@de-otio/trellis 0.6.0 → 0.7.0

package/dist/lib/notification-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-handler.js","sourceRoot":"","sources":["../../src/lib/notification-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAMH,8BAAqC;AACrC,qCAAkC;AAgBlC,wEAAwE;AACxE,MAAM,oBAAoB,GAAuB;IAC/C,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAa,mBAAmB;IAC9B;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,IAAsB,EACtB,KAAa,EACb,IAAY,EACZ,IAAS,EACT,GAAQ;QAER,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE9D,mFAAmF;YACnF,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,UAAU,CAAC;oBACvD,KAAK,EAAE,EAAE,MAAM,EAAE;iBAClB,CAAC,CAAC;gBAEH,IAAI,KAAK,EAAE,CAAC;oBACV,oCAAoC;oBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;4BACrD,MAAM;4BACN,IAAI;yBACL,CAAC,CAAC;wBACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,IAAI,WAAW,GAAgB,IAAI,IAAI,EAAE,CAAC;YAE1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;oBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,MAAM,EAAE;wBACN,iBAAiB,EAAE,IAAI;wBACvB,eAAe,EAAE,IAAI;wBACrB,aAAa,EAAE,IAAI;qBACpB;iBACF,CAAC,CAAC;gBAEH,IAAI,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,kDAAkD;oBAClD,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAChD,IAAI,EAAE;oBACJ,MAAM;oBACN,IAAI;oBACJ,KAAK;oBACL,IAAI;oBACJ,IAAI,EAAE,IAAI,IAAI,SAAS;oBACvB,WAAW;iBACZ;aACF,CAAC,CAAC;YAEH,OAAO,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,MAAqB,EACrB,KAAa,EACb,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEnD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;gBACnD,KAAK,EAAE;oBACL,MAAM;oBACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;gBACD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,IAAI,EAAE,SAAS,GAAG,CAAC;aACpB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAEhD,OAAO;gBACL,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;iBACrC,CAAC,CAAC;gBACH,MAAM,EAAE,OAAO;oBACb,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;oBACjD,CAAC,CAAC,SAAS;gBACb,OAAO;aACR,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,cAAsB,EACtB,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;gBACnD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,yBAAyB,CAAC,cAAc,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,GAAQ;QACxC,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;gBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,OAAe,EACf,GAAQ;QAER,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC9C,oDAAoD;gBACpD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;oBAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE;oBAC9B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAC;gBACH,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAChC,CAAC;YAED,4BAA4B;YAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;gBACxC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE;aAC/B,CAAC,CAAC;YAEH,OAAO,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,IAAsB,EACtB,KAMC;QAED,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,gBAAgB;gBACnB,OAAO,KAAK,CAAC,SAAS,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,aAAa,CAAC;YAC7B,KAAK,kBAAkB;gBACrB,OAAO,KAAK,CAAC,aAAa,CAAC;YAC7B,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,aAAa,CAAC;YAC7B,KAAK,sBAAsB,CAAC;YAC5B,KAAK,2BAA2B,CAAC;YACjC,KAAK,cAAc,CAAC;YACpB,KAAK,8BAA8B,CAAC;YACpC,KAAK,+BAA+B,CAAC;YACrC,KAAK,0BAA0B;gBAC7B,OAAO,KAAK,CAAC,mBAAmB,CAAC;YACnC,+DAA+D;YAC/D;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,IAItB;QACC,IACE,CAAC,IAAI,CAAC,iBAAiB;YACvB,IAAI,CAAC,eAAe,IAAI,IAAI;YAC5B,IAAI,CAAC,aAAa,IAAI,IAAI,EAC1B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,oBAAoB,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAE/B,sDAAsD;QACtD,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,oBAAoB,IAAI,KAAK,IAAI,oBAAoB,GAAG,GAAG,CAAC;QACrE,CAAC;QAED,8CAA8C;QAC9C,OAAO,oBAAoB,IAAI,KAAK,IAAI,oBAAoB,GAAG,GAAG,CAAC;IACrE,CAAC;CACF;AAzQD,kDAyQC;AAED,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,cAAsB;QAChC,KAAK,CAAC,gBAAgB,cAAc,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC"}
+{"version":3,"file":"notification-handler.js","sourceRoot":"","sources":["../../src/lib/notification-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAMH,8BAAqC;AACrC,qCAAkC;AAgBlC,wEAAwE;AACxE,MAAM,oBAAoB,GAAuB;IAC/C,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAa,mBAAmB;IAC9B;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,IAAsB,EACtB,KAAa,EACb,IAAY,EACZ,IAAS,EACT,GAAQ,EACR,QAAgB;QAEhB,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE9D,mFAAmF;YACnF,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,UAAU,CAAC;oBACvD,KAAK,EAAE,EAAE,MAAM,EAAE;iBAClB,CAAC,CAAC;gBAEH,IAAI,KAAK,EAAE,CAAC;oBACV,oCAAoC;oBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAChD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;4BACrD,MAAM;4BACN,IAAI;yBACL,CAAC,CAAC;wBACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,IAAI,WAAW,GAAgB,IAAI,IAAI,EAAE,CAAC;YAE1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;oBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;oBACrB,MAAM,EAAE;wBACN,iBAAiB,EAAE,IAAI;wBACvB,eAAe,EAAE,IAAI;wBACrB,aAAa,EAAE,IAAI;qBACpB;iBACF,CAAC,CAAC;gBAEH,IAAI,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzD,kDAAkD;oBAClD,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAChD,IAAI,EAAE;oBACJ,MAAM;oBACN,IAAI;oBACJ,KAAK;oBACL,IAAI;oBACJ,IAAI,EAAE,IAAI,IAAI,SAAS;oBACvB,WAAW;oBACX,QAAQ;iBACT;aACF,CAAC,CAAC;YAEH,OAAO,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,MAAqB,EACrB,KAAa,EACb,GAAQ,EACR,QAAgB;QAEhB,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEnD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;gBACnD,KAAK,EAAE;oBACL,MAAM;oBACN,QAAQ;oBACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;gBACD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,IAAI,EAAE,SAAS,GAAG,CAAC;aACpB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAEhD,OAAO;gBACL,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;iBACrC,CAAC,CAAC;gBACH,MAAM,EAAE,OAAO;oBACb,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;oBACjD,CAAC,CAAC,SAAS;gBACb,OAAO;aACR,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,cAAsB,EACtB,GAAQ,EACR,QAAgB;QAEhB,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;gBACnD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;aAChD,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,yBAAyB,CAAC,cAAc,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,GAAQ,EAAE,QAAgB;QAC1D,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;gBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;gBACxC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,OAAe,EACf,GAAQ,EACR,QAAgB;QAEhB,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC9C,oDAAoD;gBACpD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;oBAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;oBACxC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;iBACrB,CAAC,CAAC;gBACH,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAChC,CAAC;YAED,4BAA4B;YAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;gBACxC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;aACzC,CAAC,CAAC;YAEH,OAAO,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,IAAsB,EACtB,KAMC;QAED,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,gBAAgB;gBACnB,OAAO,KAAK,CAAC,SAAS,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,aAAa,CAAC;YAC7B,KAAK,kBAAkB;gBACrB,OAAO,KAAK,CAAC,aAAa,CAAC;YAC7B,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC,aAAa,CAAC;YAC7B,KAAK,sBAAsB,CAAC;YAC5B,KAAK,2BAA2B,CAAC;YACjC,KAAK,cAAc,CAAC;YACpB,KAAK,8BAA8B,CAAC;YACpC,KAAK,+BAA+B,CAAC;YACrC,KAAK,0BAA0B;gBAC7B,OAAO,KAAK,CAAC,mBAAmB,CAAC;YACnC,+DAA+D;YAC/D;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,IAItB;QACC,IACE,CAAC,IAAI,CAAC,iBAAiB;YACvB,IAAI,CAAC,eAAe,IAAI,IAAI;YAC5B,IAAI,CAAC,aAAa,IAAI,IAAI,EAC1B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,oBAAoB,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAE/B,sDAAsD;QACtD,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,oBAAoB,IAAI,KAAK,IAAI,oBAAoB,GAAG,GAAG,CAAC;QACrE,CAAC;QAED,8CAA8C;QAC9C,OAAO,oBAAoB,IAAI,KAAK,IAAI,oBAAoB,GAAG,GAAG,CAAC;IACrE,CAAC;CACF;AA/QD,kDA+QC;AAED,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,cAAsB;QAChC,KAAK,CAAC,gBAAgB,cAAc,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC"}

package/dist/lib/oauth/cognito-issuer.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Token issuance wrapper for the device-auth approval step.
+ *
+ * The device-auth flow needs to produce a fresh access+refresh token set
+ * scoped to the admin's identity but bound to the agent client id (so
+ * audit logs can attribute later API calls to the agent session).
+ *
+ * Cognito's `AdminInitiateAuth` is the lowest-friction call that fits.
+ * This wrapper hides the SDK shape so the route handler stays clean and
+ * unit tests can mock a single function.
+ */
+import { CognitoIdentityProviderClient } from "@aws-sdk/client-cognito-identity-provider";
+import type { TokenSet } from "./device-authorization";
+export interface CognitoIssuerInput {
+    userPoolId: string;
+    /** Public agent client id (no client secret). */
+    clientId: string;
+    /** Admin's Cognito username (sub). */
+    username: string;
+    /** Admin's current refresh token (from the active web session). */
+    refreshToken: string;
+}
+export interface CognitoIssuer {
+    issueForAgent(input: CognitoIssuerInput): Promise<TokenSet>;
+}
+/** Default implementation backed by AWS SDK. */
+export declare class AwsCognitoIssuer implements CognitoIssuer {
+    private readonly client;
+    constructor(client: CognitoIdentityProviderClient);
+    issueForAgent(input: CognitoIssuerInput): Promise<TokenSet>;
+}
+/** Build the default issuer using the global Cognito SDK client. */
+export declare function createDefaultIssuer(): CognitoIssuer;
+//# sourceMappingURL=cognito-issuer.d.ts.map

package/dist/lib/oauth/cognito-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-issuer.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/cognito-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAEL,6BAA6B,EAC9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7D;AAED,gDAAgD;AAChD,qBAAa,gBAAiB,YAAW,aAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,6BAA6B;IAE5D,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC;CAuBlE;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,IAAI,aAAa,CAKnD"}

package/dist/lib/oauth/cognito-issuer.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Token issuance wrapper for the device-auth approval step.
+ *
+ * The device-auth flow needs to produce a fresh access+refresh token set
+ * scoped to the admin's identity but bound to the agent client id (so
+ * audit logs can attribute later API calls to the agent session).
+ *
+ * Cognito's `AdminInitiateAuth` is the lowest-friction call that fits.
+ * This wrapper hides the SDK shape so the route handler stays clean and
+ * unit tests can mock a single function.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsCognitoIssuer = void 0;
+exports.createDefaultIssuer = createDefaultIssuer;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+/** Default implementation backed by AWS SDK. */
+class AwsCognitoIssuer {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async issueForAgent(input) {
+        const out = await this.client.send(new client_cognito_identity_provider_1.AdminInitiateAuthCommand({
+            UserPoolId: input.userPoolId,
+            ClientId: input.clientId,
+            AuthFlow: "REFRESH_TOKEN_AUTH",
+            AuthParameters: {
+                REFRESH_TOKEN: input.refreshToken,
+            },
+        }));
+        const r = out.AuthenticationResult;
+        if (!r?.AccessToken || !r?.ExpiresIn) {
+            throw new Error("Cognito AdminInitiateAuth returned no tokens");
+        }
+        return {
+            access_token: r.AccessToken,
+            refresh_token: r.RefreshToken ?? input.refreshToken,
+            id_token: r.IdToken,
+            token_type: "Bearer",
+            expires_in: r.ExpiresIn,
+        };
+    }
+}
+exports.AwsCognitoIssuer = AwsCognitoIssuer;
+/** Build the default issuer using the global Cognito SDK client. */
+function createDefaultIssuer() {
+    const client = new client_cognito_identity_provider_1.CognitoIdentityProviderClient({
+        region: process.env.COGNITO_REGION || process.env.AWS_REGION || "us-east-1",
+    });
+    return new AwsCognitoIssuer(client);
+}
+//# sourceMappingURL=cognito-issuer.js.map

package/dist/lib/oauth/cognito-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-issuer.js","sourceRoot":"","sources":["../../../src/lib/oauth/cognito-issuer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAoDH,kDAKC;AAvDD,gGAGmD;AAiBnD,gDAAgD;AAChD,MAAa,gBAAgB;IACE;IAA7B,YAA6B,MAAqC;QAArC,WAAM,GAAN,MAAM,CAA+B;IAAG,CAAC;IAEtE,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAChC,IAAI,2DAAwB,CAAC;YAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,oBAAoB;YAC9B,cAAc,EAAE;gBACd,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;YACL,YAAY,EAAE,CAAC,CAAC,WAAW;YAC3B,aAAa,EAAE,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY;YACnD,QAAQ,EAAE,CAAC,CAAC,OAAO;YACnB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC;CACF;AA1BD,4CA0BC;AAED,oEAAoE;AACpE,SAAgB,mBAAmB;IACjC,MAAM,MAAM,GAAG,IAAI,gEAA6B,CAAC;QAC/C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;KAC5E,CAAC,CAAC;IACH,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/lib/oauth/device-authorization.d.ts

@@ -0,0 +1,145 @@
+/**
+ * RFC 8628 device authorization grant adapter (T9b-d).
+ *
+ * Three flows:
+ *   1. POST /oauth2/device_authorization — issue a device_code/user_code pair.
+ *   2. GET/POST /agents/authorize — interactive admin approval (separate file).
+ *   3. POST /oauth2/token (grant_type=device_code) — agent polls for tokens.
+ *
+ * Storage: a single DynamoDB table keyed on `device_code` (the agent's
+ * secret) with envelope-encrypted tokens. The user_code is a secondary
+ * index entry pointing back at the device_code so the approval page can
+ * look up the pending request.
+ *
+ * Security invariants:
+ *   - device_code is 256-bit URL-safe random; never echoed in logs.
+ *   - user_code uses an unambiguous 20-char alphabet; brute-force is
+ *     bounded by the 10-failure lockout enforced by the approval page.
+ *   - tokens are encrypted with a per-record DEK derived from device_code;
+ *     a DynamoDB GetItem alone cannot decrypt.
+ *   - record TTL flips to NOW+60s on approval. If the agent doesn't poll
+ *     within 60s the row evaporates (read-once short-window).
+ *   - successful poll deletes the row before returning (read-once strict).
+ */
+import { type SealedEnvelope } from "./envelope-crypto";
+/** Unambiguous user-code alphabet — no 0/O, 1/I/L, 2/Z, U/V, A/H, S/5, etc. */
+export declare const USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+/** 8-character user codes, displayed as `XXXX-XXXX` to humans. */
+export declare const USER_CODE_LEN = 8;
+/** Default RFC 8628 expires_in. */
+export declare const DEFAULT_EXPIRES_IN = 600;
+/** Default RFC 8628 polling interval. */
+export declare const DEFAULT_INTERVAL = 5;
+/** TTL for the post-approval window — agents must poll within this. */
+export declare const POST_APPROVAL_TTL_SECONDS = 60;
+/** Failure lockout threshold for user_code lookups against a single device_code. */
+export declare const USER_CODE_FAILURE_LIMIT = 10;
+export interface DeviceAuthRecord {
+    /** Primary key: device_code (the agent's secret). */
+    deviceCode: string;
+    /** SHA-256 hex of the user_code, for indirect lookup (PII-safe). */
+    userCodeHash: string;
+    /** Display form of the user code; only present until first GET. */
+    userCode?: string;
+    status: "pending" | "approved" | "denied";
+    /** UTC seconds since epoch — DynamoDB TTL trigger. */
+    expiresAt: number;
+    createdAt: number;
+    /** RFC 8628 polling interval (seconds). */
+    interval: number;
+    /** Track failed user_code lookups against this device_code. */
+    failedLookups: number;
+    /** Last poll timestamp; used to enforce `slow_down`. */
+    lastPolledAt?: number;
+    /** When status === approved, ciphertext blob bound to device_code. */
+    envelope?: SealedEnvelope;
+    /** Cognito user id of the admin who approved, for audit. */
+    approvedByUserId?: string;
+    /** Cognito sub bound to the issued tokens, used for revocation. */
+    cognitoSub?: string;
+    /** Tenant id from the admin's session at approval time. */
+    tenantId?: string;
+    /** Agent label (User-Agent of the polling client). */
+    agentLabel?: string;
+    /** Source IP of the agent at request time, anonymised. */
+    sourceIp?: string;
+    /** Session id (for revocation correlation in the refresh table). */
+    sessionId?: string;
+}
+export interface DeviceAuthResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface TokenSet {
+    access_token: string;
+    refresh_token: string;
+    id_token?: string;
+    token_type: "Bearer";
+    expires_in: number;
+}
+export interface DeviceAuthPollResult {
+    /** "ok" — tokens returned; "pending" — keep polling; "slow_down" — back off; "expired" — restart. */
+    outcome: "ok" | "pending" | "slow_down" | "expired" | "denied" | "gone";
+    tokens?: TokenSet;
+}
+/** Format a 4-char-grouped human display: `BCDF-GHJK`. */
+export declare function formatUserCode(raw: string): string;
+/** Strip the dash so callers can match the canonical alphabet. */
+export declare function normaliseUserCode(input: string): string;
+/** SHA-256 hex; used as the secondary lookup key for user_code. */
+export declare function hashUserCode(userCode: string): string;
+/**
+ * Generate a cryptographically random user_code from the unambiguous alphabet.
+ * Uniformly samples by rejecting bytes that would bias the modulo (alphabet
+ * length 20 doesn't divide 256 evenly).
+ */
+export declare function generateUserCode(rng?: (n: number) => Buffer): string;
+/** 256-bit URL-safe random device_code. */
+export declare function generateDeviceCode(rng?: (n: number) => Buffer): string;
+/**
+ * Issue a new device-authorization request. Stores a `pending` record with
+ * TTL = expires_in seconds, plus a secondary index row keyed by user_code hash.
+ */
+export declare function startDeviceAuthorization(input: {
+    expiresIn?: number;
+    interval?: number;
+    verificationUriBase: string;
+    agentLabel?: string;
+    sourceIp?: string;
+}): Promise<DeviceAuthResponse>;
+/** Internal helper — load a record by device_code or return null. */
+export declare function loadByDeviceCode(deviceCode: string): Promise<DeviceAuthRecord | null>;
+/** Internal helper — resolve user_code to a device_code via the secondary key. */
+export declare function lookupDeviceCodeByUserCode(userCode: string): Promise<string | null>;
+/**
+ * Increment the failed-lookup counter on a device_code. Returns the new count.
+ * Once the count exceeds USER_CODE_FAILURE_LIMIT the record is deleted (lockout).
+ */
+export declare function incrementFailedLookup(deviceCode: string): Promise<number>;
+/** Delete a device-auth record (e.g. on lockout or successful poll). */
+export declare function invalidateDeviceCode(deviceCode: string): Promise<void>;
+export interface ApprovalContext {
+    deviceCode: string;
+    approvedByUserId: string;
+    cognitoSub: string;
+    tenantId: string;
+    tokens: TokenSet;
+    /** A new session id; used as the refresh-table key after first poll. */
+    sessionId: string;
+}
+/**
+ * Mark a device-auth record approved and stash the encrypted token blob.
+ * Re-keys the record's TTL to NOW + POST_APPROVAL_TTL_SECONDS.
+ */
+export declare function approveDeviceAuth(ctx: ApprovalContext): Promise<void>;
+/**
+ * Poll for tokens with a device_code. Implements the RFC 8628 §3.5/3.4
+ * outcomes: pending, slow_down, ok, expired, denied. On success the
+ * record is deleted before tokens return (read-once).
+ */
+export declare function pollDeviceAuth(deviceCode: string): Promise<DeviceAuthPollResult>;
+//# sourceMappingURL=device-authorization.d.ts.map

package/dist/lib/oauth/device-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/device-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAYH,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEhF,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,kEAAkE;AAClE,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,mCAAmC;AACnC,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC1C,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,qGAAqG;IACrG,OAAO,EAAE,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxE,MAAM,CAAC,EAAE,QAAQ,CAAC;CACnB;AAcD,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAoB,GAAG,MAAM,CAajF;AAED,2CAA2C;AAC3C,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAoB,GAAG,MAAM,CAEnF;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgE9B;AAED,qEAAqE;AACrE,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAW3F;AAED,kFAAkF;AAClF,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYzF;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB/E;AAED,wEAAwE;AACxE,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5E;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,CAAC;IACjB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B3E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyCtF"}

package/dist/lib/oauth/device-authorization.js

@@ -0,0 +1,312 @@
+"use strict";
+/**
+ * RFC 8628 device authorization grant adapter (T9b-d).
+ *
+ * Three flows:
+ *   1. POST /oauth2/device_authorization — issue a device_code/user_code pair.
+ *   2. GET/POST /agents/authorize — interactive admin approval (separate file).
+ *   3. POST /oauth2/token (grant_type=device_code) — agent polls for tokens.
+ *
+ * Storage: a single DynamoDB table keyed on `device_code` (the agent's
+ * secret) with envelope-encrypted tokens. The user_code is a secondary
+ * index entry pointing back at the device_code so the approval page can
+ * look up the pending request.
+ *
+ * Security invariants:
+ *   - device_code is 256-bit URL-safe random; never echoed in logs.
+ *   - user_code uses an unambiguous 20-char alphabet; brute-force is
+ *     bounded by the 10-failure lockout enforced by the approval page.
+ *   - tokens are encrypted with a per-record DEK derived from device_code;
+ *     a DynamoDB GetItem alone cannot decrypt.
+ *   - record TTL flips to NOW+60s on approval. If the agent doesn't poll
+ *     within 60s the row evaporates (read-once short-window).
+ *   - successful poll deletes the row before returning (read-once strict).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_CODE_FAILURE_LIMIT = exports.POST_APPROVAL_TTL_SECONDS = exports.DEFAULT_INTERVAL = exports.DEFAULT_EXPIRES_IN = exports.USER_CODE_LEN = exports.USER_CODE_ALPHABET = void 0;
+exports.formatUserCode = formatUserCode;
+exports.normaliseUserCode = normaliseUserCode;
+exports.hashUserCode = hashUserCode;
+exports.generateUserCode = generateUserCode;
+exports.generateDeviceCode = generateDeviceCode;
+exports.startDeviceAuthorization = startDeviceAuthorization;
+exports.loadByDeviceCode = loadByDeviceCode;
+exports.lookupDeviceCodeByUserCode = lookupDeviceCodeByUserCode;
+exports.incrementFailedLookup = incrementFailedLookup;
+exports.invalidateDeviceCode = invalidateDeviceCode;
+exports.approveDeviceAuth = approveDeviceAuth;
+exports.pollDeviceAuth = pollDeviceAuth;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const util_dynamodb_1 = require("@aws-sdk/util-dynamodb");
+const node_crypto_1 = require("node:crypto");
+const envelope_crypto_1 = require("./envelope-crypto");
+/** Unambiguous user-code alphabet — no 0/O, 1/I/L, 2/Z, U/V, A/H, S/5, etc. */
+exports.USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+/** 8-character user codes, displayed as `XXXX-XXXX` to humans. */
+exports.USER_CODE_LEN = 8;
+/** Default RFC 8628 expires_in. */
+exports.DEFAULT_EXPIRES_IN = 600;
+/** Default RFC 8628 polling interval. */
+exports.DEFAULT_INTERVAL = 5;
+/** TTL for the post-approval window — agents must poll within this. */
+exports.POST_APPROVAL_TTL_SECONDS = 60;
+/** Failure lockout threshold for user_code lookups against a single device_code. */
+exports.USER_CODE_FAILURE_LIMIT = 10;
+const ddb = new client_dynamodb_1.DynamoDBClient({
+    region: process.env.AWS_REGION || "us-east-1",
+    ...(process.env.DYNAMODB_ENDPOINT ? { endpoint: process.env.DYNAMODB_ENDPOINT } : {}),
+});
+function tableName() {
+    return (process.env.DEVICE_AUTH_TABLE ||
+        `${process.env.STAGE || "dev"}-trellis-device-auth`);
+}
+/** Format a 4-char-grouped human display: `BCDF-GHJK`. */
+function formatUserCode(raw) {
+    if (raw.length !== exports.USER_CODE_LEN)
+        return raw;
+    return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+}
+/** Strip the dash so callers can match the canonical alphabet. */
+function normaliseUserCode(input) {
+    return input.replace(/[\s-]/g, "").toUpperCase();
+}
+/** SHA-256 hex; used as the secondary lookup key for user_code. */
+function hashUserCode(userCode) {
+    return (0, node_crypto_1.createHash)("sha256").update(userCode).digest("hex");
+}
+/**
+ * Generate a cryptographically random user_code from the unambiguous alphabet.
+ * Uniformly samples by rejecting bytes that would bias the modulo (alphabet
+ * length 20 doesn't divide 256 evenly).
+ */
+function generateUserCode(rng = node_crypto_1.randomBytes) {
+    const alphaLen = exports.USER_CODE_ALPHABET.length; // 20
+    const cutoff = Math.floor(256 / alphaLen) * alphaLen; // 240; reject 240..255
+    const out = [];
+    while (out.length < exports.USER_CODE_LEN) {
+        const buf = rng(exports.USER_CODE_LEN * 2); // oversample
+        for (let i = 0; i < buf.length && out.length < exports.USER_CODE_LEN; i++) {
+            const b = buf[i];
+            if (b >= cutoff)
+                continue;
+            out.push(exports.USER_CODE_ALPHABET[b % alphaLen]);
+        }
+    }
+    return out.join("");
+}
+/** 256-bit URL-safe random device_code. */
+function generateDeviceCode(rng = node_crypto_1.randomBytes) {
+    return rng(32).toString("base64url");
+}
+/**
+ * Issue a new device-authorization request. Stores a `pending` record with
+ * TTL = expires_in seconds, plus a secondary index row keyed by user_code hash.
+ */
+async function startDeviceAuthorization(input) {
+    const expiresIn = input.expiresIn ?? exports.DEFAULT_EXPIRES_IN;
+    const interval = input.interval ?? exports.DEFAULT_INTERVAL;
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + expiresIn;
+    const deviceCode = generateDeviceCode();
+    const userCode = generateUserCode();
+    const userCodeHash = hashUserCode(userCode);
+    const record = {
+        deviceCode,
+        userCodeHash,
+        userCode,
+        status: "pending",
+        expiresAt,
+        createdAt: now,
+        interval,
+        failedLookups: 0,
+        agentLabel: input.agentLabel,
+        sourceIp: input.sourceIp,
+    };
+    await ddb.send(new client_dynamodb_1.PutItemCommand({
+        TableName: tableName(),
+        Item: (0, util_dynamodb_1.marshall)({
+            pk: `dc#${deviceCode}`,
+            sk: "rec",
+            ...record,
+            // DynamoDB TTL attribute (seconds since epoch).
+            ttl: expiresAt,
+        }, { removeUndefinedValues: true }),
+        ConditionExpression: "attribute_not_exists(pk)",
+    }));
+    await ddb.send(new client_dynamodb_1.PutItemCommand({
+        TableName: tableName(),
+        Item: (0, util_dynamodb_1.marshall)({
+            pk: `uc#${userCodeHash}`,
+            sk: "idx",
+            deviceCode,
+            createdAt: now,
+            ttl: expiresAt,
+        }, { removeUndefinedValues: true }),
+    }));
+    return {
+        device_code: deviceCode,
+        user_code: formatUserCode(userCode),
+        verification_uri: input.verificationUriBase,
+        verification_uri_complete: `${input.verificationUriBase}?user_code=${formatUserCode(userCode)}`,
+        expires_in: expiresIn,
+        interval,
+    };
+}
+/** Internal helper — load a record by device_code or return null. */
+async function loadByDeviceCode(deviceCode) {
+    const out = await ddb.send(new client_dynamodb_1.GetItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+    }));
+    if (!out.Item)
+        return null;
+    const raw = (0, util_dynamodb_1.unmarshall)(out.Item);
+    if (raw.ttl && raw.ttl < Math.floor(Date.now() / 1000))
+        return null;
+    return rawToRecord(raw);
+}
+/** Internal helper — resolve user_code to a device_code via the secondary key. */
+async function lookupDeviceCodeByUserCode(userCode) {
+    const userCodeHash = hashUserCode(normaliseUserCode(userCode));
+    const out = await ddb.send(new client_dynamodb_1.GetItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `uc#${userCodeHash}`, sk: "idx" }),
+    }));
+    if (!out.Item)
+        return null;
+    const raw = (0, util_dynamodb_1.unmarshall)(out.Item);
+    if (raw.ttl && raw.ttl < Math.floor(Date.now() / 1000))
+        return null;
+    return raw.deviceCode || null;
+}
+/**
+ * Increment the failed-lookup counter on a device_code. Returns the new count.
+ * Once the count exceeds USER_CODE_FAILURE_LIMIT the record is deleted (lockout).
+ */
+async function incrementFailedLookup(deviceCode) {
+    try {
+        const out = await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+            TableName: tableName(),
+            Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+            UpdateExpression: "ADD failedLookups :one",
+            ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":one": 1 }),
+            ConditionExpression: "attribute_exists(pk)",
+            ReturnValues: "ALL_NEW",
+        }));
+        if (!out.Attributes)
+            return 0;
+        const updated = (0, util_dynamodb_1.unmarshall)(out.Attributes);
+        const newCount = updated.failedLookups ?? 0;
+        if (newCount >= exports.USER_CODE_FAILURE_LIMIT) {
+            await invalidateDeviceCode(deviceCode);
+        }
+        return newCount;
+    }
+    catch (err) {
+        if (err instanceof client_dynamodb_1.ConditionalCheckFailedException)
+            return 0;
+        throw err;
+    }
+}
+/** Delete a device-auth record (e.g. on lockout or successful poll). */
+async function invalidateDeviceCode(deviceCode) {
+    await ddb.send(new client_dynamodb_1.DeleteItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+    }));
+}
+/**
+ * Mark a device-auth record approved and stash the encrypted token blob.
+ * Re-keys the record's TTL to NOW + POST_APPROVAL_TTL_SECONDS.
+ */
+async function approveDeviceAuth(ctx) {
+    const kek = await (0, envelope_crypto_1.resolveKek)();
+    const envelope = (0, envelope_crypto_1.seal)(JSON.stringify(ctx.tokens), ctx.deviceCode, kek);
+    const newTtl = Math.floor(Date.now() / 1000) + exports.POST_APPROVAL_TTL_SECONDS;
+    await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+        TableName: tableName(),
+        Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${ctx.deviceCode}`, sk: "rec" }),
+        UpdateExpression: "SET #status = :approved, envelope = :env, approvedByUserId = :u, cognitoSub = :s, tenantId = :t, sessionId = :sid, expiresAt = :ttl, #ttlAttr = :ttl REMOVE userCode",
+        ConditionExpression: "attribute_exists(pk) AND #status = :pending",
+        ExpressionAttributeNames: {
+            "#status": "status",
+            "#ttlAttr": "ttl",
+        },
+        ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({
+            ":approved": "approved",
+            ":pending": "pending",
+            ":env": JSON.stringify(envelope),
+            ":u": ctx.approvedByUserId,
+            ":s": ctx.cognitoSub,
+            ":t": ctx.tenantId,
+            ":sid": ctx.sessionId,
+            ":ttl": newTtl,
+        }),
+    }));
+}
+/**
+ * Poll for tokens with a device_code. Implements the RFC 8628 §3.5/3.4
+ * outcomes: pending, slow_down, ok, expired, denied. On success the
+ * record is deleted before tokens return (read-once).
+ */
+async function pollDeviceAuth(deviceCode) {
+    const record = await loadByDeviceCode(deviceCode);
+    if (!record)
+        return { outcome: "gone" };
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (record.expiresAt < nowSec)
+        return { outcome: "expired" };
+    // RFC 8628 §6.1 — enforce per-device polling interval.
+    if (record.lastPolledAt && nowSec - record.lastPolledAt < record.interval) {
+        return { outcome: "slow_down" };
+    }
+    if (record.status === "denied")
+        return { outcome: "denied" };
+    if (record.status === "pending") {
+        // Best-effort lastPolledAt update so subsequent fast polls hit slow_down.
+        try {
+            await ddb.send(new client_dynamodb_1.UpdateItemCommand({
+                TableName: tableName(),
+                Key: (0, util_dynamodb_1.marshall)({ pk: `dc#${deviceCode}`, sk: "rec" }),
+                UpdateExpression: "SET lastPolledAt = :n",
+                ConditionExpression: "attribute_exists(pk) AND #status = :pending",
+                ExpressionAttributeNames: { "#status": "status" },
+                ExpressionAttributeValues: (0, util_dynamodb_1.marshall)({ ":n": nowSec, ":pending": "pending" }),
+            }));
+        }
+        catch (err) {
+            if (!(err instanceof client_dynamodb_1.ConditionalCheckFailedException))
+                throw err;
+        }
+        return { outcome: "pending" };
+    }
+    // status === approved. Decrypt, then delete the row before returning.
+    if (!record.envelope)
+        return { outcome: "expired" };
+    const kek = await (0, envelope_crypto_1.resolveKek)();
+    const plaintext = (0, envelope_crypto_1.open)(record.envelope, deviceCode, kek);
+    const tokens = JSON.parse(plaintext);
+    await invalidateDeviceCode(deviceCode);
+    return { outcome: "ok", tokens };
+}
+function rawToRecord(raw) {
+    return {
+        deviceCode: raw.deviceCode,
+        userCodeHash: raw.userCodeHash,
+        userCode: raw.userCode,
+        status: raw.status,
+        expiresAt: raw.expiresAt,
+        createdAt: raw.createdAt,
+        interval: raw.interval,
+        failedLookups: raw.failedLookups ?? 0,
+        lastPolledAt: raw.lastPolledAt,
+        envelope: raw.envelope ? JSON.parse(raw.envelope) : undefined,
+        approvedByUserId: raw.approvedByUserId,
+        cognitoSub: raw.cognitoSub,
+        tenantId: raw.tenantId,
+        agentLabel: raw.agentLabel,
+        sourceIp: raw.sourceIp,
+        sessionId: raw.sessionId,
+    };
+}
+//# sourceMappingURL=device-authorization.js.map

package/dist/lib/oauth/device-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../../../src/lib/oauth/device-authorization.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAgGH,wCAGC;AAGD,8CAEC;AAGD,oCAEC;AAOD,4CAaC;AAGD,gDAEC;AAMD,4DAsEC;AAGD,4CAWC;AAGD,gEAYC;AAMD,sDAuBC;AAGD,oDAOC;AAgBD,8CA4BC;AAOD,wCAyCC;AAhXD,8DAOkC;AAClC,0DAA8D;AAC9D,6CAAsD;AACtD,uDAAgF;AAEhF,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,kEAAkE;AACrD,QAAA,aAAa,GAAG,CAAC,CAAC;AAC/B,mCAAmC;AACtB,QAAA,kBAAkB,GAAG,GAAG,CAAC;AACtC,yCAAyC;AAC5B,QAAA,gBAAgB,GAAG,CAAC,CAAC;AAClC,uEAAuE;AAC1D,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAC5C,oFAAoF;AACvE,QAAA,uBAAuB,GAAG,EAAE,CAAC;AA0D1C,MAAM,GAAG,GAAG,IAAI,gCAAc,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtF,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,sBAAsB,CACpD,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAa;QAAE,OAAO,GAAG,CAAC;IAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,SAAgB,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,MAA6B,yBAAW;IACvE,MAAM,QAAQ,GAAG,0BAAkB,CAAC,MAAM,CAAC,CAAC,KAAK;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,uBAAuB;IAC7E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,GAAG,qBAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,qBAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,qBAAa,EAAE,CAAC,EAAE,EAAE,CAAC;YAClE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YAClB,IAAI,CAAC,IAAI,MAAM;gBAAE,SAAS;YAC1B,GAAG,CAAC,IAAI,CAAC,0BAAkB,CAAC,CAAC,GAAG,QAAQ,CAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,2CAA2C;AAC3C,SAAgB,kBAAkB,CAAC,MAA6B,yBAAW;IACzE,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,0BAAkB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,wBAAgB,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC;IAElC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAqB;QAC/B,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,GAAG;QACd,QAAQ;QACR,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EACZ;YACE,EAAE,EAAE,MAAM,UAAU,EAAE;YACtB,EAAE,EAAE,KAAK;YACT,GAAG,MAAM;YACT,gDAAgD;YAChD,GAAG,EAAE,SAAS;SACf,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;QACD,mBAAmB,EAAE,0BAA0B;KAChD,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,IAAI,EAAE,IAAA,wBAAQ,EACZ;YACE,EAAE,EAAE,MAAM,YAAY,EAAE;YACxB,EAAE,EAAE,KAAK;YACT,UAAU;YACV,SAAS,EAAE,GAAG;YACd,GAAG,EAAE,SAAS;SACf,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAChC;KACF,CAAC,CACH,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;QACnC,gBAAgB,EAAE,KAAK,CAAC,mBAAmB;QAC3C,yBAAyB,EAAE,GAAG,KAAK,CAAC,mBAAmB,cAAc,cAAc,CAAC,QAAQ,CAAC,EAAE;QAC/F,UAAU,EAAE,SAAS;QACrB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACrD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,IAAI,CAA+C,CAAC;IAC/E,IAAI,GAAG,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IAC/D,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,gCAAc,CAAC;QACjB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,YAAY,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACvD,CAAC,CACH,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,IAAI,CAA+C,CAAC;IAC/E,IAAI,GAAG,CAAC,GAAG,IAAK,GAAG,CAAC,GAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAQ,GAAG,CAAC,UAAqB,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CACxB,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,SAAS,EAAE;YACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACpD,gBAAgB,EAAE,wBAAwB;YAC1C,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAClD,mBAAmB,EAAE,sBAAsB;YAC3C,YAAY,EAAE,SAAS;SACxB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAA,0BAAU,EAAC,GAAG,CAAC,UAAU,CAA+B,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,IAAI,+BAAuB,EAAE,CAAC;YACxC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iDAA+B;YAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IAC1D,MAAM,GAAG,GAAG,MAAM,IAAA,4BAAU,GAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAA,sBAAI,EAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iCAAyB,CAAC;IAEzE,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;QACpB,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACxD,gBAAgB,EACd,sKAAsK;QACxK,mBAAmB,EAAE,6CAA6C;QAClE,wBAAwB,EAAE;YACxB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,KAAK;SAClB;QACD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC;YAClC,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,gBAAgB;YAC1B,IAAI,EAAE,GAAG,CAAC,UAAU;YACpB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,MAAM,EAAE,GAAG,CAAC,SAAS;YACrB,MAAM,EAAE,MAAM;SACf,CAAC;KACH,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAExC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAE7D,uDAAuD;IACvD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mCAAiB,CAAC;gBACpB,SAAS,EAAE,SAAS,EAAE;gBACtB,GAAG,EAAE,IAAA,wBAAQ,EAAC,EAAE,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBACpD,gBAAgB,EAAE,uBAAuB;gBACzC,mBAAmB,EAAE,6CAA6C;gBAClE,wBAAwB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;gBACjD,yBAAyB,EAAE,IAAA,wBAAQ,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;aAC7E,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,iDAA+B,CAAC;gBAAE,MAAM,GAAG,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,IAAA,4BAAU,GAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAA,sBAAI,EAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAa,CAAC;IAEjD,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,YAAY,EAAE,GAAG,CAAC,YAAsB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,MAAM,EAAE,GAAG,CAAC,MAA2C;QACvD,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,SAAS,EAAE,GAAG,CAAC,SAAmB;QAClC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,aAAa,EAAG,GAAG,CAAC,aAAwB,IAAI,CAAC;QACjD,YAAY,EAAE,GAAG,CAAC,YAAkC;QACpD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAoB,CAAC,CAAC,CAAC,SAAS;QAC3F,gBAAgB,EAAE,GAAG,CAAC,gBAAsC;QAC5D,UAAU,EAAE,GAAG,CAAC,UAAgC;QAChD,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,UAAU,EAAE,GAAG,CAAC,UAAgC;QAChD,QAAQ,EAAE,GAAG,CAAC,QAA8B;QAC5C,SAAS,EAAE,GAAG,CAAC,SAA+B;KAC/C,CAAC;AACJ,CAAC"}