dist/esm/oauth2-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../src/oauth2-provider.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AA0CzC;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAAtD;;QACU,cAAS,GAAsC,IAAI,GAAG,EAAE,CAAC;QAChD,sBAAiB,GAAG,mCAAmC,CAAC;QACxD,iBAAY,GAAG,kCAAkC,CAAC;IA2iBrE,CAAC;IAziBC;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAA6C;;QACrE,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,yDAAyD,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,cAAc,mCACf,MAAM,KACT,YAAY,EAAE,MAAA,MAAM,CAAC,YAAY,mCAAI,MAAM,EAC3C,WAAW,EAAE,MAAA,MAAM,CAAC,WAAW,mCAAI,IAAI,EACvC,KAAK,EAAE,MAAA,MAAM,CAAC,KAAK,mCAAI,EAAE,EACzB,WAAW,EAAE,MAAA,MAAM,CAAC,WAAW,mCAAI,KAAK,GACzC,CAAC;YAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAE/C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,4BAA4B,EAAE;oBAC7D,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,cAAc,CAAC,YAAY;oBACzC,WAAW,EAAE,cAAc,CAAC,WAAW;iBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,4CAA4C,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,UAAkB;QACrC,OAAO,GAAG,IAAI,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAA2B;;QAE3B,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAE5C,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,MAAM,CAAC,WAAW,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,MAAM,CAAC,KAAK,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEzE,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,SAAS,EAAE,MAAM,CAAC,KAAK;YACvB,YAAY,EAAE,WAAW;YACzB,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,wCAAwC;QACxC,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACvE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE;YAC9B,UAAU;YACV,YAAY;YACZ,WAAW;YACX,KAAK;SACN,CAAC,CAAC;QAEH,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAEjH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEtE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,8BAA8B,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC;QAED,oBAAoB;QACpB,MAAM,KAAK,GAAG,GAAG,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,OAAO,EACP,aAAa,EACb,SAAS,KAAK,WAAW,MAAM,SAAS,IAAI,QAAQ,GAAG,UAAU,CAClE,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YAED,uFAAuF;YACvF,MAAM,WAAW,GAAG,UAAU,KAAK,EAAE,CAAC;YACtC,IAAI,gBAAgB,GAA4B,IAAI,CAAC;YAErD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACvD,CAAC;YAAC,WAAM,CAAC;gBACP,gEAAgE;gBAChE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,0DAA0D,CAAC,CAAC;gBAC/F,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CACd,cAA6C,EAC7C,aAAqB,EACrB,cAAsB,EACtB,EAAE;gBACF,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBACtD,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,aAAa,CAAC,cAAc,CAAC,CAAC;gBAC9B,IAAI,gBAAgB,EAAE,CAAC;oBACrB,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,kBAAkB,GAAG,CAAC,IAA6B,EAAE,EAAE;gBAC3D,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,MAAK,gBAAgB,EAAE,CAAC;oBACpC,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,QAAQ,KAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjD,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,sCAAsC;oBACtC,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,UAAU,KAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;wBACvD,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;oBAC5D,6DAA6D;oBAC7D,MAAM,KAIF,IAGH,EAPK,EACJ,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,YAAY,OAKnB,EAJI,OAAO,cAHN,oBAIL,CAGA,CAAC;oBACF,OAAO,CAAC;wBACN,QAAQ,EAAE,QAAa;wBACvB,MAAM,EAAE,OAAiC;qBACS,CAAC,CAAC;oBACtD,OAAO,IAAI,CAAC;gBACd,CAAC;qBAAM,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,MAAK,aAAa,EAAE,CAAC;oBACxC,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,QAAQ,KAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjD,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;oBAC5D,MAAM,CAAC,IAAI,KAAK,CAAE,IAAI,CAAC,KAAgB,IAAI,6BAA6B,CAAC,CAAC,CAAC;oBAC3E,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,uCAAuC;YACvC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gBAAgB,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;oBACnD,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,CAAC,KAAmB,EAAE,EAAE;gBAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAO;gBACT,CAAC;gBACD,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC,CAAC;YAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAEnD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC3C,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;gBAC5D,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBAAC,WAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;gBACD,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC/C,CAAC,EAAE,MAAM,CAAC,CAAC;YAEX,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE;gBAClD,IAAI,CAAC;oBACH,mFAAmF;oBACnF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;wBACjB,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;wBAC5D,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,8EAA8E;oBAC9E,2EAA2E;oBAC3E,2EAA2E;oBAC3E,qEAAqE;oBACrE,aAAa,CAAC,mBAAmB,CAAC,CAAC;oBACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CACT,WAAW,UAAU,gEAAgE;4BACnF,0CAA0C,CAC7C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvD,8CAA8C;QAC9C,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,UAAU,IAAI,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,EAAE,MAAM,CAAC,OAAO;SACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,iDAAiD,CAClH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAQ,EAAE,aAAsB;;QACxD,4CAA4C;QAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,wDAAwD;QACxD,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,oBAAoB,UAAU,4BAA4B,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC;YACH,IAAI,aAAkC,CAAC;YAEvC,sBAAsB;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,0BAA0B;gBAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;oBACzD,OAAO,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;gBACvE,CAAC;gBACD,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAClF,CAAC;iBAAM,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtC,gBAAgB;gBAChB,aAAa,GAAG;oBACd,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAE;oBACzC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,QAAQ;oBAChD,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC1F,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;oBACvC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;iBAC9C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACjH,MAAM,UAAU,GAAG,MAAA,MAAA,aAAa,CAAC,KAAK,0CAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;YAEzE,oCAAoC;YACpC,IAAI,YAAY,GAAmC,IAAI,CAAC;YACxD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;gBAC7B,WAAW,EAAE,aAAa,CAAC,YAAY;gBACvC,YAAY,EAAE,aAAa,CAAC,aAAa;gBACzC,OAAO,EAAE,aAAa,CAAC,QAAQ;gBAC/B,SAAS;gBACT,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,aAAa,CAAC,UAAU;aACpC,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE;oBACN,UAAU;oBACV,WAAW,EAAE;wBACX,KAAK,EAAE,aAAa,CAAC,YAAY;wBACjC,SAAS,EAAE,aAAa,CAAC,UAAU;wBACnC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;wBAC1C,YAAY,EAAE,aAAa,CAAC,aAAa;qBAC1C;oBACD,OAAO,EAAE,MAAA,aAAa,CAAC,QAAQ,mCAAI,IAAI;oBACvC,YAAY,EAAE,MAAA,aAAa,CAAC,aAAa,mCAAI,IAAI;oBACjD,YAAY;oBACZ,KAAK,EAAE,UAAU;oBACjB,SAAS,EAAE,aAAa,CAAC,UAAU;oBACnC,SAAS,EAAE,MAAA,aAAa,CAAC,UAAU,mCAAI,IAAI;iBAC5C;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,UAAkB,EAClB,IAAY,EACZ,OAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK;YACvB,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,UAAkB,EAAE,YAAoB;;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,MAAM,CAAC,KAAK;SACxB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACnG,MAAM,UAAU,GAAG,MAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;QAElE,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;YAC7B,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAA,MAAM,CAAC,aAAa,mCAAI,YAAY;YAClD,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,SAAS;YACT,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,WAAmB;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,IAAI,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC,CAAC;QAEF,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,MAA0B;QAClE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,KAAa,EAAE,OAA2B;QACpE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,CAAC;IAEO,mBAAmB,CAAC,KAAa;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,OAAO,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAEO,oBAAoB;QAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;aACxF,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,YAAoB;QACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAEO,eAAe,CAAC,MAAkB;QACxC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;CACF","sourcesContent":["import { BaseSocialLogin } from './base';\nimport type {\n  AuthorizationCode,\n  LoginResult,\n  OAuth2LoginOptions,\n  OAuth2LoginResponse,\n  OAuth2ProviderConfig,\n  ProviderResponseMap,\n} from './definitions';\n\ninterface OAuth2TokenResponse {\n  token_type: string;\n  expires_in?: number;\n  access_token: string;\n  scope?: string;\n  refresh_token?: string;\n  id_token?: string;\n}\n\ninterface OAuth2PendingLogin {\n  providerId: string;\n  codeVerifier: string;\n  redirectUri: string;\n  scope: string;\n}\n\ninterface OAuth2StoredTokens {\n  accessToken: string;\n  refreshToken?: string;\n  idToken?: string;\n  expiresAt: number;\n  scope: string[];\n  tokenType: string;\n}\n\ninterface OAuth2ConfigInternal extends OAuth2ProviderConfig {\n  responseType: 'code' | 'token';\n  pkceEnabled: boolean;\n  scope: string;\n  logsEnabled: boolean;\n}\n\n/**\n * OAuth2 Social Login Manager\n * Supports multiple OAuth2 provider configurations\n */\nexport class OAuth2SocialLogin extends BaseSocialLogin {\n  private providers: Map<string, OAuth2ConfigInternal> = new Map();\n  private readonly TOKENS_KEY_PREFIX = 'capgo_social_login_oauth2_tokens_';\n  private readonly STATE_PREFIX = 'capgo_social_login_oauth2_state_';\n\n  /**\n   * Initialize multiple OAuth2 providers\n   */\n  async initializeProviders(configs: Record<string, OAuth2ProviderConfig>): Promise<void> {\n    for (const [providerId, config] of Object.entries(configs)) {\n      if (!config.appId || !config.authorizationBaseUrl || !config.redirectUrl) {\n        throw new Error(`OAuth2 provider '${providerId}' requires appId, authorizationBaseUrl, and redirectUrl`);\n      }\n\n      const internalConfig: OAuth2ConfigInternal = {\n        ...config,\n        responseType: config.responseType ?? 'code',\n        pkceEnabled: config.pkceEnabled ?? true,\n        scope: config.scope ?? '',\n        logsEnabled: config.logsEnabled ?? false,\n      };\n\n      this.providers.set(providerId, internalConfig);\n\n      if (internalConfig.logsEnabled) {\n        console.log(`[OAuth2:${providerId}] Initialized with config:`, {\n          appId: config.appId,\n          authorizationBaseUrl: config.authorizationBaseUrl,\n          redirectUrl: config.redirectUrl,\n          responseType: internalConfig.responseType,\n          pkceEnabled: internalConfig.pkceEnabled,\n        });\n      }\n    }\n  }\n\n  private getProvider(providerId: string): OAuth2ConfigInternal {\n    const config = this.providers.get(providerId);\n    if (!config) {\n      throw new Error(`OAuth2 provider '${providerId}' not configured. Call initialize() first.`);\n    }\n    return config;\n  }\n\n  private getTokensKey(providerId: string): string {\n    return `${this.TOKENS_KEY_PREFIX}${providerId}`;\n  }\n\n  async login<T extends 'oauth2'>(\n    options: OAuth2LoginOptions,\n  ): Promise<{ provider: T; result: ProviderResponseMap[T] }> {\n    const { providerId } = options;\n    const config = this.getProvider(providerId);\n\n    const redirectUri = options.redirectUrl ?? config.redirectUrl;\n    const scope = options.scope ?? config.scope;\n    const state = options.state ?? this.generateState();\n    const codeVerifier = options.codeVerifier ?? this.generateCodeVerifier();\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      response_type: config.responseType,\n      client_id: config.appId,\n      redirect_uri: redirectUri,\n      state,\n    });\n\n    if (scope) {\n      params.set('scope', scope);\n    }\n\n    // Add PKCE for code flow\n    if (config.responseType === 'code' && config.pkceEnabled) {\n      const codeChallenge = await this.generateCodeChallenge(codeVerifier);\n      params.set('code_challenge', codeChallenge);\n      params.set('code_challenge_method', 'S256');\n    }\n\n    // Add additional parameters from config\n    if (config.additionalParameters) {\n      for (const [key, value] of Object.entries(config.additionalParameters)) {\n        params.set(key, value);\n      }\n    }\n\n    // Add additional parameters from login options\n    if (options.additionalParameters) {\n      for (const [key, value] of Object.entries(options.additionalParameters)) {\n        params.set(key, value);\n      }\n    }\n\n    // Store pending login state\n    this.persistPendingLogin(state, {\n      providerId,\n      codeVerifier,\n      redirectUri,\n      scope,\n    });\n\n    localStorage.setItem(BaseSocialLogin.OAUTH_STATE_KEY, JSON.stringify({ provider: 'oauth2', providerId, state }));\n\n    const authUrl = `${config.authorizationBaseUrl}?${params.toString()}`;\n\n    if (config.logsEnabled) {\n      console.log(`[OAuth2:${providerId}] Opening authorization URL:`, authUrl);\n    }\n\n    // Open popup window\n    const width = 500;\n    const height = 650;\n    const left = window.screenX + (window.outerWidth - width) / 2;\n    const top = window.screenY + (window.outerHeight - height) / 2;\n\n    const popup = window.open(\n      authUrl,\n      'OAuth2Login',\n      `width=${width},height=${height},left=${left},top=${top},popup=1`,\n    );\n\n    return new Promise((resolve, reject) => {\n      if (!popup) {\n        reject(new Error('Unable to open login window. Please allow popups.'));\n        return;\n      }\n\n      // Use BroadcastChannel for cross-origin communication (works when postMessage doesn't)\n      const channelName = `oauth2_${state}`;\n      let broadcastChannel: BroadcastChannel | null = null;\n\n      try {\n        broadcastChannel = new BroadcastChannel(channelName);\n      } catch {\n        // BroadcastChannel not supported, fall back to postMessage only\n        if (config.logsEnabled) {\n          console.log(`[OAuth2:${providerId}] BroadcastChannel not supported, using postMessage only`);\n        }\n      }\n\n      const cleanup = (\n        messageHandler: (event: MessageEvent) => void,\n        timeoutHandle: number,\n        intervalHandle: number,\n      ) => {\n        window.removeEventListener('message', messageHandler);\n        clearTimeout(timeoutHandle);\n        clearInterval(intervalHandle);\n        if (broadcastChannel) {\n          broadcastChannel.close();\n        }\n      };\n\n      const handleOAuthMessage = (data: Record<string, unknown>) => {\n        if (data?.type === 'oauth-response') {\n          if (data?.provider && data.provider !== 'oauth2') {\n            return false;\n          }\n          // Check providerId matches if present\n          if (data?.providerId && data.providerId !== providerId) {\n            return false;\n          }\n          cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n          // eslint-disable-next-line @typescript-eslint/no-unused-vars\n          const {\n            provider: _ignoredProvider,\n            type: _ignoredType,\n            ...payload\n          } = data as unknown as OAuth2LoginResponse & {\n            provider?: string;\n            type?: string;\n          };\n          resolve({\n            provider: 'oauth2' as T,\n            result: payload as ProviderResponseMap[T],\n          } as { provider: T; result: ProviderResponseMap[T] });\n          return true;\n        } else if (data?.type === 'oauth-error') {\n          if (data?.provider && data.provider !== 'oauth2') {\n            return false;\n          }\n          cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n          reject(new Error((data.error as string) || 'OAuth2 login was cancelled.'));\n          return true;\n        }\n        return false;\n      };\n\n      // Listen for BroadcastChannel messages\n      if (broadcastChannel) {\n        broadcastChannel.onmessage = (event: MessageEvent) => {\n          handleOAuthMessage(event.data);\n        };\n      }\n\n      const messageHandler = (event: MessageEvent) => {\n        if (event.origin !== window.location.origin) {\n          return;\n        }\n        handleOAuthMessage(event.data);\n      };\n\n      window.addEventListener('message', messageHandler);\n\n      const timeoutHandle = window.setTimeout(() => {\n        cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n        try {\n          popup.close();\n        } catch {\n          // Ignore cross-origin errors when closing\n        }\n        reject(new Error('OAuth2 login timed out.'));\n      }, 300000);\n\n      const popupClosedInterval = window.setInterval(() => {\n        try {\n          // Check if popup is closed - this may throw cross-origin errors for some providers\n          if (popup.closed) {\n            cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n            reject(new Error('OAuth2 login window was closed.'));\n          }\n        } catch {\n          // Cross-origin error when checking popup.closed - this happens when the popup\n          // navigates to a third-party OAuth provider with strict security settings.\n          // We can't detect if the window was closed, so we just rely on the timeout\n          // and message handlers. Clear the interval to avoid repeated errors.\n          clearInterval(popupClosedInterval);\n          if (config.logsEnabled) {\n            console.log(\n              `[OAuth2:${providerId}] Cannot check popup.closed due to cross-origin restrictions. ` +\n                'Relying on message handlers and timeout.',\n            );\n          }\n        }\n      }, 1000);\n    });\n  }\n\n  async logout(providerId: string): Promise<void> {\n    const config = this.providers.get(providerId);\n    localStorage.removeItem(this.getTokensKey(providerId));\n\n    // If logout URL is configured, redirect to it\n    if (config?.logoutUrl) {\n      window.open(config.logoutUrl, '_blank');\n    }\n  }\n\n  async isLoggedIn(providerId: string): Promise<{ isLoggedIn: boolean }> {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens) {\n      return { isLoggedIn: false };\n    }\n    const isValid = tokens.expiresAt > Date.now();\n    if (!isValid) {\n      localStorage.removeItem(this.getTokensKey(providerId));\n    }\n    return { isLoggedIn: isValid };\n  }\n\n  async getAuthorizationCode(providerId: string): Promise<AuthorizationCode> {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens) {\n      throw new Error(`OAuth2 access token is not available for provider '${providerId}'.`);\n    }\n    return {\n      accessToken: tokens.accessToken,\n      jwt: tokens.idToken,\n    };\n  }\n\n  async refresh(providerId: string): Promise<void> {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens?.refreshToken) {\n      throw new Error(\n        `No OAuth2 refresh token is available for provider '${providerId}'. Include offline_access scope to receive one.`,\n      );\n    }\n\n    const config = this.getProvider(providerId);\n    if (!config.accessTokenEndpoint) {\n      throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);\n    }\n\n    await this.refreshWithRefreshToken(providerId, tokens.refreshToken);\n  }\n\n  async handleOAuthRedirect(url: URL, expectedState?: string): Promise<LoginResult | { error: string } | null> {\n    // Check both query params and hash fragment\n    const params = new URLSearchParams(url.search);\n    const hashParams = new URLSearchParams(url.hash.slice(1));\n\n    // Merge params, hash takes priority (for implicit flow)\n    hashParams.forEach((value, key) => {\n      params.set(key, value);\n    });\n\n    const stateFromUrl = expectedState ?? params.get('state');\n    if (!stateFromUrl) {\n      return null;\n    }\n\n    const pending = this.consumePendingLogin(stateFromUrl);\n    if (!pending) {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n      return { error: 'OAuth2 login session expired or state mismatch.' };\n    }\n\n    const { providerId } = pending;\n    const config = this.providers.get(providerId);\n    if (!config) {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n      return { error: `OAuth2 provider '${providerId}' configuration not found.` };\n    }\n\n    const error = params.get('error');\n    if (error) {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n      return { error: params.get('error_description') || error };\n    }\n\n    try {\n      let tokenResponse: OAuth2TokenResponse;\n\n      // Check response type\n      if (params.has('code')) {\n        // Authorization code flow\n        const code = params.get('code');\n        if (!code) {\n          localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n          return { error: 'OAuth2 authorization code missing from redirect.' };\n        }\n        tokenResponse = await this.exchangeAuthorizationCode(providerId, code, pending);\n      } else if (params.has('access_token')) {\n        // Implicit flow\n        tokenResponse = {\n          access_token: params.get('access_token')!,\n          token_type: params.get('token_type') || 'bearer',\n          expires_in: params.has('expires_in') ? parseInt(params.get('expires_in')!, 10) : undefined,\n          scope: params.get('scope') || undefined,\n          id_token: params.get('id_token') || undefined,\n        };\n      } else {\n        localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n        return { error: 'No authorization code or access token in redirect.' };\n      }\n\n      const expiresAt = tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1000 : Date.now() + 3600000;\n      const scopeArray = tokenResponse.scope?.split(' ').filter(Boolean) ?? [];\n\n      // Fetch resource data if configured\n      let resourceData: Record<string, unknown> | null = null;\n      if (config.resourceUrl) {\n        resourceData = await this.fetchResource(providerId, tokenResponse.access_token);\n      }\n\n      this.persistTokens(providerId, {\n        accessToken: tokenResponse.access_token,\n        refreshToken: tokenResponse.refresh_token,\n        idToken: tokenResponse.id_token,\n        expiresAt,\n        scope: scopeArray,\n        tokenType: tokenResponse.token_type,\n      });\n\n      return {\n        provider: 'oauth2',\n        result: {\n          providerId,\n          accessToken: {\n            token: tokenResponse.access_token,\n            tokenType: tokenResponse.token_type,\n            expires: new Date(expiresAt).toISOString(),\n            refreshToken: tokenResponse.refresh_token,\n          },\n          idToken: tokenResponse.id_token ?? null,\n          refreshToken: tokenResponse.refresh_token ?? null,\n          resourceData,\n          scope: scopeArray,\n          tokenType: tokenResponse.token_type,\n          expiresIn: tokenResponse.expires_in ?? null,\n        },\n      };\n    } catch (err) {\n      if (err instanceof Error) {\n        return { error: err.message };\n      }\n      return { error: 'OAuth2 login failed unexpectedly.' };\n    } finally {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n    }\n  }\n\n  private async exchangeAuthorizationCode(\n    providerId: string,\n    code: string,\n    pending: OAuth2PendingLogin,\n  ): Promise<OAuth2TokenResponse> {\n    const config = this.getProvider(providerId);\n    if (!config.accessTokenEndpoint) {\n      throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);\n    }\n\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: config.appId,\n      code,\n      redirect_uri: pending.redirectUri,\n    });\n\n    if (config.pkceEnabled) {\n      params.set('code_verifier', pending.codeVerifier);\n    }\n\n    if (config.logsEnabled) {\n      console.log(`[OAuth2:${providerId}] Exchanging code at:`, config.accessTokenEndpoint);\n    }\n\n    const response = await fetch(config.accessTokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 token exchange failed (${response.status}): ${text}`);\n    }\n\n    return (await response.json()) as OAuth2TokenResponse;\n  }\n\n  private async refreshWithRefreshToken(providerId: string, refreshToken: string): Promise<void> {\n    const config = this.getProvider(providerId);\n    if (!config.accessTokenEndpoint) {\n      throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);\n    }\n\n    const params = new URLSearchParams({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: config.appId,\n    });\n\n    const response = await fetch(config.accessTokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 refresh failed (${response.status}): ${text}`);\n    }\n\n    const tokens = (await response.json()) as OAuth2TokenResponse;\n    const expiresAt = tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : Date.now() + 3600000;\n    const scopeArray = tokens.scope?.split(' ').filter(Boolean) ?? [];\n\n    this.persistTokens(providerId, {\n      accessToken: tokens.access_token,\n      refreshToken: tokens.refresh_token ?? refreshToken,\n      idToken: tokens.id_token,\n      expiresAt,\n      scope: scopeArray,\n      tokenType: tokens.token_type,\n    });\n  }\n\n  private async fetchResource(providerId: string, accessToken: string): Promise<Record<string, unknown>> {\n    const config = this.getProvider(providerId);\n    if (!config.resourceUrl) {\n      throw new Error(`No resourceUrl configured for provider '${providerId}'.`);\n    }\n\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${accessToken}`,\n    };\n\n    if (config.additionalResourceHeaders) {\n      Object.assign(headers, config.additionalResourceHeaders);\n    }\n\n    const response = await fetch(config.resourceUrl, {\n      headers,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`Unable to fetch OAuth2 resource (${response.status}): ${text}`);\n    }\n\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  private persistTokens(providerId: string, tokens: OAuth2StoredTokens): void {\n    localStorage.setItem(this.getTokensKey(providerId), JSON.stringify(tokens));\n  }\n\n  private getStoredTokens(providerId: string): OAuth2StoredTokens | null {\n    const raw = localStorage.getItem(this.getTokensKey(providerId));\n    if (!raw) {\n      return null;\n    }\n    try {\n      return JSON.parse(raw) as OAuth2StoredTokens;\n    } catch (err) {\n      console.warn(`Failed to parse stored OAuth2 tokens for provider '${providerId}'`, err);\n      return null;\n    }\n  }\n\n  private persistPendingLogin(state: string, payload: OAuth2PendingLogin): void {\n    localStorage.setItem(`${this.STATE_PREFIX}${state}`, JSON.stringify(payload));\n  }\n\n  private consumePendingLogin(state: string): OAuth2PendingLogin | null {\n    const key = `${this.STATE_PREFIX}${state}`;\n    const raw = localStorage.getItem(key);\n    localStorage.removeItem(key);\n    if (!raw) {\n      return null;\n    }\n    try {\n      return JSON.parse(raw) as OAuth2PendingLogin;\n    } catch (err) {\n      console.warn('Failed to parse pending OAuth2 login payload', err);\n      return null;\n    }\n  }\n\n  private generateState(): string {\n    return [...crypto.getRandomValues(new Uint8Array(16))].map((b) => b.toString(16).padStart(2, '0')).join('');\n  }\n\n  private generateCodeVerifier(): string {\n    const array = new Uint8Array(64);\n    crypto.getRandomValues(array);\n    return Array.from(array)\n      .map((b) => 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'[b % 66])\n      .join('');\n  }\n\n  private async generateCodeChallenge(codeVerifier: string): Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const digest = await crypto.subtle.digest('SHA-256', data);\n    return this.base64UrlEncode(new Uint8Array(digest));\n  }\n\n  private base64UrlEncode(buffer: Uint8Array): string {\n    let binary = '';\n    buffer.forEach((b) => (binary += String.fromCharCode(b)));\n    return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n  }\n}\n"]}
+{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../src/oauth2-provider.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAwDzC;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAAtD;;QACU,cAAS,GAAsC,IAAI,GAAG,EAAE,CAAC;QAChD,sBAAiB,GAAG,mCAAmC,CAAC;QACxD,iBAAY,GAAG,kCAAkC,CAAC;IA0vBrE,CAAC;IAxvBS,mBAAmB,CAAC,KAAc;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,MAA4B;;QACtE,MAAM,KAAK,GAAG,MAAA,MAAM,CAAC,KAAK,mCAAI,MAAM,CAAC,QAAQ,CAAC;QAC9C,MAAM,oBAAoB,GAAG,MAAA,MAAM,CAAC,oBAAoB,mCAAI,MAAM,CAAC,qBAAqB,CAAC;QACzF,MAAM,mBAAmB,GAAG,MAAA,MAAM,CAAC,mBAAmB,mCAAI,MAAM,CAAC,aAAa,CAAC;QAC/E,MAAM,SAAS,GAAG,MAAA,MAAM,CAAC,SAAS,mCAAI,MAAM,CAAC,kBAAkB,CAAC;QAChE,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,KAAK,mCAAI,MAAM,CAAC,MAAM,CAAC;QAElD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,iCAAiC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,yBAAyB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,oBAAoB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,oBAAoB,UAAU,0EAA0E,CACzG,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,oBAAoB;YACpB,mBAAmB;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,CAAC,MAAA,MAAM,CAAC,YAAY,mCAAI,MAAM,CAAqB;YACjE,WAAW,EAAE,MAAA,MAAM,CAAC,WAAW,mCAAI,IAAI;YACvC,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC;YAC5C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,SAAS;YACT,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;YAC7D,WAAW,EAAE,MAAA,MAAM,CAAC,WAAW,mCAAI,KAAK;SACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;YAAE,OAAO;QAE/B,4BAA4B;QAC5B,IAAI,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,mBAAmB;YAAE,OAAO;QAEtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,MAAM,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAE/D,MAAM,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YAC9E,MAAM,CAAC,oBAAoB,GAAG,qBAAqB,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,CAAC,mBAAmB,GAAG,aAAa,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,sBAAsB,EAAE;gBACvD,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAA6C;QACrE,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAChE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAE/C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,4BAA4B,EAAE;oBAC7D,KAAK,EAAE,cAAc,CAAC,KAAK;oBAC3B,SAAS,EAAE,cAAc,CAAC,SAAS;oBACnC,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;oBACzD,WAAW,EAAE,cAAc,CAAC,WAAW;oBACvC,YAAY,EAAE,cAAc,CAAC,YAAY;oBACzC,WAAW,EAAE,cAAc,CAAC,WAAW;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,4CAA4C,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,UAAkB;QACrC,OAAO,GAAG,IAAI,CAAC,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAA2B;;QAE3B,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAExC,MAAM,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,MAAM,CAAC,WAAW,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAA,MAAA,OAAO,CAAC,KAAK,mCAAI,OAAO,CAAC,MAAM,mCAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,KAAK,mCAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEzE,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,SAAS,EAAE,MAAM,CAAC,KAAK;YACvB,YAAY,EAAE,WAAW;YACzB,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,2BAA2B;QAC3B,MAAM,sBAAsB,mCACvB,CAAC,MAAA,MAAM,CAAC,oBAAoB,mCAAI,EAAE,CAAC,GACnC,CAAC,MAAA,OAAO,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CACxC,CAAC;QACF,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,MAAM,CAAC,SAAS,CAAC;QACxD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,SAAS,IAAI,CAAC,CAAC,YAAY,IAAI,sBAAsB,CAAC,EAAE,CAAC;YAC3D,sBAAsB,CAAC,UAAU,GAAG,SAAS,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,sBAAsB,CAAC,EAAE,CAAC;YACpD,sBAAsB,CAAC,MAAM,GAAG,MAAM,CAAC;QACzC,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,mCAAmC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE;YAC9B,UAAU;YACV,YAAY;YACZ,WAAW;YACX,KAAK;SACN,CAAC,CAAC;QAEH,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAEjH,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,gEAAgE,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEtE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,8BAA8B,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,8FAA8F;YAC9F,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,gEAAgE;YAChE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAQ,CAAC;QACtC,CAAC;QAED,oBAAoB;QACpB,MAAM,KAAK,GAAG,GAAG,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,OAAO,EACP,aAAa,EACb,SAAS,KAAK,WAAW,MAAM,SAAS,IAAI,QAAQ,GAAG,UAAU,CAClE,CAAC;QAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YAED,uFAAuF;YACvF,MAAM,WAAW,GAAG,UAAU,KAAK,EAAE,CAAC;YACtC,IAAI,gBAAgB,GAA4B,IAAI,CAAC;YAErD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACvD,CAAC;YAAC,WAAM,CAAC;gBACP,gEAAgE;gBAChE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,0DAA0D,CAAC,CAAC;gBAC/F,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CACd,cAA6C,EAC7C,aAAqB,EACrB,cAAsB,EACtB,EAAE;gBACF,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBACtD,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,aAAa,CAAC,cAAc,CAAC,CAAC;gBAC9B,IAAI,gBAAgB,EAAE,CAAC;oBACrB,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,kBAAkB,GAAG,CAAC,IAA6B,EAAE,EAAE;gBAC3D,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,MAAK,gBAAgB,EAAE,CAAC;oBACpC,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,QAAQ,KAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjD,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,sCAAsC;oBACtC,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,UAAU,KAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;wBACvD,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;oBAC5D,6DAA6D;oBAC7D,MAAM,KAIF,IAGH,EAPK,EACJ,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,YAAY,OAKnB,EAJI,OAAO,cAHN,oBAIL,CAGA,CAAC;oBACF,OAAO,CAAC;wBACN,QAAQ,EAAE,QAAa;wBACvB,MAAM,EAAE,OAAiC;qBACS,CAAC,CAAC;oBACtD,OAAO,IAAI,CAAC;gBACd,CAAC;qBAAM,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,MAAK,aAAa,EAAE,CAAC;oBACxC,IAAI,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,QAAQ,KAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjD,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;oBAC5D,MAAM,CAAC,IAAI,KAAK,CAAE,IAAI,CAAC,KAAgB,IAAI,6BAA6B,CAAC,CAAC,CAAC;oBAC3E,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,uCAAuC;YACvC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gBAAgB,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;oBACnD,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,CAAC,KAAmB,EAAE,EAAE;gBAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC5C,OAAO;gBACT,CAAC;gBACD,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC,CAAC;YAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAEnD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC3C,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;gBAC5D,IAAI,CAAC;oBACH,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBAAC,WAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;gBACD,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC/C,CAAC,EAAE,MAAM,CAAC,CAAC;YAEX,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE;gBAClD,IAAI,CAAC;oBACH,mFAAmF;oBACnF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;wBACjB,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;wBAC5D,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,WAAM,CAAC;oBACP,8EAA8E;oBAC9E,2EAA2E;oBAC3E,2EAA2E;oBAC3E,qEAAqE;oBACrE,aAAa,CAAC,mBAAmB,CAAC,CAAC;oBACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CACT,WAAW,UAAU,gEAAgE;4BACnF,0CAA0C,CAC7C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvD,8EAA8E;QAC9E,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,EAAE,CAAC;oBACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,qBAAqB,CAAC;gBAChD,IAAI,UAAU,EAAE,CAAC;oBACf,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,MAAM,CAAC,0BAA0B,EAAE,CAAC;oBACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;wBACvE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxC,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,UAAU,IAAI,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,EAAE,MAAM,CAAC,OAAO;SACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,UAAkB,EAClB,YAAqB,EACrB,oBAA6C;;QAE7C,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,qBAAqB,GAAG,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC;QACnE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,iDAAiD,CAClH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;QAElH,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACjH,MAAM,UAAU,GAAG,MAAA,MAAA,MAAA,aAAa,CAAC,KAAK,0CAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,mCAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,mCAAI,EAAE,CAAC;QAE1F,oCAAoC;QACpC,IAAI,YAAY,GAAmC,IAAI,CAAC;QACxD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAA,aAAa,CAAC,aAAa,mCAAI,qBAAqB,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;YAC7B,WAAW,EAAE,aAAa,CAAC,YAAY;YACvC,YAAY,EAAE,gBAAgB;YAC9B,OAAO,EAAE,aAAa,CAAC,QAAQ;YAC/B,SAAS;YACT,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,aAAa,CAAC,UAAU;SACpC,CAAC,CAAC;QAEH,OAAO;YACL,UAAU;YACV,WAAW,EAAE;gBACX,KAAK,EAAE,aAAa,CAAC,YAAY;gBACjC,SAAS,EAAE,aAAa,CAAC,UAAU;gBACnC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC1C,YAAY,EAAE,gBAAgB;aAC/B;YACD,OAAO,EAAE,MAAA,aAAa,CAAC,QAAQ,mCAAI,IAAI;YACvC,YAAY,EAAE,gBAAgB,aAAhB,gBAAgB,cAAhB,gBAAgB,GAAI,IAAI;YACtC,YAAY;YACZ,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,aAAa,CAAC,UAAU;YACnC,SAAS,EAAE,MAAA,aAAa,CAAC,UAAU,mCAAI,IAAI;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAQ,EAAE,aAAsB;;QACxD,4CAA4C;QAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,wDAAwD;QACxD,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,oBAAoB,UAAU,4BAA4B,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC;YACH,IAAI,aAAkC,CAAC;YAEvC,sBAAsB;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,0BAA0B;gBAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;oBACzD,OAAO,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;gBACvE,CAAC;gBACD,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAClF,CAAC;iBAAM,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtC,gBAAgB;gBAChB,aAAa,GAAG;oBACd,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAE;oBACzC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,QAAQ;oBAChD,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC1F,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;oBACvC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;iBAC9C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACjH,MAAM,UAAU,GAAG,MAAA,MAAA,aAAa,CAAC,KAAK,0CAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;YAEzE,oCAAoC;YACpC,IAAI,YAAY,GAAmC,IAAI,CAAC;YACxD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;gBAC7B,WAAW,EAAE,aAAa,CAAC,YAAY;gBACvC,YAAY,EAAE,aAAa,CAAC,aAAa;gBACzC,OAAO,EAAE,aAAa,CAAC,QAAQ;gBAC/B,SAAS;gBACT,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,aAAa,CAAC,UAAU;aACpC,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE;oBACN,UAAU;oBACV,WAAW,EAAE;wBACX,KAAK,EAAE,aAAa,CAAC,YAAY;wBACjC,SAAS,EAAE,aAAa,CAAC,UAAU;wBACnC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;wBAC1C,YAAY,EAAE,aAAa,CAAC,aAAa;qBAC1C;oBACD,OAAO,EAAE,MAAA,aAAa,CAAC,QAAQ,mCAAI,IAAI;oBACvC,YAAY,EAAE,MAAA,aAAa,CAAC,aAAa,mCAAI,IAAI;oBACjD,YAAY;oBACZ,KAAK,EAAE,UAAU;oBACjB,SAAS,EAAE,aAAa,CAAC,UAAU;oBACnC,SAAS,EAAE,MAAA,aAAa,CAAC,UAAU,mCAAI,IAAI;iBAC5C;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,UAAkB,EAClB,IAAY,EACZ,OAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK;YACvB,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,UAAkB,EAClB,YAAoB,EACpB,oBAA6C;QAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,IAAI,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,MAAM,CAAC,KAAK;SACxB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,WAAmB;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,IAAI,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC,CAAC;QAEF,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,MAA0B;QAClE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,eAAe,CAAC,UAAkB;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,sDAAsD,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,KAAa,EAAE,OAA2B;QACpE,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,CAAC;IAEO,mBAAmB,CAAC,KAAa;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,OAAO,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAEO,oBAAoB;QAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oEAAoE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;aACxF,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,YAAoB;QACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAEO,eAAe,CAAC,MAAkB;QACxC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;IACjD,CAAC;IAED,4BAA4B,CAAC,UAAkB;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;YAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACxD,OAAO,EAAE,cAAc,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACtE,CAAC;IAED,sBAAsB,CAAC,UAAkB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,CAAA,EAAE,CAAC;IAChD,CAAC;IAED,oBAAoB,CAAC,UAAkB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,uBAAuB,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { BaseSocialLogin } from './base';\nimport type {\n  AuthorizationCode,\n  LoginResult,\n  OAuth2LoginOptions,\n  OAuth2LoginResponse,\n  OAuth2ProviderConfig,\n  ProviderResponseMap,\n} from './definitions';\n\ninterface OAuth2TokenResponse {\n  token_type: string;\n  expires_in?: number;\n  access_token: string;\n  scope?: string;\n  refresh_token?: string;\n  id_token?: string;\n}\n\ninterface OAuth2PendingLogin {\n  providerId: string;\n  codeVerifier: string;\n  redirectUri: string;\n  scope: string;\n}\n\ninterface OAuth2StoredTokens {\n  accessToken: string;\n  refreshToken?: string;\n  idToken?: string;\n  expiresAt: number;\n  scope: string[];\n  tokenType: string;\n}\n\ninterface OAuth2ConfigInternal {\n  appId: string;\n  issuerUrl?: string;\n  authorizationBaseUrl?: string;\n  accessTokenEndpoint?: string;\n  redirectUrl: string;\n  resourceUrl?: string;\n  responseType: 'code' | 'token';\n  pkceEnabled: boolean;\n  scope: string;\n  additionalParameters?: Record<string, string>;\n  loginHint?: string;\n  prompt?: string;\n  additionalTokenParameters?: Record<string, string>;\n  additionalResourceHeaders?: Record<string, string>;\n  logoutUrl?: string;\n  postLogoutRedirectUrl?: string;\n  additionalLogoutParameters?: Record<string, string>;\n  logsEnabled: boolean;\n}\n\n/**\n * OAuth2 Social Login Manager\n * Supports multiple OAuth2 provider configurations\n */\nexport class OAuth2SocialLogin extends BaseSocialLogin {\n  private providers: Map<string, OAuth2ConfigInternal> = new Map();\n  private readonly TOKENS_KEY_PREFIX = 'capgo_social_login_oauth2_tokens_';\n  private readonly STATE_PREFIX = 'capgo_social_login_oauth2_state_';\n\n  private normalizeScopeValue(scope: unknown): string {\n    if (!scope) return '';\n    if (typeof scope === 'string') return scope;\n    if (Array.isArray(scope)) return scope.filter(Boolean).join(' ');\n    return '';\n  }\n\n  private normalizeConfig(providerId: string, config: OAuth2ProviderConfig): OAuth2ConfigInternal {\n    const appId = config.appId ?? config.clientId;\n    const authorizationBaseUrl = config.authorizationBaseUrl ?? config.authorizationEndpoint;\n    const accessTokenEndpoint = config.accessTokenEndpoint ?? config.tokenEndpoint;\n    const logoutUrl = config.logoutUrl ?? config.endSessionEndpoint;\n    const scopeSource = config.scope ?? config.scopes;\n\n    if (!appId) {\n      throw new Error(`OAuth2 provider '${providerId}' requires appId (or clientId).`);\n    }\n    if (!config.redirectUrl) {\n      throw new Error(`OAuth2 provider '${providerId}' requires redirectUrl.`);\n    }\n    if (!authorizationBaseUrl && !config.issuerUrl) {\n      throw new Error(\n        `OAuth2 provider '${providerId}' requires authorizationBaseUrl (or authorizationEndpoint) or issuerUrl.`,\n      );\n    }\n\n    return {\n      appId,\n      issuerUrl: config.issuerUrl,\n      authorizationBaseUrl,\n      accessTokenEndpoint,\n      redirectUrl: config.redirectUrl,\n      resourceUrl: config.resourceUrl,\n      responseType: (config.responseType ?? 'code') as 'code' | 'token',\n      pkceEnabled: config.pkceEnabled ?? true,\n      scope: this.normalizeScopeValue(scopeSource),\n      additionalParameters: config.additionalParameters,\n      loginHint: config.loginHint,\n      prompt: config.prompt,\n      additionalTokenParameters: config.additionalTokenParameters,\n      additionalResourceHeaders: config.additionalResourceHeaders,\n      logoutUrl,\n      postLogoutRedirectUrl: config.postLogoutRedirectUrl,\n      additionalLogoutParameters: config.additionalLogoutParameters,\n      logsEnabled: config.logsEnabled ?? false,\n    };\n  }\n\n  private async ensureDiscovered(providerId: string): Promise<void> {\n    const config = this.providers.get(providerId);\n    if (!config?.issuerUrl) return;\n\n    // Resolve endpoints lazily.\n    if (config.authorizationBaseUrl && config.accessTokenEndpoint) return;\n\n    const issuer = config.issuerUrl.replace(/\\/+$/, '');\n    const discoveryUrl = `${issuer}/.well-known/openid-configuration`;\n    const resp = await fetch(discoveryUrl);\n    if (!resp.ok) {\n      const text = await resp.text().catch(() => '');\n      throw new Error(`OAuth2 discovery failed (${resp.status}): ${text || discoveryUrl}`);\n    }\n    const payload = (await resp.json()) as Record<string, unknown>;\n\n    const authorizationEndpoint = payload['authorization_endpoint'];\n    const tokenEndpoint = payload['token_endpoint'];\n    const endSessionEndpoint = payload['end_session_endpoint'];\n\n    if (!config.authorizationBaseUrl && typeof authorizationEndpoint === 'string') {\n      config.authorizationBaseUrl = authorizationEndpoint;\n    }\n    if (!config.accessTokenEndpoint && typeof tokenEndpoint === 'string') {\n      config.accessTokenEndpoint = tokenEndpoint;\n    }\n    if (!config.logoutUrl && typeof endSessionEndpoint === 'string') {\n      config.logoutUrl = endSessionEndpoint;\n    }\n\n    if (config.logsEnabled) {\n      console.log(`[OAuth2:${providerId}] Discovery resolved`, {\n        authorizationBaseUrl: config.authorizationBaseUrl,\n        accessTokenEndpoint: config.accessTokenEndpoint,\n        logoutUrl: config.logoutUrl,\n      });\n    }\n  }\n\n  /**\n   * Initialize multiple OAuth2 providers\n   */\n  async initializeProviders(configs: Record<string, OAuth2ProviderConfig>): Promise<void> {\n    for (const [providerId, config] of Object.entries(configs)) {\n      const internalConfig = this.normalizeConfig(providerId, config);\n      this.providers.set(providerId, internalConfig);\n\n      if (internalConfig.logsEnabled) {\n        console.log(`[OAuth2:${providerId}] Initialized with config:`, {\n          appId: internalConfig.appId,\n          issuerUrl: internalConfig.issuerUrl,\n          authorizationBaseUrl: internalConfig.authorizationBaseUrl,\n          redirectUrl: internalConfig.redirectUrl,\n          responseType: internalConfig.responseType,\n          pkceEnabled: internalConfig.pkceEnabled,\n        });\n      }\n\n      // Pre-resolve discovery on web if issuerUrl is provided.\n      await this.ensureDiscovered(providerId);\n    }\n  }\n\n  private getProvider(providerId: string): OAuth2ConfigInternal {\n    const config = this.providers.get(providerId);\n    if (!config) {\n      throw new Error(`OAuth2 provider '${providerId}' not configured. Call initialize() first.`);\n    }\n    return config;\n  }\n\n  private getTokensKey(providerId: string): string {\n    return `${this.TOKENS_KEY_PREFIX}${providerId}`;\n  }\n\n  async login<T extends 'oauth2'>(\n    options: OAuth2LoginOptions,\n  ): Promise<{ provider: T; result: ProviderResponseMap[T] }> {\n    const { providerId } = options;\n    const config = this.getProvider(providerId);\n    await this.ensureDiscovered(providerId);\n\n    const redirectUri = options.redirectUrl ?? config.redirectUrl;\n    const scope = this.normalizeScopeValue(options.scope ?? options.scopes ?? config.scope);\n    const state = options.state ?? this.generateState();\n    const codeVerifier = options.codeVerifier ?? this.generateCodeVerifier();\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      response_type: config.responseType,\n      client_id: config.appId,\n      redirect_uri: redirectUri,\n      state,\n    });\n\n    if (scope) {\n      params.set('scope', scope);\n    }\n\n    // Convenience OIDC options\n    const mergedAdditionalParams: Record<string, string> = {\n      ...(config.additionalParameters ?? {}),\n      ...(options.additionalParameters ?? {}),\n    };\n    const loginHint = options.loginHint ?? config.loginHint;\n    const prompt = options.prompt ?? config.prompt;\n    if (loginHint && !('login_hint' in mergedAdditionalParams)) {\n      mergedAdditionalParams.login_hint = loginHint;\n    }\n    if (prompt && !('prompt' in mergedAdditionalParams)) {\n      mergedAdditionalParams.prompt = prompt;\n    }\n\n    // Add PKCE for code flow\n    if (config.responseType === 'code' && config.pkceEnabled) {\n      const codeChallenge = await this.generateCodeChallenge(codeVerifier);\n      params.set('code_challenge', codeChallenge);\n      params.set('code_challenge_method', 'S256');\n    }\n\n    // Add merged additional parameters\n    for (const [key, value] of Object.entries(mergedAdditionalParams)) {\n      if (value !== undefined) {\n        params.set(key, value);\n      }\n    }\n\n    // Store pending login state\n    this.persistPendingLogin(state, {\n      providerId,\n      codeVerifier,\n      redirectUri,\n      scope,\n    });\n\n    localStorage.setItem(BaseSocialLogin.OAUTH_STATE_KEY, JSON.stringify({ provider: 'oauth2', providerId, state }));\n\n    if (!config.authorizationBaseUrl) {\n      throw new Error(`OAuth2 provider '${providerId}' is missing authorizationBaseUrl (discovery may have failed).`);\n    }\n    const authUrl = `${config.authorizationBaseUrl}?${params.toString()}`;\n\n    if (config.logsEnabled) {\n      console.log(`[OAuth2:${providerId}] Opening authorization URL:`, authUrl);\n    }\n\n    if (options.flow === 'redirect') {\n      // Trigger a full-page redirect. The promise will not resolve because the page navigates away.\n      window.location.assign(authUrl);\n      // eslint-disable-next-line @typescript-eslint/no-empty-function\n      return new Promise(() => {}) as any;\n    }\n\n    // Open popup window\n    const width = 500;\n    const height = 650;\n    const left = window.screenX + (window.outerWidth - width) / 2;\n    const top = window.screenY + (window.outerHeight - height) / 2;\n\n    const popup = window.open(\n      authUrl,\n      'OAuth2Login',\n      `width=${width},height=${height},left=${left},top=${top},popup=1`,\n    );\n\n    return new Promise((resolve, reject) => {\n      if (!popup) {\n        reject(new Error('Unable to open login window. Please allow popups.'));\n        return;\n      }\n\n      // Use BroadcastChannel for cross-origin communication (works when postMessage doesn't)\n      const channelName = `oauth2_${state}`;\n      let broadcastChannel: BroadcastChannel | null = null;\n\n      try {\n        broadcastChannel = new BroadcastChannel(channelName);\n      } catch {\n        // BroadcastChannel not supported, fall back to postMessage only\n        if (config.logsEnabled) {\n          console.log(`[OAuth2:${providerId}] BroadcastChannel not supported, using postMessage only`);\n        }\n      }\n\n      const cleanup = (\n        messageHandler: (event: MessageEvent) => void,\n        timeoutHandle: number,\n        intervalHandle: number,\n      ) => {\n        window.removeEventListener('message', messageHandler);\n        clearTimeout(timeoutHandle);\n        clearInterval(intervalHandle);\n        if (broadcastChannel) {\n          broadcastChannel.close();\n        }\n      };\n\n      const handleOAuthMessage = (data: Record<string, unknown>) => {\n        if (data?.type === 'oauth-response') {\n          if (data?.provider && data.provider !== 'oauth2') {\n            return false;\n          }\n          // Check providerId matches if present\n          if (data?.providerId && data.providerId !== providerId) {\n            return false;\n          }\n          cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n          // eslint-disable-next-line @typescript-eslint/no-unused-vars\n          const {\n            provider: _ignoredProvider,\n            type: _ignoredType,\n            ...payload\n          } = data as unknown as OAuth2LoginResponse & {\n            provider?: string;\n            type?: string;\n          };\n          resolve({\n            provider: 'oauth2' as T,\n            result: payload as ProviderResponseMap[T],\n          } as { provider: T; result: ProviderResponseMap[T] });\n          return true;\n        } else if (data?.type === 'oauth-error') {\n          if (data?.provider && data.provider !== 'oauth2') {\n            return false;\n          }\n          cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n          reject(new Error((data.error as string) || 'OAuth2 login was cancelled.'));\n          return true;\n        }\n        return false;\n      };\n\n      // Listen for BroadcastChannel messages\n      if (broadcastChannel) {\n        broadcastChannel.onmessage = (event: MessageEvent) => {\n          handleOAuthMessage(event.data);\n        };\n      }\n\n      const messageHandler = (event: MessageEvent) => {\n        if (event.origin !== window.location.origin) {\n          return;\n        }\n        handleOAuthMessage(event.data);\n      };\n\n      window.addEventListener('message', messageHandler);\n\n      const timeoutHandle = window.setTimeout(() => {\n        cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n        try {\n          popup.close();\n        } catch {\n          // Ignore cross-origin errors when closing\n        }\n        reject(new Error('OAuth2 login timed out.'));\n      }, 300000);\n\n      const popupClosedInterval = window.setInterval(() => {\n        try {\n          // Check if popup is closed - this may throw cross-origin errors for some providers\n          if (popup.closed) {\n            cleanup(messageHandler, timeoutHandle, popupClosedInterval);\n            reject(new Error('OAuth2 login window was closed.'));\n          }\n        } catch {\n          // Cross-origin error when checking popup.closed - this happens when the popup\n          // navigates to a third-party OAuth provider with strict security settings.\n          // We can't detect if the window was closed, so we just rely on the timeout\n          // and message handlers. Clear the interval to avoid repeated errors.\n          clearInterval(popupClosedInterval);\n          if (config.logsEnabled) {\n            console.log(\n              `[OAuth2:${providerId}] Cannot check popup.closed due to cross-origin restrictions. ` +\n                'Relying on message handlers and timeout.',\n            );\n          }\n        }\n      }, 1000);\n    });\n  }\n\n  async logout(providerId: string): Promise<void> {\n    await this.ensureDiscovered(providerId);\n    const config = this.providers.get(providerId);\n    const stored = this.getStoredTokens(providerId);\n    localStorage.removeItem(this.getTokensKey(providerId));\n\n    // If logout URL is configured, build an end-session URL (OIDC) when possible.\n    if (config?.logoutUrl) {\n      try {\n        const url = new URL(config.logoutUrl);\n        if (stored?.idToken) {\n          url.searchParams.set('id_token_hint', stored.idToken);\n        }\n        const postLogout = config.postLogoutRedirectUrl;\n        if (postLogout) {\n          url.searchParams.set('post_logout_redirect_uri', postLogout);\n        }\n        if (config.additionalLogoutParameters) {\n          for (const [k, v] of Object.entries(config.additionalLogoutParameters)) {\n            url.searchParams.set(k, v);\n          }\n        }\n        window.open(url.toString(), '_blank');\n      } catch {\n        window.open(config.logoutUrl, '_blank');\n      }\n    }\n  }\n\n  async isLoggedIn(providerId: string): Promise<{ isLoggedIn: boolean }> {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens) {\n      return { isLoggedIn: false };\n    }\n    const isValid = tokens.expiresAt > Date.now();\n    if (!isValid) {\n      localStorage.removeItem(this.getTokensKey(providerId));\n    }\n    return { isLoggedIn: isValid };\n  }\n\n  async getAuthorizationCode(providerId: string): Promise<AuthorizationCode> {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens) {\n      throw new Error(`OAuth2 access token is not available for provider '${providerId}'.`);\n    }\n    return {\n      accessToken: tokens.accessToken,\n      jwt: tokens.idToken,\n    };\n  }\n\n  async refresh(providerId: string): Promise<void> {\n    await this.refreshToken(providerId);\n  }\n\n  async refreshToken(\n    providerId: string,\n    refreshToken?: string,\n    additionalParameters?: Record<string, string>,\n  ): Promise<OAuth2LoginResponse> {\n    await this.ensureDiscovered(providerId);\n    const config = this.getProvider(providerId);\n\n    const stored = this.getStoredTokens(providerId);\n    const effectiveRefreshToken = refreshToken ?? stored?.refreshToken;\n    if (!effectiveRefreshToken) {\n      throw new Error(\n        `No OAuth2 refresh token is available for provider '${providerId}'. Include offline_access scope to receive one.`,\n      );\n    }\n    if (!config.accessTokenEndpoint) {\n      throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);\n    }\n\n    const tokenResponse = await this.refreshWithRefreshToken(providerId, effectiveRefreshToken, additionalParameters);\n\n    const expiresAt = tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1000 : Date.now() + 3600000;\n    const scopeArray = tokenResponse.scope?.split(' ').filter(Boolean) ?? stored?.scope ?? [];\n\n    // Fetch resource data if configured\n    let resourceData: Record<string, unknown> | null = null;\n    if (config.resourceUrl) {\n      resourceData = await this.fetchResource(providerId, tokenResponse.access_token);\n    }\n\n    const nextRefreshToken = tokenResponse.refresh_token ?? effectiveRefreshToken;\n    this.persistTokens(providerId, {\n      accessToken: tokenResponse.access_token,\n      refreshToken: nextRefreshToken,\n      idToken: tokenResponse.id_token,\n      expiresAt,\n      scope: scopeArray,\n      tokenType: tokenResponse.token_type,\n    });\n\n    return {\n      providerId,\n      accessToken: {\n        token: tokenResponse.access_token,\n        tokenType: tokenResponse.token_type,\n        expires: new Date(expiresAt).toISOString(),\n        refreshToken: nextRefreshToken,\n      },\n      idToken: tokenResponse.id_token ?? null,\n      refreshToken: nextRefreshToken ?? null,\n      resourceData,\n      scope: scopeArray,\n      tokenType: tokenResponse.token_type,\n      expiresIn: tokenResponse.expires_in ?? null,\n    };\n  }\n\n  async handleOAuthRedirect(url: URL, expectedState?: string): Promise<LoginResult | { error: string } | null> {\n    // Check both query params and hash fragment\n    const params = new URLSearchParams(url.search);\n    const hashParams = new URLSearchParams(url.hash.slice(1));\n\n    // Merge params, hash takes priority (for implicit flow)\n    hashParams.forEach((value, key) => {\n      params.set(key, value);\n    });\n\n    const stateFromUrl = expectedState ?? params.get('state');\n    if (!stateFromUrl) {\n      return null;\n    }\n\n    const pending = this.consumePendingLogin(stateFromUrl);\n    if (!pending) {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n      return { error: 'OAuth2 login session expired or state mismatch.' };\n    }\n\n    const { providerId } = pending;\n    await this.ensureDiscovered(providerId);\n    const config = this.providers.get(providerId);\n    if (!config) {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n      return { error: `OAuth2 provider '${providerId}' configuration not found.` };\n    }\n\n    const error = params.get('error');\n    if (error) {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n      return { error: params.get('error_description') || error };\n    }\n\n    try {\n      let tokenResponse: OAuth2TokenResponse;\n\n      // Check response type\n      if (params.has('code')) {\n        // Authorization code flow\n        const code = params.get('code');\n        if (!code) {\n          localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n          return { error: 'OAuth2 authorization code missing from redirect.' };\n        }\n        tokenResponse = await this.exchangeAuthorizationCode(providerId, code, pending);\n      } else if (params.has('access_token')) {\n        // Implicit flow\n        tokenResponse = {\n          access_token: params.get('access_token')!,\n          token_type: params.get('token_type') || 'bearer',\n          expires_in: params.has('expires_in') ? parseInt(params.get('expires_in')!, 10) : undefined,\n          scope: params.get('scope') || undefined,\n          id_token: params.get('id_token') || undefined,\n        };\n      } else {\n        localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n        return { error: 'No authorization code or access token in redirect.' };\n      }\n\n      const expiresAt = tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1000 : Date.now() + 3600000;\n      const scopeArray = tokenResponse.scope?.split(' ').filter(Boolean) ?? [];\n\n      // Fetch resource data if configured\n      let resourceData: Record<string, unknown> | null = null;\n      if (config.resourceUrl) {\n        resourceData = await this.fetchResource(providerId, tokenResponse.access_token);\n      }\n\n      this.persistTokens(providerId, {\n        accessToken: tokenResponse.access_token,\n        refreshToken: tokenResponse.refresh_token,\n        idToken: tokenResponse.id_token,\n        expiresAt,\n        scope: scopeArray,\n        tokenType: tokenResponse.token_type,\n      });\n\n      return {\n        provider: 'oauth2',\n        result: {\n          providerId,\n          accessToken: {\n            token: tokenResponse.access_token,\n            tokenType: tokenResponse.token_type,\n            expires: new Date(expiresAt).toISOString(),\n            refreshToken: tokenResponse.refresh_token,\n          },\n          idToken: tokenResponse.id_token ?? null,\n          refreshToken: tokenResponse.refresh_token ?? null,\n          resourceData,\n          scope: scopeArray,\n          tokenType: tokenResponse.token_type,\n          expiresIn: tokenResponse.expires_in ?? null,\n        },\n      };\n    } catch (err) {\n      if (err instanceof Error) {\n        return { error: err.message };\n      }\n      return { error: 'OAuth2 login failed unexpectedly.' };\n    } finally {\n      localStorage.removeItem(BaseSocialLogin.OAUTH_STATE_KEY);\n    }\n  }\n\n  private async exchangeAuthorizationCode(\n    providerId: string,\n    code: string,\n    pending: OAuth2PendingLogin,\n  ): Promise<OAuth2TokenResponse> {\n    const config = this.getProvider(providerId);\n    if (!config.accessTokenEndpoint) {\n      throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);\n    }\n\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: config.appId,\n      code,\n      redirect_uri: pending.redirectUri,\n    });\n\n    if (config.pkceEnabled) {\n      params.set('code_verifier', pending.codeVerifier);\n    }\n\n    if (config.additionalTokenParameters) {\n      for (const [k, v] of Object.entries(config.additionalTokenParameters)) {\n        params.set(k, v);\n      }\n    }\n\n    if (config.logsEnabled) {\n      console.log(`[OAuth2:${providerId}] Exchanging code at:`, config.accessTokenEndpoint);\n    }\n\n    const response = await fetch(config.accessTokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 token exchange failed (${response.status}): ${text}`);\n    }\n\n    return (await response.json()) as OAuth2TokenResponse;\n  }\n\n  private async refreshWithRefreshToken(\n    providerId: string,\n    refreshToken: string,\n    additionalParameters?: Record<string, string>,\n  ): Promise<OAuth2TokenResponse> {\n    const config = this.getProvider(providerId);\n    if (!config.accessTokenEndpoint) {\n      throw new Error(`No accessTokenEndpoint configured for provider '${providerId}'.`);\n    }\n\n    const params = new URLSearchParams({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: config.appId,\n    });\n\n    if (config.additionalTokenParameters) {\n      for (const [k, v] of Object.entries(config.additionalTokenParameters)) {\n        params.set(k, v);\n      }\n    }\n    if (additionalParameters) {\n      for (const [k, v] of Object.entries(additionalParameters)) {\n        params.set(k, v);\n      }\n    }\n\n    const response = await fetch(config.accessTokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`OAuth2 refresh failed (${response.status}): ${text}`);\n    }\n\n    return (await response.json()) as OAuth2TokenResponse;\n  }\n\n  private async fetchResource(providerId: string, accessToken: string): Promise<Record<string, unknown>> {\n    const config = this.getProvider(providerId);\n    if (!config.resourceUrl) {\n      throw new Error(`No resourceUrl configured for provider '${providerId}'.`);\n    }\n\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${accessToken}`,\n    };\n\n    if (config.additionalResourceHeaders) {\n      Object.assign(headers, config.additionalResourceHeaders);\n    }\n\n    const response = await fetch(config.resourceUrl, {\n      headers,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`Unable to fetch OAuth2 resource (${response.status}): ${text}`);\n    }\n\n    return (await response.json()) as Record<string, unknown>;\n  }\n\n  private persistTokens(providerId: string, tokens: OAuth2StoredTokens): void {\n    localStorage.setItem(this.getTokensKey(providerId), JSON.stringify(tokens));\n  }\n\n  private getStoredTokens(providerId: string): OAuth2StoredTokens | null {\n    const raw = localStorage.getItem(this.getTokensKey(providerId));\n    if (!raw) {\n      return null;\n    }\n    try {\n      return JSON.parse(raw) as OAuth2StoredTokens;\n    } catch (err) {\n      console.warn(`Failed to parse stored OAuth2 tokens for provider '${providerId}'`, err);\n      return null;\n    }\n  }\n\n  private persistPendingLogin(state: string, payload: OAuth2PendingLogin): void {\n    localStorage.setItem(`${this.STATE_PREFIX}${state}`, JSON.stringify(payload));\n  }\n\n  private consumePendingLogin(state: string): OAuth2PendingLogin | null {\n    const key = `${this.STATE_PREFIX}${state}`;\n    const raw = localStorage.getItem(key);\n    localStorage.removeItem(key);\n    if (!raw) {\n      return null;\n    }\n    try {\n      return JSON.parse(raw) as OAuth2PendingLogin;\n    } catch (err) {\n      console.warn('Failed to parse pending OAuth2 login payload', err);\n      return null;\n    }\n  }\n\n  private generateState(): string {\n    return [...crypto.getRandomValues(new Uint8Array(16))].map((b) => b.toString(16).padStart(2, '0')).join('');\n  }\n\n  private generateCodeVerifier(): string {\n    const array = new Uint8Array(64);\n    crypto.getRandomValues(array);\n    return Array.from(array)\n      .map((b) => 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'[b % 66])\n      .join('');\n  }\n\n  private async generateCodeChallenge(codeVerifier: string): Promise<string> {\n    const encoder = new TextEncoder();\n    const data = encoder.encode(codeVerifier);\n    const digest = await crypto.subtle.digest('SHA-256', data);\n    return this.base64UrlEncode(new Uint8Array(digest));\n  }\n\n  private base64UrlEncode(buffer: Uint8Array): string {\n    let binary = '';\n    buffer.forEach((b) => (binary += String.fromCharCode(b)));\n    return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n  }\n\n  decodeIdToken(idToken: string): Record<string, any> {\n    const parts = idToken.split('.');\n    if (parts.length < 2) {\n      throw new Error('Invalid JWT: missing parts');\n    }\n    const payload = parts[1];\n    const normalized = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = normalized + '='.repeat((4 - (normalized.length % 4)) % 4);\n    const json = atob(padded);\n    return JSON.parse(json) as Record<string, any>;\n  }\n\n  getAccessTokenExpirationDate(providerId: string): { expirationDate: string | null } {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens?.expiresAt) return { expirationDate: null };\n    return { expirationDate: new Date(tokens.expiresAt).toISOString() };\n  }\n\n  isAccessTokenAvailable(providerId: string): { isAvailable: boolean } {\n    const tokens = this.getStoredTokens(providerId);\n    return { isAvailable: !!tokens?.accessToken };\n  }\n\n  isAccessTokenExpired(providerId: string): { isExpired: boolean } {\n    const tokens = this.getStoredTokens(providerId);\n    if (!tokens?.expiresAt) return { isExpired: true };\n    return { isExpired: tokens.expiresAt <= Date.now() };\n  }\n\n  isRefreshTokenAvailable(providerId: string): { isAvailable: boolean } {\n    const tokens = this.getStoredTokens(providerId);\n    return { isAvailable: !!tokens?.refreshToken };\n  }\n}\n"]}