@codemation/host 0.0.5 → 0.0.11

package/dist/CredentialServices-BKBGe7l3.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CredentialServices-BKBGe7l3.js","names":["fetchImpl: typeof globalThis.fetch","healthTester: OpenAiApiKeyCredentialHealthTester","CredentialTypeRegistryImpl","WorkflowCredentialNodeResolver","slots: WorkflowCredentialSlotRef[]","CredentialFieldEnvOverlayService","appConfig: AppConfig","pub: Record<string, unknown>","mat: Record<string, unknown>","CredentialSecretCipher","appConfig: AppConfig","CredentialMaterialResolver","credentialStore: CredentialStore","credentialSecretCipher: CredentialSecretCipher","appConfig: AppConfig","resolved: Record<string, unknown>","missingEnvironmentVariables: string[]","CredentialInstanceService","credentialStore: CredentialStore","credentialTypeRegistry: CredentialTypeRegistryImpl","credentialSecretCipher: CredentialSecretCipher","credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService","credentialMaterialResolver: CredentialMaterialResolver","credentialSessionService: MutableCredentialSessionService","instance: CredentialInstanceRecord","updatedInstance: CredentialInstanceRecord","out: Record<string, unknown>","CredentialBindingService","credentialStore: CredentialStore","credentialInstanceService: CredentialInstanceService","workflowRepository: WorkflowRepository","credentialSessionService: MutableCredentialSessionService","workflowCredentialNodeResolver: WorkflowCredentialNodeResolver","binding: CredentialBinding","slots: WorkflowCredentialHealthSlotDto[]","CredentialRuntimeMaterialService","credentialStore: CredentialStore","credentialMaterialResolver: CredentialMaterialResolver","credentialSecretCipher: CredentialSecretCipher","credentialTypeRegistry: CredentialTypeRegistryImpl","CredentialSessionServiceImpl","credentialStore: CredentialStore","credentialRuntimeMaterialService: CredentialRuntimeMaterialService","credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService","credentialTypeRegistry: CredentialTypeRegistryImpl","workflowRepository: WorkflowRepository","workflowCredentialNodeResolver: WorkflowCredentialNodeResolver","bindingKey: CredentialBindingKey","CredentialTestService","credentialInstanceService: CredentialInstanceService","credentialRuntimeMaterialService: CredentialRuntimeMaterialService","credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService","credentialTypeRegistry: CredentialTypeRegistryImpl","credentialStore: CredentialStore","credentialSessionService: MutableCredentialSessionService"],"sources":["../src/infrastructure/credentials/OpenAiApiKeyCredentialHealthTester.ts","../src/infrastructure/credentials/OpenAiApiKeyCredentialTypeFactory.ts","../src/domain/credentials/CredentialTypeRegistryImpl.ts","../src/application/ApplicationRequestError.ts","../src/applicationTokens.ts","../src/domain/credentials/WorkflowCredentialNodeResolver.ts","../src/domain/credentials/CredentialFieldEnvOverlayService.ts","../src/domain/credentials/CredentialSecretCipher.ts","../src/domain/credentials/CredentialMaterialResolver.ts","../src/domain/credentials/CredentialInstanceService.ts","../src/domain/credentials/CredentialBindingService.ts","../src/domain/credentials/CredentialRuntimeMaterialService.ts","../src/domain/credentials/CredentialSessionServiceImpl.ts","../src/domain/credentials/CredentialTestService.ts"],"sourcesContent":["import type { CredentialHealth, CredentialSessionFactoryArgs } from \"@codemation/core\";\n\nimport type { OpenAiApiKeyMaterial, OpenAiApiKeyPublicConfig } from \"./OpenAiApiKeyCredentialShapes.types\";\n\n/**\n * Verifies an OpenAI-compatible API key by calling the provider's models list endpoint\n * (GET `/v1/models` relative to the configured base URL).\n */\nexport class OpenAiApiKeyCredentialHealthTester {\n  constructor(private readonly fetchImpl: typeof globalThis.fetch) {}\n\n  async test(\n    args: CredentialSessionFactoryArgs<OpenAiApiKeyPublicConfig, OpenAiApiKeyMaterial>,\n  ): Promise<CredentialHealth> {\n    const testedAt = new Date().toISOString();\n    const apiKey = String(args.material.apiKey ?? \"\").trim();\n    if (apiKey.length === 0) {\n      return {\n        status: \"failing\",\n        message: \"OpenAI API key is empty.\",\n        testedAt,\n      };\n    }\n\n    const modelsUrl = this.resolveModelsListUrl(args.publicConfig.baseUrl);\n\n    try {\n      const response = await this.fetchImpl(modelsUrl, {\n        method: \"GET\",\n        headers: {\n          Authorization: `Bearer ${apiKey}`,\n        },\n        signal: AbortSignal.timeout(25_000),\n      });\n\n      if (response.ok) {\n        return {\n          status: \"healthy\",\n          message: \"API key verified against the models endpoint.\",\n          testedAt,\n        };\n      }\n\n      const message = await this.parseErrorMessage(response);\n      return {\n        status: \"failing\",\n        message,\n        testedAt,\n      };\n    } catch (error) {\n      return {\n        status: \"failing\",\n        message: error instanceof Error ? error.message : String(error),\n        testedAt,\n      };\n    }\n  }\n\n  private resolveModelsListUrl(baseUrlRaw: unknown): string {\n    const defaultBase = \"https://api.openai.com/v1\";\n    const raw = typeof baseUrlRaw === \"string\" ? baseUrlRaw.trim() : \"\";\n    const base = raw === \"\" ? defaultBase : raw.replace(/\\/+$/, \"\");\n    if (base.endsWith(\"/models\")) {\n      return base;\n    }\n    if (base.endsWith(\"/v1\")) {\n      return `${base}/models`;\n    }\n    return `${base}/v1/models`;\n  }\n\n  private async parseErrorMessage(response: Response): Promise<string> {\n    const prefix = `HTTP ${response.status}`;\n    try {\n      const text = await response.text();\n      if (text.trim() === \"\") {\n        return prefix;\n      }\n      const parsed = JSON.parse(text) as { error?: { message?: string } };\n      const fromApi = parsed.error?.message;\n      if (typeof fromApi === \"string\" && fromApi.trim() !== \"\") {\n        return `${prefix}: ${fromApi.trim()}`;\n      }\n      return `${prefix}: ${text.length > 280 ? `${text.slice(0, 280)}…` : text}`;\n    } catch {\n      return prefix;\n    }\n  }\n}\n","import type { CredentialType } from \"../../domain/credentials/CredentialServices\";\n\nimport type { OpenAiApiKeyCredentialHealthTester } from \"./OpenAiApiKeyCredentialHealthTester\";\nimport type {\n  OpenAiApiKeyMaterial,\n  OpenAiApiKeyPublicConfig,\n  OpenAiApiKeySession,\n} from \"./OpenAiApiKeyCredentialShapes.types\";\n\n/**\n * Builds the OpenAI-compatible API key credential (`openai.apiKey`) registration.\n * Used by {@link FrameworkBuiltinCredentialTypesRegistrar} and may be listed in {@link CodemationConfig.credentialTypes}\n * so consumer apps always register the type even when bootstrap order differs.\n */\nexport class OpenAiApiKeyCredentialTypeFactory {\n  constructor(private readonly healthTester: OpenAiApiKeyCredentialHealthTester) {}\n\n  createCredentialType(): CredentialType<OpenAiApiKeyPublicConfig, OpenAiApiKeyMaterial, OpenAiApiKeySession> {\n    return {\n      definition: {\n        typeId: \"openai.apiKey\",\n        displayName: \"OpenAI API key\",\n        description: \"API key and optional base URL for OpenAI or OpenAI-compatible chat endpoints.\",\n        publicFields: [\n          {\n            key: \"baseUrl\",\n            label: \"Base URL\",\n            type: \"string\",\n            placeholder: \"https://api.openai.com/v1\",\n            helpText: \"Leave empty to use the default OpenAI API endpoint.\",\n          },\n        ],\n        secretFields: [{ key: \"apiKey\", label: \"API key\", type: \"password\", required: true }],\n        supportedSourceKinds: [\"db\", \"env\", \"code\"],\n      },\n      createSession: async (args) => {\n        const baseUrlRaw = args.publicConfig.baseUrl;\n        const baseUrl = typeof baseUrlRaw === \"string\" && baseUrlRaw.trim() !== \"\" ? baseUrlRaw.trim() : undefined;\n        return {\n          apiKey: String(args.material.apiKey ?? \"\"),\n          baseUrl,\n        };\n      },\n      test: async (args) => this.healthTester.test(args),\n    };\n  }\n}\n","import type { CredentialTypeDefinition, CredentialTypeId, CredentialTypeRegistry } from \"@codemation/core\";\n\nimport { injectable } from \"@codemation/core\";\n\nimport type { AnyCredentialType, CredentialType } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialTypeRegistryImpl implements CredentialTypeRegistry {\n  private readonly credentialTypesById = new Map<CredentialTypeId, AnyCredentialType>();\n\n  register(type: CredentialType<any, any, unknown>): void {\n    if (this.credentialTypesById.has(type.definition.typeId)) {\n      throw new Error(`Credential type already registered: ${type.definition.typeId}`);\n    }\n    this.credentialTypesById.set(type.definition.typeId, type);\n  }\n\n  listTypes(): ReadonlyArray<CredentialTypeDefinition> {\n    return [...this.credentialTypesById.values()].map((entry) => entry.definition);\n  }\n\n  getType(typeId: CredentialTypeId): CredentialTypeDefinition | undefined {\n    return this.credentialTypesById.get(typeId)?.definition;\n  }\n\n  getCredentialType(typeId: CredentialTypeId): AnyCredentialType | undefined {\n    return this.credentialTypesById.get(typeId);\n  }\n}\n","export class ApplicationRequestError extends Error {\n  readonly status: number;\n\n  readonly payload: Readonly<{ error: string; errors?: ReadonlyArray<string> }>;\n\n  constructor(status: number, message: string, errors?: ReadonlyArray<string>) {\n    super(message);\n    this.name = \"ApplicationRequestError\";\n    this.status = status;\n    this.payload = errors && errors.length > 0 ? { error: message, errors } : { error: message };\n  }\n}\n","import type { Clock, TypeToken } from \"@codemation/core\";\nimport type { SessionVerifier } from \"./application/auth/SessionVerifier\";\nimport type { Command } from \"./application/bus/Command\";\nimport type { CommandBus } from \"./application/bus/CommandBus\";\nimport type { CommandHandler } from \"./application/bus/CommandHandler\";\nimport type { DomainEvent } from \"./application/bus/DomainEvent\";\nimport type { DomainEventBus } from \"./application/bus/DomainEventBus\";\nimport type { DomainEventHandler } from \"./application/bus/DomainEventHandler\";\nimport type { Query } from \"./application/bus/Query\";\nimport type { QueryBus } from \"./application/bus/QueryBus\";\nimport type { QueryHandler } from \"./application/bus/QueryHandler\";\nimport type { Logger, LoggerFactory } from \"./application/logging/Logger\";\nimport type { WorkflowWebsocketPublisher } from \"./application/websocket/WorkflowWebsocketPublisher\";\nimport type { CredentialStore } from \"./domain/credentials/CredentialServices\";\nimport type { WorkflowRunRepository } from \"./domain/runs/WorkflowRunRepository\";\nimport type { WorkflowDebuggerOverlayRepository } from \"./domain/workflows/WorkflowDebuggerOverlayRepository\";\nimport type { WorkflowDefinitionRepository } from \"./domain/workflows/WorkflowDefinitionRepository\";\nimport type { WorkflowActivationRepository } from \"./domain/workflows/WorkflowActivationRepository\";\nimport type { WorkerRuntimeScheduler } from \"./infrastructure/runtime/WorkerRuntimeScheduler\";\nimport type { PrismaClient } from \"./infrastructure/persistence/generated/prisma-client/client.js\";\nimport type { AppConfig } from \"./presentation/config/AppConfig\";\nimport type { CodemationAuthConfig } from \"./presentation/config/CodemationAuthConfig\";\nimport type { CodemationWhitelabelConfig } from \"./presentation/config/CodemationWhitelabelConfig\";\nimport type { HonoApiRouteRegistrar } from \"./presentation/http/hono/HonoApiRouteRegistrar\";\n\nexport const ApplicationTokens = {\n  CodemationAuthConfig: Symbol.for(\"codemation.application.CodemationAuthConfig\") as TypeToken<\n    CodemationAuthConfig | undefined\n  >,\n  CodemationWhitelabelConfig: Symbol.for(\n    \"codemation.application.CodemationWhitelabelConfig\",\n  ) as TypeToken<CodemationWhitelabelConfig>,\n  AppConfig: Symbol.for(\"codemation.application.AppConfig\") as TypeToken<AppConfig>,\n  WebSocketPort: Symbol.for(\"codemation.application.WebSocketPort\") as TypeToken<number>,\n  WebSocketBindHost: Symbol.for(\"codemation.application.WebSocketBindHost\") as TypeToken<string>,\n  QueryBus: Symbol.for(\"codemation.application.QueryBus\") as TypeToken<QueryBus>,\n  CommandBus: Symbol.for(\"codemation.application.CommandBus\") as TypeToken<CommandBus>,\n  DomainEventBus: Symbol.for(\"codemation.application.DomainEventBus\") as TypeToken<DomainEventBus>,\n  QueryHandler: Symbol.for(\"codemation.application.QueryHandler\") as TypeToken<QueryHandler<Query<unknown>, unknown>>,\n  CommandHandler: Symbol.for(\"codemation.application.CommandHandler\") as TypeToken<\n    CommandHandler<Command<unknown>, unknown>\n  >,\n  DomainEventHandler: Symbol.for(\"codemation.application.DomainEventHandler\") as TypeToken<\n    DomainEventHandler<DomainEvent>\n  >,\n  HonoApiRouteRegistrar: Symbol.for(\"codemation.application.HonoApiRouteRegistrar\") as TypeToken<HonoApiRouteRegistrar>,\n  WorkflowWebsocketPublisher: Symbol.for(\n    \"codemation.application.WorkflowWebsocketPublisher\",\n  ) as TypeToken<WorkflowWebsocketPublisher>,\n  WorkerRuntimeScheduler: Symbol.for(\n    \"codemation.application.WorkerRuntimeScheduler\",\n  ) as TypeToken<WorkerRuntimeScheduler>,\n  WorkflowDefinitionRepository: Symbol.for(\n    \"codemation.application.WorkflowDefinitionRepository\",\n  ) as TypeToken<WorkflowDefinitionRepository>,\n  WorkflowActivationRepository: Symbol.for(\n    \"codemation.application.WorkflowActivationRepository\",\n  ) as TypeToken<WorkflowActivationRepository>,\n  WorkflowDebuggerOverlayRepository: Symbol.for(\n    \"codemation.application.WorkflowDebuggerOverlayRepository\",\n  ) as TypeToken<WorkflowDebuggerOverlayRepository>,\n  WorkflowRunRepository: Symbol.for(\"codemation.application.WorkflowRunRepository\") as TypeToken<WorkflowRunRepository>,\n  LoggerFactory: Symbol.for(\"codemation.application.LoggerFactory\") as TypeToken<LoggerFactory>,\n  /**\n   * Opt-in timing/diagnostics logger (`CODEMATION_PERFORMANCE_LOGGING` + normal minimum log level).\n   */\n  PerformanceDiagnosticsLogger: Symbol.for(\"codemation.application.PerformanceDiagnosticsLogger\") as TypeToken<Logger>,\n  CredentialStore: Symbol.for(\"codemation.application.CredentialStore\") as TypeToken<CredentialStore>,\n  PrismaClient: Symbol.for(\"codemation.application.PrismaClient\") as TypeToken<PrismaClient>,\n  SessionVerifier: Symbol.for(\"codemation.application.SessionVerifier\") as TypeToken<SessionVerifier>,\n  Clock: Symbol.for(\"codemation.application.Clock\") as TypeToken<Clock>,\n} as const;\n","import type { CredentialRequirement, WorkflowDefinition } from \"@codemation/core\";\nimport {\n  AgentConfigInspector,\n  ConnectionNodeIdFactory,\n  WorkflowExecutableNodeClassifierFactory,\n} from \"@codemation/core\";\n\nimport { injectable } from \"@codemation/core\";\n\nexport type WorkflowCredentialSlotRef = Readonly<{\n  workflowId: string;\n  nodeId: string;\n  nodeName: string;\n  requirement: CredentialRequirement;\n}>;\n\n/**\n * Resolves credential requirements for workflow node ids, including connection-owned LLM/tool children.\n */\n@injectable()\nexport class WorkflowCredentialNodeResolver {\n  /**\n   * Human-readable label for credential errors (workflow node name or agent › attachment).\n   */\n  describeCredentialNodeDisplay(workflow: WorkflowDefinition, nodeId: string): string {\n    const direct = workflow.nodes.find((n) => n.id === nodeId);\n    if (direct) {\n      return direct.name ?? direct.config.name ?? direct.id;\n    }\n    if (ConnectionNodeIdFactory.isLanguageModelConnectionNodeId(nodeId)) {\n      const parentId = this.parseParentForLanguageModelConnectionNodeId(nodeId);\n      const parent = parentId ? workflow.nodes.find((n) => n.id === parentId) : undefined;\n      const agentLabel = parent?.name ?? parentId ?? \"Agent\";\n      return `${agentLabel} › Language model`;\n    }\n    if (ConnectionNodeIdFactory.isToolConnectionNodeId(nodeId)) {\n      const parsed = this.parseToolConnectionNodeId(nodeId);\n      if (!parsed) {\n        return nodeId;\n      }\n      const parent = workflow.nodes.find((n) => n.id === parsed.parentNodeId);\n      const agentLabel = parent?.name ?? parsed.parentNodeId;\n      const toolConfig =\n        parent && AgentConfigInspector.isAgentNodeConfig(parent.config)\n          ? parent.config.tools?.find(\n              (tool) => ConnectionNodeIdFactory.normalizeToolName(tool.name) === parsed.normalizedToolName,\n            )\n          : undefined;\n      const toolLabel = toolConfig?.presentation?.label ?? toolConfig?.name ?? parsed.normalizedToolName;\n      return `${agentLabel} › ${toolLabel}`;\n    }\n    return nodeId;\n  }\n\n  isCredentialNodeIdInWorkflow(workflow: WorkflowDefinition, nodeId: string): boolean {\n    if (workflow.nodes.some((n) => n.id === nodeId)) {\n      return true;\n    }\n    if (ConnectionNodeIdFactory.isLanguageModelConnectionNodeId(nodeId)) {\n      const parent = this.parseParentForLanguageModelConnectionNodeId(nodeId);\n      if (parent && workflow.nodes.some((n) => n.id === parent)) {\n        return true;\n      }\n    }\n    if (ConnectionNodeIdFactory.isToolConnectionNodeId(nodeId)) {\n      const parsed = this.parseToolConnectionNodeId(nodeId);\n      if (parsed && workflow.nodes.some((n) => n.id === parsed.parentNodeId)) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  findRequirement(\n    workflow: WorkflowDefinition,\n    nodeId: string,\n    slotKey: string,\n  ): Readonly<{ nodeName: string; requirement: CredentialRequirement }> | undefined {\n    const direct = this.findDirectRequirement(workflow, nodeId, slotKey);\n    if (direct) {\n      return direct;\n    }\n    if (ConnectionNodeIdFactory.isLanguageModelConnectionNodeId(nodeId)) {\n      const parent = this.parseParentForLanguageModelConnectionNodeId(nodeId);\n      if (parent) {\n        const fromConn = this.findLanguageModelRequirement(workflow, parent, slotKey);\n        if (fromConn) {\n          return fromConn;\n        }\n      }\n    }\n    if (ConnectionNodeIdFactory.isToolConnectionNodeId(nodeId)) {\n      const parsed = this.parseToolConnectionNodeId(nodeId);\n      if (parsed) {\n        const fromConn = this.findToolRequirement(workflow, parsed.parentNodeId, parsed.normalizedToolName, slotKey);\n        if (fromConn) {\n          return fromConn;\n        }\n      }\n    }\n    return undefined;\n  }\n\n  listSlots(workflow: WorkflowDefinition): ReadonlyArray<WorkflowCredentialSlotRef> {\n    const slots: WorkflowCredentialSlotRef[] = [];\n    const classifier = WorkflowExecutableNodeClassifierFactory.create(workflow);\n    const hasConnectionMetadata = (workflow.connections?.length ?? 0) > 0;\n\n    for (const node of workflow.nodes) {\n      if (classifier.isConnectionOwnedNodeId(node.id)) {\n        for (const requirement of node.config.getCredentialRequirements?.() ?? []) {\n          slots.push({\n            workflowId: workflow.id,\n            nodeId: node.id,\n            nodeName: node.name ?? node.config.name ?? node.id,\n            requirement,\n          });\n        }\n        continue;\n      }\n\n      if (AgentConfigInspector.isAgentNodeConfig(node.config)) {\n        if (!hasConnectionMetadata) {\n          const lmNodeId = ConnectionNodeIdFactory.languageModelConnectionNodeId(node.id);\n          const lmLabel = node.config.chatModel.presentation?.label ?? node.config.chatModel.name;\n          for (const requirement of node.config.chatModel.getCredentialRequirements?.() ?? []) {\n            slots.push({\n              workflowId: workflow.id,\n              nodeId: lmNodeId,\n              nodeName: lmLabel,\n              requirement,\n            });\n          }\n          for (const toolConfig of node.config.tools ?? []) {\n            const toolNodeId = ConnectionNodeIdFactory.toolConnectionNodeId(node.id, toolConfig.name);\n            const toolLabel = toolConfig.presentation?.label ?? toolConfig.name;\n            for (const requirement of toolConfig.getCredentialRequirements?.() ?? []) {\n              slots.push({\n                workflowId: workflow.id,\n                nodeId: toolNodeId,\n                nodeName: toolLabel,\n                requirement,\n              });\n            }\n          }\n        }\n        continue;\n      }\n\n      for (const requirement of node.config.getCredentialRequirements?.() ?? []) {\n        slots.push({\n          workflowId: workflow.id,\n          nodeId: node.id,\n          nodeName: node.name ?? node.config.name ?? node.id,\n          requirement,\n        });\n      }\n    }\n    return slots;\n  }\n\n  private findDirectRequirement(\n    workflow: WorkflowDefinition,\n    nodeId: string,\n    slotKey: string,\n  ): Readonly<{ nodeName: string; requirement: CredentialRequirement }> | undefined {\n    const node = workflow.nodes.find((entry) => entry.id === nodeId);\n    if (!node || AgentConfigInspector.isAgentNodeConfig(node.config)) {\n      return undefined;\n    }\n    const requirement = node.config.getCredentialRequirements?.()?.find((entry) => entry.slotKey === slotKey);\n    if (!requirement) {\n      return undefined;\n    }\n    return { nodeName: node.name ?? node.config.name ?? node.id, requirement };\n  }\n\n  private findLanguageModelRequirement(\n    workflow: WorkflowDefinition,\n    parentNodeId: string,\n    slotKey: string,\n  ): Readonly<{ nodeName: string; requirement: CredentialRequirement }> | undefined {\n    const parent = workflow.nodes.find((entry) => entry.id === parentNodeId);\n    if (!parent || !AgentConfigInspector.isAgentNodeConfig(parent.config)) {\n      return undefined;\n    }\n    const requirement = parent.config.chatModel\n      .getCredentialRequirements?.()\n      ?.find((entry) => entry.slotKey === slotKey);\n    if (!requirement) {\n      return undefined;\n    }\n    const nodeName =\n      parent.config.chatModel.presentation?.label ?? parent.config.chatModel.name ?? parent.name ?? parent.id;\n    return { nodeName, requirement };\n  }\n\n  private findToolRequirement(\n    workflow: WorkflowDefinition,\n    parentNodeId: string,\n    normalizedToolName: string,\n    slotKey: string,\n  ): Readonly<{ nodeName: string; requirement: CredentialRequirement }> | undefined {\n    const parent = workflow.nodes.find((entry) => entry.id === parentNodeId);\n    if (!parent || !AgentConfigInspector.isAgentNodeConfig(parent.config)) {\n      return undefined;\n    }\n    const toolConfig = parent.config.tools?.find(\n      (tool) => ConnectionNodeIdFactory.normalizeToolName(tool.name) === normalizedToolName,\n    );\n    if (!toolConfig) {\n      return undefined;\n    }\n    const requirement = toolConfig.getCredentialRequirements?.()?.find((entry) => entry.slotKey === slotKey);\n    if (!requirement) {\n      return undefined;\n    }\n    const nodeName = toolConfig.presentation?.label ?? toolConfig.name ?? parent.name ?? parent.id;\n    return { nodeName, requirement };\n  }\n\n  private parseParentForLanguageModelConnectionNodeId(nodeId: string): string | undefined {\n    if (!ConnectionNodeIdFactory.isLanguageModelConnectionNodeId(nodeId)) {\n      return undefined;\n    }\n    const suffix = `${ConnectionNodeIdFactory.connectionSegment}llm`;\n    return nodeId.slice(0, -suffix.length);\n  }\n\n  private parseToolConnectionNodeId(nodeId: string): { parentNodeId: string; normalizedToolName: string } | undefined {\n    if (!ConnectionNodeIdFactory.isToolConnectionNodeId(nodeId)) {\n      return undefined;\n    }\n    const marker = `${ConnectionNodeIdFactory.connectionSegment}tool${ConnectionNodeIdFactory.connectionSegment}`;\n    const idx = nodeId.indexOf(marker);\n    if (idx < 0) {\n      return undefined;\n    }\n    const parentNodeId = nodeId.slice(0, idx);\n    const normalizedToolName = nodeId.slice(idx + marker.length);\n    if (!parentNodeId || !normalizedToolName) {\n      return undefined;\n    }\n    return { parentNodeId, normalizedToolName };\n  }\n}\n","import type { CredentialFieldSchema, CredentialTypeDefinition } from \"@codemation/core\";\nimport { inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\nimport type { AppConfig } from \"../../presentation/config/AppConfig\";\n\nimport type { JsonRecord } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialFieldEnvOverlayService {\n  constructor(\n    @inject(ApplicationTokens.AppConfig)\n    private readonly appConfig: AppConfig,\n  ) {}\n\n  /** True when the field declares an env var and process.env has a non-empty string for it. */\n  isFieldResolvedFromEnv(field: CredentialFieldSchema): boolean {\n    const name = field.envVarName?.trim();\n    if (!name) {\n      return false;\n    }\n    const v = this.appConfig.env[name];\n    return typeof v === \"string\" && v.length > 0;\n  }\n\n  apply(\n    args: Readonly<{\n      definition: CredentialTypeDefinition;\n      publicConfig: JsonRecord;\n      material: JsonRecord;\n    }>,\n  ): Readonly<{ resolvedPublicConfig: JsonRecord; resolvedMaterial: JsonRecord }> {\n    const pub: Record<string, unknown> = { ...args.publicConfig };\n    const mat: Record<string, unknown> = { ...args.material };\n    for (const field of args.definition.publicFields ?? []) {\n      const name = field.envVarName?.trim();\n      if (!name) {\n        continue;\n      }\n      const v = this.appConfig.env[name];\n      if (typeof v === \"string\" && v.length > 0) {\n        pub[field.key] = v;\n      }\n    }\n    for (const field of args.definition.secretFields ?? []) {\n      const name = field.envVarName?.trim();\n      if (!name) {\n        continue;\n      }\n      const v = this.appConfig.env[name];\n      if (typeof v === \"string\" && v.length > 0) {\n        mat[field.key] = v;\n      }\n    }\n    return Object.freeze({\n      resolvedPublicConfig: Object.freeze(pub),\n      resolvedMaterial: Object.freeze(mat),\n    });\n  }\n}\n","import { createCipheriv, createDecipheriv, createHash, randomBytes } from \"node:crypto\";\n\nimport { inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\nimport type { AppConfig } from \"../../presentation/config/AppConfig\";\n\nimport type { JsonRecord } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialSecretCipher {\n  private static readonly algorithm = \"aes-256-gcm\";\n  private static readonly schemaVersion = 1;\n  private static readonly ivLength = 12;\n\n  constructor(\n    @inject(ApplicationTokens.AppConfig)\n    private readonly appConfig: AppConfig,\n  ) {}\n\n  encrypt(value: JsonRecord): Readonly<{\n    encryptedJson: string;\n    encryptionKeyId: string;\n    schemaVersion: number;\n  }> {\n    const iv = randomBytes(CredentialSecretCipher.ivLength);\n    const cipher = createCipheriv(CredentialSecretCipher.algorithm, this.resolveKeyMaterial(), iv);\n    const plaintext = Buffer.from(JSON.stringify(value), \"utf8\");\n    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n    const authTag = cipher.getAuthTag();\n    return {\n      encryptedJson: Buffer.concat([iv, authTag, encrypted]).toString(\"base64\"),\n      encryptionKeyId: this.resolveKeyId(),\n      schemaVersion: CredentialSecretCipher.schemaVersion,\n    };\n  }\n\n  decrypt(\n    record: Readonly<{\n      encryptedJson: string;\n      encryptionKeyId: string;\n      schemaVersion: number;\n    }>,\n  ): JsonRecord {\n    const packed = Buffer.from(record.encryptedJson, \"base64\");\n    const iv = packed.subarray(0, CredentialSecretCipher.ivLength);\n    const authTag = packed.subarray(CredentialSecretCipher.ivLength, CredentialSecretCipher.ivLength + 16);\n    const encrypted = packed.subarray(CredentialSecretCipher.ivLength + 16);\n    const decipher = createDecipheriv(CredentialSecretCipher.algorithm, this.resolveKeyMaterial(), iv);\n    decipher.setAuthTag(authTag);\n    const plaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(\"utf8\");\n    return JSON.parse(plaintext) as JsonRecord;\n  }\n\n  private resolveKeyMaterial(): Buffer {\n    const rawValue = this.appConfig.env.CODEMATION_CREDENTIALS_MASTER_KEY;\n    if (!rawValue || rawValue.trim().length === 0) {\n      throw new Error(\"CODEMATION_CREDENTIALS_MASTER_KEY is required to encrypt database-managed credentials.\");\n    }\n    return createHash(\"sha256\").update(rawValue).digest();\n  }\n\n  private resolveKeyId(): string {\n    const rawValue = this.appConfig.env.CODEMATION_CREDENTIALS_MASTER_KEY;\n    return createHash(\"sha256\")\n      .update(rawValue ?? \"\")\n      .digest(\"hex\")\n      .slice(0, 12);\n  }\n}\n","import { inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\nimport type { AppConfig } from \"../../presentation/config/AppConfig\";\n\nimport { CredentialSecretCipher } from \"./CredentialSecretCipher\";\nimport type { CredentialInstanceRecord, CredentialStore, JsonRecord } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialMaterialResolver {\n  constructor(\n    @inject(ApplicationTokens.CredentialStore)\n    private readonly credentialStore: CredentialStore,\n    @inject(CredentialSecretCipher)\n    private readonly credentialSecretCipher: CredentialSecretCipher,\n    @inject(ApplicationTokens.AppConfig)\n    private readonly appConfig: AppConfig,\n  ) {}\n\n  async resolveMaterial(instance: CredentialInstanceRecord): Promise<JsonRecord> {\n    if (instance.secretRef.kind === \"db\") {\n      const secretMaterial = await this.credentialStore.getSecretMaterial(instance.instanceId);\n      if (!secretMaterial) {\n        throw new Error(`Credential ${instance.instanceId} is missing encrypted secret material.`);\n      }\n      return this.credentialSecretCipher.decrypt(secretMaterial);\n    }\n    if (instance.secretRef.kind === \"env\") {\n      return this.resolveEnvMaterial(instance);\n    }\n    return instance.secretRef.value;\n  }\n\n  private resolveEnvMaterial(instance: CredentialInstanceRecord): JsonRecord {\n    if (instance.secretRef.kind !== \"env\") {\n      throw new Error(`Credential ${instance.instanceId} is not environment-backed.`);\n    }\n    const resolved: Record<string, unknown> = {};\n    const missingEnvironmentVariables: string[] = [];\n    for (const [fieldKey, envVarName] of Object.entries(instance.secretRef.envByField)) {\n      const value = this.appConfig.env[envVarName];\n      if (value === undefined || value.length === 0) {\n        missingEnvironmentVariables.push(envVarName);\n        continue;\n      }\n      resolved[fieldKey] = value;\n    }\n    if (missingEnvironmentVariables.length > 0) {\n      throw new Error(\n        `Credential ${instance.instanceId} requires environment variables that are not set: ${missingEnvironmentVariables.join(\", \")}.`,\n      );\n    }\n    return resolved;\n  }\n}\n","import { randomUUID } from \"node:crypto\";\n\nimport type {\n  CredentialFieldSchema,\n  CredentialInstanceId,\n  CredentialMaterialSourceKind,\n  CredentialTypeId,\n} from \"@codemation/core\";\n\nimport { CoreTokens, inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationRequestError } from \"../../application/ApplicationRequestError\";\n\nimport type {\n  CreateCredentialInstanceRequest,\n  CredentialInstanceDto,\n  CredentialInstanceWithSecretsDto,\n  CredentialOAuth2ConnectionDto,\n  UpdateCredentialInstanceRequest,\n} from \"../../application/contracts/CredentialContractsRegistry\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\n\nimport { CredentialFieldEnvOverlayService } from \"./CredentialFieldEnvOverlayService\";\nimport { CredentialMaterialResolver } from \"./CredentialMaterialResolver\";\nimport { CredentialSecretCipher } from \"./CredentialSecretCipher\";\nimport type {\n  CredentialInstanceRecord,\n  CredentialSecretMaterialRecord,\n  CredentialSecretRef,\n  CredentialStore,\n  CredentialTestRecord,\n  AnyCredentialType,\n  JsonRecord,\n  MutableCredentialSessionService,\n} from \"./CredentialServices\";\nimport { CredentialTypeRegistryImpl } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialInstanceService {\n  constructor(\n    @inject(ApplicationTokens.CredentialStore)\n    private readonly credentialStore: CredentialStore,\n    @inject(CredentialTypeRegistryImpl)\n    private readonly credentialTypeRegistry: CredentialTypeRegistryImpl,\n    @inject(CredentialSecretCipher)\n    private readonly credentialSecretCipher: CredentialSecretCipher,\n    @inject(CredentialFieldEnvOverlayService)\n    private readonly credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService,\n    @inject(CredentialMaterialResolver)\n    private readonly credentialMaterialResolver: CredentialMaterialResolver,\n    @inject(CoreTokens.CredentialSessionService)\n    private readonly credentialSessionService: MutableCredentialSessionService,\n  ) {}\n\n  async listInstances(): Promise<ReadonlyArray<CredentialInstanceDto>> {\n    const instances = await this.credentialStore.listInstances();\n    const latestTestResults = await this.credentialStore.getLatestTestResults(\n      instances.map((instance) => instance.instanceId),\n    );\n    return await Promise.all(\n      instances.map(async (instance) => await this.toDto(instance, latestTestResults.get(instance.instanceId))),\n    );\n  }\n\n  async getInstance(instanceId: CredentialInstanceId): Promise<CredentialInstanceDto | undefined> {\n    const instance = await this.credentialStore.getInstance(instanceId);\n    if (!instance) {\n      return undefined;\n    }\n    const latestTestResult = await this.credentialStore.getLatestTestResult(instanceId);\n    return await this.toDto(instance, latestTestResult);\n  }\n\n  async getInstanceWithSecrets(\n    instanceId: CredentialInstanceId,\n  ): Promise<CredentialInstanceWithSecretsDto | undefined> {\n    const instance = await this.credentialStore.getInstance(instanceId);\n    if (!instance) {\n      return undefined;\n    }\n    const latestTestResult = await this.credentialStore.getLatestTestResult(instanceId);\n    const base = await this.toDto(instance, latestTestResult);\n    try {\n      const material = await this.credentialMaterialResolver.resolveMaterial(instance);\n      const secretConfig = Object.fromEntries(Object.entries(material).map(([k, v]) => [k, String(v ?? \"\")])) as Record<\n        string,\n        string\n      >;\n      const envSecretRefs =\n        instance.secretRef.kind === \"env\" ? (instance.secretRef.envByField as Record<string, string>) : undefined;\n      return { ...base, secretConfig, envSecretRefs };\n    } catch {\n      return base;\n    }\n  }\n\n  async create(request: CreateCredentialInstanceRequest): Promise<CredentialInstanceDto> {\n    const credentialType = this.requireCredentialType(request.typeId);\n    const publicFields = credentialType.definition.publicFields ?? [];\n    const secretFields = credentialType.definition.secretFields ?? [];\n    this.validateRequestFields({\n      displayName: request.displayName,\n      publicFields,\n      publicConfig: request.publicConfig ?? {},\n      secretFields,\n      sourceKind: request.sourceKind,\n      secretConfig: request.secretConfig ?? {},\n      envSecretRefs: request.envSecretRefs ?? {},\n    });\n    const timestamp = new Date().toISOString();\n    const strippedPublic = this.stripEnvManagedFieldValues(publicFields, request.publicConfig ?? {});\n    const strippedSecretForRef = this.stripEnvManagedFieldValues(secretFields, request.secretConfig ?? {});\n    const instance: CredentialInstanceRecord = {\n      instanceId: randomUUID(),\n      typeId: request.typeId,\n      displayName: request.displayName.trim(),\n      sourceKind: request.sourceKind,\n      publicConfig: Object.freeze({ ...strippedPublic }),\n      secretRef: this.createSecretRef(request.sourceKind, strippedSecretForRef, request.envSecretRefs ?? {}),\n      tags: Object.freeze([...(request.tags ?? [])]),\n      setupStatus: credentialType.definition.auth?.kind === \"oauth2\" ? \"draft\" : \"ready\",\n      createdAt: timestamp,\n      updatedAt: timestamp,\n    };\n    await this.credentialStore.saveInstance({\n      instance,\n      secretMaterial: this.createSecretMaterial(instance, strippedSecretForRef, timestamp),\n    });\n    this.credentialSessionService.evictInstance(instance.instanceId);\n    return this.toDto(instance, undefined);\n  }\n\n  async update(\n    instanceId: CredentialInstanceId,\n    request: UpdateCredentialInstanceRequest,\n  ): Promise<CredentialInstanceDto> {\n    const existing = await this.requireInstance(instanceId);\n    const credentialType = this.requireCredentialType(existing.typeId);\n    const mergedPublicRaw = { ...(request.publicConfig ?? existing.publicConfig) };\n    const updatedAt = new Date().toISOString();\n    const nextSecretConfig = request.secretConfig;\n    const nextEnvSecretRefs = request.envSecretRefs;\n    const secretFields = credentialType.definition.secretFields ?? [];\n    this.validateRequestFields({\n      displayName: request.displayName ?? existing.displayName,\n      publicFields: credentialType.definition.publicFields ?? [],\n      publicConfig: mergedPublicRaw,\n      secretFields,\n      sourceKind: existing.sourceKind,\n      secretConfig: nextSecretConfig ?? {},\n      envSecretRefs: nextEnvSecretRefs ?? {},\n      allowSecretOmission: true,\n    });\n    const publicConfig = Object.freeze({\n      ...this.stripEnvManagedFieldValues(credentialType.definition.publicFields ?? [], mergedPublicRaw),\n    });\n    const mergedSecretForRef =\n      nextSecretConfig !== undefined ? this.stripEnvManagedFieldValues(secretFields, nextSecretConfig) : undefined;\n    const instance: CredentialInstanceRecord = {\n      ...existing,\n      displayName: request.displayName?.trim() || existing.displayName,\n      publicConfig,\n      tags: Object.freeze([...(request.tags ?? existing.tags)]),\n      setupStatus: request.setupStatus ?? existing.setupStatus,\n      secretRef:\n        nextSecretConfig || nextEnvSecretRefs\n          ? this.createSecretRef(existing.sourceKind, mergedSecretForRef ?? {}, nextEnvSecretRefs ?? {})\n          : existing.secretRef,\n      updatedAt,\n    };\n    await this.credentialStore.saveInstance({\n      instance,\n      secretMaterial:\n        nextSecretConfig !== undefined && mergedSecretForRef !== undefined\n          ? this.createSecretMaterial(instance, mergedSecretForRef, updatedAt)\n          : undefined,\n    });\n    this.credentialSessionService.evictInstance(instance.instanceId);\n    return this.toDto(instance, await this.credentialStore.getLatestTestResult(instance.instanceId));\n  }\n\n  async delete(instanceId: CredentialInstanceId): Promise<void> {\n    await this.credentialStore.deleteInstance(instanceId);\n    this.credentialSessionService.evictInstance(instanceId);\n  }\n\n  async disconnectOAuth2(instanceId: CredentialInstanceId): Promise<CredentialInstanceDto> {\n    const instance = await this.requireInstance(instanceId);\n    const credentialType = this.requireCredentialType(instance.typeId);\n    if (credentialType.definition.auth?.kind !== \"oauth2\") {\n      throw new ApplicationRequestError(400, `Credential instance ${instanceId} does not use OAuth2.`);\n    }\n    const updatedInstance: CredentialInstanceRecord = {\n      ...instance,\n      setupStatus: \"draft\",\n      updatedAt: new Date().toISOString(),\n    };\n    await this.credentialStore.saveInstance({\n      instance: updatedInstance,\n    });\n    await this.credentialStore.deleteOAuth2Material(instanceId);\n    this.credentialSessionService.evictInstance(instanceId);\n    return await this.toDto(updatedInstance, await this.credentialStore.getLatestTestResult(instanceId));\n  }\n\n  async requireInstance(instanceId: CredentialInstanceId): Promise<CredentialInstanceRecord> {\n    const instance = await this.credentialStore.getInstance(instanceId);\n    if (!instance) {\n      throw new ApplicationRequestError(404, `Unknown credential instance: ${instanceId}`);\n    }\n    return instance;\n  }\n\n  private createSecretRef(\n    sourceKind: CredentialMaterialSourceKind,\n    secretConfig: JsonRecord,\n    envSecretRefs: Readonly<Record<string, string>>,\n  ): CredentialSecretRef {\n    if (sourceKind === \"db\") {\n      return { kind: \"db\" };\n    }\n    if (sourceKind === \"env\") {\n      return {\n        kind: \"env\",\n        envByField: Object.freeze({ ...envSecretRefs }),\n      };\n    }\n    return {\n      kind: \"code\",\n      value: Object.freeze({ ...secretConfig }),\n    };\n  }\n\n  private createSecretMaterial(\n    instance: CredentialInstanceRecord,\n    secretConfig: JsonRecord,\n    updatedAt: string,\n  ): CredentialSecretMaterialRecord | undefined {\n    if (instance.sourceKind !== \"db\") {\n      return undefined;\n    }\n    const encrypted = this.credentialSecretCipher.encrypt(secretConfig);\n    return {\n      instanceId: instance.instanceId,\n      encryptedJson: encrypted.encryptedJson,\n      encryptionKeyId: encrypted.encryptionKeyId,\n      schemaVersion: encrypted.schemaVersion,\n      updatedAt,\n    };\n  }\n\n  private validateRequestFields(\n    args: Readonly<{\n      displayName: string;\n      publicFields: ReadonlyArray<CredentialFieldSchema>;\n      publicConfig: JsonRecord;\n      secretFields: ReadonlyArray<CredentialFieldSchema>;\n      sourceKind: CredentialMaterialSourceKind;\n      secretConfig: JsonRecord;\n      envSecretRefs: Readonly<Record<string, string>>;\n      allowSecretOmission?: boolean;\n    }>,\n  ): void {\n    if (!args.displayName || args.displayName.trim().length === 0) {\n      throw new ApplicationRequestError(400, \"Credential displayName is required.\");\n    }\n    this.assertRequiredFields(\"publicConfig\", args.publicFields, args.publicConfig);\n    if (args.sourceKind === \"db\") {\n      if (!args.allowSecretOmission || Object.keys(args.secretConfig).length > 0) {\n        this.assertRequiredFields(\"secretConfig\", args.secretFields, args.secretConfig);\n      }\n      return;\n    }\n    if (args.sourceKind === \"env\") {\n      if (!args.allowSecretOmission || Object.keys(args.envSecretRefs).length > 0) {\n        this.assertRequiredEnvFields(args.secretFields, args.envSecretRefs);\n      }\n      return;\n    }\n    if (!args.allowSecretOmission || Object.keys(args.secretConfig).length > 0) {\n      this.assertRequiredFields(\"secretConfig\", args.secretFields, args.secretConfig);\n    }\n  }\n\n  private stripEnvManagedFieldValues(fields: ReadonlyArray<CredentialFieldSchema>, value: JsonRecord): JsonRecord {\n    const out: Record<string, unknown> = { ...value };\n    for (const field of fields) {\n      if (this.credentialFieldEnvOverlayService.isFieldResolvedFromEnv(field)) {\n        delete out[field.key];\n      }\n    }\n    return Object.freeze(out);\n  }\n\n  private assertRequiredFields(\n    fieldName: string,\n    schema: ReadonlyArray<CredentialFieldSchema>,\n    value: JsonRecord,\n  ): void {\n    const missing = schema\n      .filter((field) => field.required === true)\n      .filter((field) => !this.credentialFieldEnvOverlayService.isFieldResolvedFromEnv(field))\n      .filter((field) => value[field.key] === undefined || value[field.key] === null || value[field.key] === \"\")\n      .map((field) => field.key);\n    if (missing.length > 0) {\n      throw new ApplicationRequestError(400, `Missing required ${fieldName} field(s): ${missing.join(\", \")}`);\n    }\n  }\n\n  private assertRequiredEnvFields(\n    schema: ReadonlyArray<CredentialFieldSchema>,\n    envSecretRefs: Readonly<Record<string, string>>,\n  ): void {\n    const missing = schema\n      .filter((field) => field.required === true)\n      .filter((field) => !this.credentialFieldEnvOverlayService.isFieldResolvedFromEnv(field))\n      .filter((field) => !envSecretRefs[field.key] || envSecretRefs[field.key]!.trim().length === 0)\n      .map((field) => field.key);\n    if (missing.length > 0) {\n      throw new ApplicationRequestError(400, `Missing required envSecretRefs field(s): ${missing.join(\", \")}`);\n    }\n  }\n\n  private requireCredentialType(typeId: CredentialTypeId): AnyCredentialType {\n    const credentialType = this.credentialTypeRegistry.getCredentialType(typeId);\n    if (!credentialType) {\n      throw new ApplicationRequestError(400, `Unknown credential type: ${typeId}`);\n    }\n    return credentialType;\n  }\n\n  async markOAuth2Connected(instanceId: CredentialInstanceId, connectedAt: string): Promise<void> {\n    const instance = await this.requireInstance(instanceId);\n    await this.credentialStore.saveInstance({\n      instance: {\n        ...instance,\n        setupStatus: \"ready\",\n        updatedAt: connectedAt,\n      },\n    });\n    this.credentialSessionService.evictInstance(instanceId);\n  }\n\n  private async toDto(\n    instance: CredentialInstanceRecord,\n    latestTestResult: CredentialTestRecord | undefined,\n  ): Promise<CredentialInstanceDto> {\n    const oauth2Connection = await this.toOAuth2ConnectionDto(instance);\n    return {\n      instanceId: instance.instanceId,\n      typeId: instance.typeId,\n      displayName: instance.displayName,\n      sourceKind: instance.sourceKind,\n      publicConfig: instance.publicConfig,\n      tags: instance.tags,\n      setupStatus: instance.setupStatus,\n      createdAt: instance.createdAt,\n      updatedAt: instance.updatedAt,\n      latestHealth: latestTestResult?.health,\n      oauth2Connection,\n    };\n  }\n\n  private async toOAuth2ConnectionDto(\n    instance: CredentialInstanceRecord,\n  ): Promise<CredentialOAuth2ConnectionDto | undefined> {\n    const credentialType = this.credentialTypeRegistry.getCredentialType(instance.typeId);\n    if (credentialType?.definition.auth?.kind !== \"oauth2\") {\n      return undefined;\n    }\n    const providerId =\n      \"providerId\" in credentialType.definition.auth ? credentialType.definition.auth.providerId : \"custom\";\n    const material = await this.credentialStore.getOAuth2Material(instance.instanceId);\n    if (!material) {\n      return {\n        status: \"disconnected\",\n        providerId,\n        scopes: [...credentialType.definition.auth.scopes],\n      };\n    }\n    return {\n      status: \"connected\",\n      providerId: material.providerId,\n      connectedEmail: material.connectedEmail,\n      connectedAt: material.connectedAt,\n      scopes: material.scopes,\n      updatedAt: material.updatedAt,\n    };\n  }\n}\n","import type {\n  CredentialBinding,\n  CredentialBindingKey,\n  CredentialInstanceId,\n  CredentialRequirement,\n  WorkflowDefinition,\n  WorkflowRepository,\n} from \"@codemation/core\";\n\nimport { CoreTokens, inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationRequestError } from \"../../application/ApplicationRequestError\";\n\nimport type {\n  WorkflowCredentialHealthDto,\n  WorkflowCredentialHealthSlotDto,\n} from \"../../application/contracts/CredentialContractsRegistry\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\n\nimport { WorkflowCredentialNodeResolver } from \"./WorkflowCredentialNodeResolver\";\nimport { CredentialInstanceService } from \"./CredentialInstanceService\";\nimport type { CredentialStore, MutableCredentialSessionService } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialBindingService {\n  constructor(\n    @inject(ApplicationTokens.CredentialStore)\n    private readonly credentialStore: CredentialStore,\n    @inject(CredentialInstanceService)\n    private readonly credentialInstanceService: CredentialInstanceService,\n    @inject(CoreTokens.WorkflowRepository)\n    private readonly workflowRepository: WorkflowRepository,\n    @inject(CoreTokens.CredentialSessionService)\n    private readonly credentialSessionService: MutableCredentialSessionService,\n    @inject(WorkflowCredentialNodeResolver)\n    private readonly workflowCredentialNodeResolver: WorkflowCredentialNodeResolver,\n  ) {}\n\n  async upsertBinding(\n    args: Readonly<{ workflowId: string; nodeId: string; slotKey: string; instanceId: CredentialInstanceId }>,\n  ): Promise<CredentialBinding> {\n    const workflow = this.requireWorkflow(args.workflowId);\n    const requirement = this.requireRequirement(workflow, args.nodeId, args.slotKey);\n    const instance = await this.credentialInstanceService.requireInstance(args.instanceId);\n    if (!requirement.acceptedTypes.includes(instance.typeId)) {\n      throw new ApplicationRequestError(\n        400,\n        `Credential instance ${instance.instanceId} (${instance.typeId}) is not compatible with slot ${args.slotKey}. Accepted types: ${requirement.acceptedTypes.join(\", \")}`,\n      );\n    }\n    const binding: CredentialBinding = {\n      key: {\n        workflowId: args.workflowId,\n        nodeId: args.nodeId,\n        slotKey: args.slotKey,\n      },\n      instanceId: args.instanceId,\n      updatedAt: new Date().toISOString(),\n    };\n    await this.credentialStore.upsertBinding(binding);\n    this.credentialSessionService.evictBinding(binding.key);\n    return binding;\n  }\n\n  async listWorkflowHealth(workflowId: string): Promise<WorkflowCredentialHealthDto> {\n    const workflow = this.requireWorkflow(workflowId);\n    const bindings = await this.credentialStore.listBindingsByWorkflowId(workflowId);\n    const bindingsByKey = new Map(bindings.map((binding) => [this.toBindingKeyString(binding.key), binding] as const));\n    const slots: WorkflowCredentialHealthSlotDto[] = [];\n    for (const slotRef of this.workflowCredentialNodeResolver.listSlots(workflow)) {\n      const requirement = slotRef.requirement;\n      const bindingKey = {\n        workflowId,\n        nodeId: slotRef.nodeId,\n        slotKey: requirement.slotKey,\n      } satisfies CredentialBindingKey;\n      const binding = bindingsByKey.get(this.toBindingKeyString(bindingKey));\n      if (!binding) {\n        slots.push({\n          workflowId,\n          nodeId: slotRef.nodeId,\n          nodeName: slotRef.nodeName,\n          requirement,\n          health: {\n            status: requirement.optional ? \"optional-unbound\" : \"unbound\",\n          },\n        });\n        continue;\n      }\n      const instance = await this.credentialInstanceService.requireInstance(binding.instanceId);\n      const latestTestResult = await this.credentialStore.getLatestTestResult(instance.instanceId);\n      slots.push({\n        workflowId,\n        nodeId: slotRef.nodeId,\n        nodeName: slotRef.nodeName,\n        requirement,\n        instance: {\n          instanceId: instance.instanceId,\n          typeId: instance.typeId,\n          displayName: instance.displayName,\n          setupStatus: instance.setupStatus,\n        },\n        health: {\n          status: latestTestResult?.health.status ?? \"unknown\",\n          message: latestTestResult?.health.message,\n          testedAt: latestTestResult?.health.testedAt,\n        },\n      });\n    }\n    return {\n      workflowId,\n      slots,\n    };\n  }\n\n  private requireWorkflow(workflowId: string): WorkflowDefinition {\n    const workflow = this.workflowRepository.get(decodeURIComponent(workflowId));\n    if (!workflow) {\n      throw new ApplicationRequestError(404, `Unknown workflowId: ${workflowId}`);\n    }\n    return workflow;\n  }\n\n  private requireRequirement(workflow: WorkflowDefinition, nodeId: string, slotKey: string): CredentialRequirement {\n    const resolved = this.workflowCredentialNodeResolver.findRequirement(workflow, nodeId, slotKey);\n    if (!resolved) {\n      if (!this.workflowCredentialNodeResolver.isCredentialNodeIdInWorkflow(workflow, nodeId)) {\n        throw new ApplicationRequestError(404, `Unknown workflow node: ${nodeId}`);\n      }\n      throw new ApplicationRequestError(400, `Node ${nodeId} does not declare credential slot ${slotKey}.`);\n    }\n    return resolved.requirement;\n  }\n\n  private toBindingKeyString(bindingKey: CredentialBindingKey): string {\n    return `${bindingKey.workflowId}:${bindingKey.nodeId}:${bindingKey.slotKey}`;\n  }\n}\n","import { inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\n\nimport { CredentialMaterialResolver } from \"./CredentialMaterialResolver\";\nimport { CredentialSecretCipher } from \"./CredentialSecretCipher\";\nimport type { CredentialInstanceRecord, CredentialStore, JsonRecord } from \"./CredentialServices\";\nimport { CredentialTypeRegistryImpl } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialRuntimeMaterialService {\n  constructor(\n    @inject(ApplicationTokens.CredentialStore)\n    private readonly credentialStore: CredentialStore,\n    @inject(CredentialMaterialResolver)\n    private readonly credentialMaterialResolver: CredentialMaterialResolver,\n    @inject(CredentialSecretCipher)\n    private readonly credentialSecretCipher: CredentialSecretCipher,\n    @inject(CredentialTypeRegistryImpl)\n    private readonly credentialTypeRegistry: CredentialTypeRegistryImpl,\n  ) {}\n\n  async compose(instance: CredentialInstanceRecord): Promise<JsonRecord> {\n    const baseMaterial = await this.credentialMaterialResolver.resolveMaterial(instance);\n    const auth = this.credentialTypeRegistry.getCredentialType(instance.typeId)?.definition.auth;\n    if (auth?.kind !== \"oauth2\") {\n      return baseMaterial;\n    }\n    const oauth2Material = await this.credentialStore.getOAuth2Material(instance.instanceId);\n    if (!oauth2Material) {\n      return baseMaterial;\n    }\n    const decryptedOauth2Material = this.credentialSecretCipher.decrypt(oauth2Material);\n    return Object.freeze({\n      ...baseMaterial,\n      ...decryptedOauth2Material,\n    });\n  }\n}\n","import type {\n  CredentialBindingKey,\n  CredentialInstanceId,\n  CredentialSessionService,\n  WorkflowRepository,\n} from \"@codemation/core\";\n\nimport { CoreTokens, CredentialUnboundError, inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationRequestError } from \"../../application/ApplicationRequestError\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\n\nimport { WorkflowCredentialNodeResolver } from \"./WorkflowCredentialNodeResolver\";\nimport { CredentialFieldEnvOverlayService } from \"./CredentialFieldEnvOverlayService\";\nimport { CredentialRuntimeMaterialService } from \"./CredentialRuntimeMaterialService\";\nimport type { CredentialStore } from \"./CredentialServices\";\nimport { CredentialTypeRegistryImpl } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialSessionServiceImpl implements CredentialSessionService {\n  private readonly cachedSessionsByInstanceId = new Map<CredentialInstanceId, Promise<unknown>>();\n  private readonly cachedInstanceIdsByBindingKey = new Map<string, CredentialInstanceId>();\n\n  constructor(\n    @inject(ApplicationTokens.CredentialStore)\n    private readonly credentialStore: CredentialStore,\n    @inject(CredentialRuntimeMaterialService)\n    private readonly credentialRuntimeMaterialService: CredentialRuntimeMaterialService,\n    @inject(CredentialFieldEnvOverlayService)\n    private readonly credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService,\n    @inject(CredentialTypeRegistryImpl)\n    private readonly credentialTypeRegistry: CredentialTypeRegistryImpl,\n    @inject(CoreTokens.WorkflowRepository)\n    private readonly workflowRepository: WorkflowRepository,\n    @inject(WorkflowCredentialNodeResolver)\n    private readonly workflowCredentialNodeResolver: WorkflowCredentialNodeResolver,\n  ) {}\n\n  async getSession<TSession = unknown>(\n    args: Readonly<{ workflowId: string; nodeId: string; slotKey: string }>,\n  ): Promise<TSession> {\n    const workflow = this.workflowRepository.get(decodeURIComponent(args.workflowId));\n    const displayLabel = workflow\n      ? this.workflowCredentialNodeResolver.describeCredentialNodeDisplay(workflow, args.nodeId)\n      : undefined;\n    const requirement = workflow\n      ? this.workflowCredentialNodeResolver.findRequirement(workflow, args.nodeId, args.slotKey)?.requirement\n      : undefined;\n    const bindingKey: CredentialBindingKey = {\n      workflowId: args.workflowId,\n      nodeId: args.nodeId,\n      slotKey: args.slotKey,\n    };\n    const binding = await this.credentialStore.getBinding(bindingKey);\n    if (!binding) {\n      const unbound = new CredentialUnboundError(bindingKey, requirement?.acceptedTypes ?? []);\n      if (displayLabel) {\n        throw new Error(`${displayLabel}: ${unbound.message}`, { cause: unbound });\n      }\n      throw unbound;\n    }\n    const bindingCacheKey = this.toBindingKeyString(bindingKey);\n    this.cachedInstanceIdsByBindingKey.set(bindingCacheKey, binding.instanceId);\n    const cachedSession = this.cachedSessionsByInstanceId.get(binding.instanceId);\n    if (cachedSession) {\n      return (await cachedSession) as TSession;\n    }\n    const nextSessionPromise = this.createSession(binding.instanceId, displayLabel).catch((error) => {\n      this.cachedSessionsByInstanceId.delete(binding.instanceId);\n      throw error;\n    });\n    this.cachedSessionsByInstanceId.set(binding.instanceId, nextSessionPromise);\n    return (await nextSessionPromise) as TSession;\n  }\n\n  evictInstance(instanceId: CredentialInstanceId): void {\n    this.cachedSessionsByInstanceId.delete(instanceId);\n  }\n\n  evictBinding(bindingKey: CredentialBindingKey): void {\n    const cacheKey = this.toBindingKeyString(bindingKey);\n    const instanceId = this.cachedInstanceIdsByBindingKey.get(cacheKey);\n    if (instanceId) {\n      this.cachedSessionsByInstanceId.delete(instanceId);\n    }\n    this.cachedInstanceIdsByBindingKey.delete(cacheKey);\n  }\n\n  private async createSession(instanceId: CredentialInstanceId, displayLabel?: string): Promise<unknown> {\n    const instance = await this.credentialStore.getInstance(instanceId);\n    if (!instance) {\n      throw new ApplicationRequestError(404, `Unknown credential instance: ${instanceId}`);\n    }\n    const credentialType = this.credentialTypeRegistry.getCredentialType(instance.typeId);\n    if (!credentialType) {\n      const prefix = displayLabel ? `${displayLabel}: ` : \"\";\n      throw new ApplicationRequestError(\n        400,\n        `${prefix}Credential type \"${instance.typeId}\" is not registered in this runtime (binding points at an unknown type).`,\n      );\n    }\n    const material = await this.credentialRuntimeMaterialService.compose(instance);\n    const { resolvedPublicConfig, resolvedMaterial } = this.credentialFieldEnvOverlayService.apply({\n      definition: credentialType.definition,\n      publicConfig: instance.publicConfig,\n      material,\n    });\n    return await credentialType.createSession({\n      instance,\n      material: resolvedMaterial,\n      publicConfig: resolvedPublicConfig,\n    });\n  }\n\n  private toBindingKeyString(bindingKey: CredentialBindingKey): string {\n    return `${bindingKey.workflowId}:${bindingKey.nodeId}:${bindingKey.slotKey}`;\n  }\n}\n","import { randomUUID } from \"node:crypto\";\n\nimport type { CredentialHealth, CredentialInstanceId, CredentialTypeId } from \"@codemation/core\";\n\nimport { CoreTokens, inject, injectable } from \"@codemation/core\";\n\nimport { ApplicationRequestError } from \"../../application/ApplicationRequestError\";\n\nimport { ApplicationTokens } from \"../../applicationTokens\";\n\nimport { CredentialFieldEnvOverlayService } from \"./CredentialFieldEnvOverlayService\";\nimport { CredentialInstanceService } from \"./CredentialInstanceService\";\nimport { CredentialRuntimeMaterialService } from \"./CredentialRuntimeMaterialService\";\nimport type { CredentialStore, AnyCredentialType, MutableCredentialSessionService } from \"./CredentialServices\";\nimport { CredentialTypeRegistryImpl } from \"./CredentialServices\";\n\n@injectable()\nexport class CredentialTestService {\n  constructor(\n    @inject(CredentialInstanceService)\n    private readonly credentialInstanceService: CredentialInstanceService,\n    @inject(CredentialRuntimeMaterialService)\n    private readonly credentialRuntimeMaterialService: CredentialRuntimeMaterialService,\n    @inject(CredentialFieldEnvOverlayService)\n    private readonly credentialFieldEnvOverlayService: CredentialFieldEnvOverlayService,\n    @inject(CredentialTypeRegistryImpl)\n    private readonly credentialTypeRegistry: CredentialTypeRegistryImpl,\n    @inject(ApplicationTokens.CredentialStore)\n    private readonly credentialStore: CredentialStore,\n    @inject(CoreTokens.CredentialSessionService)\n    private readonly credentialSessionService: MutableCredentialSessionService,\n  ) {}\n\n  async test(instanceId: CredentialInstanceId): Promise<CredentialHealth> {\n    const instance = await this.credentialInstanceService.requireInstance(instanceId);\n    const credentialType = this.requireCredentialType(instance.typeId);\n    const material = await this.credentialRuntimeMaterialService.compose(instance);\n    const { resolvedPublicConfig, resolvedMaterial } = this.credentialFieldEnvOverlayService.apply({\n      definition: credentialType.definition,\n      publicConfig: instance.publicConfig,\n      material,\n    });\n    const health = await credentialType.test({\n      instance,\n      material: resolvedMaterial,\n      publicConfig: resolvedPublicConfig,\n    });\n    const testedAt = health.testedAt ?? new Date().toISOString();\n    await this.credentialStore.saveTestResult({\n      testId: randomUUID(),\n      instanceId,\n      health: {\n        ...health,\n        testedAt,\n      },\n      testedAt,\n      expiresAt: health.expiresAt,\n    });\n    this.credentialSessionService.evictInstance(instanceId);\n    return {\n      ...health,\n      testedAt,\n    };\n  }\n\n  private requireCredentialType(typeId: CredentialTypeId): AnyCredentialType {\n    const credentialType = this.credentialTypeRegistry.getCredentialType(typeId);\n    if (!credentialType) {\n      throw new ApplicationRequestError(400, `Unknown credential type: ${typeId}`);\n    }\n    return credentialType;\n  }\n}\n"],"mappings":";;;;;;;;;;AAQA,IAAa,qCAAb,MAAgD;CAC9C,YAAY,AAAiBA,WAAoC;EAApC;;CAE7B,MAAM,KACJ,MAC2B;EAC3B,MAAM,4BAAW,IAAI,MAAM,EAAC,aAAa;EACzC,MAAM,SAAS,OAAO,KAAK,SAAS,UAAU,GAAG,CAAC,MAAM;AACxD,MAAI,OAAO,WAAW,EACpB,QAAO;GACL,QAAQ;GACR,SAAS;GACT;GACD;EAGH,MAAM,YAAY,KAAK,qBAAqB,KAAK,aAAa,QAAQ;AAEtE,MAAI;GACF,MAAM,WAAW,MAAM,KAAK,UAAU,WAAW;IAC/C,QAAQ;IACR,SAAS,EACP,eAAe,UAAU,UAC1B;IACD,QAAQ,YAAY,QAAQ,KAAO;IACpC,CAAC;AAEF,OAAI,SAAS,GACX,QAAO;IACL,QAAQ;IACR,SAAS;IACT;IACD;AAIH,UAAO;IACL,QAAQ;IACR,SAHc,MAAM,KAAK,kBAAkB,SAAS;IAIpD;IACD;WACM,OAAO;AACd,UAAO;IACL,QAAQ;IACR,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IAC/D;IACD;;;CAIL,AAAQ,qBAAqB,YAA6B;EACxD,MAAM,cAAc;EACpB,MAAM,MAAM,OAAO,eAAe,WAAW,WAAW,MAAM,GAAG;EACjE,MAAM,OAAO,QAAQ,KAAK,cAAc,IAAI,QAAQ,QAAQ,GAAG;AAC/D,MAAI,KAAK,SAAS,UAAU,CAC1B,QAAO;AAET,MAAI,KAAK,SAAS,MAAM,CACtB,QAAO,GAAG,KAAK;AAEjB,SAAO,GAAG,KAAK;;CAGjB,MAAc,kBAAkB,UAAqC;EACnE,MAAM,SAAS,QAAQ,SAAS;AAChC,MAAI;GACF,MAAM,OAAO,MAAM,SAAS,MAAM;AAClC,OAAI,KAAK,MAAM,KAAK,GAClB,QAAO;GAGT,MAAM,UADS,KAAK,MAAM,KAAK,CACR,OAAO;AAC9B,OAAI,OAAO,YAAY,YAAY,QAAQ,MAAM,KAAK,GACpD,QAAO,GAAG,OAAO,IAAI,QAAQ,MAAM;AAErC,UAAO,GAAG,OAAO,IAAI,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK;UAC9D;AACN,UAAO;;;;;;;;;;;;ACvEb,IAAa,oCAAb,MAA+C;CAC7C,YAAY,AAAiBC,cAAkD;EAAlD;;CAE7B,uBAA4G;AAC1G,SAAO;GACL,YAAY;IACV,QAAQ;IACR,aAAa;IACb,aAAa;IACb,cAAc,CACZ;KACE,KAAK;KACL,OAAO;KACP,MAAM;KACN,aAAa;KACb,UAAU;KACX,CACF;IACD,cAAc,CAAC;KAAE,KAAK;KAAU,OAAO;KAAW,MAAM;KAAY,UAAU;KAAM,CAAC;IACrF,sBAAsB;KAAC;KAAM;KAAO;KAAO;IAC5C;GACD,eAAe,OAAO,SAAS;IAC7B,MAAM,aAAa,KAAK,aAAa;IACrC,MAAM,UAAU,OAAO,eAAe,YAAY,WAAW,MAAM,KAAK,KAAK,WAAW,MAAM,GAAG;AACjG,WAAO;KACL,QAAQ,OAAO,KAAK,SAAS,UAAU,GAAG;KAC1C;KACD;;GAEH,MAAM,OAAO,SAAS,KAAK,aAAa,KAAK,KAAK;GACnD;;;;;;ACrCE,uCAAMC,6BAA6D;CACxE,AAAiB,sCAAsB,IAAI,KAA0C;CAErF,SAAS,MAA+C;AACtD,MAAI,KAAK,oBAAoB,IAAI,KAAK,WAAW,OAAO,CACtD,OAAM,IAAI,MAAM,uCAAuC,KAAK,WAAW,SAAS;AAElF,OAAK,oBAAoB,IAAI,KAAK,WAAW,QAAQ,KAAK;;CAG5D,YAAqD;AACnD,SAAO,CAAC,GAAG,KAAK,oBAAoB,QAAQ,CAAC,CAAC,KAAK,UAAU,MAAM,WAAW;;CAGhF,QAAQ,QAAgE;AACtE,SAAO,KAAK,oBAAoB,IAAI,OAAO,EAAE;;CAG/C,kBAAkB,QAAyD;AACzE,SAAO,KAAK,oBAAoB,IAAI,OAAO;;;yCApB9C,YAAY;;;;ACNb,IAAa,0BAAb,cAA6C,MAAM;CACjD,AAAS;CAET,AAAS;CAET,YAAY,QAAgB,SAAiB,QAAgC;AAC3E,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,SAAS;AACd,OAAK,UAAU,UAAU,OAAO,SAAS,IAAI;GAAE,OAAO;GAAS;GAAQ,GAAG,EAAE,OAAO,SAAS;;;;;;ACgBhG,MAAa,oBAAoB;CAC/B,sBAAsB,OAAO,IAAI,8CAA8C;CAG/E,4BAA4B,OAAO,IACjC,oDACD;CACD,WAAW,OAAO,IAAI,mCAAmC;CACzD,eAAe,OAAO,IAAI,uCAAuC;CACjE,mBAAmB,OAAO,IAAI,2CAA2C;CACzE,UAAU,OAAO,IAAI,kCAAkC;CACvD,YAAY,OAAO,IAAI,oCAAoC;CAC3D,gBAAgB,OAAO,IAAI,wCAAwC;CACnE,cAAc,OAAO,IAAI,sCAAsC;CAC/D,gBAAgB,OAAO,IAAI,wCAAwC;CAGnE,oBAAoB,OAAO,IAAI,4CAA4C;CAG3E,uBAAuB,OAAO,IAAI,+CAA+C;CACjF,4BAA4B,OAAO,IACjC,oDACD;CACD,wBAAwB,OAAO,IAC7B,gDACD;CACD,8BAA8B,OAAO,IACnC,sDACD;CACD,8BAA8B,OAAO,IACnC,sDACD;CACD,mCAAmC,OAAO,IACxC,2DACD;CACD,uBAAuB,OAAO,IAAI,+CAA+C;CACjF,eAAe,OAAO,IAAI,uCAAuC;CAIjE,8BAA8B,OAAO,IAAI,sDAAsD;CAC/F,iBAAiB,OAAO,IAAI,yCAAyC;CACrE,cAAc,OAAO,IAAI,sCAAsC;CAC/D,iBAAiB,OAAO,IAAI,yCAAyC;CACrE,OAAO,OAAO,IAAI,+BAA+B;CAClD;;;;ACnDM,2CAAMC,iCAA+B;;;;CAI1C,8BAA8B,UAA8B,QAAwB;EAClF,MAAM,SAAS,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO;AAC1D,MAAI,OACF,QAAO,OAAO,QAAQ,OAAO,OAAO,QAAQ,OAAO;AAErD,MAAI,wBAAwB,gCAAgC,OAAO,EAAE;GACnE,MAAM,WAAW,KAAK,4CAA4C,OAAO;AAGzE,UAAO,IAFQ,WAAW,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,SAAS,GAAG,SAC/C,QAAQ,YAAY,QAC1B;;AAEvB,MAAI,wBAAwB,uBAAuB,OAAO,EAAE;GAC1D,MAAM,SAAS,KAAK,0BAA0B,OAAO;AACrD,OAAI,CAAC,OACH,QAAO;GAET,MAAM,SAAS,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO,aAAa;GACvE,MAAM,aAAa,QAAQ,QAAQ,OAAO;GAC1C,MAAM,aACJ,UAAU,qBAAqB,kBAAkB,OAAO,OAAO,GAC3D,OAAO,OAAO,OAAO,MAClB,SAAS,wBAAwB,kBAAkB,KAAK,KAAK,KAAK,OAAO,mBAC3E,GACD;AAEN,UAAO,GAAG,WAAW,KADH,YAAY,cAAc,SAAS,YAAY,QAAQ,OAAO;;AAGlF,SAAO;;CAGT,6BAA6B,UAA8B,QAAyB;AAClF,MAAI,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO,CAC7C,QAAO;AAET,MAAI,wBAAwB,gCAAgC,OAAO,EAAE;GACnE,MAAM,SAAS,KAAK,4CAA4C,OAAO;AACvE,OAAI,UAAU,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO,CACvD,QAAO;;AAGX,MAAI,wBAAwB,uBAAuB,OAAO,EAAE;GAC1D,MAAM,SAAS,KAAK,0BAA0B,OAAO;AACrD,OAAI,UAAU,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,OAAO,aAAa,CACpE,QAAO;;AAGX,SAAO;;CAGT,gBACE,UACA,QACA,SACgF;EAChF,MAAM,SAAS,KAAK,sBAAsB,UAAU,QAAQ,QAAQ;AACpE,MAAI,OACF,QAAO;AAET,MAAI,wBAAwB,gCAAgC,OAAO,EAAE;GACnE,MAAM,SAAS,KAAK,4CAA4C,OAAO;AACvE,OAAI,QAAQ;IACV,MAAM,WAAW,KAAK,6BAA6B,UAAU,QAAQ,QAAQ;AAC7E,QAAI,SACF,QAAO;;;AAIb,MAAI,wBAAwB,uBAAuB,OAAO,EAAE;GAC1D,MAAM,SAAS,KAAK,0BAA0B,OAAO;AACrD,OAAI,QAAQ;IACV,MAAM,WAAW,KAAK,oBAAoB,UAAU,OAAO,cAAc,OAAO,oBAAoB,QAAQ;AAC5G,QAAI,SACF,QAAO;;;;CAOf,UAAU,UAAwE;EAChF,MAAMC,QAAqC,EAAE;EAC7C,MAAM,aAAa,wCAAwC,OAAO,SAAS;EAC3E,MAAM,yBAAyB,SAAS,aAAa,UAAU,KAAK;AAEpE,OAAK,MAAM,QAAQ,SAAS,OAAO;AACjC,OAAI,WAAW,wBAAwB,KAAK,GAAG,EAAE;AAC/C,SAAK,MAAM,eAAe,KAAK,OAAO,6BAA6B,IAAI,EAAE,CACvE,OAAM,KAAK;KACT,YAAY,SAAS;KACrB,QAAQ,KAAK;KACb,UAAU,KAAK,QAAQ,KAAK,OAAO,QAAQ,KAAK;KAChD;KACD,CAAC;AAEJ;;AAGF,OAAI,qBAAqB,kBAAkB,KAAK,OAAO,EAAE;AACvD,QAAI,CAAC,uBAAuB;KAC1B,MAAM,WAAW,wBAAwB,8BAA8B,KAAK,GAAG;KAC/E,MAAM,UAAU,KAAK,OAAO,UAAU,cAAc,SAAS,KAAK,OAAO,UAAU;AACnF,UAAK,MAAM,eAAe,KAAK,OAAO,UAAU,6BAA6B,IAAI,EAAE,CACjF,OAAM,KAAK;MACT,YAAY,SAAS;MACrB,QAAQ;MACR,UAAU;MACV;MACD,CAAC;AAEJ,UAAK,MAAM,cAAc,KAAK,OAAO,SAAS,EAAE,EAAE;MAChD,MAAM,aAAa,wBAAwB,qBAAqB,KAAK,IAAI,WAAW,KAAK;MACzF,MAAM,YAAY,WAAW,cAAc,SAAS,WAAW;AAC/D,WAAK,MAAM,eAAe,WAAW,6BAA6B,IAAI,EAAE,CACtE,OAAM,KAAK;OACT,YAAY,SAAS;OACrB,QAAQ;OACR,UAAU;OACV;OACD,CAAC;;;AAIR;;AAGF,QAAK,MAAM,eAAe,KAAK,OAAO,6BAA6B,IAAI,EAAE,CACvE,OAAM,KAAK;IACT,YAAY,SAAS;IACrB,QAAQ,KAAK;IACb,UAAU,KAAK,QAAQ,KAAK,OAAO,QAAQ,KAAK;IAChD;IACD,CAAC;;AAGN,SAAO;;CAGT,AAAQ,sBACN,UACA,QACA,SACgF;EAChF,MAAM,OAAO,SAAS,MAAM,MAAM,UAAU,MAAM,OAAO,OAAO;AAChE,MAAI,CAAC,QAAQ,qBAAqB,kBAAkB,KAAK,OAAO,CAC9D;EAEF,MAAM,cAAc,KAAK,OAAO,6BAA6B,EAAE,MAAM,UAAU,MAAM,YAAY,QAAQ;AACzG,MAAI,CAAC,YACH;AAEF,SAAO;GAAE,UAAU,KAAK,QAAQ,KAAK,OAAO,QAAQ,KAAK;GAAI;GAAa;;CAG5E,AAAQ,6BACN,UACA,cACA,SACgF;EAChF,MAAM,SAAS,SAAS,MAAM,MAAM,UAAU,MAAM,OAAO,aAAa;AACxE,MAAI,CAAC,UAAU,CAAC,qBAAqB,kBAAkB,OAAO,OAAO,CACnE;EAEF,MAAM,cAAc,OAAO,OAAO,UAC/B,6BAA6B,EAC5B,MAAM,UAAU,MAAM,YAAY,QAAQ;AAC9C,MAAI,CAAC,YACH;AAIF,SAAO;GAAE,UADP,OAAO,OAAO,UAAU,cAAc,SAAS,OAAO,OAAO,UAAU,QAAQ,OAAO,QAAQ,OAAO;GACpF;GAAa;;CAGlC,AAAQ,oBACN,UACA,cACA,oBACA,SACgF;EAChF,MAAM,SAAS,SAAS,MAAM,MAAM,UAAU,MAAM,OAAO,aAAa;AACxE,MAAI,CAAC,UAAU,CAAC,qBAAqB,kBAAkB,OAAO,OAAO,CACnE;EAEF,MAAM,aAAa,OAAO,OAAO,OAAO,MACrC,SAAS,wBAAwB,kBAAkB,KAAK,KAAK,KAAK,mBACpE;AACD,MAAI,CAAC,WACH;EAEF,MAAM,cAAc,WAAW,6BAA6B,EAAE,MAAM,UAAU,MAAM,YAAY,QAAQ;AACxG,MAAI,CAAC,YACH;AAGF,SAAO;GAAE,UADQ,WAAW,cAAc,SAAS,WAAW,QAAQ,OAAO,QAAQ,OAAO;GACzE;GAAa;;CAGlC,AAAQ,4CAA4C,QAAoC;AACtF,MAAI,CAAC,wBAAwB,gCAAgC,OAAO,CAClE;EAEF,MAAM,SAAS,GAAG,wBAAwB,kBAAkB;AAC5D,SAAO,OAAO,MAAM,GAAG,CAAC,OAAO,OAAO;;CAGxC,AAAQ,0BAA0B,QAAkF;AAClH,MAAI,CAAC,wBAAwB,uBAAuB,OAAO,CACzD;EAEF,MAAM,SAAS,GAAG,wBAAwB,kBAAkB,MAAM,wBAAwB;EAC1F,MAAM,MAAM,OAAO,QAAQ,OAAO;AAClC,MAAI,MAAM,EACR;EAEF,MAAM,eAAe,OAAO,MAAM,GAAG,IAAI;EACzC,MAAM,qBAAqB,OAAO,MAAM,MAAM,OAAO,OAAO;AAC5D,MAAI,CAAC,gBAAgB,CAAC,mBACpB;AAEF,SAAO;GAAE;GAAc;GAAoB;;;6CAhO9C,YAAY;;;;ACVN,6CAAMC,mCAAiC;CAC5C,YACE,AACiBC,WACjB;EADiB;;;CAInB,uBAAuB,OAAuC;EAC5D,MAAM,OAAO,MAAM,YAAY,MAAM;AACrC,MAAI,CAAC,KACH,QAAO;EAET,MAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,SAAO,OAAO,MAAM,YAAY,EAAE,SAAS;;CAG7C,MACE,MAK8E;EAC9E,MAAMC,MAA+B,EAAE,GAAG,KAAK,cAAc;EAC7D,MAAMC,MAA+B,EAAE,GAAG,KAAK,UAAU;AACzD,OAAK,MAAM,SAAS,KAAK,WAAW,gBAAgB,EAAE,EAAE;GACtD,MAAM,OAAO,MAAM,YAAY,MAAM;AACrC,OAAI,CAAC,KACH;GAEF,MAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,OAAI,OAAO,MAAM,YAAY,EAAE,SAAS,EACtC,KAAI,MAAM,OAAO;;AAGrB,OAAK,MAAM,SAAS,KAAK,WAAW,gBAAgB,EAAE,EAAE;GACtD,MAAM,OAAO,MAAM,YAAY,MAAM;AACrC,OAAI,CAAC,KACH;GAEF,MAAM,IAAI,KAAK,UAAU,IAAI;AAC7B,OAAI,OAAO,MAAM,YAAY,EAAE,SAAS,EACtC,KAAI,MAAM,OAAO;;AAGrB,SAAO,OAAO,OAAO;GACnB,sBAAsB,OAAO,OAAO,IAAI;GACxC,kBAAkB,OAAO,OAAO,IAAI;GACrC,CAAC;;;;CAjDL,YAAY;oBAGR,OAAO,kBAAkB,UAAU;;;;;;;ACDjC,mCAAMC,yBAAuB;;;;CAClC,OAAwB,YAAY;CACpC,OAAwB,gBAAgB;CACxC,OAAwB,WAAW;CAEnC,YACE,AACiBC,WACjB;EADiB;;CAGnB,QAAQ,OAIL;EACD,MAAM,KAAK,oCAAmC,SAAS;EACvD,MAAM,SAAS,uCAAsC,WAAW,KAAK,oBAAoB,EAAE,GAAG;EAC9F,MAAM,YAAY,OAAO,KAAK,KAAK,UAAU,MAAM,EAAE,OAAO;EAC5D,MAAM,YAAY,OAAO,OAAO,CAAC,OAAO,OAAO,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC;EAC3E,MAAM,UAAU,OAAO,YAAY;AACnC,SAAO;GACL,eAAe,OAAO,OAAO;IAAC;IAAI;IAAS;IAAU,CAAC,CAAC,SAAS,SAAS;GACzE,iBAAiB,KAAK,cAAc;GACpC,uCAAsC;GACvC;;CAGH,QACE,QAKY;EACZ,MAAM,SAAS,OAAO,KAAK,OAAO,eAAe,SAAS;EAC1D,MAAM,KAAK,OAAO,SAAS,2BAA0B,SAAS;EAC9D,MAAM,UAAU,OAAO,iCAAgC,kCAAiC,WAAW,GAAG;EACtG,MAAM,YAAY,OAAO,iCAAgC,WAAW,GAAG;EACvE,MAAM,WAAW,yCAAwC,WAAW,KAAK,oBAAoB,EAAE,GAAG;AAClG,WAAS,WAAW,QAAQ;EAC5B,MAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO;AAChG,SAAO,KAAK,MAAM,UAAU;;CAG9B,AAAQ,qBAA6B;EACnC,MAAM,WAAW,KAAK,UAAU,IAAI;AACpC,MAAI,CAAC,YAAY,SAAS,MAAM,CAAC,WAAW,EAC1C,OAAM,IAAI,MAAM,yFAAyF;AAE3G,SAAO,WAAW,SAAS,CAAC,OAAO,SAAS,CAAC,QAAQ;;CAGvD,AAAQ,eAAuB;EAC7B,MAAM,WAAW,KAAK,UAAU,IAAI;AACpC,SAAO,WAAW,SAAS,CACxB,OAAO,YAAY,GAAG,CACtB,OAAO,MAAM,CACb,MAAM,GAAG,GAAG;;;;CA1DlB,YAAY;oBAOR,OAAO,kBAAkB,UAAU;;;;;;;ACPjC,uCAAMC,6BAA2B;CACtC,YACE,AACiBC,iBACjB,AACiBC,wBACjB,AACiBC,WACjB;EALiB;EAEA;EAEA;;CAGnB,MAAM,gBAAgB,UAAyD;AAC7E,MAAI,SAAS,UAAU,SAAS,MAAM;GACpC,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,kBAAkB,SAAS,WAAW;AACxF,OAAI,CAAC,eACH,OAAM,IAAI,MAAM,cAAc,SAAS,WAAW,wCAAwC;AAE5F,UAAO,KAAK,uBAAuB,QAAQ,eAAe;;AAE5D,MAAI,SAAS,UAAU,SAAS,MAC9B,QAAO,KAAK,mBAAmB,SAAS;AAE1C,SAAO,SAAS,UAAU;;CAG5B,AAAQ,mBAAmB,UAAgD;AACzE,MAAI,SAAS,UAAU,SAAS,MAC9B,OAAM,IAAI,MAAM,cAAc,SAAS,WAAW,6BAA6B;EAEjF,MAAMC,WAAoC,EAAE;EAC5C,MAAMC,8BAAwC,EAAE;AAChD,OAAK,MAAM,CAAC,UAAU,eAAe,OAAO,QAAQ,SAAS,UAAU,WAAW,EAAE;GAClF,MAAM,QAAQ,KAAK,UAAU,IAAI;AACjC,OAAI,UAAU,UAAa,MAAM,WAAW,GAAG;AAC7C,gCAA4B,KAAK,WAAW;AAC5C;;AAEF,YAAS,YAAY;;AAEvB,MAAI,4BAA4B,SAAS,EACvC,OAAM,IAAI,MACR,cAAc,SAAS,WAAW,oDAAoD,4BAA4B,KAAK,KAAK,CAAC,GAC9H;AAEH,SAAO;;;;CA5CV,YAAY;oBAGR,OAAO,kBAAkB,gBAAgB;oBAEzC,OAAO,uBAAuB;oBAE9B,OAAO,kBAAkB,UAAU;;;;;;;;;;;ACwBjC,sCAAMC,4BAA0B;CACrC,YACE,AACiBC,iBACjB,AACiBC,wBACjB,AACiBC,wBACjB,AACiBC,kCACjB,AACiBC,4BACjB,AACiBC,0BACjB;EAXiB;EAEA;EAEA;EAEA;EAEA;EAEA;;CAGnB,MAAM,gBAA+D;EACnE,MAAM,YAAY,MAAM,KAAK,gBAAgB,eAAe;EAC5D,MAAM,oBAAoB,MAAM,KAAK,gBAAgB,qBACnD,UAAU,KAAK,aAAa,SAAS,WAAW,CACjD;AACD,SAAO,MAAM,QAAQ,IACnB,UAAU,IAAI,OAAO,aAAa,MAAM,KAAK,MAAM,UAAU,kBAAkB,IAAI,SAAS,WAAW,CAAC,CAAC,CAC1G;;CAGH,MAAM,YAAY,YAA8E;EAC9F,MAAM,WAAW,MAAM,KAAK,gBAAgB,YAAY,WAAW;AACnE,MAAI,CAAC,SACH;EAEF,MAAM,mBAAmB,MAAM,KAAK,gBAAgB,oBAAoB,WAAW;AACnF,SAAO,MAAM,KAAK,MAAM,UAAU,iBAAiB;;CAGrD,MAAM,uBACJ,YACuD;EACvD,MAAM,WAAW,MAAM,KAAK,gBAAgB,YAAY,WAAW;AACnE,MAAI,CAAC,SACH;EAEF,MAAM,mBAAmB,MAAM,KAAK,gBAAgB,oBAAoB,WAAW;EACnF,MAAM,OAAO,MAAM,KAAK,MAAM,UAAU,iBAAiB;AACzD,MAAI;GACF,MAAM,WAAW,MAAM,KAAK,2BAA2B,gBAAgB,SAAS;GAChF,MAAM,eAAe,OAAO,YAAY,OAAO,QAAQ,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC;GAIvG,MAAM,gBACJ,SAAS,UAAU,SAAS,QAAS,SAAS,UAAU,aAAwC;AAClG,UAAO;IAAE,GAAG;IAAM;IAAc;IAAe;UACzC;AACN,UAAO;;;CAIX,MAAM,OAAO,SAA0E;EACrF,MAAM,iBAAiB,KAAK,sBAAsB,QAAQ,OAAO;EACjE,MAAM,eAAe,eAAe,WAAW,gBAAgB,EAAE;EACjE,MAAM,eAAe,eAAe,WAAW,gBAAgB,EAAE;AACjE,OAAK,sBAAsB;GACzB,aAAa,QAAQ;GACrB;GACA,cAAc,QAAQ,gBAAgB,EAAE;GACxC;GACA,YAAY,QAAQ;GACpB,cAAc,QAAQ,gBAAgB,EAAE;GACxC,eAAe,QAAQ,iBAAiB,EAAE;GAC3C,CAAC;EACF,MAAM,6BAAY,IAAI,MAAM,EAAC,aAAa;EAC1C,MAAM,iBAAiB,KAAK,2BAA2B,cAAc,QAAQ,gBAAgB,EAAE,CAAC;EAChG,MAAM,uBAAuB,KAAK,2BAA2B,cAAc,QAAQ,gBAAgB,EAAE,CAAC;EACtG,MAAMC,WAAqC;GACzC,YAAY,YAAY;GACxB,QAAQ,QAAQ;GAChB,aAAa,QAAQ,YAAY,MAAM;GACvC,YAAY,QAAQ;GACpB,cAAc,OAAO,OAAO,EAAE,GAAG,gBAAgB,CAAC;GAClD,WAAW,KAAK,gBAAgB,QAAQ,YAAY,sBAAsB,QAAQ,iBAAiB,EAAE,CAAC;GACtG,MAAM,OAAO,OAAO,CAAC,GAAI,QAAQ,QAAQ,EAAE,CAAE,CAAC;GAC9C,aAAa,eAAe,WAAW,MAAM,SAAS,WAAW,UAAU;GAC3E,WAAW;GACX,WAAW;GACZ;AACD,QAAM,KAAK,gBAAgB,aAAa;GACtC;GACA,gBAAgB,KAAK,qBAAqB,UAAU,sBAAsB,UAAU;GACrF,CAAC;AACF,OAAK,yBAAyB,cAAc,SAAS,WAAW;AAChE,SAAO,KAAK,MAAM,UAAU,OAAU;;CAGxC,MAAM,OACJ,YACA,SACgC;EAChC,MAAM,WAAW,MAAM,KAAK,gBAAgB,WAAW;EACvD,MAAM,iBAAiB,KAAK,sBAAsB,SAAS,OAAO;EAClE,MAAM,kBAAkB,EAAE,GAAI,QAAQ,gBAAgB,SAAS,cAAe;EAC9E,MAAM,6BAAY,IAAI,MAAM,EAAC,aAAa;EAC1C,MAAM,mBAAmB,QAAQ;EACjC,MAAM,oBAAoB,QAAQ;EAClC,MAAM,eAAe,eAAe,WAAW,gBAAgB,EAAE;AACjE,OAAK,sBAAsB;GACzB,aAAa,QAAQ,eAAe,SAAS;GAC7C,cAAc,eAAe,WAAW,gBAAgB,EAAE;GAC1D,cAAc;GACd;GACA,YAAY,SAAS;GACrB,cAAc,oBAAoB,EAAE;GACpC,eAAe,qBAAqB,EAAE;GACtC,qBAAqB;GACtB,CAAC;EACF,MAAM,eAAe,OAAO,OAAO,EACjC,GAAG,KAAK,2BAA2B,eAAe,WAAW,gBAAgB,EAAE,EAAE,gBAAgB,EAClG,CAAC;EACF,MAAM,qBACJ,qBAAqB,SAAY,KAAK,2BAA2B,cAAc,iBAAiB,GAAG;EACrG,MAAMA,WAAqC;GACzC,GAAG;GACH,aAAa,QAAQ,aAAa,MAAM,IAAI,SAAS;GACrD;GACA,MAAM,OAAO,OAAO,CAAC,GAAI,QAAQ,QAAQ,SAAS,KAAM,CAAC;GACzD,aAAa,QAAQ,eAAe,SAAS;GAC7C,WACE,oBAAoB,oBAChB,KAAK,gBAAgB,SAAS,YAAY,sBAAsB,EAAE,EAAE,qBAAqB,EAAE,CAAC,GAC5F,SAAS;GACf;GACD;AACD,QAAM,KAAK,gBAAgB,aAAa;GACtC;GACA,gBACE,qBAAqB,UAAa,uBAAuB,SACrD,KAAK,qBAAqB,UAAU,oBAAoB,UAAU,GAClE;GACP,CAAC;AACF,OAAK,yBAAyB,cAAc,SAAS,WAAW;AAChE,SAAO,KAAK,MAAM,UAAU,MAAM,KAAK,gBAAgB,oBAAoB,SAAS,WAAW,CAAC;;CAGlG,MAAM,OAAO,YAAiD;AAC5D,QAAM,KAAK,gBAAgB,eAAe,WAAW;AACrD,OAAK,yBAAyB,cAAc,WAAW;;CAGzD,MAAM,iBAAiB,YAAkE;EACvF,MAAM,WAAW,MAAM,KAAK,gBAAgB,WAAW;AAEvD,MADuB,KAAK,sBAAsB,SAAS,OAAO,CAC/C,WAAW,MAAM,SAAS,SAC3C,OAAM,IAAI,wBAAwB,KAAK,uBAAuB,WAAW,uBAAuB;EAElG,MAAMC,kBAA4C;GAChD,GAAG;GACH,aAAa;GACb,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC;AACD,QAAM,KAAK,gBAAgB,aAAa,EACtC,UAAU,iBACX,CAAC;AACF,QAAM,KAAK,gBAAgB,qBAAqB,WAAW;AAC3D,OAAK,yBAAyB,cAAc,WAAW;AACvD,SAAO,MAAM,KAAK,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,oBAAoB,WAAW,CAAC;;CAGtG,MAAM,gBAAgB,YAAqE;EACzF,MAAM,WAAW,MAAM,KAAK,gBAAgB,YAAY,WAAW;AACnE,MAAI,CAAC,SACH,OAAM,IAAI,wBAAwB,KAAK,gCAAgC,aAAa;AAEtF,SAAO;;CAGT,AAAQ,gBACN,YACA,cACA,eACqB;AACrB,MAAI,eAAe,KACjB,QAAO,EAAE,MAAM,MAAM;AAEvB,MAAI,eAAe,MACjB,QAAO;GACL,MAAM;GACN,YAAY,OAAO,OAAO,EAAE,GAAG,eAAe,CAAC;GAChD;AAEH,SAAO;GACL,MAAM;GACN,OAAO,OAAO,OAAO,EAAE,GAAG,cAAc,CAAC;GAC1C;;CAGH,AAAQ,qBACN,UACA,cACA,WAC4C;AAC5C,MAAI,SAAS,eAAe,KAC1B;EAEF,MAAM,YAAY,KAAK,uBAAuB,QAAQ,aAAa;AACnE,SAAO;GACL,YAAY,SAAS;GACrB,eAAe,UAAU;GACzB,iBAAiB,UAAU;GAC3B,eAAe,UAAU;GACzB;GACD;;CAGH,AAAQ,sBACN,MAUM;AACN,MAAI,CAAC,KAAK,eAAe,KAAK,YAAY,MAAM,CAAC,WAAW,EAC1D,OAAM,IAAI,wBAAwB,KAAK,sCAAsC;AAE/E,OAAK,qBAAqB,gBAAgB,KAAK,cAAc,KAAK,aAAa;AAC/E,MAAI,KAAK,eAAe,MAAM;AAC5B,OAAI,CAAC,KAAK,uBAAuB,OAAO,KAAK,KAAK,aAAa,CAAC,SAAS,EACvE,MAAK,qBAAqB,gBAAgB,KAAK,cAAc,KAAK,aAAa;AAEjF;;AAEF,MAAI,KAAK,eAAe,OAAO;AAC7B,OAAI,CAAC,KAAK,uBAAuB,OAAO,KAAK,KAAK,cAAc,CAAC,SAAS,EACxE,MAAK,wBAAwB,KAAK,cAAc,KAAK,cAAc;AAErE;;AAEF,MAAI,CAAC,KAAK,uBAAuB,OAAO,KAAK,KAAK,aAAa,CAAC,SAAS,EACvE,MAAK,qBAAqB,gBAAgB,KAAK,cAAc,KAAK,aAAa;;CAInF,AAAQ,2BAA2B,QAA8C,OAA+B;EAC9G,MAAMC,MAA+B,EAAE,GAAG,OAAO;AACjD,OAAK,MAAM,SAAS,OAClB,KAAI,KAAK,iCAAiC,uBAAuB,MAAM,CACrE,QAAO,IAAI,MAAM;AAGrB,SAAO,OAAO,OAAO,IAAI;;CAG3B,AAAQ,qBACN,WACA,QACA,OACM;EACN,MAAM,UAAU,OACb,QAAQ,UAAU,MAAM,aAAa,KAAK,CAC1C,QAAQ,UAAU,CAAC,KAAK,iCAAiC,uBAAuB,MAAM,CAAC,CACvF,QAAQ,UAAU,MAAM,MAAM,SAAS,UAAa,MAAM,MAAM,SAAS,QAAQ,MAAM,MAAM,SAAS,GAAG,CACzG,KAAK,UAAU,MAAM,IAAI;AAC5B,MAAI,QAAQ,SAAS,EACnB,OAAM,IAAI,wBAAwB,KAAK,oBAAoB,UAAU,aAAa,QAAQ,KAAK,KAAK,GAAG;;CAI3G,AAAQ,wBACN,QACA,eACM;EACN,MAAM,UAAU,OACb,QAAQ,UAAU,MAAM,aAAa,KAAK,CAC1C,QAAQ,UAAU,CAAC,KAAK,iCAAiC,uBAAuB,MAAM,CAAC,CACvF,QAAQ,UAAU,CAAC,cAAc,MAAM,QAAQ,cAAc,MAAM,KAAM,MAAM,CAAC,WAAW,EAAE,CAC7F,KAAK,UAAU,MAAM,IAAI;AAC5B,MAAI,QAAQ,SAAS,EACnB,OAAM,IAAI,wBAAwB,KAAK,4CAA4C,QAAQ,KAAK,KAAK,GAAG;;CAI5G,AAAQ,sBAAsB,QAA6C;EACzE,MAAM,iBAAiB,KAAK,uBAAuB,kBAAkB,OAAO;AAC5E,MAAI,CAAC,eACH,OAAM,IAAI,wBAAwB,KAAK,4BAA4B,SAAS;AAE9E,SAAO;;CAGT,MAAM,oBAAoB,YAAkC,aAAoC;EAC9F,MAAM,WAAW,MAAM,KAAK,gBAAgB,WAAW;AACvD,QAAM,KAAK,gBAAgB,aAAa,EACtC,UAAU;GACR,GAAG;GACH,aAAa;GACb,WAAW;GACZ,EACF,CAAC;AACF,OAAK,yBAAyB,cAAc,WAAW;;CAGzD,MAAc,MACZ,UACA,kBACgC;EAChC,MAAM,mBAAmB,MAAM,KAAK,sBAAsB,SAAS;AACnE,SAAO;GACL,YAAY,SAAS;GACrB,QAAQ,SAAS;GACjB,aAAa,SAAS;GACtB,YAAY,SAAS;GACrB,cAAc,SAAS;GACvB,MAAM,SAAS;GACf,aAAa,SAAS;GACtB,WAAW,SAAS;GACpB,WAAW,SAAS;GACpB,cAAc,kBAAkB;GAChC;GACD;;CAGH,MAAc,sBACZ,UACoD;EACpD,MAAM,iBAAiB,KAAK,uBAAuB,kBAAkB,SAAS,OAAO;AACrF,MAAI,gBAAgB,WAAW,MAAM,SAAS,SAC5C;EAEF,MAAM,aACJ,gBAAgB,eAAe,WAAW,OAAO,eAAe,WAAW,KAAK,aAAa;EAC/F,MAAM,WAAW,MAAM,KAAK,gBAAgB,kBAAkB,SAAS,WAAW;AAClF,MAAI,CAAC,SACH,QAAO;GACL,QAAQ;GACR;GACA,QAAQ,CAAC,GAAG,eAAe,WAAW,KAAK,OAAO;GACnD;AAEH,SAAO;GACL,QAAQ;GACR,YAAY,SAAS;GACrB,gBAAgB,SAAS;GACzB,aAAa,SAAS;GACtB,QAAQ,SAAS;GACjB,WAAW,SAAS;GACrB;;;;CA9VJ,YAAY;oBAGR,OAAO,kBAAkB,gBAAgB;oBAEzC,OAAO,2BAA2B;oBAElC,OAAO,uBAAuB;oBAE9B,OAAO,iCAAiC;oBAExC,OAAO,2BAA2B;oBAElC,OAAO,WAAW,yBAAyB;;;;;;;;;;;;;;AC1BzC,qCAAMC,2BAAyB;CACpC,YACE,AACiBC,iBACjB,AACiBC,2BACjB,AACiBC,oBACjB,AACiBC,0BACjB,AACiBC,gCACjB;EATiB;EAEA;EAEA;EAEA;EAEA;;CAGnB,MAAM,cACJ,MAC4B;EAC5B,MAAM,WAAW,KAAK,gBAAgB,KAAK,WAAW;EACtD,MAAM,cAAc,KAAK,mBAAmB,UAAU,KAAK,QAAQ,KAAK,QAAQ;EAChF,MAAM,WAAW,MAAM,KAAK,0BAA0B,gBAAgB,KAAK,WAAW;AACtF,MAAI,CAAC,YAAY,cAAc,SAAS,SAAS,OAAO,CACtD,OAAM,IAAI,wBACR,KACA,uBAAuB,SAAS,WAAW,IAAI,SAAS,OAAO,gCAAgC,KAAK,QAAQ,oBAAoB,YAAY,cAAc,KAAK,KAAK,GACrK;EAEH,MAAMC,UAA6B;GACjC,KAAK;IACH,YAAY,KAAK;IACjB,QAAQ,KAAK;IACb,SAAS,KAAK;IACf;GACD,YAAY,KAAK;GACjB,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC;AACD,QAAM,KAAK,gBAAgB,cAAc,QAAQ;AACjD,OAAK,yBAAyB,aAAa,QAAQ,IAAI;AACvD,SAAO;;CAGT,MAAM,mBAAmB,YAA0D;EACjF,MAAM,WAAW,KAAK,gBAAgB,WAAW;EACjD,MAAM,WAAW,MAAM,KAAK,gBAAgB,yBAAyB,WAAW;EAChF,MAAM,gBAAgB,IAAI,IAAI,SAAS,KAAK,YAAY,CAAC,KAAK,mBAAmB,QAAQ,IAAI,EAAE,QAAQ,CAAU,CAAC;EAClH,MAAMC,QAA2C,EAAE;AACnD,OAAK,MAAM,WAAW,KAAK,+BAA+B,UAAU,SAAS,EAAE;GAC7E,MAAM,cAAc,QAAQ;GAC5B,MAAM,aAAa;IACjB;IACA,QAAQ,QAAQ;IAChB,SAAS,YAAY;IACtB;GACD,MAAM,UAAU,cAAc,IAAI,KAAK,mBAAmB,WAAW,CAAC;AACtE,OAAI,CAAC,SAAS;AACZ,UAAM,KAAK;KACT;KACA,QAAQ,QAAQ;KAChB,UAAU,QAAQ;KAClB;KACA,QAAQ,EACN,QAAQ,YAAY,WAAW,qBAAqB,WACrD;KACF,CAAC;AACF;;GAEF,MAAM,WAAW,MAAM,KAAK,0BAA0B,gBAAgB,QAAQ,WAAW;GACzF,MAAM,mBAAmB,MAAM,KAAK,gBAAgB,oBAAoB,SAAS,WAAW;AAC5F,SAAM,KAAK;IACT;IACA,QAAQ,QAAQ;IAChB,UAAU,QAAQ;IAClB;IACA,UAAU;KACR,YAAY,SAAS;KACrB,QAAQ,SAAS;KACjB,aAAa,SAAS;KACtB,aAAa,SAAS;KACvB;IACD,QAAQ;KACN,QAAQ,kBAAkB,OAAO,UAAU;KAC3C,SAAS,kBAAkB,OAAO;KAClC,UAAU,kBAAkB,OAAO;KACpC;IACF,CAAC;;AAEJ,SAAO;GACL;GACA;GACD;;CAGH,AAAQ,gBAAgB,YAAwC;EAC9D,MAAM,WAAW,KAAK,mBAAmB,IAAI,mBAAmB,WAAW,CAAC;AAC5E,MAAI,CAAC,SACH,OAAM,IAAI,wBAAwB,KAAK,uBAAuB,aAAa;AAE7E,SAAO;;CAGT,AAAQ,mBAAmB,UAA8B,QAAgB,SAAwC;EAC/G,MAAM,WAAW,KAAK,+BAA+B,gBAAgB,UAAU,QAAQ,QAAQ;AAC/F,MAAI,CAAC,UAAU;AACb,OAAI,CAAC,KAAK,+BAA+B,6BAA6B,UAAU,OAAO,CACrF,OAAM,IAAI,wBAAwB,KAAK,0BAA0B,SAAS;AAE5E,SAAM,IAAI,wBAAwB,KAAK,QAAQ,OAAO,oCAAoC,QAAQ,GAAG;;AAEvG,SAAO,SAAS;;CAGlB,AAAQ,mBAAmB,YAA0C;AACnE,SAAO,GAAG,WAAW,WAAW,GAAG,WAAW,OAAO,GAAG,WAAW;;;;CAhHtE,YAAY;oBAGR,OAAO,kBAAkB,gBAAgB;oBAEzC,OAAO,0BAA0B;oBAEjC,OAAO,WAAW,mBAAmB;oBAErC,OAAO,WAAW,yBAAyB;oBAE3C,OAAO,+BAA+B;;;;;;;;;;;;;ACzBpC,6CAAMC,mCAAiC;CAC5C,YACE,AACiBC,iBACjB,AACiBC,4BACjB,AACiBC,wBACjB,AACiBC,wBACjB;EAPiB;EAEA;EAEA;EAEA;;CAGnB,MAAM,QAAQ,UAAyD;EACrE,MAAM,eAAe,MAAM,KAAK,2BAA2B,gBAAgB,SAAS;AAEpF,OADa,KAAK,uBAAuB,kBAAkB,SAAS,OAAO,EAAE,WAAW,OAC9E,SAAS,SACjB,QAAO;EAET,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,kBAAkB,SAAS,WAAW;AACxF,MAAI,CAAC,eACH,QAAO;EAET,MAAM,0BAA0B,KAAK,uBAAuB,QAAQ,eAAe;AACnF,SAAO,OAAO,OAAO;GACnB,GAAG;GACH,GAAG;GACJ,CAAC;;;;CA3BL,YAAY;oBAGR,OAAO,kBAAkB,gBAAgB;oBAEzC,OAAO,2BAA2B;oBAElC,OAAO,uBAAuB;oBAE9B,OAAO,2BAA2B;;;;;;;;;;;;ACEhC,yCAAMC,+BAAiE;CAC5E,AAAiB,6CAA6B,IAAI,KAA6C;CAC/F,AAAiB,gDAAgC,IAAI,KAAmC;CAExF,YACE,AACiBC,iBACjB,AACiBC,kCACjB,AACiBC,kCACjB,AACiBC,wBACjB,AACiBC,oBACjB,AACiBC,gCACjB;EAXiB;EAEA;EAEA;EAEA;EAEA;EAEA;;CAGnB,MAAM,WACJ,MACmB;EACnB,MAAM,WAAW,KAAK,mBAAmB,IAAI,mBAAmB,KAAK,WAAW,CAAC;EACjF,MAAM,eAAe,WACjB,KAAK,+BAA+B,8BAA8B,UAAU,KAAK,OAAO,GACxF;EACJ,MAAM,cAAc,WAChB,KAAK,+BAA+B,gBAAgB,UAAU,KAAK,QAAQ,KAAK,QAAQ,EAAE,cAC1F;EACJ,MAAMC,aAAmC;GACvC,YAAY,KAAK;GACjB,QAAQ,KAAK;GACb,SAAS,KAAK;GACf;EACD,MAAM,UAAU,MAAM,KAAK,gBAAgB,WAAW,WAAW;AACjE,MAAI,CAAC,SAAS;GACZ,MAAM,UAAU,IAAI,uBAAuB,YAAY,aAAa,iBAAiB,EAAE,CAAC;AACxF,OAAI,aACF,OAAM,IAAI,MAAM,GAAG,aAAa,IAAI,QAAQ,WAAW,EAAE,OAAO,SAAS,CAAC;AAE5E,SAAM;;EAER,MAAM,kBAAkB,KAAK,mBAAmB,WAAW;AAC3D,OAAK,8BAA8B,IAAI,iBAAiB,QAAQ,WAAW;EAC3E,MAAM,gBAAgB,KAAK,2BAA2B,IAAI,QAAQ,WAAW;AAC7E,MAAI,cACF,QAAQ,MAAM;EAEhB,MAAM,qBAAqB,KAAK,cAAc,QAAQ,YAAY,aAAa,CAAC,OAAO,UAAU;AAC/F,QAAK,2BAA2B,OAAO,QAAQ,WAAW;AAC1D,SAAM;IACN;AACF,OAAK,2BAA2B,IAAI,QAAQ,YAAY,mBAAmB;AAC3E,SAAQ,MAAM;;CAGhB,cAAc,YAAwC;AACpD,OAAK,2BAA2B,OAAO,WAAW;;CAGpD,aAAa,YAAwC;EACnD,MAAM,WAAW,KAAK,mBAAmB,WAAW;EACpD,MAAM,aAAa,KAAK,8BAA8B,IAAI,SAAS;AACnE,MAAI,WACF,MAAK,2BAA2B,OAAO,WAAW;AAEpD,OAAK,8BAA8B,OAAO,SAAS;;CAGrD,MAAc,cAAc,YAAkC,cAAyC;EACrG,MAAM,WAAW,MAAM,KAAK,gBAAgB,YAAY,WAAW;AACnE,MAAI,CAAC,SACH,OAAM,IAAI,wBAAwB,KAAK,gCAAgC,aAAa;EAEtF,MAAM,iBAAiB,KAAK,uBAAuB,kBAAkB,SAAS,OAAO;AACrF,MAAI,CAAC,eAEH,OAAM,IAAI,wBACR,KACA,GAHa,eAAe,GAAG,aAAa,MAAM,GAGxC,mBAAmB,SAAS,OAAO,0EAC9C;EAEH,MAAM,WAAW,MAAM,KAAK,iCAAiC,QAAQ,SAAS;EAC9E,MAAM,EAAE,sBAAsB,qBAAqB,KAAK,iCAAiC,MAAM;GAC7F,YAAY,eAAe;GAC3B,cAAc,SAAS;GACvB;GACD,CAAC;AACF,SAAO,MAAM,eAAe,cAAc;GACxC;GACA,UAAU;GACV,cAAc;GACf,CAAC;;CAGJ,AAAQ,mBAAmB,YAA0C;AACnE,SAAO,GAAG,WAAW,WAAW,GAAG,WAAW,OAAO,GAAG,WAAW;;;;CAjGtE,YAAY;oBAMR,OAAO,kBAAkB,gBAAgB;oBAEzC,OAAO,iCAAiC;oBAExC,OAAO,iCAAiC;oBAExC,OAAO,2BAA2B;oBAElC,OAAO,WAAW,mBAAmB;oBAErC,OAAO,+BAA+B;;;;;;;;;;;;;;AClBpC,kCAAMC,wBAAsB;CACjC,YACE,AACiBC,2BACjB,AACiBC,kCACjB,AACiBC,kCACjB,AACiBC,wBACjB,AACiBC,iBACjB,AACiBC,0BACjB;EAXiB;EAEA;EAEA;EAEA;EAEA;EAEA;;CAGnB,MAAM,KAAK,YAA6D;EACtE,MAAM,WAAW,MAAM,KAAK,0BAA0B,gBAAgB,WAAW;EACjF,MAAM,iBAAiB,KAAK,sBAAsB,SAAS,OAAO;EAClE,MAAM,WAAW,MAAM,KAAK,iCAAiC,QAAQ,SAAS;EAC9E,MAAM,EAAE,sBAAsB,qBAAqB,KAAK,iCAAiC,MAAM;GAC7F,YAAY,eAAe;GAC3B,cAAc,SAAS;GACvB;GACD,CAAC;EACF,MAAM,SAAS,MAAM,eAAe,KAAK;GACvC;GACA,UAAU;GACV,cAAc;GACf,CAAC;EACF,MAAM,WAAW,OAAO,6BAAY,IAAI,MAAM,EAAC,aAAa;AAC5D,QAAM,KAAK,gBAAgB,eAAe;GACxC,QAAQ,YAAY;GACpB;GACA,QAAQ;IACN,GAAG;IACH;IACD;GACD;GACA,WAAW,OAAO;GACnB,CAAC;AACF,OAAK,yBAAyB,cAAc,WAAW;AACvD,SAAO;GACL,GAAG;GACH;GACD;;CAGH,AAAQ,sBAAsB,QAA6C;EACzE,MAAM,iBAAiB,KAAK,uBAAuB,kBAAkB,OAAO;AAC5E,MAAI,CAAC,eACH,OAAM,IAAI,wBAAwB,KAAK,4BAA4B,SAAS;AAE9E,SAAO;;;;CAtDV,YAAY;oBAGR,OAAO,0BAA0B;oBAEjC,OAAO,iCAAiC;oBAExC,OAAO,iCAAiC;oBAExC,OAAO,2BAA2B;oBAElC,OAAO,kBAAkB,gBAAgB;oBAEzC,OAAO,WAAW,yBAAyB"}