@invect/core 0.0.1

package/dist/services/credentials/credentials.service.d.ts

@@ -0,0 +1,156 @@
+import { Logger } from "../../types/schemas-fresh/invect-config.js";
+import { EncryptionService } from "./encryption.service.js";
+import { InvectAdapter } from "../../database/adapter.js";
+import { Credential as Credential$1 } from "./credentials.model.js";
+import { OAuth2Service } from "./oauth2.service.js";
+import { CredentialAuthType, CredentialConfig, CredentialType } from "../../database/schema-sqlite.js";
+
+//#region src/services/credentials/credentials.service.d.ts
+type Credential = Credential$1;
+interface CreateCredentialInput {
+  name: string;
+  type: CredentialType;
+  authType: CredentialAuthType;
+  config: CredentialConfig;
+  description?: string;
+  workspaceId?: string;
+  isShared?: boolean;
+  metadata?: Record<string, unknown>;
+  expiresAt?: string;
+}
+interface UpdateCredentialInput {
+  name?: string;
+  type?: CredentialType;
+  authType?: CredentialAuthType;
+  config?: CredentialConfig;
+  description?: string;
+  isActive?: boolean;
+  isShared?: boolean;
+  metadata?: Record<string, unknown>;
+  expiresAt?: string;
+}
+interface CredentialFilters {
+  type?: CredentialType;
+  authType?: CredentialAuthType;
+  isActive?: boolean;
+  workspaceId?: string;
+  includeShared?: boolean;
+}
+interface CredentialUsage {
+  flowsCount: number;
+  nodesCount: number;
+  lastUsedAt: string | null;
+}
+interface CredentialWebhookInfo {
+  webhookPath: string;
+  fullUrl: string;
+}
+declare class CredentialsService {
+  private adapter;
+  private encryption;
+  private logger;
+  private model;
+  private oauth2Service;
+  constructor(adapter: InvectAdapter, encryption: EncryptionService, logger: Logger);
+  /**
+   * Get the OAuth2 service instance
+   */
+  getOAuth2Service(): OAuth2Service;
+  /**
+   * Create a new credential
+   * Automatically encrypts the config
+   */
+  create(input: CreateCredentialInput): Promise<Credential>;
+  /**
+   * Get a credential by ID
+   * Decrypts the config before returning
+   */
+  get(id: string): Promise<Credential>;
+  /**
+   * Alias for get() - Get a decrypted credential by ID
+   */
+  getDecrypted(id: string): Promise<Credential>;
+  /**
+   * Get a decrypted credential and automatically refresh OAuth2 tokens if expired
+   *
+   * This method:
+   * 1. Gets the credential with decrypted config
+   * 2. Checks if it's an OAuth2 credential with expired token
+   * 3. If expired and has refresh token, refreshes the token
+   * 4. Updates the credential in database with new token
+   * 5. Returns the credential with fresh token
+   *
+   * @param id - Credential ID
+   * @returns Credential with valid (possibly refreshed) access token
+   */
+  getDecryptedWithRefresh(id: string): Promise<Credential>;
+  /**
+   * List all credentials
+   * Does NOT decrypt configs (for security)
+   * Use get() to decrypt a specific credential
+   */
+  list(filters?: CredentialFilters): Promise<Array<Omit<Credential, 'config'>>>;
+  /**
+   * Update a credential
+   * Re-encrypts config if provided
+   */
+  update(id: string, input: UpdateCredentialInput): Promise<Credential>;
+  /**
+   * Delete a credential
+   */
+  delete(id: string): Promise<void>;
+  /**
+   * Update the lastUsedAt timestamp
+   * Called by execution engine when credential is used
+   */
+  updateLastUsed(id: string): Promise<void>;
+  /**
+   * Get credential usage information
+   * Returns how many flows/nodes use this credential
+   */
+  getUsage(id: string): Promise<CredentialUsage>;
+  /**
+   * Test a credential by making a test API call
+   * Returns true if credential is valid
+   */
+  test(id: string): Promise<{
+    success: boolean;
+    error?: string;
+  }>;
+  /**
+   * Check if a credential has expired
+   */
+  isExpired(credential: Credential | null): boolean;
+  /**
+   * Get credentials that are about to expire
+   * Useful for sending notifications
+   */
+  getExpiringCredentials(daysUntilExpiry?: number): Promise<Credential[]>;
+  getWebhookInfo(id: string): Promise<CredentialWebhookInfo | null>;
+  enableWebhook(id: string): Promise<CredentialWebhookInfo>;
+  findByWebhookPath(webhookPath: string): Promise<Credential | null>;
+  /**
+   * Check if a user can access a credential
+   * For now, all credentials are accessible since we removed userId
+   */
+  private canAccess;
+  /**
+   * Test bearer token credential
+   */
+  private testBearerToken;
+  /**
+   * Test API key credential
+   */
+  private testApiKey;
+  /**
+   * Test basic auth credential
+   */
+  private testBasicAuth;
+  /**
+   * Test database connection string credential
+   */
+  private testConnectionString;
+}
+//#endregion
+export { CreateCredentialInput, Credential, CredentialFilters, CredentialUsage, CredentialWebhookInfo, CredentialsService, UpdateCredentialInput };
+//# sourceMappingURL=credentials.service.d.ts.map

package/dist/services/credentials/credentials.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.service.d.ts","names":[],"sources":["../../../src/services/credentials/credentials.service.ts"],"mappings":";;;;;;;;KAqBY,UAAA,GAAa,YAAA;AAAA,UAER,qBAAA;EACf,IAAA;EACA,IAAA,EAAM,cAAA;EACN,QAAA,EAAU,kBAAA;EACV,MAAA,EAAQ,gBAAA;EACR,WAAA;EACA,WAAA;EACA,QAAA;EACA,QAAA,GAAW,MAAA;EACX,SAAA;AAAA;AAAA,UAGe,qBAAA;EACf,IAAA;EACA,IAAA,GAAO,cAAA;EACP,QAAA,GAAW,kBAAA;EACX,MAAA,GAAS,gBAAA;EACT,WAAA;EACA,QAAA;EACA,QAAA;EACA,QAAA,GAAW,MAAA;EACX,SAAA;AAAA;AAAA,UAGe,iBAAA;EACf,IAAA,GAAO,cAAA;EACP,QAAA,GAAW,kBAAA;EACX,QAAA;EACA,WAAA;EACA,aAAA;AAAA;AAAA,UAGe,eAAA;EACf,UAAA;EACA,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,qBAAA;EACf,WAAA;EACA,OAAA;AAAA;AAAA,cAMW,kBAAA;EAAA,QAKD,OAAA;EAAA,QACA,UAAA;EAAA,QACA,MAAA;EAAA,QANF,KAAA;EAAA,QACA,aAAA;cAGE,OAAA,EAAS,aAAA,EACT,UAAA,EAAY,iBAAA,EACZ,MAAA,EAAQ,MAAA;EAhClB;;;EAyCA,gBAAA,CAAA,GAAoB,aAAA;EAtCY;;;;EA8C1B,MAAA,CAAO,KAAA,EAAO,qBAAA,GAAwB,OAAA,CAAQ,UAAA;EA5CpD;;;;EAqEM,GAAA,CAAI,EAAA,WAAa,OAAA,CAAQ,UAAA;EAlElB;;AAGf;EAoFQ,YAAA,CAAa,EAAA,WAAa,OAAA,CAAQ,UAAA;;;;;;;;AA9E1C;;;;;AAQA;EAuFQ,uBAAA,CAAwB,EAAA,WAAa,OAAA,CAAQ,UAAA;;;;;;EAwE7C,IAAA,CAAK,OAAA,GAAU,iBAAA,GAAoB,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,UAAA;EAvIR;;;;EAsK9C,MAAA,CAAO,EAAA,UAAY,KAAA,EAAO,qBAAA,GAAwB,OAAA,CAAQ,UAAA;EAxHhC;;;EA2J1B,MAAA,CAAO,EAAA,WAAa,OAAA;EAlEkC;;;;EAuFtD,cAAA,CAAe,EAAA,WAAa,OAAA;EAxD8B;;;;EAgE1D,QAAA,CAAS,EAAA,WAAa,OAAA,CAAQ,eAAA;EAAR;;;;EAkBtB,IAAA,CAAK,EAAA,WAAa,OAAA;IAAU,OAAA;IAAkB,KAAA;EAAA;EAiFnB;;;EAzCjC,SAAA,CAAU,UAAA,EAAY,UAAA;EA6D+B;;;;EAhD/C,sBAAA,CAAuB,eAAA,YAA8B,OAAA,CAAQ,UAAA;EAe7D,cAAA,CAAe,EAAA,WAAa,OAAA,CAAQ,qBAAA;EAapC,aAAA,CAAc,EAAA,WAAa,OAAA,CAAQ,qBAAA;EAoBnC,iBAAA,CAAkB,WAAA,WAAsB,OAAA,CAAQ,UAAA;EAhX5C;;;;EAAA,QA4XF,SAAA;EAjXR;;;EAAA,QA6Xc,eAAA;EArXD;;;EAAA,QAgdC,UAAA;EAvbJ;;;EAAA,QA6cI,aAAA;EAxbK;;;EAAA,QA8cL,oBAAA;AAAA"}

package/dist/services/credentials/credentials.service.js

@@ -0,0 +1,357 @@
+import { CredentialsModel } from "./credentials.model.js";
+import { createOAuth2Service } from "./oauth2.service.js";
+import { randomUUID } from "node:crypto";
+//#region src/services/credentials/credentials.service.ts
+/**
+* Credentials Service
+*
+* Business logic for managing API credentials
+* Uses CredentialsModel for database operations
+* Handles encryption/decryption transparently
+*/
+var CredentialsService = class {
+	model;
+	oauth2Service;
+	constructor(adapter, encryption, logger) {
+		this.adapter = adapter;
+		this.encryption = encryption;
+		this.logger = logger;
+		this.model = new CredentialsModel(adapter, logger);
+		this.oauth2Service = createOAuth2Service(logger);
+	}
+	/**
+	* Get the OAuth2 service instance
+	*/
+	getOAuth2Service() {
+		return this.oauth2Service;
+	}
+	/**
+	* Create a new credential
+	* Automatically encrypts the config
+	*/
+	async create(input) {
+		const encryptedConfigString = this.encryption.encryptObject(input.config);
+		const credential = await this.model.create({
+			...input,
+			config: encryptedConfigString
+		});
+		const decryptedConfig = this.encryption.decryptObject(typeof credential.config === "string" ? credential.config : JSON.stringify(credential.config));
+		return {
+			...credential,
+			config: decryptedConfig
+		};
+	}
+	/**
+	* Get a credential by ID
+	* Decrypts the config before returning
+	*/
+	async get(id) {
+		const credential = await this.model.findById(id);
+		if (!credential) throw new Error("Credential not found");
+		const decryptedConfig = this.encryption.decryptObject(typeof credential.config === "string" ? credential.config : JSON.stringify(credential.config));
+		return {
+			...credential,
+			config: decryptedConfig
+		};
+	}
+	/**
+	* Alias for get() - Get a decrypted credential by ID
+	*/
+	async getDecrypted(id) {
+		return this.get(id);
+	}
+	/**
+	* Get a decrypted credential and automatically refresh OAuth2 tokens if expired
+	*
+	* This method:
+	* 1. Gets the credential with decrypted config
+	* 2. Checks if it's an OAuth2 credential with expired token
+	* 3. If expired and has refresh token, refreshes the token
+	* 4. Updates the credential in database with new token
+	* 5. Returns the credential with fresh token
+	*
+	* @param id - Credential ID
+	* @returns Credential with valid (possibly refreshed) access token
+	*/
+	async getDecryptedWithRefresh(id) {
+		const credential = await this.get(id);
+		if (credential.authType === "oauth2" && this.oauth2Service.isTokenExpired(credential.config) && this.oauth2Service.canRefresh(credential.config)) {
+			this.logger.info("Refreshing expired OAuth2 token", {
+				credentialId: id,
+				provider: credential.config.oauth2Provider
+			});
+			try {
+				const appConfig = {
+					clientId: credential.config.clientId,
+					clientSecret: credential.config.clientSecret,
+					redirectUri: ""
+				};
+				const newTokens = await this.oauth2Service.refreshAccessToken(credential.config.refreshToken, credential.config.oauth2Provider, appConfig);
+				const now = /* @__PURE__ */ new Date();
+				const expiresAt = newTokens.expiresIn ? new Date(now.getTime() + newTokens.expiresIn * 1e3).toISOString() : void 0;
+				const updatedConfig = {
+					...credential.config,
+					accessToken: newTokens.accessToken,
+					refreshToken: newTokens.refreshToken || credential.config.refreshToken,
+					expiresAt
+				};
+				await this.update(id, { config: updatedConfig });
+				this.logger.info("OAuth2 token refreshed successfully", { credentialId: id });
+				return {
+					...credential,
+					config: updatedConfig
+				};
+			} catch (error) {
+				this.logger.error("Failed to refresh OAuth2 token", {
+					credentialId: id,
+					error: error instanceof Error ? error.message : "Unknown error"
+				});
+				return credential;
+			}
+		}
+		return credential;
+	}
+	/**
+	* List all credentials
+	* Does NOT decrypt configs (for security)
+	* Use get() to decrypt a specific credential
+	*/
+	async list(filters) {
+		let filtered = (await this.model.findAll()).data;
+		if (filters?.type) filtered = filtered.filter((c) => c.type === filters.type);
+		if (filters?.authType) filtered = filtered.filter((c) => c.authType === filters.authType);
+		if (filters?.isActive !== void 0) filtered = filtered.filter((c) => c.isActive === filters.isActive);
+		return filtered.map((cred) => {
+			const { config: _config, ...rest } = cred;
+			return rest;
+		});
+	}
+	/**
+	* Update a credential
+	* Re-encrypts config if provided
+	*/
+	async update(id, input) {
+		await this.get(id);
+		const updateData = { ...input };
+		if (input.config !== void 0) updateData.config = this.encryption.encryptObject(input.config);
+		const updated = await this.model.update(id, updateData);
+		if (updated.config) {
+			const decryptedConfig = this.encryption.decryptObject(JSON.stringify(updated.config));
+			return {
+				...updated,
+				config: decryptedConfig
+			};
+		}
+		return updated;
+	}
+	/**
+	* Delete a credential
+	*/
+	async delete(id) {
+		await this.get(id);
+		const usage = await this.getUsage(id);
+		if (usage.nodesCount > 0) throw new Error(`Cannot delete credential. It is currently used in ${usage.nodesCount} nodes. Please remove all references before deleting.`);
+		await this.model.delete(id);
+	}
+	/**
+	* Update the lastUsedAt timestamp
+	* Called by execution engine when credential is used
+	*/
+	async updateLastUsed(id) {
+		await this.model.updateLastUsed(id);
+	}
+	/**
+	* Get credential usage information
+	* Returns how many flows/nodes use this credential
+	*/
+	async getUsage(id) {
+		const credential = await this.model.findById(id);
+		if (!credential) throw new Error("Credential not found");
+		return {
+			flowsCount: 0,
+			nodesCount: 0,
+			lastUsedAt: credential.lastUsedAt || null
+		};
+	}
+	/**
+	* Test a credential by making a test API call
+	* Returns true if credential is valid
+	*/
+	async test(id) {
+		try {
+			const credential = await this.get(id);
+			if (!credential) return {
+				success: false,
+				error: "Credential not found"
+			};
+			switch (credential.authType) {
+				case "bearer":
+				case "oauth2": return await this.testBearerToken(credential);
+				case "apiKey": return await this.testApiKey(credential);
+				case "basic": return await this.testBasicAuth(credential);
+				case "connectionString": return await this.testConnectionString(credential);
+				default: return {
+					success: false,
+					error: `Testing not implemented for auth type: ${credential.authType}`
+				};
+			}
+		} catch (error) {
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : "Unknown error"
+			};
+		}
+	}
+	/**
+	* Check if a credential has expired
+	*/
+	isExpired(credential) {
+		if (!credential || !credential.expiresAt) return false;
+		return new Date(credential.expiresAt) < /* @__PURE__ */ new Date();
+	}
+	/**
+	* Get credentials that are about to expire
+	* Useful for sending notifications
+	*/
+	async getExpiringCredentials(daysUntilExpiry = 7) {
+		return (await this.model.getExpiredCredentials(daysUntilExpiry)).map((cred) => {
+			const decryptedConfig = this.encryption.decryptObject(JSON.stringify(cred.config));
+			return {
+				...cred,
+				config: decryptedConfig
+			};
+		});
+	}
+	async getWebhookInfo(id) {
+		const credential = await this.get(id);
+		if (!credential.webhookPath) return null;
+		return {
+			webhookPath: credential.webhookPath,
+			fullUrl: `/webhooks/credentials/${credential.webhookPath}`
+		};
+	}
+	async enableWebhook(id) {
+		const existing = await this.getWebhookInfo(id);
+		if (existing) return existing;
+		const webhookPath = randomUUID().replace(/-/g, "").slice(0, 24);
+		const webhookSecret = randomUUID().replace(/-/g, "");
+		const updated = await this.model.enableWebhook(id, webhookPath, webhookSecret);
+		if (!updated.webhookPath) throw new Error("Failed to enable webhook for credential");
+		return {
+			webhookPath: updated.webhookPath,
+			fullUrl: `/webhooks/credentials/${updated.webhookPath}`
+		};
+	}
+	async findByWebhookPath(webhookPath) {
+		return this.model.findByWebhookPath(webhookPath);
+	}
+	/**
+	* Check if a user can access a credential
+	* For now, all credentials are accessible since we removed userId
+	*/
+	canAccess(credential, _userId) {
+		if (!credential) return false;
+		return true;
+	}
+	/**
+	* Test bearer token credential
+	*/
+	async testBearerToken(credential) {
+		if (!credential) return {
+			success: false,
+			error: "Credential not found"
+		};
+		const endpoints = { "http-api": {
+			anthropic: "https://api.anthropic.com/v1/models",
+			github: "https://api.github.com/user",
+			linear: "https://api.linear.app/graphql",
+			stripe: "https://api.stripe.com/v1/customers?limit=1",
+			openai: "https://api.openai.com/v1/models"
+		} }[credential.type];
+		if (!endpoints) return {
+			success: false,
+			error: `No test endpoints configured for credential type: ${credential.type}`
+		};
+		const token = credential.authType === "oauth2" ? credential.config?.accessToken : credential.config?.token;
+		if (!token) return {
+			success: false,
+			error: "Token not found in credential config"
+		};
+		const providerHint = credential.metadata?.provider;
+		const endpoint = providerHint ? endpoints[providerHint.toLowerCase()] : void 0;
+		if (!endpoint) return {
+			success: true,
+			error: "Token found but no test endpoint available. Add provider to metadata for testing."
+		};
+		try {
+			const providerHeaders = { "Content-Type": "application/json" };
+			if (providerHint?.toLowerCase() === "anthropic") {
+				providerHeaders["x-api-key"] = token;
+				providerHeaders["anthropic-version"] = "2023-06-01";
+			} else providerHeaders.Authorization = `Bearer ${token}`;
+			const requestInit = { headers: providerHeaders };
+			if (providerHint?.toLowerCase() === "linear") {
+				requestInit.method = "POST";
+				requestInit.body = JSON.stringify({ query: "query CredentialHealthcheck { viewer { id name } }" });
+			}
+			const response = await fetch(endpoint, requestInit);
+			if (response.ok) return { success: true };
+			const errorText = await response.text();
+			return {
+				success: false,
+				error: `HTTP ${response.status}: ${errorText}`
+			};
+		} catch (error) {
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : "Network error"
+			};
+		}
+	}
+	/**
+	* Test API key credential
+	*/
+	async testApiKey(credential) {
+		if (!credential) return {
+			success: false,
+			error: "Credential not found"
+		};
+		if (!credential.config?.apiKey) return {
+			success: false,
+			error: "API key is empty"
+		};
+		return { success: true };
+	}
+	/**
+	* Test basic auth credential
+	*/
+	async testBasicAuth(credential) {
+		if (!credential) return {
+			success: false,
+			error: "Credential not found"
+		};
+		if (!credential.config?.username || !credential.config?.password) return {
+			success: false,
+			error: "Username or password is empty"
+		};
+		return { success: true };
+	}
+	/**
+	* Test database connection string credential
+	*/
+	async testConnectionString(credential) {
+		if (!credential) return {
+			success: false,
+			error: "Credential not found"
+		};
+		if (!credential.config?.connectionString) return {
+			success: false,
+			error: "Connection string is empty"
+		};
+		return { success: true };
+	}
+};
+//#endregion
+export { CredentialsService };
+
+//# sourceMappingURL=credentials.service.js.map

package/dist/services/credentials/credentials.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.service.js","names":[],"sources":["../../../src/services/credentials/credentials.service.ts"],"sourcesContent":["/**\n * Credentials Service\n *\n * Business logic for managing API credentials\n * Uses CredentialsModel for database operations\n * Handles encryption/decryption transparently\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { CredentialsModel } from './credentials.model';\nimport { EncryptionService } from './encryption.service';\nimport type { InvectAdapter } from '../../database/adapter';\nimport type {\n  CredentialConfig,\n  CredentialAuthType,\n  CredentialType,\n} from '../../database/schema-sqlite';\nimport type { Logger } from 'src/types/schemas';\n\nimport type { Credential as ModelCredential } from './credentials.model';\n\nexport type Credential = ModelCredential;\n\nexport interface CreateCredentialInput {\n  name: string;\n  type: CredentialType;\n  authType: CredentialAuthType;\n  config: CredentialConfig;\n  description?: string;\n  workspaceId?: string;\n  isShared?: boolean;\n  metadata?: Record<string, unknown>;\n  expiresAt?: string;\n}\n\nexport interface UpdateCredentialInput {\n  name?: string;\n  type?: CredentialType;\n  authType?: CredentialAuthType;\n  config?: CredentialConfig;\n  description?: string;\n  isActive?: boolean;\n  isShared?: boolean;\n  metadata?: Record<string, unknown>;\n  expiresAt?: string;\n}\n\nexport interface CredentialFilters {\n  type?: CredentialType;\n  authType?: CredentialAuthType;\n  isActive?: boolean;\n  workspaceId?: string;\n  includeShared?: boolean;\n}\n\nexport interface CredentialUsage {\n  flowsCount: number;\n  nodesCount: number;\n  lastUsedAt: string | null;\n}\n\nexport interface CredentialWebhookInfo {\n  webhookPath: string;\n  fullUrl: string;\n}\n\n// Import OAuth2 service for token refresh\nimport { OAuth2Service, createOAuth2Service, type OAuth2AppConfig } from './oauth2.service';\n\nexport class CredentialsService {\n  private model: CredentialsModel;\n  private oauth2Service: OAuth2Service;\n\n  constructor(\n    private adapter: InvectAdapter,\n    private encryption: EncryptionService,\n    private logger: Logger,\n  ) {\n    this.model = new CredentialsModel(adapter, logger);\n    this.oauth2Service = createOAuth2Service(logger);\n  }\n\n  /**\n   * Get the OAuth2 service instance\n   */\n  getOAuth2Service(): OAuth2Service {\n    return this.oauth2Service;\n  }\n\n  /**\n   * Create a new credential\n   * Automatically encrypts the config\n   */\n  async create(input: CreateCredentialInput): Promise<Credential> {\n    // Encrypt the config before storing\n    const encryptedConfigString = this.encryption.encryptObject(input.config);\n\n    // Create the credential via model\n    const credential = await this.model.create({\n      ...input,\n      config: encryptedConfigString as unknown as CredentialConfig,\n    });\n\n    // Decrypt config for return (config is already a string from DB)\n    const decryptedConfig = this.encryption.decryptObject<CredentialConfig>(\n      typeof credential.config === 'string' ? credential.config : JSON.stringify(credential.config),\n    );\n\n    return {\n      ...credential,\n      config: decryptedConfig,\n    };\n  }\n\n  /**\n   * Get a credential by ID\n   * Decrypts the config before returning\n   */\n  async get(id: string): Promise<Credential> {\n    const credential = await this.model.findById(id);\n\n    if (!credential) {\n      throw new Error('Credential not found');\n    }\n\n    // Decrypt the config (config is already a string from DB)\n    const decryptedConfig = this.encryption.decryptObject<CredentialConfig>(\n      typeof credential.config === 'string' ? credential.config : JSON.stringify(credential.config),\n    );\n\n    return {\n      ...credential,\n      config: decryptedConfig,\n    };\n  }\n\n  /**\n   * Alias for get() - Get a decrypted credential by ID\n   */\n  async getDecrypted(id: string): Promise<Credential> {\n    return this.get(id);\n  }\n\n  /**\n   * Get a decrypted credential and automatically refresh OAuth2 tokens if expired\n   *\n   * This method:\n   * 1. Gets the credential with decrypted config\n   * 2. Checks if it's an OAuth2 credential with expired token\n   * 3. If expired and has refresh token, refreshes the token\n   * 4. Updates the credential in database with new token\n   * 5. Returns the credential with fresh token\n   *\n   * @param id - Credential ID\n   * @returns Credential with valid (possibly refreshed) access token\n   */\n  async getDecryptedWithRefresh(id: string): Promise<Credential> {\n    const credential = await this.get(id);\n\n    // Check if this is an OAuth2 credential that needs refresh\n    if (\n      credential.authType === 'oauth2' &&\n      this.oauth2Service.isTokenExpired(credential.config) &&\n      this.oauth2Service.canRefresh(credential.config)\n    ) {\n      this.logger.info('Refreshing expired OAuth2 token', {\n        credentialId: id,\n        provider: credential.config.oauth2Provider,\n      });\n\n      try {\n        const appConfig: OAuth2AppConfig = {\n          // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- checked via canRefresh()\n          clientId: credential.config.clientId!,\n          // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- checked via canRefresh()\n          clientSecret: credential.config.clientSecret!,\n          redirectUri: '', // Not needed for refresh\n        };\n\n        const newTokens = await this.oauth2Service.refreshAccessToken(\n          // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- checked via canRefresh()\n          credential.config.refreshToken!,\n          // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- checked via canRefresh()\n          credential.config.oauth2Provider!,\n          appConfig,\n        );\n\n        // Calculate new expiry time\n        const now = new Date();\n        const expiresAt = newTokens.expiresIn\n          ? new Date(now.getTime() + newTokens.expiresIn * 1000).toISOString()\n          : undefined;\n\n        // Build updated config\n        const updatedConfig: CredentialConfig = {\n          ...credential.config,\n          accessToken: newTokens.accessToken,\n          refreshToken: newTokens.refreshToken || credential.config.refreshToken,\n          expiresAt,\n        };\n\n        // Update in database\n        await this.update(id, { config: updatedConfig });\n\n        this.logger.info('OAuth2 token refreshed successfully', { credentialId: id });\n\n        return {\n          ...credential,\n          config: updatedConfig,\n        };\n      } catch (error) {\n        this.logger.error('Failed to refresh OAuth2 token', {\n          credentialId: id,\n          error: error instanceof Error ? error.message : 'Unknown error',\n        });\n        // Return original credential - let the caller handle the expired token\n        return credential;\n      }\n    }\n\n    return credential;\n  }\n\n  /**\n   * List all credentials\n   * Does NOT decrypt configs (for security)\n   * Use get() to decrypt a specific credential\n   */\n  async list(filters?: CredentialFilters): Promise<Array<Omit<Credential, 'config'>>> {\n    // Get all credentials\n    const allCredentials = await this.model.findAll();\n    const credentials = allCredentials.data;\n\n    // Apply optional filters\n    let filtered = credentials;\n\n    if (filters?.type) {\n      filtered = filtered.filter((c: Credential) => c.type === filters.type);\n    }\n\n    if (filters?.authType) {\n      filtered = filtered.filter((c: Credential) => c.authType === filters.authType);\n    }\n\n    if (filters?.isActive !== undefined) {\n      filtered = filtered.filter((c: Credential) => c.isActive === filters.isActive);\n    }\n\n    // Remove config from results for security\n    return filtered.map((cred: Credential) => {\n      const { config: _config, ...rest } = cred;\n      return rest as Omit<Credential, 'config'>;\n    });\n  }\n\n  /**\n   * Update a credential\n   * Re-encrypts config if provided\n   */\n  async update(id: string, input: UpdateCredentialInput): Promise<Credential> {\n    // Get existing credential to verify it exists\n    const _existing = await this.get(id);\n\n    // Build update object\n    const updateData: UpdateCredentialInput = {\n      ...input,\n    };\n\n    // Encrypt config if provided\n    if (input.config !== undefined) {\n      const encryptedConfigStr = this.encryption.encryptObject(input.config);\n      updateData.config = encryptedConfigStr as unknown as CredentialConfig;\n    }\n\n    // Update the credential\n    const updated = await this.model.update(id, updateData);\n\n    // Decrypt config for return\n    if (updated.config) {\n      const decryptedConfig = this.encryption.decryptObject<CredentialConfig>(\n        JSON.stringify(updated.config),\n      );\n      return {\n        ...updated,\n        config: decryptedConfig,\n      };\n    }\n\n    return updated;\n  }\n\n  /**\n   * Delete a credential\n   */\n  async delete(id: string): Promise<void> {\n    // Verify credential exists\n    await this.get(id);\n\n    // Check if credential is in use\n    const usage = await this.getUsage(id);\n    if (usage.nodesCount > 0) {\n      throw new Error(\n        `Cannot delete credential. It is currently used in ${usage.nodesCount} nodes. ` +\n          `Please remove all references before deleting.`,\n      );\n    }\n\n    // Delete the credential\n    await this.model.delete(id);\n  }\n\n  /**\n   * Update the lastUsedAt timestamp\n   * Called by execution engine when credential is used\n   */\n  async updateLastUsed(id: string): Promise<void> {\n    await this.model.updateLastUsed(id);\n  }\n\n  /**\n   * Get credential usage information\n   * Returns how many flows/nodes use this credential\n   */\n  async getUsage(id: string): Promise<CredentialUsage> {\n    const credential = await this.model.findById(id);\n\n    if (!credential) {\n      throw new Error('Credential not found');\n    }\n\n    return {\n      flowsCount: 0, // TODO: Count flows using this credential\n      nodesCount: 0, // TODO: Count nodes using this credential\n      lastUsedAt: credential.lastUsedAt || null,\n    };\n  }\n\n  /**\n   * Test a credential by making a test API call\n   * Returns true if credential is valid\n   */\n  async test(id: string): Promise<{ success: boolean; error?: string }> {\n    try {\n      const credential = await this.get(id);\n\n      if (!credential) {\n        return { success: false, error: 'Credential not found' };\n      }\n\n      // Test based on auth type\n      switch (credential.authType) {\n        case 'bearer':\n        case 'oauth2':\n          return await this.testBearerToken(credential);\n\n        case 'apiKey':\n          return await this.testApiKey(credential);\n\n        case 'basic':\n          return await this.testBasicAuth(credential);\n\n        case 'connectionString':\n          return await this.testConnectionString(credential);\n\n        default:\n          return {\n            success: false,\n            error: `Testing not implemented for auth type: ${credential.authType}`,\n          };\n      }\n    } catch (error) {\n      return {\n        success: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Check if a credential has expired\n   */\n  isExpired(credential: Credential | null): boolean {\n    if (!credential || !credential.expiresAt) {\n      return false;\n    }\n\n    const expiresAt = new Date(credential.expiresAt);\n    return expiresAt < new Date();\n  }\n\n  /**\n   * Get credentials that are about to expire\n   * Useful for sending notifications\n   */\n  async getExpiringCredentials(daysUntilExpiry: number = 7): Promise<Credential[]> {\n    const expiredCredentials = await this.model.getExpiredCredentials(daysUntilExpiry);\n\n    // Decrypt configs for return\n    return expiredCredentials.map((cred) => {\n      const decryptedConfig = this.encryption.decryptObject<CredentialConfig>(\n        JSON.stringify(cred.config),\n      );\n      return {\n        ...cred,\n        config: decryptedConfig,\n      };\n    });\n  }\n\n  async getWebhookInfo(id: string): Promise<CredentialWebhookInfo | null> {\n    const credential = await this.get(id);\n\n    if (!credential.webhookPath) {\n      return null;\n    }\n\n    return {\n      webhookPath: credential.webhookPath,\n      fullUrl: `/webhooks/credentials/${credential.webhookPath}`,\n    };\n  }\n\n  async enableWebhook(id: string): Promise<CredentialWebhookInfo> {\n    const existing = await this.getWebhookInfo(id);\n    if (existing) {\n      return existing;\n    }\n\n    const webhookPath = randomUUID().replace(/-/g, '').slice(0, 24);\n    const webhookSecret = randomUUID().replace(/-/g, '');\n    const updated = await this.model.enableWebhook(id, webhookPath, webhookSecret);\n\n    if (!updated.webhookPath) {\n      throw new Error('Failed to enable webhook for credential');\n    }\n\n    return {\n      webhookPath: updated.webhookPath,\n      fullUrl: `/webhooks/credentials/${updated.webhookPath}`,\n    };\n  }\n\n  async findByWebhookPath(webhookPath: string): Promise<Credential | null> {\n    return this.model.findByWebhookPath(webhookPath);\n  }\n\n  // ========================================================================\n  // Private Helper Methods\n  // ========================================================================\n\n  /**\n   * Check if a user can access a credential\n   * For now, all credentials are accessible since we removed userId\n   */\n  private canAccess(credential: Credential | null, _userId: string): boolean {\n    if (!credential) {\n      return false;\n    }\n\n    // All credentials are accessible (no user-level permissions)\n    return true;\n  }\n\n  /**\n   * Test bearer token credential\n   */\n  private async testBearerToken(\n    credential: Credential | null,\n  ): Promise<{ success: boolean; error?: string }> {\n    if (!credential) {\n      return { success: false, error: 'Credential not found' };\n    }\n\n    // Type-specific validation endpoints\n    const testEndpoints: Record<string, Record<string, string>> = {\n      'http-api': {\n        anthropic: 'https://api.anthropic.com/v1/models',\n        github: 'https://api.github.com/user',\n        linear: 'https://api.linear.app/graphql',\n        stripe: 'https://api.stripe.com/v1/customers?limit=1',\n        openai: 'https://api.openai.com/v1/models',\n      },\n    };\n\n    const endpoints = testEndpoints[credential.type];\n    if (!endpoints) {\n      return {\n        success: false,\n        error: `No test endpoints configured for credential type: ${credential.type}`,\n      };\n    }\n\n    // For http-api, we could try to detect the provider from metadata or config\n    // For now, just validate the token exists\n    const token =\n      credential.authType === 'oauth2' ? credential.config?.accessToken : credential.config?.token;\n\n    if (!token) {\n      return { success: false, error: 'Token not found in credential config' };\n    }\n\n    // If we have metadata with a provider hint, try to use it\n    const providerHint = credential.metadata?.provider as string | undefined;\n    const endpoint = providerHint ? endpoints[providerHint.toLowerCase()] : undefined;\n\n    if (!endpoint) {\n      return {\n        success: true, // Token exists, but we can't test it without knowing the endpoint\n        error: 'Token found but no test endpoint available. Add provider to metadata for testing.',\n      };\n    }\n\n    try {\n      const providerHeaders: Record<string, string> = {\n        'Content-Type': 'application/json',\n      };\n\n      if (providerHint?.toLowerCase() === 'anthropic') {\n        providerHeaders['x-api-key'] = token;\n        providerHeaders['anthropic-version'] = '2023-06-01';\n      } else {\n        providerHeaders.Authorization = `Bearer ${token}`;\n      }\n\n      const requestInit: RequestInit = {\n        headers: providerHeaders,\n      };\n\n      if (providerHint?.toLowerCase() === 'linear') {\n        requestInit.method = 'POST';\n        requestInit.body = JSON.stringify({\n          query: 'query CredentialHealthcheck { viewer { id name } }',\n        });\n      }\n\n      const response = await fetch(endpoint, requestInit);\n\n      if (response.ok) {\n        return { success: true };\n      }\n\n      const errorText = await response.text();\n      return {\n        success: false,\n        error: `HTTP ${response.status}: ${errorText}`,\n      };\n    } catch (error) {\n      return {\n        success: false,\n        error: error instanceof Error ? error.message : 'Network error',\n      };\n    }\n  }\n\n  /**\n   * Test API key credential\n   */\n  private async testApiKey(\n    credential: Credential | null,\n  ): Promise<{ success: boolean; error?: string }> {\n    if (!credential) {\n      return { success: false, error: 'Credential not found' };\n    }\n\n    // For now, just validate the key exists\n    if (!credential.config?.apiKey) {\n      return {\n        success: false,\n        error: 'API key is empty',\n      };\n    }\n\n    // Could add provider-specific validation here\n    return { success: true };\n  }\n\n  /**\n   * Test basic auth credential\n   */\n  private async testBasicAuth(\n    credential: Credential | null,\n  ): Promise<{ success: boolean; error?: string }> {\n    if (!credential) {\n      return { success: false, error: 'Credential not found' };\n    }\n\n    // Validate username and password exist\n    if (!credential.config?.username || !credential.config?.password) {\n      return {\n        success: false,\n        error: 'Username or password is empty',\n      };\n    }\n\n    // Could add provider-specific validation here\n    return { success: true };\n  }\n\n  /**\n   * Test database connection string credential\n   */\n  private async testConnectionString(\n    credential: Credential | null,\n  ): Promise<{ success: boolean; error?: string }> {\n    if (!credential) {\n      return { success: false, error: 'Credential not found' };\n    }\n\n    if (!credential.config?.connectionString) {\n      return { success: false, error: 'Connection string is empty' };\n    }\n\n    // Future: Try lightweight parse/validation by driver\n    return { success: true };\n  }\n}\n"],"mappings":";;;;;;;;;;;AAqEA,IAAa,qBAAb,MAAgC;CAC9B;CACA;CAEA,YACE,SACA,YACA,QACA;AAHQ,OAAA,UAAA;AACA,OAAA,aAAA;AACA,OAAA,SAAA;AAER,OAAK,QAAQ,IAAI,iBAAiB,SAAS,OAAO;AAClD,OAAK,gBAAgB,oBAAoB,OAAO;;;;;CAMlD,mBAAkC;AAChC,SAAO,KAAK;;;;;;CAOd,MAAM,OAAO,OAAmD;EAE9D,MAAM,wBAAwB,KAAK,WAAW,cAAc,MAAM,OAAO;EAGzE,MAAM,aAAa,MAAM,KAAK,MAAM,OAAO;GACzC,GAAG;GACH,QAAQ;GACT,CAAC;EAGF,MAAM,kBAAkB,KAAK,WAAW,cACtC,OAAO,WAAW,WAAW,WAAW,WAAW,SAAS,KAAK,UAAU,WAAW,OAAO,CAC9F;AAED,SAAO;GACL,GAAG;GACH,QAAQ;GACT;;;;;;CAOH,MAAM,IAAI,IAAiC;EACzC,MAAM,aAAa,MAAM,KAAK,MAAM,SAAS,GAAG;AAEhD,MAAI,CAAC,WACH,OAAM,IAAI,MAAM,uBAAuB;EAIzC,MAAM,kBAAkB,KAAK,WAAW,cACtC,OAAO,WAAW,WAAW,WAAW,WAAW,SAAS,KAAK,UAAU,WAAW,OAAO,CAC9F;AAED,SAAO;GACL,GAAG;GACH,QAAQ;GACT;;;;;CAMH,MAAM,aAAa,IAAiC;AAClD,SAAO,KAAK,IAAI,GAAG;;;;;;;;;;;;;;;CAgBrB,MAAM,wBAAwB,IAAiC;EAC7D,MAAM,aAAa,MAAM,KAAK,IAAI,GAAG;AAGrC,MACE,WAAW,aAAa,YACxB,KAAK,cAAc,eAAe,WAAW,OAAO,IACpD,KAAK,cAAc,WAAW,WAAW,OAAO,EAChD;AACA,QAAK,OAAO,KAAK,mCAAmC;IAClD,cAAc;IACd,UAAU,WAAW,OAAO;IAC7B,CAAC;AAEF,OAAI;IACF,MAAM,YAA6B;KAEjC,UAAU,WAAW,OAAO;KAE5B,cAAc,WAAW,OAAO;KAChC,aAAa;KACd;IAED,MAAM,YAAY,MAAM,KAAK,cAAc,mBAEzC,WAAW,OAAO,cAElB,WAAW,OAAO,gBAClB,UACD;IAGD,MAAM,sBAAM,IAAI,MAAM;IACtB,MAAM,YAAY,UAAU,YACxB,IAAI,KAAK,IAAI,SAAS,GAAG,UAAU,YAAY,IAAK,CAAC,aAAa,GAClE,KAAA;IAGJ,MAAM,gBAAkC;KACtC,GAAG,WAAW;KACd,aAAa,UAAU;KACvB,cAAc,UAAU,gBAAgB,WAAW,OAAO;KAC1D;KACD;AAGD,UAAM,KAAK,OAAO,IAAI,EAAE,QAAQ,eAAe,CAAC;AAEhD,SAAK,OAAO,KAAK,uCAAuC,EAAE,cAAc,IAAI,CAAC;AAE7E,WAAO;KACL,GAAG;KACH,QAAQ;KACT;YACM,OAAO;AACd,SAAK,OAAO,MAAM,kCAAkC;KAClD,cAAc;KACd,OAAO,iBAAiB,QAAQ,MAAM,UAAU;KACjD,CAAC;AAEF,WAAO;;;AAIX,SAAO;;;;;;;CAQT,MAAM,KAAK,SAAyE;EAMlF,IAAI,YAJmB,MAAM,KAAK,MAAM,SAAS,EACd;AAKnC,MAAI,SAAS,KACX,YAAW,SAAS,QAAQ,MAAkB,EAAE,SAAS,QAAQ,KAAK;AAGxE,MAAI,SAAS,SACX,YAAW,SAAS,QAAQ,MAAkB,EAAE,aAAa,QAAQ,SAAS;AAGhF,MAAI,SAAS,aAAa,KAAA,EACxB,YAAW,SAAS,QAAQ,MAAkB,EAAE,aAAa,QAAQ,SAAS;AAIhF,SAAO,SAAS,KAAK,SAAqB;GACxC,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,UAAO;IACP;;;;;;CAOJ,MAAM,OAAO,IAAY,OAAmD;AAExD,QAAM,KAAK,IAAI,GAAG;EAGpC,MAAM,aAAoC,EACxC,GAAG,OACJ;AAGD,MAAI,MAAM,WAAW,KAAA,EAEnB,YAAW,SADgB,KAAK,WAAW,cAAc,MAAM,OAAO;EAKxE,MAAM,UAAU,MAAM,KAAK,MAAM,OAAO,IAAI,WAAW;AAGvD,MAAI,QAAQ,QAAQ;GAClB,MAAM,kBAAkB,KAAK,WAAW,cACtC,KAAK,UAAU,QAAQ,OAAO,CAC/B;AACD,UAAO;IACL,GAAG;IACH,QAAQ;IACT;;AAGH,SAAO;;;;;CAMT,MAAM,OAAO,IAA2B;AAEtC,QAAM,KAAK,IAAI,GAAG;EAGlB,MAAM,QAAQ,MAAM,KAAK,SAAS,GAAG;AACrC,MAAI,MAAM,aAAa,EACrB,OAAM,IAAI,MACR,qDAAqD,MAAM,WAAW,uDAEvE;AAIH,QAAM,KAAK,MAAM,OAAO,GAAG;;;;;;CAO7B,MAAM,eAAe,IAA2B;AAC9C,QAAM,KAAK,MAAM,eAAe,GAAG;;;;;;CAOrC,MAAM,SAAS,IAAsC;EACnD,MAAM,aAAa,MAAM,KAAK,MAAM,SAAS,GAAG;AAEhD,MAAI,CAAC,WACH,OAAM,IAAI,MAAM,uBAAuB;AAGzC,SAAO;GACL,YAAY;GACZ,YAAY;GACZ,YAAY,WAAW,cAAc;GACtC;;;;;;CAOH,MAAM,KAAK,IAA2D;AACpE,MAAI;GACF,MAAM,aAAa,MAAM,KAAK,IAAI,GAAG;AAErC,OAAI,CAAC,WACH,QAAO;IAAE,SAAS;IAAO,OAAO;IAAwB;AAI1D,WAAQ,WAAW,UAAnB;IACE,KAAK;IACL,KAAK,SACH,QAAO,MAAM,KAAK,gBAAgB,WAAW;IAE/C,KAAK,SACH,QAAO,MAAM,KAAK,WAAW,WAAW;IAE1C,KAAK,QACH,QAAO,MAAM,KAAK,cAAc,WAAW;IAE7C,KAAK,mBACH,QAAO,MAAM,KAAK,qBAAqB,WAAW;IAEpD,QACE,QAAO;KACL,SAAS;KACT,OAAO,0CAA0C,WAAW;KAC7D;;WAEE,OAAO;AACd,UAAO;IACL,SAAS;IACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IACjD;;;;;;CAOL,UAAU,YAAwC;AAChD,MAAI,CAAC,cAAc,CAAC,WAAW,UAC7B,QAAO;AAIT,SADkB,IAAI,KAAK,WAAW,UAAU,mBAC7B,IAAI,MAAM;;;;;;CAO/B,MAAM,uBAAuB,kBAA0B,GAA0B;AAI/E,UAH2B,MAAM,KAAK,MAAM,sBAAsB,gBAAgB,EAGxD,KAAK,SAAS;GACtC,MAAM,kBAAkB,KAAK,WAAW,cACtC,KAAK,UAAU,KAAK,OAAO,CAC5B;AACD,UAAO;IACL,GAAG;IACH,QAAQ;IACT;IACD;;CAGJ,MAAM,eAAe,IAAmD;EACtE,MAAM,aAAa,MAAM,KAAK,IAAI,GAAG;AAErC,MAAI,CAAC,WAAW,YACd,QAAO;AAGT,SAAO;GACL,aAAa,WAAW;GACxB,SAAS,yBAAyB,WAAW;GAC9C;;CAGH,MAAM,cAAc,IAA4C;EAC9D,MAAM,WAAW,MAAM,KAAK,eAAe,GAAG;AAC9C,MAAI,SACF,QAAO;EAGT,MAAM,cAAc,YAAY,CAAC,QAAQ,MAAM,GAAG,CAAC,MAAM,GAAG,GAAG;EAC/D,MAAM,gBAAgB,YAAY,CAAC,QAAQ,MAAM,GAAG;EACpD,MAAM,UAAU,MAAM,KAAK,MAAM,cAAc,IAAI,aAAa,cAAc;AAE9E,MAAI,CAAC,QAAQ,YACX,OAAM,IAAI,MAAM,0CAA0C;AAG5D,SAAO;GACL,aAAa,QAAQ;GACrB,SAAS,yBAAyB,QAAQ;GAC3C;;CAGH,MAAM,kBAAkB,aAAiD;AACvE,SAAO,KAAK,MAAM,kBAAkB,YAAY;;;;;;CAWlD,UAAkB,YAA+B,SAA0B;AACzE,MAAI,CAAC,WACH,QAAO;AAIT,SAAO;;;;;CAMT,MAAc,gBACZ,YAC+C;AAC/C,MAAI,CAAC,WACH,QAAO;GAAE,SAAS;GAAO,OAAO;GAAwB;EAc1D,MAAM,YAVwD,EAC5D,YAAY;GACV,WAAW;GACX,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACT,EACF,CAE+B,WAAW;AAC3C,MAAI,CAAC,UACH,QAAO;GACL,SAAS;GACT,OAAO,qDAAqD,WAAW;GACxE;EAKH,MAAM,QACJ,WAAW,aAAa,WAAW,WAAW,QAAQ,cAAc,WAAW,QAAQ;AAEzF,MAAI,CAAC,MACH,QAAO;GAAE,SAAS;GAAO,OAAO;GAAwC;EAI1E,MAAM,eAAe,WAAW,UAAU;EAC1C,MAAM,WAAW,eAAe,UAAU,aAAa,aAAa,IAAI,KAAA;AAExE,MAAI,CAAC,SACH,QAAO;GACL,SAAS;GACT,OAAO;GACR;AAGH,MAAI;GACF,MAAM,kBAA0C,EAC9C,gBAAgB,oBACjB;AAED,OAAI,cAAc,aAAa,KAAK,aAAa;AAC/C,oBAAgB,eAAe;AAC/B,oBAAgB,uBAAuB;SAEvC,iBAAgB,gBAAgB,UAAU;GAG5C,MAAM,cAA2B,EAC/B,SAAS,iBACV;AAED,OAAI,cAAc,aAAa,KAAK,UAAU;AAC5C,gBAAY,SAAS;AACrB,gBAAY,OAAO,KAAK,UAAU,EAChC,OAAO,sDACR,CAAC;;GAGJ,MAAM,WAAW,MAAM,MAAM,UAAU,YAAY;AAEnD,OAAI,SAAS,GACX,QAAO,EAAE,SAAS,MAAM;GAG1B,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,UAAO;IACL,SAAS;IACT,OAAO,QAAQ,SAAS,OAAO,IAAI;IACpC;WACM,OAAO;AACd,UAAO;IACL,SAAS;IACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU;IACjD;;;;;;CAOL,MAAc,WACZ,YAC+C;AAC/C,MAAI,CAAC,WACH,QAAO;GAAE,SAAS;GAAO,OAAO;GAAwB;AAI1D,MAAI,CAAC,WAAW,QAAQ,OACtB,QAAO;GACL,SAAS;GACT,OAAO;GACR;AAIH,SAAO,EAAE,SAAS,MAAM;;;;;CAM1B,MAAc,cACZ,YAC+C;AAC/C,MAAI,CAAC,WACH,QAAO;GAAE,SAAS;GAAO,OAAO;GAAwB;AAI1D,MAAI,CAAC,WAAW,QAAQ,YAAY,CAAC,WAAW,QAAQ,SACtD,QAAO;GACL,SAAS;GACT,OAAO;GACR;AAIH,SAAO,EAAE,SAAS,MAAM;;;;;CAM1B,MAAc,qBACZ,YAC+C;AAC/C,MAAI,CAAC,WACH,QAAO;GAAE,SAAS;GAAO,OAAO;GAAwB;AAG1D,MAAI,CAAC,WAAW,QAAQ,iBACtB,QAAO;GAAE,SAAS;GAAO,OAAO;GAA8B;AAIhE,SAAO,EAAE,SAAS,MAAM"}