@invect/core 0.0.1

package/dist/services/credentials/oauth2.service.js

@@ -0,0 +1,251 @@
+import { getAllOAuth2Providers, getOAuth2Provider } from "./oauth2-providers.js";
+import { createHash, randomBytes } from "crypto";
+//#region src/services/credentials/oauth2.service.ts
+/**
+* OAuth2 Service
+*
+* Handles OAuth2 authorization flow:
+* 1. Generate authorization URL with state
+* 2. Exchange authorization code for tokens
+* 3. Refresh access tokens when expired
+*/
+const pendingStates = /* @__PURE__ */ new Map();
+const STATE_EXPIRY_MS = 600 * 1e3;
+function cleanupExpiredStates() {
+	const now = Date.now();
+	for (const [state, pending] of pendingStates.entries()) if (now - pending.createdAt > STATE_EXPIRY_MS) pendingStates.delete(state);
+}
+setInterval(cleanupExpiredStates, 300 * 1e3);
+/**
+* OAuth2 Service for handling authorization flows
+*/
+var OAuth2Service = class {
+	constructor(logger) {
+		this.logger = logger;
+	}
+	/**
+	* Get all available OAuth2 providers
+	*/
+	getProviders() {
+		return getAllOAuth2Providers();
+	}
+	/**
+	* Get a specific OAuth2 provider
+	*/
+	getProvider(providerId) {
+		return getOAuth2Provider(providerId);
+	}
+	/**
+	* Start an OAuth2 authorization flow
+	*
+	* @param providerId - The OAuth2 provider ID
+	* @param appConfig - OAuth app credentials and redirect URI
+	* @param options - Additional options
+	* @returns Authorization URL and state to redirect user to
+	*/
+	startAuthorizationFlow(providerId, appConfig, options = {}) {
+		const provider = getOAuth2Provider(providerId);
+		if (!provider) throw new Error(`Unknown OAuth2 provider: ${providerId}`);
+		const state = randomBytes(32).toString("hex");
+		const codeVerifier = randomBytes(32).toString("base64url");
+		const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+		const params = new URLSearchParams({
+			client_id: appConfig.clientId,
+			redirect_uri: appConfig.redirectUri,
+			response_type: "code",
+			state,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256"
+		});
+		const scopes = options.scopes ?? provider.defaultScopes;
+		if (scopes.length > 0) {
+			const separator = provider.scopeSeparator ?? " ";
+			params.set("scope", scopes.join(separator));
+		}
+		if (provider.additionalAuthParams) for (const [key, value] of Object.entries(provider.additionalAuthParams)) params.set(key, value);
+		const authorizationUrl = `${provider.authorizationUrl}?${params.toString()}`;
+		const pendingState = {
+			state,
+			providerId,
+			codeVerifier,
+			returnUrl: options.returnUrl,
+			credentialName: options.credentialName,
+			createdAt: Date.now()
+		};
+		pendingStates.set(state, pendingState);
+		this.logger.debug("Started OAuth2 flow", {
+			providerId,
+			state
+		});
+		return {
+			authorizationUrl,
+			state,
+			codeVerifier
+		};
+	}
+	/**
+	* Get pending OAuth2 state
+	*/
+	getPendingState(state) {
+		return pendingStates.get(state);
+	}
+	/**
+	* Remove pending OAuth2 state (after successful exchange)
+	*/
+	removePendingState(state) {
+		pendingStates.delete(state);
+	}
+	/**
+	* Exchange authorization code for tokens
+	*
+	* @param code - Authorization code from callback
+	* @param state - State parameter for verification
+	* @param appConfig - OAuth app credentials
+	* @returns OAuth2 tokens
+	*/
+	async exchangeCodeForTokens(code, state, appConfig) {
+		const pendingState = pendingStates.get(state);
+		if (!pendingState) throw new Error("Invalid or expired OAuth state. Please try again.");
+		const provider = getOAuth2Provider(pendingState.providerId);
+		if (!provider) throw new Error(`Unknown OAuth2 provider: ${pendingState.providerId}`);
+		const params = new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: appConfig.redirectUri,
+			client_id: appConfig.clientId,
+			client_secret: appConfig.clientSecret
+		});
+		if (pendingState.codeVerifier) params.set("code_verifier", pendingState.codeVerifier);
+		this.logger.debug("Exchanging code for tokens", { providerId: pendingState.providerId });
+		const response = await fetch(provider.tokenUrl, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body: params.toString()
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			this.logger.error("Token exchange failed", {
+				status: response.status,
+				error: errorText
+			});
+			throw new Error(`Token exchange failed: ${errorText}`);
+		}
+		const data = await response.json();
+		const tokens = {
+			accessToken: data.access_token,
+			refreshToken: data.refresh_token,
+			tokenType: data.token_type || "Bearer",
+			expiresIn: data.expires_in,
+			scope: data.scope,
+			raw: data
+		};
+		pendingStates.delete(state);
+		this.logger.info("OAuth2 tokens obtained", {
+			providerId: pendingState.providerId,
+			hasRefreshToken: !!tokens.refreshToken,
+			expiresIn: tokens.expiresIn
+		});
+		return {
+			tokens,
+			pendingState
+		};
+	}
+	/**
+	* Refresh an expired access token
+	*
+	* @param refreshToken - The refresh token
+	* @param providerId - The OAuth2 provider ID
+	* @param appConfig - OAuth app credentials
+	* @returns New OAuth2 tokens
+	*/
+	async refreshAccessToken(refreshToken, providerId, appConfig) {
+		const provider = getOAuth2Provider(providerId);
+		if (!provider) throw new Error(`Unknown OAuth2 provider: ${providerId}`);
+		if (!provider.supportsRefresh) throw new Error(`Provider ${providerId} does not support token refresh`);
+		const params = new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: appConfig.clientId,
+			client_secret: appConfig.clientSecret
+		});
+		this.logger.debug("Refreshing access token", { providerId });
+		const response = await fetch(provider.tokenUrl, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body: params.toString()
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			this.logger.error("Token refresh failed", {
+				status: response.status,
+				error: errorText
+			});
+			throw new Error(`Token refresh failed: ${errorText}`);
+		}
+		const data = await response.json();
+		const tokens = {
+			accessToken: data.access_token,
+			refreshToken: data.refresh_token || refreshToken,
+			tokenType: data.token_type || "Bearer",
+			expiresIn: data.expires_in,
+			scope: data.scope,
+			raw: data
+		};
+		this.logger.info("Access token refreshed", {
+			providerId,
+			expiresIn: tokens.expiresIn
+		});
+		return tokens;
+	}
+	/**
+	* Build a CredentialConfig from OAuth2 tokens
+	*/
+	buildCredentialConfig(tokens, providerId, appConfig) {
+		const now = /* @__PURE__ */ new Date();
+		const expiresAt = tokens.expiresIn ? new Date(now.getTime() + tokens.expiresIn * 1e3).toISOString() : void 0;
+		return {
+			accessToken: tokens.accessToken,
+			refreshToken: tokens.refreshToken,
+			tokenType: tokens.tokenType,
+			scope: tokens.scope,
+			expiresAt,
+			oauth2Provider: providerId,
+			clientId: appConfig.clientId,
+			clientSecret: appConfig.clientSecret
+		};
+	}
+	/**
+	* Check if a credential's access token is expired or about to expire
+	*
+	* @param config - The credential config
+	* @param bufferSeconds - Buffer time before actual expiry (default 5 minutes)
+	*/
+	isTokenExpired(config, bufferSeconds = 300) {
+		if (!config.expiresAt) return false;
+		const expiresAt = new Date(config.expiresAt);
+		const bufferMs = bufferSeconds * 1e3;
+		return expiresAt.getTime() - bufferMs < Date.now();
+	}
+	/**
+	* Check if a credential can be refreshed
+	*/
+	canRefresh(config) {
+		return !!(config.refreshToken && config.oauth2Provider);
+	}
+};
+/**
+* Create OAuth2 service instance
+*/
+function createOAuth2Service(logger) {
+	return new OAuth2Service(logger);
+}
+//#endregion
+export { createOAuth2Service };
+
+//# sourceMappingURL=oauth2.service.js.map

package/dist/services/credentials/oauth2.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.service.js","names":[],"sources":["../../../src/services/credentials/oauth2.service.ts"],"sourcesContent":["/**\n * OAuth2 Service\n *\n * Handles OAuth2 authorization flow:\n * 1. Generate authorization URL with state\n * 2. Exchange authorization code for tokens\n * 3. Refresh access tokens when expired\n */\n\nimport { randomBytes, createHash } from 'crypto';\nimport type { Logger } from 'src/types/schemas';\nimport type { CredentialConfig } from 'src/database/schema-sqlite';\nimport {\n  getOAuth2Provider,\n  getAllOAuth2Providers,\n  type OAuth2ProviderDefinition,\n} from './oauth2-providers';\n\n/**\n * OAuth2 configuration for the Invect application\n */\nexport interface OAuth2AppConfig {\n  /** Client ID from the OAuth provider */\n  clientId: string;\n  /** Client secret from the OAuth provider */\n  clientSecret: string;\n  /** Redirect URI registered with the provider */\n  redirectUri: string;\n}\n\n/**\n * Result of starting an OAuth2 flow\n */\nexport interface OAuth2StartResult {\n  /** URL to redirect the user to */\n  authorizationUrl: string;\n  /** State parameter for CSRF protection (store and verify on callback) */\n  state: string;\n  /** Code verifier for PKCE (store and use during token exchange) */\n  codeVerifier?: string;\n}\n\n/**\n * OAuth2 tokens received from provider\n */\nexport interface OAuth2Tokens {\n  accessToken: string;\n  refreshToken?: string;\n  tokenType: string;\n  expiresIn?: number; // seconds until expiry\n  scope?: string;\n  /** Additional provider-specific data */\n  raw?: Record<string, unknown>;\n}\n\n/**\n * Pending OAuth2 flow state\n * Store this temporarily during the OAuth flow\n */\nexport interface OAuth2PendingState {\n  state: string;\n  providerId: string;\n  codeVerifier?: string;\n  /** Original URL to redirect back to after OAuth completes */\n  returnUrl?: string;\n  /** Custom credential name */\n  credentialName?: string;\n  /** Timestamp when this state was created */\n  createdAt: number;\n}\n\n// In-memory store for pending OAuth states (should use Redis in production)\nconst pendingStates = new Map<string, OAuth2PendingState>();\n\n// Clean up expired states (older than 10 minutes)\nconst STATE_EXPIRY_MS = 10 * 60 * 1000;\n\nfunction cleanupExpiredStates() {\n  const now = Date.now();\n  for (const [state, pending] of pendingStates.entries()) {\n    if (now - pending.createdAt > STATE_EXPIRY_MS) {\n      pendingStates.delete(state);\n    }\n  }\n}\n\n// Run cleanup every 5 minutes\nsetInterval(cleanupExpiredStates, 5 * 60 * 1000);\n\n/**\n * OAuth2 Service for handling authorization flows\n */\nexport class OAuth2Service {\n  constructor(private readonly logger: Logger) {}\n\n  /**\n   * Get all available OAuth2 providers\n   */\n  getProviders(): OAuth2ProviderDefinition[] {\n    return getAllOAuth2Providers();\n  }\n\n  /**\n   * Get a specific OAuth2 provider\n   */\n  getProvider(providerId: string): OAuth2ProviderDefinition | undefined {\n    return getOAuth2Provider(providerId);\n  }\n\n  /**\n   * Start an OAuth2 authorization flow\n   *\n   * @param providerId - The OAuth2 provider ID\n   * @param appConfig - OAuth app credentials and redirect URI\n   * @param options - Additional options\n   * @returns Authorization URL and state to redirect user to\n   */\n  startAuthorizationFlow(\n    providerId: string,\n    appConfig: OAuth2AppConfig,\n    options: {\n      scopes?: string[];\n      returnUrl?: string;\n      credentialName?: string;\n    } = {},\n  ): OAuth2StartResult {\n    const provider = getOAuth2Provider(providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth2 provider: ${providerId}`);\n    }\n\n    // Generate cryptographically secure state\n    const state = randomBytes(32).toString('hex');\n\n    // Generate PKCE code verifier and challenge\n    const codeVerifier = randomBytes(32).toString('base64url');\n    const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      client_id: appConfig.clientId,\n      redirect_uri: appConfig.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    // Add scopes\n    const scopes = options.scopes ?? provider.defaultScopes;\n    if (scopes.length > 0) {\n      const separator = provider.scopeSeparator ?? ' ';\n      params.set('scope', scopes.join(separator));\n    }\n\n    // Add provider-specific additional params\n    if (provider.additionalAuthParams) {\n      for (const [key, value] of Object.entries(provider.additionalAuthParams)) {\n        params.set(key, value);\n      }\n    }\n\n    const authorizationUrl = `${provider.authorizationUrl}?${params.toString()}`;\n\n    // Store pending state\n    const pendingState: OAuth2PendingState = {\n      state,\n      providerId,\n      codeVerifier,\n      returnUrl: options.returnUrl,\n      credentialName: options.credentialName,\n      createdAt: Date.now(),\n    };\n    pendingStates.set(state, pendingState);\n\n    this.logger.debug('Started OAuth2 flow', { providerId, state });\n\n    return {\n      authorizationUrl,\n      state,\n      codeVerifier,\n    };\n  }\n\n  /**\n   * Get pending OAuth2 state\n   */\n  getPendingState(state: string): OAuth2PendingState | undefined {\n    return pendingStates.get(state);\n  }\n\n  /**\n   * Remove pending OAuth2 state (after successful exchange)\n   */\n  removePendingState(state: string): void {\n    pendingStates.delete(state);\n  }\n\n  /**\n   * Exchange authorization code for tokens\n   *\n   * @param code - Authorization code from callback\n   * @param state - State parameter for verification\n   * @param appConfig - OAuth app credentials\n   * @returns OAuth2 tokens\n   */\n  async exchangeCodeForTokens(\n    code: string,\n    state: string,\n    appConfig: OAuth2AppConfig,\n  ): Promise<{ tokens: OAuth2Tokens; pendingState: OAuth2PendingState }> {\n    // Verify and retrieve pending state\n    const pendingState = pendingStates.get(state);\n    if (!pendingState) {\n      throw new Error('Invalid or expired OAuth state. Please try again.');\n    }\n\n    const provider = getOAuth2Provider(pendingState.providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth2 provider: ${pendingState.providerId}`);\n    }\n\n    // Build token request\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: appConfig.redirectUri,\n      client_id: appConfig.clientId,\n      client_secret: appConfig.clientSecret,\n    });\n\n    // Add PKCE code verifier if available\n    if (pendingState.codeVerifier) {\n      params.set('code_verifier', pendingState.codeVerifier);\n    }\n\n    this.logger.debug('Exchanging code for tokens', { providerId: pendingState.providerId });\n\n    // Exchange code for tokens\n    const response = await fetch(provider.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      this.logger.error('Token exchange failed', { status: response.status, error: errorText });\n      throw new Error(`Token exchange failed: ${errorText}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    // Parse tokens\n    const tokens: OAuth2Tokens = {\n      accessToken: data.access_token as string,\n      refreshToken: data.refresh_token as string | undefined,\n      tokenType: (data.token_type as string) || 'Bearer',\n      expiresIn: data.expires_in as number | undefined,\n      scope: data.scope as string | undefined,\n      raw: data,\n    };\n\n    // Remove used state\n    pendingStates.delete(state);\n\n    this.logger.info('OAuth2 tokens obtained', {\n      providerId: pendingState.providerId,\n      hasRefreshToken: !!tokens.refreshToken,\n      expiresIn: tokens.expiresIn,\n    });\n\n    return { tokens, pendingState };\n  }\n\n  /**\n   * Refresh an expired access token\n   *\n   * @param refreshToken - The refresh token\n   * @param providerId - The OAuth2 provider ID\n   * @param appConfig - OAuth app credentials\n   * @returns New OAuth2 tokens\n   */\n  async refreshAccessToken(\n    refreshToken: string,\n    providerId: string,\n    appConfig: OAuth2AppConfig,\n  ): Promise<OAuth2Tokens> {\n    const provider = getOAuth2Provider(providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth2 provider: ${providerId}`);\n    }\n\n    if (!provider.supportsRefresh) {\n      throw new Error(`Provider ${providerId} does not support token refresh`);\n    }\n\n    const params = new URLSearchParams({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: appConfig.clientId,\n      client_secret: appConfig.clientSecret,\n    });\n\n    this.logger.debug('Refreshing access token', { providerId });\n\n    const response = await fetch(provider.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      this.logger.error('Token refresh failed', { status: response.status, error: errorText });\n      throw new Error(`Token refresh failed: ${errorText}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    const tokens: OAuth2Tokens = {\n      accessToken: data.access_token as string,\n      // Some providers return a new refresh token\n      refreshToken: (data.refresh_token as string | undefined) || refreshToken,\n      tokenType: (data.token_type as string) || 'Bearer',\n      expiresIn: data.expires_in as number | undefined,\n      scope: data.scope as string | undefined,\n      raw: data,\n    };\n\n    this.logger.info('Access token refreshed', {\n      providerId,\n      expiresIn: tokens.expiresIn,\n    });\n\n    return tokens;\n  }\n\n  /**\n   * Build a CredentialConfig from OAuth2 tokens\n   */\n  buildCredentialConfig(\n    tokens: OAuth2Tokens,\n    providerId: string,\n    appConfig: { clientId: string; clientSecret: string },\n  ): CredentialConfig {\n    const now = new Date();\n    const expiresAt = tokens.expiresIn\n      ? new Date(now.getTime() + tokens.expiresIn * 1000).toISOString()\n      : undefined;\n\n    return {\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n      tokenType: tokens.tokenType,\n      scope: tokens.scope,\n      expiresAt,\n      // Store provider info for refresh\n      oauth2Provider: providerId,\n      clientId: appConfig.clientId,\n      clientSecret: appConfig.clientSecret,\n    };\n  }\n\n  /**\n   * Check if a credential's access token is expired or about to expire\n   *\n   * @param config - The credential config\n   * @param bufferSeconds - Buffer time before actual expiry (default 5 minutes)\n   */\n  isTokenExpired(config: CredentialConfig, bufferSeconds: number = 300): boolean {\n    if (!config.expiresAt) {\n      return false; // No expiry means it doesn't expire (or we don't know)\n    }\n\n    const expiresAt = new Date(config.expiresAt);\n    const bufferMs = bufferSeconds * 1000;\n    return expiresAt.getTime() - bufferMs < Date.now();\n  }\n\n  /**\n   * Check if a credential can be refreshed\n   */\n  canRefresh(config: CredentialConfig): boolean {\n    return !!(config.refreshToken && config.oauth2Provider);\n  }\n}\n\n/**\n * Create OAuth2 service instance\n */\nexport function createOAuth2Service(logger: Logger): OAuth2Service {\n  return new OAuth2Service(logger);\n}\n"],"mappings":";;;;;;;;;;;AAwEA,MAAM,gCAAgB,IAAI,KAAiC;AAG3D,MAAM,kBAAkB,MAAU;AAElC,SAAS,uBAAuB;CAC9B,MAAM,MAAM,KAAK,KAAK;AACtB,MAAK,MAAM,CAAC,OAAO,YAAY,cAAc,SAAS,CACpD,KAAI,MAAM,QAAQ,YAAY,gBAC5B,eAAc,OAAO,MAAM;;AAMjC,YAAY,sBAAsB,MAAS,IAAK;;;;AAKhD,IAAa,gBAAb,MAA2B;CACzB,YAAY,QAAiC;AAAhB,OAAA,SAAA;;;;;CAK7B,eAA2C;AACzC,SAAO,uBAAuB;;;;;CAMhC,YAAY,YAA0D;AACpE,SAAO,kBAAkB,WAAW;;;;;;;;;;CAWtC,uBACE,YACA,WACA,UAII,EAAE,EACa;EACnB,MAAM,WAAW,kBAAkB,WAAW;AAC9C,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,4BAA4B,aAAa;EAI3D,MAAM,QAAQ,YAAY,GAAG,CAAC,SAAS,MAAM;EAG7C,MAAM,eAAe,YAAY,GAAG,CAAC,SAAS,YAAY;EAC1D,MAAM,gBAAgB,WAAW,SAAS,CAAC,OAAO,aAAa,CAAC,OAAO,YAAY;EAGnF,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW,UAAU;GACrB,cAAc,UAAU;GACxB,eAAe;GACf;GACA,gBAAgB;GAChB,uBAAuB;GACxB,CAAC;EAGF,MAAM,SAAS,QAAQ,UAAU,SAAS;AAC1C,MAAI,OAAO,SAAS,GAAG;GACrB,MAAM,YAAY,SAAS,kBAAkB;AAC7C,UAAO,IAAI,SAAS,OAAO,KAAK,UAAU,CAAC;;AAI7C,MAAI,SAAS,qBACX,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,qBAAqB,CACtE,QAAO,IAAI,KAAK,MAAM;EAI1B,MAAM,mBAAmB,GAAG,SAAS,iBAAiB,GAAG,OAAO,UAAU;EAG1E,MAAM,eAAmC;GACvC;GACA;GACA;GACA,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;GACxB,WAAW,KAAK,KAAK;GACtB;AACD,gBAAc,IAAI,OAAO,aAAa;AAEtC,OAAK,OAAO,MAAM,uBAAuB;GAAE;GAAY;GAAO,CAAC;AAE/D,SAAO;GACL;GACA;GACA;GACD;;;;;CAMH,gBAAgB,OAA+C;AAC7D,SAAO,cAAc,IAAI,MAAM;;;;;CAMjC,mBAAmB,OAAqB;AACtC,gBAAc,OAAO,MAAM;;;;;;;;;;CAW7B,MAAM,sBACJ,MACA,OACA,WACqE;EAErE,MAAM,eAAe,cAAc,IAAI,MAAM;AAC7C,MAAI,CAAC,aACH,OAAM,IAAI,MAAM,oDAAoD;EAGtE,MAAM,WAAW,kBAAkB,aAAa,WAAW;AAC3D,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,4BAA4B,aAAa,aAAa;EAIxE,MAAM,SAAS,IAAI,gBAAgB;GACjC,YAAY;GACZ;GACA,cAAc,UAAU;GACxB,WAAW,UAAU;GACrB,eAAe,UAAU;GAC1B,CAAC;AAGF,MAAI,aAAa,aACf,QAAO,IAAI,iBAAiB,aAAa,aAAa;AAGxD,OAAK,OAAO,MAAM,8BAA8B,EAAE,YAAY,aAAa,YAAY,CAAC;EAGxF,MAAM,WAAW,MAAM,MAAM,SAAS,UAAU;GAC9C,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACT;GACD,MAAM,OAAO,UAAU;GACxB,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,QAAK,OAAO,MAAM,yBAAyB;IAAE,QAAQ,SAAS;IAAQ,OAAO;IAAW,CAAC;AACzF,SAAM,IAAI,MAAM,0BAA0B,YAAY;;EAGxD,MAAM,OAAQ,MAAM,SAAS,MAAM;EAGnC,MAAM,SAAuB;GAC3B,aAAa,KAAK;GAClB,cAAc,KAAK;GACnB,WAAY,KAAK,cAAyB;GAC1C,WAAW,KAAK;GAChB,OAAO,KAAK;GACZ,KAAK;GACN;AAGD,gBAAc,OAAO,MAAM;AAE3B,OAAK,OAAO,KAAK,0BAA0B;GACzC,YAAY,aAAa;GACzB,iBAAiB,CAAC,CAAC,OAAO;GAC1B,WAAW,OAAO;GACnB,CAAC;AAEF,SAAO;GAAE;GAAQ;GAAc;;;;;;;;;;CAWjC,MAAM,mBACJ,cACA,YACA,WACuB;EACvB,MAAM,WAAW,kBAAkB,WAAW;AAC9C,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,4BAA4B,aAAa;AAG3D,MAAI,CAAC,SAAS,gBACZ,OAAM,IAAI,MAAM,YAAY,WAAW,iCAAiC;EAG1E,MAAM,SAAS,IAAI,gBAAgB;GACjC,YAAY;GACZ,eAAe;GACf,WAAW,UAAU;GACrB,eAAe,UAAU;GAC1B,CAAC;AAEF,OAAK,OAAO,MAAM,2BAA2B,EAAE,YAAY,CAAC;EAE5D,MAAM,WAAW,MAAM,MAAM,SAAS,UAAU;GAC9C,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACT;GACD,MAAM,OAAO,UAAU;GACxB,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,QAAK,OAAO,MAAM,wBAAwB;IAAE,QAAQ,SAAS;IAAQ,OAAO;IAAW,CAAC;AACxF,SAAM,IAAI,MAAM,yBAAyB,YAAY;;EAGvD,MAAM,OAAQ,MAAM,SAAS,MAAM;EAEnC,MAAM,SAAuB;GAC3B,aAAa,KAAK;GAElB,cAAe,KAAK,iBAAwC;GAC5D,WAAY,KAAK,cAAyB;GAC1C,WAAW,KAAK;GAChB,OAAO,KAAK;GACZ,KAAK;GACN;AAED,OAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,WAAW,OAAO;GACnB,CAAC;AAEF,SAAO;;;;;CAMT,sBACE,QACA,YACA,WACkB;EAClB,MAAM,sBAAM,IAAI,MAAM;EACtB,MAAM,YAAY,OAAO,YACrB,IAAI,KAAK,IAAI,SAAS,GAAG,OAAO,YAAY,IAAK,CAAC,aAAa,GAC/D,KAAA;AAEJ,SAAO;GACL,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,WAAW,OAAO;GAClB,OAAO,OAAO;GACd;GAEA,gBAAgB;GAChB,UAAU,UAAU;GACpB,cAAc,UAAU;GACzB;;;;;;;;CASH,eAAe,QAA0B,gBAAwB,KAAc;AAC7E,MAAI,CAAC,OAAO,UACV,QAAO;EAGT,MAAM,YAAY,IAAI,KAAK,OAAO,UAAU;EAC5C,MAAM,WAAW,gBAAgB;AACjC,SAAO,UAAU,SAAS,GAAG,WAAW,KAAK,KAAK;;;;;CAMpD,WAAW,QAAmC;AAC5C,SAAO,CAAC,EAAE,OAAO,gBAAgB,OAAO;;;;;;AAO5C,SAAgB,oBAAoB,QAA+B;AACjE,QAAO,IAAI,cAAc,OAAO"}