@kya-os/mcp-i-cloudflare 1.5.10-canary.9 → 1.6.0

package/dist/runtime/oauth-handler.js

@@ -184,7 +184,7 @@ export function createOAuthCallbackHandler(config = {}) {
     return async (c) => {
         const env = c.env;
         // Get configuration with defaults
-        const { agentShieldApiUrl = env.AGENTSHIELD_API_URL || 'https://hobbs.work', delegationStorage, consentService, successTemplate = defaultSuccessTemplate, errorTemplate = defaultErrorTemplate, autoClose = true, autoCloseDelay = 5000 } = config;
+        const { agentShieldApiUrl = env.AGENTSHIELD_API_URL || 'https://hobbs.work', delegationStorage, consentService, oauthSecurityService, successTemplate = defaultSuccessTemplate, errorTemplate = defaultErrorTemplate, autoClose = true, autoCloseDelay = 5000 } = config;
         // Get query parameters
         const code = c.req.query('code');
         const stateParam = c.req.query('state');
@@ -192,7 +192,12 @@ export function createOAuthCallbackHandler(config = {}) {
         // Handle OAuth errors
         if (error) {
             const errorDescription = c.req.query('error_description') || 'Authorization failed';
-            console.error('[OAuth] Error from provider:', error, errorDescription);
+            console.error('[OAuth] 🔒 SECURITY EVENT: Error from provider:', {
+                error,
+                errorDescription,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_provider_error'
+            });
             const html = errorTemplate({
                 error,
                 description: errorDescription
@@ -201,25 +206,89 @@ export function createOAuthCallbackHandler(config = {}) {
         }
         // Validate required parameters
         if (!code || !stateParam) {
-            console.error('[OAuth] Missing code or state parameter');
+            console.error('[OAuth] 🔒 SECURITY EVENT: Missing required parameters:', {
+                hasCode: !!code,
+                hasState: !!stateParam,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_validation_failed',
+                reason: 'missing_parameters'
+            });
             const html = errorTemplate({
                 error: 'invalid_request',
                 description: 'Missing authorization code or state parameter'
             });
             return c.html(html, 400);
         }
-        // Decode state parameter
+        // ✅ CSRF Protection: Retrieve and validate state from secure storage
         let state;
-        try {
-            state = JSON.parse(atob(stateParam));
+        let stateData = null;
+        if (oauthSecurityService) {
+            // Use secure state validation (CSRF-protected)
+            try {
+                stateData = await oauthSecurityService.getOAuthState(stateParam);
+                if (!stateData) {
+                    console.error('[OAuth] 🔒 SECURITY EVENT: State validation failed - state not found or expired:', {
+                        stateParam: stateParam.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'csrf_protection_failed',
+                        reason: 'state_not_found_or_expired'
+                    });
+                    const html = errorTemplate({
+                        error: 'invalid_state',
+                        description: 'Invalid or expired state parameter. This may be a CSRF attack or the authorization request has expired.'
+                    });
+                    return c.html(html, 400);
+                }
+                // Extract state from stored data
+                state = {
+                    project_id: stateData.project_id,
+                    agent_did: stateData.agent_did,
+                    session_id: stateData.session_id,
+                    delegation_id: stateData.delegation_id,
+                };
+                console.log('[OAuth] 🔒 SECURITY EVENT: State validated successfully:', {
+                    projectId: state.project_id,
+                    agentDid: state.agent_did.substring(0, 20) + '...',
+                    sessionId: state.session_id?.substring(0, 20) + '...',
+                    timestamp: new Date().toISOString(),
+                    eventType: 'csrf_protection_success',
+                    stateStoredAt: stateData.storedAt
+                });
+            }
+            catch (err) {
+                console.error('[OAuth] 🔒 SECURITY EVENT: State validation error:', {
+                    error: err instanceof Error ? err.message : String(err),
+                    stateParam: stateParam.substring(0, 20) + '...',
+                    timestamp: new Date().toISOString(),
+                    eventType: 'csrf_protection_error',
+                    reason: 'validation_exception'
+                });
+                const html = errorTemplate({
+                    error: 'invalid_state',
+                    description: 'Failed to validate state parameter'
+                });
+                return c.html(html, 400);
+            }
         }
-        catch (err) {
-            console.error('[OAuth] Failed to decode state:', err);
-            const html = errorTemplate({
-                error: 'invalid_state',
-                description: 'Invalid state parameter'
-            });
-            return c.html(html, 400);
+        else {
+            // Fallback: Decode state parameter directly (less secure, but backward compatible)
+            console.warn('[OAuth] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state decoding');
+            try {
+                state = JSON.parse(atob(stateParam));
+            }
+            catch (err) {
+                console.error('[OAuth] 🔒 SECURITY EVENT: Failed to decode state:', {
+                    error: err instanceof Error ? err.message : String(err),
+                    timestamp: new Date().toISOString(),
+                    eventType: 'oauth_validation_failed',
+                    reason: 'state_decode_error'
+                });
+                const html = errorTemplate({
+                    error: 'invalid_state',
+                    description: 'Invalid state parameter'
+                });
+                return c.html(html, 400);
+            }
         }
         const { project_id, agent_did, session_id, delegation_id } = state;
         // Validate session ID
@@ -231,11 +300,14 @@ export function createOAuthCallbackHandler(config = {}) {
             });
             return c.html(html, 400);
         }
-        console.log('[OAuth] Processing authorization code exchange:', {
+        console.log('[OAuth] 🔒 SECURITY EVENT: Processing authorization code exchange:', {
             projectId: project_id,
             agentDid: agent_did.substring(0, 20) + '...',
-            sessionId: session_id,
-            delegationId: delegation_id
+            sessionId: session_id?.substring(0, 20) + '...',
+            delegationId: delegation_id,
+            timestamp: new Date().toISOString(),
+            eventType: 'oauth_code_exchange_start',
+            hasSecureState: !!oauthSecurityService
         });
         try {
             // Exchange authorization code for delegation token
@@ -255,9 +327,13 @@ export function createOAuthCallbackHandler(config = {}) {
             });
             if (!tokenResponse.ok) {
                 const errorText = await tokenResponse.text();
-                console.error('[OAuth] Token exchange failed:', {
+                console.error('[OAuth] 🔒 SECURITY EVENT: Token exchange failed:', {
                     status: tokenResponse.status,
-                    error: errorText
+                    error: errorText.substring(0, 200),
+                    projectId: project_id,
+                    agentDid: agent_did.substring(0, 20) + '...',
+                    timestamp: new Date().toISOString(),
+                    eventType: 'oauth_token_exchange_failed'
                 });
                 const html = errorTemplate({
                     error: 'token_exchange_failed',
@@ -268,18 +344,26 @@ export function createOAuthCallbackHandler(config = {}) {
             const tokenData = await tokenResponse.json();
             // Validate token response
             if (!tokenData.delegation_token) {
-                console.error('[OAuth] No delegation token in response:', tokenData);
+                console.error('[OAuth] 🔒 SECURITY EVENT: Invalid token response:', {
+                    hasDelegationToken: !!tokenData.delegation_token,
+                    responseKeys: Object.keys(tokenData),
+                    projectId: project_id,
+                    timestamp: new Date().toISOString(),
+                    eventType: 'oauth_invalid_token_response'
+                });
                 const html = errorTemplate({
                     error: 'invalid_response',
                     description: 'Invalid token response from authorization server'
                 });
                 return c.html(html, 500);
             }
-            console.log('[OAuth] Token exchange successful:', {
+            console.log('[OAuth] 🔒 SECURITY EVENT: Token exchange successful:', {
                 delegationId: tokenData.delegation_id,
                 sessionId: tokenData.session_id || session_id,
                 expiresIn: tokenData.expires_in,
-                scopes: tokenData.scopes
+                scopes: tokenData.scopes,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_token_exchange_success'
             });
             // Phase 4 PR #3: Extract OAuth user info and link to User DID
             let oauthIdentity = null;
@@ -320,16 +404,161 @@ export function createOAuthCallbackHandler(config = {}) {
                         // Set OAuth identity cookie for consent page
                         const cookieValue = encodeURIComponent(JSON.stringify(oauthIdentity));
                         c.header("Set-Cookie", `oauth_identity=${cookieValue}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
-                        console.log('[OAuth] OAuth identity linked and cookie set:', {
+                        console.log('[OAuth] 🔒 SECURITY EVENT: OAuth identity linked and cookie set:', {
                             provider: oauthIdentity.provider,
                             subject: oauthIdentity.subject.substring(0, 20) + '...',
                             userDid: userDid.substring(0, 20) + '...',
+                            sessionId: session_id?.substring(0, 20) + '...',
+                            timestamp: new Date().toISOString(),
+                            eventType: 'oauth_identity_linked',
+                            cookieSet: true
                         });
                     }
                 }
                 catch (error) {
                     // OAuth linking errors are non-fatal - log but continue
-                    console.error('[OAuth] Failed to link OAuth identity (non-fatal):', error);
+                    console.error('[OAuth] 🔒 SECURITY EVENT: Failed to link OAuth identity (non-fatal):', {
+                        error: error instanceof Error ? error.message : String(error),
+                        sessionId: session_id?.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'oauth_identity_linking_failed',
+                        severity: 'warning'
+                    });
+                }
+            }
+            // ✅ Phase 3: Retrieve OAuth tokens from AgentShield (two-step flow)
+            // After receiving delegation token, retrieve OAuth tokens separately
+            // Note: userDid may not be available if OAuth linking failed, but we still need to store tokens
+            // For PKCE flows, we can use session-based userDid lookup if needed
+            if (delegationStorage && oauthSecurityService && tokenData.delegation_id) {
+                try {
+                    // Extract provider from state or token response
+                    const provider = tokenData.provider ||
+                        state.provider ||
+                        oauthIdentity?.provider ||
+                        null;
+                    // Extract scopes from state or token response
+                    const requestedScopes = tokenData.scopes || state.scopes || [];
+                    // Extract code_verifier from stored state (PKCE)
+                    const codeVerifier = stateData
+                        ? stateData.code_verifier
+                        : null;
+                    const redirectUri = stateData?.redirect_uri ||
+                        state?.redirect_uri ||
+                        `${env.MCP_SERVER_URL || new URL(c.req.header("Referer") || "").origin}/oauth/callback`;
+                    // Get userDid - use linked userDid if available, otherwise fallback to session-based lookup
+                    let effectiveUserDid = userDid;
+                    if (!effectiveUserDid && session_id && consentService) {
+                        try {
+                            effectiveUserDid = await consentService.getUserDidForSession(session_id);
+                        }
+                        catch (error) {
+                            console.warn("[OAuth] Failed to get userDid from session, skipping token storage:", {
+                                sessionId: session_id?.substring(0, 20) + "...",
+                                error: error instanceof Error ? error.message : String(error),
+                            });
+                        }
+                    }
+                    if (provider && requestedScopes.length > 0 && effectiveUserDid) {
+                        // Fetch provider config to determine flow (PKCE vs non-PKCE)
+                        const { OAuthConfigService } = await import("@kya-os/mcp-i-core");
+                        const { WorkersFetchProvider } = await import("../providers/storage.js");
+                        const { KVOAuthConfigCache } = await import("../cache/kv-oauth-config-cache.js");
+                        const { IdpTokenStorage } = await import("../services/idp-token-storage.js");
+                        const fetchProvider = new WorkersFetchProvider();
+                        const oauthConfigCache = delegationStorage
+                            ? new KVOAuthConfigCache({ kv: delegationStorage })
+                            : undefined;
+                        const oauthConfigService = new OAuthConfigService({
+                            baseUrl: agentShieldApiUrl,
+                            apiKey: env.AGENTSHIELD_API_KEY || "",
+                            fetchProvider,
+                            cache: oauthConfigCache,
+                        });
+                        const oauthConfig = await oauthConfigService.getOAuthConfig(project_id);
+                        const providerConfig = oauthConfig.providers[provider];
+                        if (!providerConfig) {
+                            console.warn("[OAuth] Provider config not found, skipping token storage:", {
+                                provider,
+                                projectId: project_id,
+                            });
+                        }
+                        else {
+                            const idpTokenStorage = new IdpTokenStorage({
+                                storage: delegationStorage,
+                                oauthSecurityService,
+                            });
+                            // Choose flow based on provider config and codeVerifier availability
+                            if (providerConfig.supportsPKCE && codeVerifier) {
+                                // PKCE flow: Use OAuthService.exchangeToken()
+                                const { OAuthService } = await import("@kya-os/mcp-i-core");
+                                const oauthService = new OAuthService({
+                                    configService: oauthConfigService,
+                                    fetchProvider,
+                                    agentShieldApiUrl,
+                                    agentShieldApiKey: env.AGENTSHIELD_API_KEY || "",
+                                    projectId: project_id,
+                                });
+                                const idpTokens = await oauthService.exchangeToken(provider, code, codeVerifier, redirectUri);
+                                await idpTokenStorage.storeToken(effectiveUserDid, provider, requestedScopes, idpTokens);
+                                console.log("[OAuth] ✅ IDP tokens stored (PKCE flow):", {
+                                    userDid: effectiveUserDid.substring(0, 20) + "...",
+                                    provider,
+                                    scopes: requestedScopes,
+                                    expiresAt: new Date(idpTokens.expires_at).toISOString(),
+                                });
+                            }
+                            else {
+                                // Non-PKCE proxy mode: Use OAuthTokenRetrievalService
+                                const { OAuthTokenRetrievalService } = await import("@kya-os/mcp-i-core");
+                                const tokenRetrievalService = new OAuthTokenRetrievalService({
+                                    baseUrl: agentShieldApiUrl,
+                                    fetchProvider: fetch,
+                                    logger: (message, data) => {
+                                        console.log(`[OAuthTokenRetrieval] ${message}`, data);
+                                    },
+                                });
+                                const idpTokens = await tokenRetrievalService.retrieveTokens(tokenData.delegation_id, tokenData.delegation_token);
+                                if (idpTokens) {
+                                    await idpTokenStorage.storeToken(effectiveUserDid, provider, requestedScopes, idpTokens);
+                                    console.log("[OAuth] ✅ OAuth tokens retrieved and stored (proxy mode):", {
+                                        userDid: effectiveUserDid.substring(0, 20) + "...",
+                                        provider,
+                                        scopes: requestedScopes,
+                                        expiresAt: new Date(idpTokens.expires_at).toISOString(),
+                                        delegationId: tokenData.delegation_id,
+                                    });
+                                }
+                                else {
+                                    // Token retrieval failed but delegation token is still valid
+                                    console.warn("[OAuth] OAuth token retrieval failed (non-fatal):", {
+                                        delegationId: tokenData.delegation_id,
+                                        provider,
+                                        sessionId: session_id?.substring(0, 20) + "...",
+                                        note: "Delegation token is still valid for MCP-I auth",
+                                    });
+                                }
+                            }
+                        }
+                    }
+                    else {
+                        console.log("[OAuth] Skipping IDP token storage:", {
+                            hasProvider: !!provider,
+                            hasScopes: requestedScopes.length > 0,
+                            hasEffectiveUserDid: !!effectiveUserDid,
+                            hasDelegationId: !!tokenData.delegation_id,
+                        });
+                    }
+                }
+                catch (error) {
+                    // IDP token storage errors are non-fatal - log but continue
+                    // Delegation token is still valid for MCP-I auth
+                    console.error("[OAuth] Failed to retrieve/store OAuth tokens (non-fatal):", {
+                        error: error instanceof Error ? error.message : String(error),
+                        sessionId: session_id?.substring(0, 20) + "...",
+                        delegationId: tokenData.delegation_id,
+                        note: "Delegation token is still valid for MCP-I auth",
+                    });
                 }
             }
             // Store delegation token in KV if storage is configured
@@ -350,11 +579,15 @@ export function createOAuthCallbackHandler(config = {}) {
                         await delegationStorage.put(userAgentKey, tokenData.delegation_token, {
                             expirationTtl: ttl
                         });
-                        console.log('[OAuth] Delegation token stored with user+agent DID:', {
-                            key: userAgentKey,
+                        console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token stored with user+agent DID:', {
+                            key: userAgentKey.substring(0, 50) + '...',
                             ttl,
                             agentDid: agent_did.substring(0, 20) + '...',
-                            delegationId: tokenData.delegation_id
+                            userDid: sessionUserDid.substring(0, 20) + '...',
+                            delegationId: tokenData.delegation_id,
+                            timestamp: new Date().toISOString(),
+                            eventType: 'delegation_token_stored',
+                            storageType: 'user_agent_scoped'
                         });
                     }
                     // Backward compatibility: Agent-only key (24 hour TTL)
@@ -362,11 +595,15 @@ export function createOAuthCallbackHandler(config = {}) {
                     await delegationStorage.put(legacyKey, tokenData.delegation_token, {
                         expirationTtl: 24 * 60 * 60 // 24 hours only
                     });
-                    console.log('[OAuth] Delegation token stored with legacy agent key:', {
-                        key: legacyKey,
+                    console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token stored with legacy agent key:', {
+                        key: legacyKey.substring(0, 50) + '...',
                         ttl: 24 * 60 * 60,
                         agentDid: agent_did.substring(0, 20) + '...',
-                        delegationId: tokenData.delegation_id
+                        delegationId: tokenData.delegation_id,
+                        timestamp: new Date().toISOString(),
+                        eventType: 'delegation_token_stored',
+                        storageType: 'legacy_agent_scoped',
+                        warning: 'Legacy format - migrate to user+agent scoped tokens'
                     });
                     // Session cache for fast lookup (shorter TTL for performance)
                     await delegationStorage.put(sessionKey, JSON.stringify({
@@ -377,16 +614,25 @@ export function createOAuthCallbackHandler(config = {}) {
                     }), {
                         expirationTtl: Math.min(ttl, 1800) // 30 minutes or token TTL, whichever is shorter
                     });
-                    console.log('[OAuth] Delegation token cached for session:', {
-                        key: sessionKey,
+                    console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token cached for session:', {
+                        key: sessionKey.substring(0, 50) + '...',
                         ttl: Math.min(ttl, 1800),
-                        sessionId: session_id,
-                        userDid: sessionUserDid,
+                        sessionId: session_id?.substring(0, 20) + '...',
+                        userDid: sessionUserDid?.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'delegation_token_cached',
+                        storageType: 'session_cache'
                     });
                 }
                 catch (storageError) {
                     // Storage errors are non-fatal - log but continue
-                    console.error('[OAuth] Storage error (non-fatal):', storageError);
+                    console.error('[OAuth] 🔒 SECURITY EVENT: Storage error (non-fatal):', {
+                        error: storageError instanceof Error ? storageError.message : String(storageError),
+                        sessionId: session_id?.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'delegation_storage_error',
+                        severity: 'warning'
+                    });
                 }
             }
             // Return success page
@@ -399,7 +645,13 @@ export function createOAuthCallbackHandler(config = {}) {
             return c.html(html);
         }
         catch (error) {
-            console.error('[OAuth] Unexpected error:', error);
+            console.error('[OAuth] 🔒 SECURITY EVENT: Unexpected error:', {
+                error: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : undefined,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_unexpected_error',
+                severity: 'error'
+            });
             const html = errorTemplate({
                 error: 'internal_error',
                 description: error instanceof Error ? error.message : 'An unexpected error occurred'

package/dist/runtime/oauth-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-handler.js","sourceRoot":"","sources":["../../src/runtime/oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAqEzD;;GAEG;AACH,MAAM,sBAAsB,GAAG,CAAC,IAAsB,EAAU,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAgEtB,IAAI,CAAC,SAAS,IAAI,IAAI;;;;;;;;;;;;;8BAarC,IAAI,CAAC,YAAY;;;;;8BAKjB,IAAI,CAAC,SAAS;;;;;8BAKd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;oDAQA,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;;;;;CAK9F,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAU,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAsDN,KAAK,CAAC,KAAK;6CACxB,KAAK,CAAC,WAAW;;;;;;;CAO7D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA8B,EAAE;IACzE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAA0C,CAAC;QAEzD,kCAAkC;QAClC,MAAM,EACJ,iBAAiB,GAAG,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,EACnE,iBAAiB,EACjB,cAAc,EACd,eAAe,GAAG,sBAAsB,EACxC,aAAa,GAAG,oBAAoB,EACpC,SAAS,GAAG,IAAI,EAChB,cAAc,GAAG,IAAI,EACtB,GAAG,MAAM,CAAC;QAEX,uBAAuB;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,sBAAsB;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,sBAAsB,CAAC;YACpF,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAEvE,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK;gBACL,WAAW,EAAE,gBAAgB;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,+CAA+C;aAC7D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,yBAAyB;QACzB,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,yBAAyB;aACvC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAEnE,sBAAsB;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,uCAAuC;aACrD,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iDAAiD,EAAE;YAC7D,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YAC5C,SAAS,EAAE,UAAU;YACrB,YAAY,EAAE,aAAa;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,aAAa,GAAG,GAAG,iBAAiB,6BAA6B,CAAC;YAExE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,QAAQ,EAAE,kBAAkB;iBAC7B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,oBAAoB;oBAChC,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,UAAU;iBACvB,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE;oBAC9C,MAAM,EAAE,aAAa,CAAC,MAAM;oBAC5B,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG,aAAa,CAAC;oBACzB,KAAK,EAAE,uBAAuB;oBAC9B,WAAW,EAAE,4DAA4D;iBAC1E,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,SAAS,GAA0B,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAEpE,0BAA0B;YAC1B,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,SAAS,CAAC,CAAC;gBACrE,MAAM,IAAI,GAAG,aAAa,CAAC;oBACzB,KAAK,EAAE,kBAAkB;oBACzB,WAAW,EAAE,kDAAkD;iBAChE,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE;gBAChD,YAAY,EAAE,SAAS,CAAC,aAAa;gBACrC,SAAS,EAAE,SAAS,CAAC,UAAU,IAAI,UAAU;gBAC7C,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;YAEH,8DAA8D;YAC9D,IAAI,aAAa,GAAyB,IAAI,CAAC;YAC/C,IAAI,OAA2B,CAAC;YAEhC,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,mEAAmE;oBACnE,mDAAmD;oBACnD,MAAM,iBAAiB,GAAI,SAAiB,CAAC,SAAS,IAAK,SAAiB,CAAC,IAAI,CAAC;oBAElF,IAAI,iBAAiB,EAAE,CAAC;wBACtB,kDAAkD;wBAClD,+CAA+C;wBAC/C,yDAAyD;wBACzD,0CAA0C;wBAC1C,iCAAiC;wBACjC,MAAM,QAAQ,GAAI,SAAiB,CAAC,QAAQ;+BACtC,KAAa,CAAC,QAAQ;+BACtB,GAAW,CAAC,sBAAsB;+BACnC,QAAQ,CAAC;wBAEd,aAAa,GAAG;4BACd,QAAQ,EAAE,QAAQ;4BAClB,OAAO,EAAE,iBAAiB,CAAC,GAAG,IAAI,iBAAiB,CAAC,EAAE,IAAI,iBAAiB,CAAC,KAAK;4BACjF,KAAK,EAAE,iBAAiB,CAAC,KAAK;4BAC9B,IAAI,EAAE,iBAAiB,CAAC,IAAI,IAAI,iBAAiB,CAAC,YAAY;yBAC/D,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,oDAAoD;wBACpD,wDAAwD;wBACxD,sDAAsD;wBACtD,sEAAsE;wBACtE,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;wBAC1F,OAAO,CAAC,IAAI,CAAC,0GAA0G,CAAC,CAAC;oBAC3H,CAAC;oBAED,gDAAgD;oBAChD,IAAI,aAAa,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;wBAC3C,OAAO,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAC/C,aAAa,EACb,UAAU,CACX,CAAC;wBAEF,6CAA6C;wBAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;wBACtE,CAAC,CAAC,MAAM,CACN,YAAY,EACZ,kBAAkB,WAAW,0DAA0D,CACxF,CAAC;wBAEF,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE;4BAC3D,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BACvD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;yBAC1C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,wDAAwD;oBACxD,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBAEzE,IAAI,CAAC;oBACH,kDAAkD;oBAClD,2DAA2D;oBAC3D,IAAI,cAAc,GAAG,OAAO,CAAC;oBAC7B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpD,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAmD,CAAC;wBACtH,cAAc,GAAG,WAAW,EAAE,OAAO,CAAC;oBACxC,CAAC;oBAED,sDAAsD;oBACtD,IAAI,cAAc,EAAE,CAAC;wBACnB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;wBACxE,MAAM,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,gBAAgB,EAAE;4BACpE,aAAa,EAAE,GAAG;yBACnB,CAAC,CAAC;wBACH,OAAO,CAAC,GAAG,CAAC,sDAAsD,EAAE;4BAClE,GAAG,EAAE,YAAY;4BACjB,GAAG;4BACH,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BAC5C,YAAY,EAAE,SAAS,CAAC,aAAa;yBACtC,CAAC,CAAC;oBACL,CAAC;oBAED,uDAAuD;oBACvD,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAC3D,MAAM,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBACjE,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB;qBAC7C,CAAC,CAAC;oBACH,OAAO,CAAC,GAAG,CAAC,wDAAwD,EAAE;wBACpE,GAAG,EAAE,SAAS;wBACd,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;wBACjB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC5C,YAAY,EAAE,SAAS,CAAC,aAAa;qBACtC,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;wBACrD,OAAO,EAAE,cAAc;wBACvB,QAAQ,EAAE,SAAS;wBACnB,eAAe,EAAE,SAAS,CAAC,gBAAgB;wBAC3C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;qBACrB,CAAC,EAAE;wBACF,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,gDAAgD;qBACpF,CAAC,CAAC;oBAEH,OAAO,CAAC,GAAG,CAAC,8CAA8C,EAAE;wBAC1D,GAAG,EAAE,UAAU;wBACf,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;wBACxB,SAAS,EAAE,UAAU;wBACrB,OAAO,EAAE,cAAc;qBACxB,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,kDAAkD;oBAClD,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,YAAY,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,sBAAsB;YACtB,MAAM,IAAI,GAAG,eAAe,CAAC;gBAC3B,YAAY,EAAE,SAAS,CAAC,aAAa,IAAI,aAAa;gBACtD,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC1C,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YAElD,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACrF,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAc;IACnD,6BAA6B;IAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"oauth-handler.js","sourceRoot":"","sources":["../../src/runtime/oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA2EzD;;GAEG;AACH,MAAM,sBAAsB,GAAG,CAAC,IAAsB,EAAU,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAgEtB,IAAI,CAAC,SAAS,IAAI,IAAI;;;;;;;;;;;;;8BAarC,IAAI,CAAC,YAAY;;;;;8BAKjB,IAAI,CAAC,SAAS;;;;;8BAKd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;oDAQA,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;;;;;CAK9F,CAAC;AAEF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAU,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0DAsDN,KAAK,CAAC,KAAK;6CACxB,KAAK,CAAC,WAAW;;;;;;;CAO7D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAA8B,EAAE;IACzE,OAAO,KAAK,EAAE,CAAc,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAA0C,CAAC;QAEzD,kCAAkC;QAClC,MAAM,EACJ,iBAAiB,GAAG,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,EACnE,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,eAAe,GAAG,sBAAsB,EACxC,aAAa,GAAG,oBAAoB,EACpC,SAAS,GAAG,IAAI,EAChB,cAAc,GAAG,IAAI,EACtB,GAAG,MAAM,CAAC;QAEX,uBAAuB;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,sBAAsB;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,sBAAsB,CAAC;YACpF,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE;gBAC/D,KAAK;gBACL,gBAAgB;gBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,sBAAsB;aAClC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK;gBACL,WAAW,EAAE,gBAAgB;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE;gBACvE,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,QAAQ,EAAE,CAAC,CAAC,UAAU;gBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,yBAAyB;gBACpC,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,+CAA+C;aAC7D,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,qEAAqE;QACrE,IAAI,KAAiB,CAAC;QACtB,IAAI,SAAS,GAAmC,IAAI,CAAC;QAErD,IAAI,oBAAoB,EAAE,CAAC;YACzB,+CAA+C;YAC/C,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;gBAEjE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,kFAAkF,EAAE;wBAChG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,wBAAwB;wBACnC,MAAM,EAAE,4BAA4B;qBACrC,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,aAAa,CAAC;wBACzB,KAAK,EAAE,eAAe;wBACtB,WAAW,EAAE,yGAAyG;qBACvH,CAAC,CAAC;oBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAED,iCAAiC;gBACjC,KAAK,GAAG;oBACN,UAAU,EAAE,SAAS,CAAC,UAAoB;oBAC1C,SAAS,EAAE,SAAS,CAAC,SAAmB;oBACxC,UAAU,EAAE,SAAS,CAAC,UAAgC;oBACtD,aAAa,EAAE,SAAS,CAAC,aAAuB;iBACjD,CAAC;gBAEF,OAAO,CAAC,GAAG,CAAC,0DAA0D,EAAE;oBACtE,SAAS,EAAE,KAAK,CAAC,UAAU;oBAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBAClD,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACrD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,SAAS,EAAE,yBAAyB;oBACpC,aAAa,EAAE,SAAS,CAAC,QAA8B;iBACxD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBAClE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACvD,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,SAAS,EAAE,uBAAuB;oBAClC,MAAM,EAAE,sBAAsB;iBAC/B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,aAAa,CAAC;oBACzB,KAAK,EAAE,eAAe;oBACtB,WAAW,EAAE,oCAAoC;iBAClD,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mFAAmF;YACnF,OAAO,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;YAC9G,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBAClE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACvD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,SAAS,EAAE,yBAAyB;oBACpC,MAAM,EAAE,oBAAoB;iBAC7B,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,aAAa,CAAC;oBACzB,KAAK,EAAE,eAAe;oBACtB,WAAW,EAAE,yBAAyB;iBACvC,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAEnE,sBAAsB;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,uCAAuC;aACrD,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,oEAAoE,EAAE;YAChF,SAAS,EAAE,UAAU;YACrB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YAC5C,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;YAC/C,YAAY,EAAE,aAAa;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,2BAA2B;YACtC,cAAc,EAAE,CAAC,CAAC,oBAAoB;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,aAAa,GAAG,GAAG,iBAAiB,6BAA6B,CAAC;YAExE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,QAAQ,EAAE,kBAAkB;iBAC7B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,oBAAoB;oBAChC,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,UAAU;iBACvB,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE;oBACjE,MAAM,EAAE,aAAa,CAAC,MAAM;oBAC5B,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;oBAClC,SAAS,EAAE,UAAU;oBACrB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBAC5C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,SAAS,EAAE,6BAA6B;iBACzC,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG,aAAa,CAAC;oBACzB,KAAK,EAAE,uBAAuB;oBAC9B,WAAW,EAAE,4DAA4D;iBAC1E,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,SAAS,GAA0B,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAEpE,0BAA0B;YAC1B,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE;oBAClE,kBAAkB,EAAE,CAAC,CAAC,SAAS,CAAC,gBAAgB;oBAChD,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;oBACpC,SAAS,EAAE,UAAU;oBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,SAAS,EAAE,8BAA8B;iBAC1C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,aAAa,CAAC;oBACzB,KAAK,EAAE,kBAAkB;oBACzB,WAAW,EAAE,kDAAkD;iBAChE,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,uDAAuD,EAAE;gBACnE,YAAY,EAAE,SAAS,CAAC,aAAa;gBACrC,SAAS,EAAE,SAAS,CAAC,UAAU,IAAI,UAAU;gBAC7C,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC/B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,8BAA8B;aAC1C,CAAC,CAAC;YAEH,8DAA8D;YAC9D,IAAI,aAAa,GAAyB,IAAI,CAAC;YAC/C,IAAI,OAA2B,CAAC;YAEhC,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,mEAAmE;oBACnE,mDAAmD;oBACnD,MAAM,iBAAiB,GAAI,SAAiB,CAAC,SAAS,IAAK,SAAiB,CAAC,IAAI,CAAC;oBAElF,IAAI,iBAAiB,EAAE,CAAC;wBACtB,kDAAkD;wBAClD,+CAA+C;wBAC/C,yDAAyD;wBACzD,0CAA0C;wBAC1C,iCAAiC;wBACjC,MAAM,QAAQ,GAAI,SAAiB,CAAC,QAAQ;+BACtC,KAAa,CAAC,QAAQ;+BACtB,GAAW,CAAC,sBAAsB;+BACnC,QAAQ,CAAC;wBAEd,aAAa,GAAG;4BACd,QAAQ,EAAE,QAAQ;4BAClB,OAAO,EAAE,iBAAiB,CAAC,GAAG,IAAI,iBAAiB,CAAC,EAAE,IAAI,iBAAiB,CAAC,KAAK;4BACjF,KAAK,EAAE,iBAAiB,CAAC,KAAK;4BAC9B,IAAI,EAAE,iBAAiB,CAAC,IAAI,IAAI,iBAAiB,CAAC,YAAY;yBAC/D,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,oDAAoD;wBACpD,wDAAwD;wBACxD,sDAAsD;wBACtD,sEAAsE;wBACtE,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;wBAC1F,OAAO,CAAC,IAAI,CAAC,0GAA0G,CAAC,CAAC;oBAC3H,CAAC;oBAED,gDAAgD;oBAChD,IAAI,aAAa,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;wBAC3C,OAAO,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAC/C,aAAa,EACb,UAAU,CACX,CAAC;wBAEF,6CAA6C;wBAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;wBACtE,CAAC,CAAC,MAAM,CACN,YAAY,EACZ,kBAAkB,WAAW,0DAA0D,CACxF,CAAC;wBAEF,OAAO,CAAC,GAAG,CAAC,kEAAkE,EAAE;4BAC9E,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BACvD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BACzC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BACnC,SAAS,EAAE,uBAAuB;4BAClC,SAAS,EAAE,IAAI;yBAChB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,wDAAwD;oBACxD,OAAO,CAAC,KAAK,CAAC,uEAAuE,EAAE;wBACrF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC7D,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,+BAA+B;wBAC1C,QAAQ,EAAE,SAAS;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,qEAAqE;YACrE,gGAAgG;YAChG,oEAAoE;YACpE,IAAI,iBAAiB,IAAI,oBAAoB,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;gBACzE,IAAI,CAAC;oBACH,gDAAgD;oBAChD,MAAM,QAAQ,GACX,SAAiB,CAAC,QAAQ;wBAC1B,KAAa,CAAC,QAAQ;wBACvB,aAAa,EAAE,QAAQ;wBACvB,IAAI,CAAC;oBAEP,8CAA8C;oBAC9C,MAAM,eAAe,GACnB,SAAS,CAAC,MAAM,IAAK,KAAa,CAAC,MAAM,IAAI,EAAE,CAAC;oBAElD,iDAAiD;oBACjD,MAAM,YAAY,GAAG,SAAS;wBAC5B,CAAC,CAAE,SAAiB,CAAC,aAAa;wBAClC,CAAC,CAAC,IAAI,CAAC;oBAET,MAAM,WAAW,GACd,SAAiB,EAAE,YAAY;wBAC/B,KAAa,EAAE,YAAY;wBAC5B,GAAG,GAAG,CAAC,cAAc,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,iBAAiB,CAAC;oBAE1F,4FAA4F;oBAC5F,IAAI,gBAAgB,GAAG,OAAO,CAAC;oBAC/B,IAAI,CAAC,gBAAgB,IAAI,UAAU,IAAI,cAAc,EAAE,CAAC;wBACtD,IAAI,CAAC;4BACH,gBAAgB,GAAG,MAAM,cAAc,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC;wBAC3E,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,OAAO,CAAC,IAAI,CAAC,qEAAqE,EAAE;gCAClF,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gCAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;6BAC9D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAED,IAAI,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;wBAC/D,6DAA6D;wBAC7D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CACzC,oBAAoB,CACrB,CAAC;wBACF,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAC3C,yBAAyB,CAC1B,CAAC;wBACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CACzC,mCAAmC,CACpC,CAAC;wBACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CACtC,kCAAkC,CACnC,CAAC;wBAEF,MAAM,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;wBACjD,MAAM,gBAAgB,GAAG,iBAAiB;4BACxC,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,iBAAwB,EAAE,CAAC;4BAC1D,CAAC,CAAC,SAAS,CAAC;wBAEd,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC;4BAChD,OAAO,EAAE,iBAAiB;4BAC1B,MAAM,EAAE,GAAG,CAAC,mBAAmB,IAAI,EAAE;4BACrC,aAAa;4BACb,KAAK,EAAE,gBAAgB;yBACxB,CAAC,CAAC;wBAEH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;wBACxE,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;wBAEvD,IAAI,CAAC,cAAc,EAAE,CAAC;4BACpB,OAAO,CAAC,IAAI,CAAC,4DAA4D,EAAE;gCACzE,QAAQ;gCACR,SAAS,EAAE,UAAU;6BACtB,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC;gCAC1C,OAAO,EAAE,iBAAwB;gCACjC,oBAAoB;6BACrB,CAAC,CAAC;4BAEH,qEAAqE;4BACrE,IAAI,cAAc,CAAC,YAAY,IAAI,YAAY,EAAE,CAAC;gCAChD,8CAA8C;gCAC9C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CACnC,oBAAoB,CACrB,CAAC;gCAEF,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;oCACpC,aAAa,EAAE,kBAAkB;oCACjC,aAAa;oCACb,iBAAiB;oCACjB,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,IAAI,EAAE;oCAChD,SAAS,EAAE,UAAU;iCACtB,CAAC,CAAC;gCAEH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,aAAa,CAChD,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,WAAW,CACZ,CAAC;gCAEF,MAAM,eAAe,CAAC,UAAU,CAC9B,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,SAAS,CACV,CAAC;gCAEF,OAAO,CAAC,GAAG,CAAC,0CAA0C,EAAE;oCACtD,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oCAClD,QAAQ;oCACR,MAAM,EAAE,eAAe;oCACvB,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;iCACxD,CAAC,CAAC;4BACL,CAAC;iCAAM,CAAC;gCACN,sDAAsD;gCACtD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CACjD,oBAAoB,CACrB,CAAC;gCAEF,MAAM,qBAAqB,GAAG,IAAI,0BAA0B,CAAC;oCAC3D,OAAO,EAAE,iBAAiB;oCAC1B,aAAa,EAAE,KAAK;oCACpB,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;wCACxB,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;oCACxD,CAAC;iCACF,CAAC,CAAC;gCAEH,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,cAAc,CAC1D,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;gCAEF,IAAI,SAAS,EAAE,CAAC;oCACd,MAAM,eAAe,CAAC,UAAU,CAC9B,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,SAAS,CACV,CAAC;oCAEF,OAAO,CAAC,GAAG,CAAC,2DAA2D,EAAE;wCACvE,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wCAClD,QAAQ;wCACR,MAAM,EAAE,eAAe;wCACvB,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;wCACvD,YAAY,EAAE,SAAS,CAAC,aAAa;qCACtC,CAAC,CAAC;gCACL,CAAC;qCAAM,CAAC;oCACN,6DAA6D;oCAC7D,OAAO,CAAC,IAAI,CAAC,mDAAmD,EAAE;wCAChE,YAAY,EAAE,SAAS,CAAC,aAAa;wCACrC,QAAQ;wCACR,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wCAC/C,IAAI,EAAE,gDAAgD;qCACvD,CAAC,CAAC;gCACL,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE;4BACjD,WAAW,EAAE,CAAC,CAAC,QAAQ;4BACvB,SAAS,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC;4BACrC,mBAAmB,EAAE,CAAC,CAAC,gBAAgB;4BACvC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa;yBAC3C,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,4DAA4D;oBAC5D,iDAAiD;oBACjD,OAAO,CAAC,KAAK,CAAC,4DAA4D,EAAE;wBAC1E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC7D,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC/C,YAAY,EAAE,SAAS,CAAC,aAAa;wBACrC,IAAI,EAAE,gDAAgD;qBACvD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB;gBAEzE,IAAI,CAAC;oBACH,kDAAkD;oBAClD,2DAA2D;oBAC3D,IAAI,cAAc,GAAG,OAAO,CAAC;oBAC7B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpD,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAmD,CAAC;wBACtH,cAAc,GAAG,WAAW,EAAE,OAAO,CAAC;oBACxC,CAAC;oBAED,sDAAsD;oBACtD,IAAI,cAAc,EAAE,CAAC;wBACnB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;wBACxE,MAAM,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,gBAAgB,EAAE;4BACpE,aAAa,EAAE,GAAG;yBACnB,CAAC,CAAC;wBACH,OAAO,CAAC,GAAG,CAAC,yEAAyE,EAAE;4BACrF,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BAC1C,GAAG;4BACH,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BAC5C,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;4BAChD,YAAY,EAAE,SAAS,CAAC,aAAa;4BACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BACnC,SAAS,EAAE,yBAAyB;4BACpC,WAAW,EAAE,mBAAmB;yBACjC,CAAC,CAAC;oBACL,CAAC;oBAED,uDAAuD;oBACvD,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;oBAC3D,MAAM,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBACjE,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB;qBAC7C,CAAC,CAAC;oBACH,OAAO,CAAC,GAAG,CAAC,2EAA2E,EAAE;wBACvF,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBACvC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;wBACjB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC5C,YAAY,EAAE,SAAS,CAAC,aAAa;wBACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,yBAAyB;wBACpC,WAAW,EAAE,qBAAqB;wBAClC,OAAO,EAAE,qDAAqD;qBAC/D,CAAC,CAAC;oBAEH,8DAA8D;oBAC9D,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;wBACrD,OAAO,EAAE,cAAc;wBACvB,QAAQ,EAAE,SAAS;wBACnB,eAAe,EAAE,SAAS,CAAC,gBAAgB;wBAC3C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;qBACrB,CAAC,EAAE;wBACF,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,gDAAgD;qBACpF,CAAC,CAAC;oBAEH,OAAO,CAAC,GAAG,CAAC,iEAAiE,EAAE;wBAC7E,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBACxC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;wBACxB,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC/C,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBACjD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,yBAAyB;wBACpC,WAAW,EAAE,eAAe;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,kDAAkD;oBAClD,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE;wBACrE,KAAK,EAAE,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;wBAClF,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;wBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,0BAA0B;wBACrC,QAAQ,EAAE,SAAS;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,sBAAsB;YACtB,MAAM,IAAI,GAAG,eAAe,CAAC;gBAC3B,YAAY,EAAE,SAAS,CAAC,aAAa,IAAI,aAAa;gBACtD,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,EAAE;gBAC9B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC1C,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBAC5D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACvD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,wBAAwB;gBACnC,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;aACrF,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAc;IACnD,6BAA6B;IAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime.d.ts

@@ -13,6 +13,8 @@ import { CloudflareProofGenerator } from "./proof-generator";
 import type { DetachedProof } from "@kya-os/contracts/proof";
 import { type KVNamespace } from "./cache/kv-tool-protection-cache";
 import type { CloudflareRuntimeConfig } from "./config";
+import type { IAuditLogger } from "@kya-os/mcp-i-core/runtime/audit-logger";
+import type { AgentIdentity } from "@kya-os/mcp-i-core";
 /**
  * CloudflareRuntime extends MCPIRuntimeBase with CloudflareProofGenerator
  */
@@ -32,7 +34,7 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
     private lastToolCallContext?;
     private serverUrl?;
     private proofService?;
-    protected accessControlService?: AccessControlApiService;
+    private auditLogger?;
     constructor(config: ProviderRuntimeConfig, serverUrl?: string, cloudflareConfig?: CloudflareRuntimeConfig);
     /**
      * Set AccessControlApiService (injected by createCloudflareRuntime)
@@ -42,6 +44,15 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
      * Set ProofVerifier (injected by createCloudflareRuntime)
      */
     setProofVerifier(verifier: ProofVerifier): void;
+    /**
+     * Get audit logger instance
+     */
+    getAuditLogger(): IAuditLogger | undefined;
+    /**
+     * Get identity - uses cached identity from base class for performance
+     * The base class caches identity during initialize() to avoid repeated provider calls
+     */
+    getIdentity(): Promise<AgentIdentity>;
     /**
      * Initialize runtime and proof generator
      */

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAExD;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,SAAS,CAAC,oBAAoB,CAAC,EAAE,uBAAuB,CAAC;gBAG7C,MAAM,EAAE,qBAAqB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,uBAAuB;IAWzG;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAI/D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IAwEf;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM;IAgDT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAE5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IAEpC,OAAO,CAAC,WAAW,CAAC,CAAe;gBAIjC,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,uBAAuB;IAY5C;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM/D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;OAEG;IACH,cAAc,IAAI,YAAY,GAAG,SAAS;IAI1C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAI3C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2BjC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IA4Ef;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM;IAgDT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}

package/dist/runtime.js

@@ -12,13 +12,15 @@ import { MCPIRuntimeBase, ToolProtectionService, } from "@kya-os/mcp-i-core";
 import { CloudflareProofGenerator } from "./proof-generator";
 import { KVToolProtectionCache, } from "./cache/kv-tool-protection-cache";
 import { ProofService } from "./services/proof.service";
+import { CloudflareAuditLogger } from "./runtime/audit-logger";
 export class CloudflareRuntime extends MCPIRuntimeBase {
     proofGenerator;
     lastDetachedProof;
     lastToolCallContext;
     serverUrl; // Store server URL for consent URL building
     proofService; // Proof submission service
-    accessControlService; // Access control API service
+    // accessControlService is inherited from MCPIRuntimeBase (protected), no need to redeclare
+    auditLogger; // Audit logger instance
     // proofVerifier is inherited from MCPIRuntimeBase (protected), no need to redeclare
     constructor(config, serverUrl, cloudflareConfig) {
         super(config);
@@ -31,21 +33,47 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
      * Set AccessControlApiService (injected by createCloudflareRuntime)
      */
     setAccessControlService(service) {
+        // Access protected property from base class (MCPIRuntimeBase)
+        // Protected members are accessible from subclasses in TypeScript
         this.accessControlService = service;
     }
     /**
      * Set ProofVerifier (injected by createCloudflareRuntime)
      */
     setProofVerifier(verifier) {
-        // Set the base class protected property directly
-        // Use type assertion to access protected property from base class
+        // Access protected property from base class (MCPIRuntimeBase)
+        // Protected members are accessible from subclasses in TypeScript
         this.proofVerifier = verifier;
     }
+    /**
+     * Get audit logger instance
+     */
+    getAuditLogger() {
+        return this.auditLogger;
+    }
+    /**
+     * Get identity - uses cached identity from base class for performance
+     * The base class caches identity during initialize() to avoid repeated provider calls
+     */
+    async getIdentity() {
+        return await super.getIdentity();
+    }
     /**
      * Initialize runtime and proof generator
      */
     async initialize() {
         await super.initialize();
+        // Initialize CloudflareAuditLogger if audit is enabled
+        // Uses Web Crypto API instead of Node.js crypto for Cloudflare Workers compatibility
+        if (this.config.audit?.enabled) {
+            this.auditLogger = new CloudflareAuditLogger({
+                enabled: true,
+                logFunction: this.config.audit.logFunction || console.log,
+                includePayloads: false,
+                // rotation is optional and may not be in the config type
+                rotation: this.config.audit.rotation,
+            });
+        }
         // Initialize CloudflareProofGenerator with identity
         const identity = await this.getIdentity();
         this.proofGenerator = new CloudflareProofGenerator(identity);
@@ -166,7 +194,9 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
                 // Determine MCP server URL from session or stored serverUrl
                 // Ensure URL has protocol (https://) for AgentShield tool discovery
                 let mcpServerUrl = enhancedSession.serverOrigin || this.serverUrl;
-                if (mcpServerUrl && !mcpServerUrl.startsWith('http://') && !mcpServerUrl.startsWith('https://')) {
+                if (mcpServerUrl &&
+                    !mcpServerUrl.startsWith("http://") &&
+                    !mcpServerUrl.startsWith("https://")) {
                     // Auto-add https:// if protocol missing
                     mcpServerUrl = `https://${mcpServerUrl}`;
                 }