@cleocode/core 2026.6.13 → 2026.6.14

package/dist/store/service-oauth.js

@@ -0,0 +1,524 @@
+/**
+ * Service-vault OAuth flow — build / exchange / refresh / self-heal (T11939).
+ *
+ * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409 · M2 W2 ·
+ * task T11939). The OAuth dance the foundation (T11937) left a clean seam for.
+ * Every function is DRIVEN BY the declarative {@link ServiceProviderDef} from the
+ * `SERVICE_PROVIDERS` registry (contracts, T11937 + T11938 breadth) — there is no
+ * per-provider code, only data-shaped branches on the provider's `oauth` config
+ * and `refresh.kind` discriminant.
+ *
+ * ## What this module owns (the four entry points)
+ *
+ *  1. {@link buildAuthUrl} — compose the authorization URL (PKCE S256 + state +
+ *     provider `extraAuthParams`) for an `oauth2`/`oauth2-pkce` provider, or the
+ *     device-authorization start for a `device-code` provider.
+ *  2. {@link exchangeCode} — POST `grant_type=authorization_code` (+ PKCE
+ *     verifier) to the token endpoint and PERSIST the resulting
+ *     `{accessToken, refreshToken}` blob `encryptGlobal`-encrypted via
+ *     {@link connectService} (the foundation accessor — reused, not reinvented).
+ *  3. {@link refreshAccessToken} — refresh an access token honoring the
+ *     provider's `refresh` config: the `refresh-token` grant (Form/Json body ×
+ *     Body/BasicAuth client auth) plus the three special variants (`github-app`
+ *     JWT, `service-account-jwt` bearer, `client-credentials`).
+ *  4. {@link selfHealConnection} — the resolve-path self-heal: when a connection's
+ *     `expires_at` is past, transparently refresh → re-`encryptGlobal` → persist
+ *     back via the accessor, returning a FRESH {@link SealedCredential} so agents
+ *     NEVER see a stale token. Cannibalizes onecli `connect.rs::resolve_access_token`.
+ *
+ * ## Crypto + persistence reuse (DRY — no new crypto, no new store)
+ *
+ * Encryption is ALWAYS `encryptGlobal` keyed `id = service:${provider}:${label}`
+ * (via {@link connectService} / {@link updateConnectionTokens}). The egress handle
+ * is the shared {@link makeSealedCredential} — the plaintext materializes ONLY at
+ * the wire inside the handle's `fetch()`, never inline on a resolve. HTTP uses the
+ * platform `globalThis.fetch` (no new dep) so tests inject a stub.
+ *
+ * @module store/service-oauth
+ * @task T11939
+ * @epic T11765
+ * @saga T10409
+ * @see ../../../contracts/src/vault/service-provider.ts — the DATA that drives this flow
+ * @see ./service-connections-accessor.ts — connect/resolve/persist (reused)
+ * @see ../llm/oauth/pkce.ts — generatePkcePair / buildAuthorizationUrl (reused)
+ * @see ../crypto/credentials.ts — encryptGlobal / decryptGlobal (reused)
+ * @see ../../../onecli — apps/gateway/src/{apps.rs,connect.rs} (the ported design)
+ */
+import { SERVICE_PROVIDERS } from '@cleocode/contracts';
+import { buildAuthorizationUrl, generatePkcePair } from '../llm/oauth/pkce.js';
+import { makeSealedCredential, tokenPreview } from '../llm/sealed-credential.js';
+import { connectService, loadDecryptedTokenBlob, updateConnectionTokens, } from './service-connections-accessor.js';
+/** Bind the platform fetch lazily so the module imports side-effect-free. */
+const globalFetch = (input, init) => globalThis.fetch(input, init);
+// ---------------------------------------------------------------------------
+// Provider resolution
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the {@link ServiceProviderDef} for a provider key, throwing a typed
+ * error when unknown.
+ *
+ * @param provider - The stable provider key (e.g. `'github'`).
+ * @returns The declarative provider definition.
+ * @throws {Error} `E_SERVICE_PROVIDER_UNKNOWN` when the key is not in the registry.
+ * @task T11939
+ */
+export function resolveProviderDef(provider) {
+    const def = SERVICE_PROVIDERS[provider];
+    if (def === undefined) {
+        throw new Error(`E_SERVICE_PROVIDER_UNKNOWN: no service provider '${provider}' in registry`);
+    }
+    return def;
+}
+/** Resolve the provider's OAuth config, throwing when the provider is api-key-only. */
+function requireOAuth(def) {
+    if (def.oauth === undefined) {
+        throw new Error(`E_SERVICE_OAUTH_UNSUPPORTED: provider '${def.provider}' (authKind=${def.authKind}) has no OAuth config`);
+    }
+    return def.oauth;
+}
+/**
+ * AC1 — build the authorization URL (+ PKCE pair) for an OAuth provider.
+ *
+ * Generates a fresh PKCE verifier/challenge (RFC 7636 S256) and composes the
+ * authorization URL via the reused {@link buildAuthorizationUrl}, appending the
+ * provider's declared `extraAuthParams` (e.g. google `access_type=offline`).
+ * Returns the verifier + state the caller round-trips through the redirect into
+ * {@link exchangeCode}.
+ *
+ * @param provider - The provider key (must have an `oauth` config).
+ * @param opts - Optional state / scope / client-id / redirect overrides (BYOC).
+ * @returns The auth URL plus the PKCE verifier and state to round-trip.
+ * @throws {Error} When the provider is unknown or api-key-only.
+ * @task T11939
+ */
+export async function buildAuthUrl(provider, opts = {}) {
+    const def = resolveProviderDef(provider);
+    const oauth = requireOAuth(def);
+    if (oauth.authorizationEndpoint === undefined) {
+        throw new Error(`E_SERVICE_OAUTH_NO_AUTH_ENDPOINT: provider '${provider}' has no authorizationEndpoint (device-code flow uses startDeviceAuthorization)`);
+    }
+    const { codeVerifier, codeChallenge } = await generatePkcePair();
+    const state = opts.state ?? generateState();
+    const redirectUri = opts.redirectUri ?? oauth.redirectUri ?? 'http://127.0.0.1:7878/callback';
+    const scope = opts.scope ?? oauth.scope ?? def.defaultScopes ?? '';
+    const authUrl = buildAuthorizationUrl({
+        authorizationEndpoint: oauth.authorizationEndpoint,
+        clientId: opts.clientId ?? oauth.clientId,
+        redirectUri,
+        scope,
+        codeChallenge,
+        state,
+        ...(oauth.extraAuthParams !== undefined ? { extraParams: oauth.extraAuthParams } : {}),
+    });
+    return { authUrl, codeVerifier, state, redirectUri };
+}
+/** Generate an opaque, URL-safe CSRF `state` value. */
+function generateState() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * AC1 — exchange an authorization code for tokens and PERSIST them encrypted.
+ *
+ * POSTs `grant_type=authorization_code` (+ PKCE verifier) to the provider's token
+ * endpoint via the reused {@link exchangePkceCode}, then writes the resulting
+ * `{accessToken, refreshToken}` blob `encryptGlobal`-encrypted through
+ * {@link connectService}. The plaintext token is NEVER returned — only the
+ * non-secret connection identity. The expiry is computed from `expires_in`.
+ *
+ * @param provider - The provider key.
+ * @param opts - The code, PKCE verifier, redirect, and connection label.
+ * @param deps - Injectable HTTP / clock / vault (test seam).
+ * @returns The persisted connection's non-secret identity.
+ * @throws {Error} On HTTP failure or a token response missing `access_token`.
+ * @task T11939
+ */
+export async function exchangeCode(provider, opts, deps = {}) {
+    const def = resolveProviderDef(provider);
+    const oauth = requireOAuth(def);
+    const label = opts.label ?? 'default';
+    const fetchImpl = deps.fetch ?? globalFetch;
+    // POST grant_type=authorization_code + PKCE verifier through the injectable
+    // FetchLike (consistent with the refresh path; lets a test stub the endpoint).
+    const form = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: opts.clientId ?? oauth.clientId,
+        code: opts.code,
+        code_verifier: opts.codeVerifier,
+        redirect_uri: opts.redirectUri,
+    });
+    const resp = await fetchImpl(oauth.tokenEndpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: form.toString(),
+    });
+    if (!resp.ok) {
+        throw new Error(`E_SERVICE_EXCHANGE_HTTP: provider '${provider}' code exchange failed: HTTP ${resp.status}: ${await safeText(resp)}`);
+    }
+    const data = (await resp.json());
+    const accessToken = data['access_token'];
+    if (typeof accessToken !== 'string' || accessToken.length === 0) {
+        const err = typeof data['error'] === 'string' ? data['error'] : 'no access_token';
+        throw new Error(`E_SERVICE_EXCHANGE_NO_ACCESS_TOKEN: provider '${provider}': ${err}`);
+    }
+    const tokens = {
+        accessToken,
+        refreshToken: typeof data['refresh_token'] === 'string' ? data['refresh_token'] : undefined,
+        expiresIn: typeof data['expires_in'] === 'number' ? data['expires_in'] : undefined,
+        tokenType: typeof data['token_type'] === 'string' ? data['token_type'] : 'bearer',
+    };
+    const expiresAt = computeExpiresAt(tokens.expiresIn, deps.now);
+    const blob = {
+        accessToken: tokens.accessToken,
+        ...(tokens.refreshToken !== undefined ? { refreshToken: tokens.refreshToken } : {}),
+    };
+    const connectionId = await connectService({
+        provider,
+        label,
+        tokens: blob,
+        scopes: (oauth.scope ?? def.defaultScopes ?? '').split(' ').filter((s) => s.length > 0),
+        ...(expiresAt !== null ? { expiresAt } : {}),
+        ...(opts.metadata !== undefined ? { metadata: opts.metadata } : {}),
+    }, deps.vault);
+    return {
+        connectionId,
+        provider,
+        label,
+        expiresAt,
+        hasRefreshToken: tokens.refreshToken !== undefined,
+    };
+}
+/**
+ * AC2 — refresh an access token honoring the provider's declared refresh config.
+ *
+ * Branches on {@link RefreshConfig.kind}:
+ *
+ *  - `refresh-token` — `grant_type=refresh_token` shaped by `bodyFormat`
+ *    (Form/Json) × `clientAuth` (Body/BasicAuth). The common OAuth case.
+ *  - `github-app` — sign an RS256 JWT with the app key, POST
+ *    `/app/installations/{id}/access_tokens`.
+ *  - `service-account-jwt` — sign an RS256 JWT, exchange via
+ *    `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`.
+ *  - `client-credentials` — `grant_type=client_credentials`, Basic-auth client.
+ *
+ * Returns normalized {@link OAuthTokens} (a fresh access token + optional rotated
+ * refresh token). PERSISTENCE is the caller's job ({@link selfHealConnection}
+ * does it); this function is pure HTTP + crypto so it is independently testable.
+ *
+ * @param provider - The provider key.
+ * @param opts - The refresh token / client credentials / variant secrets.
+ * @param deps - Injectable HTTP / clock (test seam).
+ * @returns The refreshed tokens.
+ * @throws {Error} When the provider declares no refresh, or the exchange fails.
+ * @task T11939
+ */
+export async function refreshAccessToken(provider, opts, deps = {}) {
+    const def = resolveProviderDef(provider);
+    const refresh = def.refresh;
+    if (refresh === undefined) {
+        throw new Error(`E_SERVICE_REFRESH_UNSUPPORTED: provider '${provider}' declares no refresh config`);
+    }
+    const fetchImpl = deps.fetch ?? globalFetch;
+    switch (refresh.kind) {
+        case 'refresh-token':
+            return refreshViaRefreshToken(provider, refresh, opts, fetchImpl);
+        case 'github-app':
+            return refreshViaGithubApp(refresh, opts, fetchImpl, deps.now);
+        case 'service-account-jwt':
+            return refreshViaServiceAccount(refresh, opts, fetchImpl, deps.now);
+        case 'client-credentials':
+            return refreshViaClientCredentials(refresh, opts, fetchImpl);
+        default: {
+            // Exhaustiveness guard — a new RefreshKind must extend this switch.
+            const never = refresh.kind;
+            throw new Error(`E_SERVICE_REFRESH_KIND_UNKNOWN: ${String(never)}`);
+        }
+    }
+}
+/** `grant_type=refresh_token` — Form/Json body × Body/BasicAuth client auth. */
+async function refreshViaRefreshToken(provider, refresh, opts, fetchImpl) {
+    const refreshToken = opts.refreshToken;
+    if (refreshToken === undefined || refreshToken.length === 0) {
+        throw new Error(`E_SERVICE_REFRESH_NO_TOKEN: provider '${provider}' refresh requires a token`);
+    }
+    const bodyFormat = refresh.bodyFormat ?? 'form';
+    const clientAuth = refresh.clientAuth ?? 'body';
+    const clientId = opts.client?.clientId;
+    const clientSecret = opts.client?.clientSecret;
+    const headers = { Accept: 'application/json' };
+    // BasicAuth presents the client credentials as an Authorization header.
+    if (clientAuth === 'basic-auth' && clientId !== undefined && clientSecret !== undefined) {
+        headers['authorization'] = `Basic ${base64(`${clientId}:${clientSecret}`)}`;
+    }
+    let body;
+    if (bodyFormat === 'json') {
+        headers['Content-Type'] = 'application/json';
+        const json = {
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        };
+        if (clientAuth === 'body' && clientId !== undefined && clientSecret !== undefined) {
+            json['client_id'] = clientId;
+            json['client_secret'] = clientSecret;
+        }
+        body = JSON.stringify(json);
+    }
+    else {
+        headers['Content-Type'] = 'application/x-www-form-urlencoded';
+        const form = new URLSearchParams({
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        });
+        if (clientAuth === 'body' && clientId !== undefined && clientSecret !== undefined) {
+            form.set('client_id', clientId);
+            form.set('client_secret', clientSecret);
+        }
+        body = form.toString();
+    }
+    const resp = await fetchImpl(refresh.tokenUrl, { method: 'POST', headers, body });
+    return parseRefreshResponse(provider, resp);
+}
+/** `grant_type=client_credentials` — Basic-auth client (e.g. MongoDB Atlas SAs). */
+async function refreshViaClientCredentials(refresh, opts, fetchImpl) {
+    const clientId = opts.client?.clientId;
+    const clientSecret = opts.client?.clientSecret;
+    if (clientId === undefined || clientSecret === undefined) {
+        throw new Error('E_SERVICE_REFRESH_NO_CLIENT: client_credentials refresh requires clientId + clientSecret');
+    }
+    const resp = await fetchImpl(refresh.tokenUrl, {
+        method: 'POST',
+        headers: {
+            Authorization: `Basic ${base64(`${clientId}:${clientSecret}`)}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: 'grant_type=client_credentials',
+    });
+    return parseRefreshResponse('client-credentials', resp);
+}
+/**
+ * GitHub App installation token — sign an RS256 JWT with the app key, exchange at
+ * `/app/installations/{id}/access_tokens`. The response shape differs (`token` +
+ * `expires_at`), normalized here to {@link OAuthTokens}.
+ */
+async function refreshViaGithubApp(refresh, opts, fetchImpl, now) {
+    const { privateKeyPem, appId, installationId } = opts.variant ?? {};
+    if (privateKeyPem === undefined || appId === undefined || installationId === undefined) {
+        throw new Error('E_SERVICE_REFRESH_GITHUB_APP: github-app refresh requires privateKeyPem + appId + installationId');
+    }
+    const nowSec = Math.floor((now?.() ?? Date.now()) / 1000);
+    const jwt = await signRs256Jwt({ alg: 'RS256', typ: 'JWT' }, { iss: appId, iat: nowSec - 60, exp: nowSec + 600 }, privateKeyPem);
+    const url = `${refresh.tokenUrl}/${installationId}/access_tokens`;
+    const resp = await fetchImpl(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${jwt}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+            'User-Agent': 'cleo-service-vault',
+        },
+    });
+    if (!resp.ok) {
+        throw new Error(`E_SERVICE_REFRESH_GITHUB_APP_HTTP: HTTP ${resp.status}: ${await safeText(resp)}`);
+    }
+    const data = (await resp.json());
+    const token = data['token'];
+    if (typeof token !== 'string' || token.length === 0) {
+        throw new Error('E_SERVICE_REFRESH_GITHUB_APP_NO_TOKEN: installation token response missing token');
+    }
+    // GitHub returns an ISO `expires_at`; derive seconds-until for the common shape.
+    const expiresAtIso = typeof data['expires_at'] === 'string' ? data['expires_at'] : undefined;
+    const expiresIn = expiresAtIso !== undefined
+        ? Math.max(0, Math.floor((Date.parse(expiresAtIso) - (now?.() ?? Date.now())) / 1000))
+        : 3600;
+    return { accessToken: token, expiresIn, tokenType: 'bearer' };
+}
+/**
+ * Google service-account — sign an RS256 JWT and exchange via the jwt-bearer
+ * grant at the provider's token endpoint.
+ */
+async function refreshViaServiceAccount(refresh, opts, fetchImpl, now) {
+    const { privateKeyPem, clientEmail } = opts.variant ?? {};
+    if (privateKeyPem === undefined || clientEmail === undefined) {
+        throw new Error('E_SERVICE_REFRESH_SERVICE_ACCOUNT: service-account-jwt refresh requires privateKeyPem + clientEmail');
+    }
+    const nowSec = Math.floor((now?.() ?? Date.now()) / 1000);
+    const assertion = await signRs256Jwt({ alg: 'RS256', typ: 'JWT' }, {
+        iss: clientEmail,
+        sub: clientEmail,
+        aud: refresh.tokenUrl,
+        scope: 'https://www.googleapis.com/auth/cloud-platform',
+        iat: nowSec,
+        exp: nowSec + 3600,
+    }, privateKeyPem);
+    const resp = await fetchImpl(refresh.tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion,
+        }).toString(),
+    });
+    return parseRefreshResponse('service-account', resp);
+}
+/**
+ * AC3 — resolve a connection, transparently refreshing a PAST-EXPIRY token.
+ *
+ * The self-heal resolve path (cannibalized from onecli
+ * `connect.rs::resolve_access_token`):
+ *
+ *  1. Read the connection's non-secret view (`expiresAt`).
+ *  2. If `expiresAt` is past (within `skewSeconds`) AND a refresh token exists:
+ *     refresh via {@link refreshAccessToken}, re-`encryptGlobal` the new blob, and
+ *     persist it back via {@link updateConnectionTokens} — so the NEXT resolve and
+ *     every other agent see the fresh token.
+ *  3. Return a FRESH {@link SealedCredential} resolving against the (now-current)
+ *     stored blob. A stale token is NEVER handed out: the heal runs BEFORE the
+ *     sealed handle is built, and the handle decrypts the persisted (fresh) blob.
+ *
+ * The trust gate runs inside the accessor's resolve — a denied agent gets `null`
+ * with NO refresh and NO decrypt.
+ *
+ * @param connectionRef - The agent + provider + label, plus refresh credentials.
+ * @param deps - Injectable HTTP / clock / vault (test seam — the fake clock proves
+ *   the past-expiry branch fires).
+ * @returns The fresh sealed credential + whether a refresh fired.
+ * @task T11939
+ */
+export async function selfHealConnection(connectionRef, deps = {}) {
+    const { agentId, provider, label } = connectionRef;
+    const nowMs = deps.now?.() ?? Date.now();
+    const skewMs = (connectionRef.skewSeconds ?? 0) * 1000;
+    // 1. Load the decrypted blob + expiry (gated: the accessor enforces the trust
+    //    gate and only decrypts on allow). A denied/missing connection → null.
+    const loaded = await loadDecryptedTokenBlob({
+        agentId,
+        provider,
+        label,
+        ...(connectionRef.approved !== undefined ? { approved: connectionRef.approved } : {}),
+    }, deps.vault);
+    if (loaded === null) {
+        return { sealed: null, refreshed: false, expiresAt: null };
+    }
+    let { blob, expiresAt } = loaded;
+    let refreshed = false;
+    // 2. Past expiry (within skew) AND refreshable → transparent refresh + persist.
+    const expiryMs = expiresAt !== null ? Date.parse(expiresAt) : Number.NaN;
+    const isPast = !Number.isNaN(expiryMs) && expiryMs - skewMs <= nowMs;
+    if (isPast && blob.refreshToken !== undefined && def_isRefreshable(provider)) {
+        const fresh = await refreshAccessToken(provider, {
+            refreshToken: blob.refreshToken,
+            ...(connectionRef.client !== undefined ? { client: connectionRef.client } : {}),
+            ...(connectionRef.variant !== undefined ? { variant: connectionRef.variant } : {}),
+        }, deps);
+        const newExpiresAt = computeExpiresAt(fresh.expiresIn, deps.now);
+        const newBlob = {
+            accessToken: fresh.accessToken,
+            // Honor refresh-token rotation; else keep the existing one.
+            refreshToken: fresh.refreshToken ?? blob.refreshToken,
+        };
+        await updateConnectionTokens({ provider, label, tokens: newBlob, expiresAt: newExpiresAt }, deps.vault);
+        blob = newBlob;
+        expiresAt = newExpiresAt;
+        refreshed = true;
+    }
+    // 3. Build a sealed handle over the (now-fresh) access token. The plaintext
+    //    only materializes at the wire inside fetch().
+    const freshAccessToken = blob.accessToken;
+    const sealed = makeSealedCredential({
+        provider,
+        account: label,
+        tokenPreview: tokenPreview('', 'oauth'),
+        resolveToken: () => freshAccessToken,
+    });
+    return { sealed, refreshed, expiresAt };
+}
+/** Whether the provider declares a refresh config (drives the self-heal branch). */
+function def_isRefreshable(provider) {
+    return SERVICE_PROVIDERS[provider]?.refresh !== undefined;
+}
+// ---------------------------------------------------------------------------
+// Shared helpers (HTTP parse, expiry, base64, RS256 JWT)
+// ---------------------------------------------------------------------------
+/** Parse a token-endpoint response into normalized {@link OAuthTokens}. */
+async function parseRefreshResponse(provider, resp) {
+    if (!resp.ok) {
+        throw new Error(`E_SERVICE_REFRESH_HTTP: provider '${provider}' refresh failed: HTTP ${resp.status}: ${await safeText(resp)}`);
+    }
+    const data = (await resp.json());
+    const accessToken = data['access_token'];
+    if (typeof accessToken !== 'string' || accessToken.length === 0) {
+        const err = typeof data['error'] === 'string' ? data['error'] : 'no access_token';
+        throw new Error(`E_SERVICE_REFRESH_NO_ACCESS_TOKEN: provider '${provider}': ${err}`);
+    }
+    return {
+        accessToken,
+        refreshToken: typeof data['refresh_token'] === 'string' ? data['refresh_token'] : undefined,
+        expiresIn: typeof data['expires_in'] === 'number' ? data['expires_in'] : undefined,
+        tokenType: typeof data['token_type'] === 'string' ? data['token_type'] : 'bearer',
+    };
+}
+/** Read a response body as text without throwing (for error detail). */
+async function safeText(resp) {
+    try {
+        return (await resp.text()).slice(0, 512);
+    }
+    catch {
+        return '';
+    }
+}
+/** Compute an ISO-8601 expiry from `expires_in` seconds, or `null` when absent. */
+function computeExpiresAt(expiresIn, now) {
+    if (expiresIn === undefined)
+        return null;
+    return new Date((now?.() ?? Date.now()) + expiresIn * 1000).toISOString();
+}
+/** Base64-encode a UTF-8 string (Node Buffer; platform-available). */
+function base64(input) {
+    return Buffer.from(input, 'utf-8').toString('base64');
+}
+/** Base64url-encode bytes (no padding) for JWT segments. */
+function base64url(bytes) {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+/**
+ * Sign a compact RS256 JWT using Web Crypto (no new dep — replaces the Rust
+ * `jsonwebtoken` crate). Used by the github-app + service-account-jwt variants.
+ *
+ * @param header - The JOSE header (`{ alg: 'RS256', typ: 'JWT' }`).
+ * @param claims - The claim set.
+ * @param privateKeyPem - The RSA private key in PKCS#8 PEM.
+ * @returns The signed compact JWT.
+ */
+async function signRs256Jwt(header, claims, privateKeyPem) {
+    const enc = new TextEncoder();
+    const headerB64 = base64url(enc.encode(JSON.stringify(header)));
+    const claimsB64 = base64url(enc.encode(JSON.stringify(claims)));
+    const signingInput = `${headerB64}.${claimsB64}`;
+    const key = await crypto.subtle.importKey('pkcs8', pemToPkcs8(privateKeyPem), { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('RSASSA-PKCS1-v1_5', key, enc.encode(signingInput));
+    return `${signingInput}.${base64url(new Uint8Array(signature))}`;
+}
+/** Decode a PKCS#8 PEM private key to its DER bytes. */
+function pemToPkcs8(pem) {
+    const body = pem
+        .replace(/-----BEGIN [^-]+-----/, '')
+        .replace(/-----END [^-]+-----/, '')
+        .replace(/\s+/g, '');
+    const der = Buffer.from(body, 'base64');
+    // Return a copy as a standalone ArrayBuffer (avoids SharedArrayBuffer typing).
+    const out = new ArrayBuffer(der.byteLength);
+    new Uint8Array(out).set(der);
+    return out;
+}
+//# sourceMappingURL=service-oauth.js.map

package/dist/store/service-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-oauth.js","sourceRoot":"","sources":["../../src/store/service-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAQH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAoB,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EACL,cAAc,EACd,sBAAsB,EAGtB,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AA4C3C,6EAA6E;AAC7E,MAAM,WAAW,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7C,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAmB,CAAqC,CAAC;AAEnF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,eAAe,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0CAA0C,GAAG,CAAC,QAAQ,eAAe,GAAG,CAAC,QAAQ,uBAAuB,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;AACnB,CAAC;AAiCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,iFAAiF,CACzI,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,gCAAgC,CAAC;IAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC;QACpC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;QACzC,WAAW;QACX,KAAK;QACL,aAAa;QACb,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,uDAAuD;AACvD,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAoCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,IAAyB,EACzB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAC5C,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,YAAY,EAAE,IAAI,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,gCAAgC,IAAI,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAgB;QAC1B,WAAW;QACX,YAAY,EACV,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS;QAC3F,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,SAAS;QAC9F,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,QAAQ;KAC9F,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAqB;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,cAAc,CACvC;QACE,QAAQ;QACR,KAAK;QACL,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvF,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,EACD,IAAI,CAAC,KAAK,CACX,CAAC;IACF,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,SAAS;QACT,eAAe,EAAE,MAAM,CAAC,YAAY,KAAK,SAAS;KACnD,CAAC;AACJ,CAAC;AAoCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,IAA+B,EAC/B,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,8BAA8B,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAC5C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACpE,KAAK,YAAY;YACf,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,KAAK,qBAAqB;YACxB,OAAO,wBAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,KAAK,oBAAoB;YACvB,OAAO,2BAA2B,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,CAAC;YACR,oEAAoE;YACpE,MAAM,KAAK,GAAU,OAAO,CAAC,IAAI,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,sBAAsB,CACnC,QAAgB,EAChB,OAAsB,EACtB,IAA+B,EAC/B,SAAoB;IAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,4BAA4B,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;IAC/C,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvE,wEAAwE;IACxE,IAAI,UAAU,KAAK,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,MAAM,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC7C,MAAM,IAAI,GAA2B;YACnC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;SAC5B,CAAC;QACF,IAAI,UAAU,KAAK,MAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;YAC7B,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,CAAC;QACvC,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,cAAc,CAAC,GAAG,mCAAmC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;SAC5B,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,MAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,2BAA2B,CACxC,OAAsB,EACtB,IAA+B,EAC/B,SAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,MAAM,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,EAAE;YAC/D,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,OAAsB,EACtB,IAA+B,EAC/B,SAAoB,EACpB,GAAkB;IAElB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpE,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,YAAY,CAC5B,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAC5B,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,EACnD,aAAa,CACd,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,gBAAgB,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;YACpC,YAAY,EAAE,oBAAoB;SACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,iFAAiF;IACjF,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,MAAM,SAAS,GACb,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtF,CAAC,CAAC,IAAI,CAAC;IACX,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAAsB,EACtB,IAA+B,EAC/B,SAAoB,EACpB,GAAkB;IAElB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,YAAY,CAClC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAC5B;QACE,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,QAAQ;QACrB,KAAK,EAAE,gDAAgD;QACvD,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM,GAAG,IAAI;KACnB,EACD,aAAa,CACd,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,6CAA6C;YACzD,SAAS;SACV,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAsCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAA8B,EAC9B,OAAyB,EAAE;IAE3B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAEvD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,OAAO;QACP,QAAQ;QACR,KAAK;QACL,GAAG,CAAC,aAAa,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,EACD,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACjC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,gFAAgF;IAChF,MAAM,QAAQ,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,IAAI,KAAK,CAAC;IACrE,IAAI,MAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,QAAQ,EACR;YACE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,EACD,IAAI,CACL,CAAC;QACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,OAAO,GAAqB;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,4DAA4D;YAC5D,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;SACtD,CAAC;QACF,MAAM,sBAAsB,CAC1B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAC7D,IAAI,CAAC,KAAK,CACX,CAAC;QACF,IAAI,GAAG,OAAO,CAAC;QACf,SAAS,GAAG,YAAY,CAAC;QACzB,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;IAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC;QAClC,QAAQ;QACR,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC;QACvC,YAAY,EAAE,GAAW,EAAE,CAAC,gBAAgB;KAC7C,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,2EAA2E;AAC3E,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,IAAgG;IAEhG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,0BAA0B,IAAI,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACL,WAAW;QACX,YAAY,EACV,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAY,CAAC,CAAC,CAAC,SAAS;QAC3F,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,SAAS;QAC9F,SAAS,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,QAAQ;KAC9F,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,QAAQ,CAAC,IAAqC;IAC3D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,SAA6B,EAAE,GAAkB;IACzE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED,sEAAsE;AACtE,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CACzB,MAA+B,EAC/B,MAA+B,EAC/B,aAAqB;IAErB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,OAAO,EACP,UAAU,CAAC,aAAa,CAAC,EACzB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/F,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,wDAAwD;AACxD,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,+EAA+E;IAC/E,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC"}