@llm-dev-ops/agentics-cli 1.4.27 → 1.4.32

package/dist/bundled-agents/analytics-hub-agents/dist/auth/middleware.js

@@ -1,167 +0,0 @@
-"use strict";
-/**
- * Authentication Middleware
- * Handles JWT validation, API key authentication, and request decoration
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = authenticate;
-exports.requireAuth = requireAuth;
-exports.optionalAuth = optionalAuth;
-exports.requireMFA = requireMFA;
-exports.validateCSRF = validateCSRF;
-exports.createUserRateLimiter = createUserRateLimiter;
-const jwt_1 = require("./jwt");
-const rbac_1 = require("./rbac");
-const api_keys_1 = require("./api-keys");
-/**
- * Authentication middleware
- */
-async function authenticate(request, reply, options = {}) {
-    const { required = true, allowApiKey = true, requireMFA = false } = options;
-    try {
-        // Try JWT authentication first
-        const authHeader = request.headers.authorization;
-        if (authHeader?.startsWith('Bearer ')) {
-            const token = authHeader.substring(7);
-            const payload = await jwt_1.jwtManager.verifyAccessToken(token);
-            // Check MFA requirement
-            if (requireMFA && !payload.mfaVerified) {
-                throw new Error('MFA verification required');
-            }
-            // Get user permissions
-            const permissions = rbac_1.rbacManager.getUserPermissions(payload.roles);
-            // Decorate request with user info
-            request.user = {
-                ...payload,
-                roles: payload.roles,
-                permissions: permissions,
-            };
-            return;
-        }
-        // Try API Key authentication
-        if (allowApiKey) {
-            const apiKey = request.headers['x-api-key'];
-            if (apiKey) {
-                const keyData = await api_keys_1.apiKeyManager.validateKey(apiKey);
-                if (keyData) {
-                    // Decorate request with API key user info
-                    request.user = {
-                        userId: keyData.userId,
-                        email: keyData.name,
-                        roles: [rbac_1.Role.API_CLIENT],
-                        permissions: rbac_1.rbacManager.getRolePermissions(rbac_1.Role.API_CLIENT),
-                        organizationId: keyData.organizationId,
-                        sessionId: keyData.keyId,
-                        mfaVerified: false, // API keys don't require MFA
-                    };
-                    return;
-                }
-            }
-        }
-        // No valid authentication found
-        if (required) {
-            throw new Error('Authentication required');
-        }
-    }
-    catch (error) {
-        if (required) {
-            reply.code(401).send({
-                success: false,
-                error: error instanceof Error ? error.message : 'Authentication failed',
-            });
-            return;
-        }
-    }
-}
-/**
- * Require authentication (throws error if not authenticated)
- */
-async function requireAuth(request, reply) {
-    await authenticate(request, reply, { required: true });
-}
-/**
- * Optional authentication (doesn't throw if not authenticated)
- */
-async function optionalAuth(request, reply) {
-    await authenticate(request, reply, { required: false });
-}
-/**
- * Require MFA
- */
-async function requireMFA(request, reply) {
-    await authenticate(request, reply, { required: true, requireMFA: true });
-}
-/**
- * CSRF Token Validation Middleware
- */
-async function validateCSRF(request, reply) {
-    // Skip CSRF for GET, HEAD, OPTIONS
-    if (['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
-        return;
-    }
-    const csrfToken = request.headers['x-csrf-token'];
-    const sessionToken = request.headers['x-session-token'];
-    if (!csrfToken || !sessionToken) {
-        reply.code(403).send({
-            success: false,
-            error: 'CSRF token required',
-        });
-        return;
-    }
-    // Validate CSRF token (would check against session in production)
-    // This is a simplified version
-    const isValid = await validateCSRFToken(csrfToken, sessionToken);
-    if (!isValid) {
-        reply.code(403).send({
-            success: false,
-            error: 'Invalid CSRF token',
-        });
-        return;
-    }
-}
-async function validateCSRFToken(_csrfToken, _sessionToken) {
-    // In production, this would:
-    // 1. Look up session in Redis/database
-    // 2. Verify CSRF token matches session
-    // 3. Check token expiry
-    // For now, returning true as placeholder
-    return true;
-}
-/**
- * Rate limiting by user
- */
-function createUserRateLimiter(max, timeWindow) {
-    const userLimits = new Map();
-    return async (request, reply) => {
-        const user = request.user;
-        if (!user) {
-            return; // No user, skip rate limiting
-        }
-        const userId = user.userId;
-        const now = Date.now();
-        let userLimit = userLimits.get(userId);
-        if (!userLimit || userLimit.resetAt < now) {
-            // Create new limit window
-            userLimit = {
-                count: 0,
-                resetAt: now + timeWindow,
-            };
-            userLimits.set(userId, userLimit);
-        }
-        userLimit.count++;
-        if (userLimit.count > max) {
-            const retryAfter = Math.ceil((userLimit.resetAt - now) / 1000);
-            reply.code(429).header('Retry-After', retryAfter.toString()).send({
-                success: false,
-                error: 'Rate limit exceeded',
-                retryAfter,
-            });
-            return;
-        }
-        // Add rate limit headers
-        reply.header('X-RateLimit-Limit', max.toString());
-        reply.header('X-RateLimit-Remaining', (max - userLimit.count).toString());
-        reply.header('X-RateLimit-Reset', Math.ceil(userLimit.resetAt / 1000).toString());
-    };
-}
-//# sourceMappingURL=middleware.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAgBH,oCAwEC;AAKD,kCAKC;AAKD,oCAKC;AAKD,gCAKC;AAKD,oCA+BC;AAiBD,sDA6CC;AArND,+BAAmC;AACnC,iCAA6E;AAC7E,yCAA2C;AAQ3C;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,KAAmB,EACnB,UAAuB,EAAE;IAEzB,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,UAAU,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE5E,IAAI,CAAC;QACH,+BAA+B;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,gBAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAE1D,wBAAwB;YACxB,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,uBAAuB;YACvB,MAAM,WAAW,GAAG,kBAAW,CAAC,kBAAkB,CAChD,OAAO,CAAC,KAAe,CACxB,CAAC;YAEF,kCAAkC;YACjC,OAAgC,CAAC,IAAI,GAAG;gBACvC,GAAG,OAAO;gBACV,KAAK,EAAE,OAAO,CAAC,KAAe;gBAC9B,WAAW,EAAE,WAA2B;aACzC,CAAC;YAEF,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAW,CAAC;YAEtD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,MAAM,wBAAa,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAExD,IAAI,OAAO,EAAE,CAAC;oBACZ,0CAA0C;oBACzC,OAAgC,CAAC,IAAI,GAAG;wBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,KAAK,EAAE,OAAO,CAAC,IAAI;wBACnB,KAAK,EAAE,CAAC,WAAI,CAAC,UAAU,CAAC;wBACxB,WAAW,EAAE,kBAAW,CAAC,kBAAkB,CAAC,WAAI,CAAC,UAAU,CAAC;wBAC5D,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,SAAS,EAAE,OAAO,CAAC,KAAK;wBACxB,WAAW,EAAE,KAAK,EAAE,6BAA6B;qBAClD,CAAC;oBAEF,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aACxE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAC/B,OAAuB,EACvB,KAAmB;IAEnB,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,KAAmB;IAEnB,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,UAAU,CAC9B,OAAuB,EACvB,KAAmB;IAEnB,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,KAAmB;IAEnB,mCAAmC;IACnC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAW,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAW,CAAC;IAElE,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,qBAAqB;SAC7B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAkB,EAClB,aAAqB;IAErB,6BAA6B;IAC7B,uCAAuC;IACvC,uCAAuC;IACvC,wBAAwB;IACxB,yCAAyC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,GAAW,EAAE,UAAkB;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEzE,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAI,OAAgC,CAAC,IAAI,CAAC;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,8BAA8B;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEvC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAC1C,0BAA0B;YAC1B,SAAS,GAAG;gBACV,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,GAAG,UAAU;aAC1B,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,SAAS,CAAC,KAAK,EAAE,CAAC;QAElB,IAAI,SAAS,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAE/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;gBAChE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,UAAU;aACX,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,MAAM,CACV,mBAAmB,EACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAC/C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/oauth.d.ts

@@ -1,94 +0,0 @@
-/**
- * OAuth 2.0 / OIDC Integration
- * Supports Keycloak, Auth0, Okta, and other OIDC providers
- */
-import { TokenSet } from 'openid-client';
-export interface OAuthConfig {
-    issuerUrl: string;
-    clientId: string;
-    clientSecret: string;
-    redirectUri: string;
-    scopes: string[];
-}
-export interface OAuthUser {
-    sub: string;
-    email: string;
-    email_verified: boolean;
-    name?: string;
-    given_name?: string;
-    family_name?: string;
-    picture?: string;
-    roles?: string[];
-    groups?: string[];
-}
-export declare class OAuthManager {
-    private client;
-    private issuer;
-    private config;
-    constructor(config?: OAuthConfig);
-    /**
-     * Initialize OAuth client
-     */
-    initialize(): Promise<void>;
-    /**
-     * Get authorization URL
-     */
-    getAuthorizationUrl(state?: string): Promise<{
-        url: string;
-        state: string;
-        nonce: string;
-    }>;
-    /**
-     * Handle OAuth callback
-     */
-    handleCallback(callbackUrl: string, expectedState: string): Promise<{
-        user: OAuthUser;
-        tokens: TokenSet;
-    }>;
-    /**
-     * Refresh access token
-     */
-    refreshToken(refreshToken: string): Promise<TokenSet>;
-    /**
-     * Revoke token
-     */
-    revokeToken(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
-    /**
-     * End session (logout)
-     */
-    endSession(idToken: string, postLogoutRedirectUri?: string): Promise<string>;
-    /**
-     * Map OAuth user to internal user and generate JWT
-     */
-    createInternalSession(oauthUser: OAuthUser): Promise<{
-        accessToken: string;
-        refreshToken: string;
-        expiresIn: number;
-    }>;
-    /**
-     * Extract roles from OAuth claims
-     */
-    private extractRoles;
-    /**
-     * Get nested object value by path
-     */
-    private getNestedValue;
-    /**
-     * Map OAuth roles to internal RBAC roles
-     */
-    private mapOAuthRolesToInternal;
-    /**
-     * Store code verifier (would use Redis in production)
-     */
-    private storeCodeVerifier;
-    /**
-     * Get code verifier (would use Redis in production)
-     */
-    private getCodeVerifier;
-    /**
-     * Delete code verifier (would use Redis in production)
-     */
-    private deleteCodeVerifier;
-}
-export declare const oauthManager: OAuthManager;
-//# sourceMappingURL=oauth.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA8B,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIrE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,MAAM,CAAc;gBAEhB,MAAM,CAAC,EAAE,WAAW;IAchC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAWjC;;OAEG;IACG,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA4BjG;;OAEG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC;IA+CjD;;OAEG;IACG,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQ3D;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjG;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYlF;;OAEG;IACG,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QACzD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAoBF;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBpB;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA2B/B;;OAEG;YACW,iBAAiB;IAI/B;;OAEG;YACW,eAAe;IAK7B;;OAEG;YACW,kBAAkB;CAGjC;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/oauth.js

@@ -1,223 +0,0 @@
-"use strict";
-/**
- * OAuth 2.0 / OIDC Integration
- * Supports Keycloak, Auth0, Okta, and other OIDC providers
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oauthManager = exports.OAuthManager = void 0;
-const openid_client_1 = require("openid-client");
-const jwt_1 = require("./jwt");
-const rbac_1 = require("./rbac");
-class OAuthManager {
-    client = null;
-    issuer = null;
-    config;
-    constructor(config) {
-        this.config = config || {
-            issuerUrl: process.env.OAUTH_ISSUER_URL ||
-                'https://keycloak.llm-analytics.com/realms/llm-analytics',
-            clientId: process.env.OAUTH_CLIENT_ID || 'llm-analytics-hub',
-            clientSecret: process.env.OAUTH_CLIENT_SECRET || '',
-            redirectUri: process.env.OAUTH_REDIRECT_URI ||
-                'https://app.llm-analytics.com/auth/callback',
-            scopes: ['openid', 'profile', 'email', 'roles'],
-        };
-    }
-    /**
-     * Initialize OAuth client
-     */
-    async initialize() {
-        this.issuer = await openid_client_1.Issuer.discover(this.config.issuerUrl);
-        this.client = new this.issuer.Client({
-            client_id: this.config.clientId,
-            client_secret: this.config.clientSecret,
-            redirect_uris: [this.config.redirectUri],
-            response_types: ['code'],
-        });
-    }
-    /**
-     * Get authorization URL
-     */
-    async getAuthorizationUrl(state) {
-        if (!this.client) {
-            await this.initialize();
-        }
-        const codeVerifier = openid_client_1.generators.codeVerifier();
-        const codeChallenge = openid_client_1.generators.codeChallenge(codeVerifier);
-        const nonce = openid_client_1.generators.nonce();
-        const stateValue = state || openid_client_1.generators.state();
-        const authUrl = this.client.authorizationUrl({
-            scope: this.config.scopes.join(' '),
-            code_challenge: codeChallenge,
-            code_challenge_method: 'S256',
-            state: stateValue,
-            nonce,
-        });
-        // Store code verifier for token exchange (would use Redis in production)
-        await this.storeCodeVerifier(stateValue, codeVerifier);
-        return {
-            url: authUrl,
-            state: stateValue,
-            nonce,
-        };
-    }
-    /**
-     * Handle OAuth callback
-     */
-    async handleCallback(callbackUrl, expectedState) {
-        if (!this.client) {
-            await this.initialize();
-        }
-        // Retrieve code verifier
-        const codeVerifier = await this.getCodeVerifier(expectedState);
-        if (!codeVerifier) {
-            throw new Error('Invalid state or expired session');
-        }
-        // Exchange authorization code for tokens
-        const params = this.client.callbackParams(callbackUrl);
-        const tokenSet = await this.client.callback(this.config.redirectUri, params, {
-            code_verifier: codeVerifier,
-            state: expectedState,
-        });
-        // Get user info from token claims
-        const claims = tokenSet.claims();
-        // Optionally fetch additional user info
-        const userinfo = await this.client.userinfo(tokenSet);
-        const user = {
-            sub: claims.sub,
-            email: claims.email || userinfo.email,
-            email_verified: claims.email_verified || false,
-            name: claims.name || userinfo.name,
-            given_name: claims.given_name || userinfo.given_name,
-            family_name: claims.family_name || userinfo.family_name,
-            picture: claims.picture || userinfo.picture,
-            roles: claims.roles || this.extractRoles(claims),
-            groups: claims.groups || userinfo.groups,
-        };
-        // Clean up code verifier
-        await this.deleteCodeVerifier(expectedState);
-        return { user, tokens: tokenSet };
-    }
-    /**
-     * Refresh access token
-     */
-    async refreshToken(refreshToken) {
-        if (!this.client) {
-            await this.initialize();
-        }
-        return await this.client.refresh(refreshToken);
-    }
-    /**
-     * Revoke token
-     */
-    async revokeToken(token, tokenTypeHint) {
-        if (!this.client) {
-            await this.initialize();
-        }
-        await this.client.revoke(token, tokenTypeHint);
-    }
-    /**
-     * End session (logout)
-     */
-    async endSession(idToken, postLogoutRedirectUri) {
-        if (!this.client) {
-            await this.initialize();
-        }
-        return this.client.endSessionUrl({
-            id_token_hint: idToken,
-            post_logout_redirect_uri: postLogoutRedirectUri || 'https://app.llm-analytics.com',
-        });
-    }
-    /**
-     * Map OAuth user to internal user and generate JWT
-     */
-    async createInternalSession(oauthUser) {
-        // Map OAuth roles to internal roles
-        const internalRoles = this.mapOAuthRolesToInternal(oauthUser.roles || []);
-        // Generate session ID
-        const sessionId = await jwt_1.jwtManager.generateSessionId();
-        // Generate JWT tokens
-        const tokens = await jwt_1.jwtManager.generateTokenPair({
-            userId: oauthUser.sub,
-            email: oauthUser.email,
-            roles: internalRoles,
-            permissions: [], // Will be populated by RBAC middleware
-            sessionId,
-            mfaVerified: false, // OAuth doesn't guarantee MFA
-        });
-        return tokens;
-    }
-    /**
-     * Extract roles from OAuth claims
-     */
-    extractRoles(claims) {
-        // Try different claim paths where roles might be stored
-        const rolePaths = [
-            'roles',
-            'realm_access.roles',
-            'resource_access.llm-analytics-hub.roles',
-            'groups',
-        ];
-        for (const path of rolePaths) {
-            const value = this.getNestedValue(claims, path);
-            if (Array.isArray(value)) {
-                return value;
-            }
-        }
-        return [];
-    }
-    /**
-     * Get nested object value by path
-     */
-    getNestedValue(obj, path) {
-        return path.split('.').reduce((current, key) => current?.[key], obj);
-    }
-    /**
-     * Map OAuth roles to internal RBAC roles
-     */
-    mapOAuthRolesToInternal(oauthRoles) {
-        const roleMap = {
-            'super-admin': rbac_1.Role.SUPER_ADMIN,
-            'super_admin': rbac_1.Role.SUPER_ADMIN,
-            'admin': rbac_1.Role.ADMIN,
-            'administrator': rbac_1.Role.ADMIN,
-            'analyst': rbac_1.Role.ANALYST,
-            'data-analyst': rbac_1.Role.ANALYST,
-            'developer': rbac_1.Role.DEVELOPER,
-            'dev': rbac_1.Role.DEVELOPER,
-            'viewer': rbac_1.Role.VIEWER,
-            'read-only': rbac_1.Role.VIEWER,
-        };
-        const mappedRoles = [];
-        for (const oauthRole of oauthRoles) {
-            const normalizedRole = oauthRole.toLowerCase();
-            if (roleMap[normalizedRole]) {
-                mappedRoles.push(roleMap[normalizedRole]);
-            }
-        }
-        // Default to viewer if no roles matched
-        return mappedRoles.length > 0 ? mappedRoles : [rbac_1.Role.VIEWER];
-    }
-    /**
-     * Store code verifier (would use Redis in production)
-     */
-    async storeCodeVerifier(_state, _verifier) {
-        // In production: await redis.setex(`oauth:verifier:${state}`, 600, verifier);
-    }
-    /**
-     * Get code verifier (would use Redis in production)
-     */
-    async getCodeVerifier(_state) {
-        // In production: return await redis.get(`oauth:verifier:${state}`);
-        return null;
-    }
-    /**
-     * Delete code verifier (would use Redis in production)
-     */
-    async deleteCodeVerifier(_state) {
-        // In production: await redis.del(`oauth:verifier:${state}`);
-    }
-}
-exports.OAuthManager = OAuthManager;
-exports.oauthManager = new OAuthManager();
-//# sourceMappingURL=oauth.js.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,iDAAqE;AACrE,+BAAmC;AACnC,iCAA8B;AAsB9B,MAAa,YAAY;IACf,MAAM,GAAkB,IAAI,CAAC;IAC7B,MAAM,GAAkB,IAAI,CAAC;IAC7B,MAAM,CAAc;IAE5B,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI;YACtB,SAAS,EACP,OAAO,CAAC,GAAG,CAAC,gBAAgB;gBAC5B,yDAAyD;YAC3D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,mBAAmB;YAC5D,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE;YACnD,WAAW,EACT,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC9B,6CAA6C;YAC/C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,sBAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,aAAa,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,YAAY,GAAG,0BAAU,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,aAAa,GAAG,0BAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,0BAAU,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,KAAK,IAAI,0BAAU,CAAC,KAAK,EAAE,CAAC;QAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAO,CAAC,gBAAgB,CAAC;YAC5C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACnC,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,UAAU;YACjB,KAAK;SACN,CAAC,CAAC;QAEH,yEAAyE;QACzE,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAEvD,OAAO;YACL,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,UAAU;YACjB,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,aAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,yBAAyB;QACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAE/D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAO,CAAC,QAAQ,CAC1C,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,MAAM,EACN;YACE,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,aAAa;SACrB,CACF,CAAC;QAEF,kCAAkC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAe,CAAC;QAE9C,wCAAwC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK,IAAK,QAAQ,CAAC,KAAgB;YACjD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;YAC9C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAK,QAAQ,CAAC,IAAe;YAC9C,UAAU,EAAE,MAAM,CAAC,UAAU,IAAK,QAAQ,CAAC,UAAqB;YAChE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAK,QAAQ,CAAC,WAAsB;YACnE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAK,QAAQ,CAAC,OAAkB;YACvD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAChD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAK,QAAQ,CAAC,MAAmB;SACvD,CAAC;QAEF,yBAAyB;QACzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,aAAgD;QAC/E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,qBAA8B;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC,MAAO,CAAC,aAAa,CAAC;YAChC,aAAa,EAAE,OAAO;YACtB,wBAAwB,EACtB,qBAAqB,IAAI,+BAA+B;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,SAAoB;QAK9C,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAE1E,sBAAsB;QACtB,MAAM,SAAS,GAAG,MAAM,gBAAU,CAAC,iBAAiB,EAAE,CAAC;QAEvD,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,gBAAU,CAAC,iBAAiB,CAAC;YAChD,MAAM,EAAE,SAAS,CAAC,GAAG;YACrB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,EAAE,EAAE,uCAAuC;YACxD,SAAS;YACT,WAAW,EAAE,KAAK,EAAE,8BAA8B;SACnD,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAW;QAC9B,wDAAwD;QACxD,MAAM,SAAS,GAAG;YAChB,OAAO;YACP,oBAAoB;YACpB,yCAAyC;YACzC,QAAQ;SACT,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAQ,EAAE,IAAY;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,UAAoB;QAClD,MAAM,OAAO,GAAyB;YACpC,aAAa,EAAE,WAAI,CAAC,WAAW;YAC/B,aAAa,EAAE,WAAI,CAAC,WAAW;YAC/B,OAAO,EAAE,WAAI,CAAC,KAAK;YACnB,eAAe,EAAE,WAAI,CAAC,KAAK;YAC3B,SAAS,EAAE,WAAI,CAAC,OAAO;YACvB,cAAc,EAAE,WAAI,CAAC,OAAO;YAC5B,WAAW,EAAE,WAAI,CAAC,SAAS;YAC3B,KAAK,EAAE,WAAI,CAAC,SAAS;YACrB,QAAQ,EAAE,WAAI,CAAC,MAAM;YACrB,WAAW,EAAE,WAAI,CAAC,MAAM;SACzB,CAAC;QAEF,MAAM,WAAW,GAAW,EAAE,CAAC;QAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,SAAiB;QAC/D,8EAA8E;IAChF,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAC7C,6DAA6D;IAC/D,CAAC;CACF;AArQD,oCAqQC;AAEY,QAAA,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/dist/bundled-agents/analytics-hub-agents/dist/auth/rbac.d.ts

@@ -1,106 +0,0 @@
-/**
- * Role-Based Access Control (RBAC) System
- * Manages roles, permissions, and access control policies
- */
-import { FastifyRequest } from 'fastify';
-export declare enum Role {
-    SUPER_ADMIN = "super_admin",
-    ADMIN = "admin",
-    ANALYST = "analyst",
-    DEVELOPER = "developer",
-    VIEWER = "viewer",
-    API_CLIENT = "api_client"
-}
-export declare enum Permission {
-    EVENT_READ = "event:read",
-    EVENT_WRITE = "event:write",
-    EVENT_DELETE = "event:delete",
-    METRICS_READ = "metrics:read",
-    METRICS_WRITE = "metrics:write",
-    METRICS_DELETE = "metrics:delete",
-    DASHBOARD_READ = "dashboard:read",
-    DASHBOARD_WRITE = "dashboard:write",
-    DASHBOARD_DELETE = "dashboard:delete",
-    USER_READ = "user:read",
-    USER_WRITE = "user:write",
-    USER_DELETE = "user:delete",
-    ORG_READ = "org:read",
-    ORG_WRITE = "org:write",
-    ORG_DELETE = "org:delete",
-    API_KEY_READ = "api_key:read",
-    API_KEY_WRITE = "api_key:write",
-    API_KEY_DELETE = "api_key:delete",
-    SYSTEM_CONFIG = "system:config",
-    SYSTEM_AUDIT = "system:audit"
-}
-/**
- * Role-Permission mapping
- */
-export declare const RolePermissions: Record<Role, Permission[]>;
-/**
- * RBAC Manager
- */
-export declare class RBACManager {
-    /**
-     * Check if role has permission
-     */
-    hasPermission(role: Role, permission: Permission): boolean;
-    /**
-     * Check if user has permission (supports multiple roles)
-     */
-    userHasPermission(roles: Role[], permission: Permission): boolean;
-    /**
-     * Get all permissions for a role
-     */
-    getRolePermissions(role: Role): Permission[];
-    /**
-     * Get all permissions for user (union of all role permissions)
-     */
-    getUserPermissions(roles: Role[]): Permission[];
-    /**
-     * Check if user has any of the required permissions
-     */
-    hasAnyPermission(roles: Role[], permissions: Permission[]): boolean;
-    /**
-     * Check if user has all required permissions
-     */
-    hasAllPermissions(roles: Role[], permissions: Permission[]): boolean;
-    /**
-     * Validate resource access (attribute-based)
-     */
-    canAccessResource(roles: Role[], permission: Permission, resource: {
-        organizationId?: string;
-        userId?: string;
-    }, user: {
-        userId: string;
-        organizationId?: string;
-    }): boolean;
-}
-export declare const rbacManager: RBACManager;
-/**
- * Fastify request with authenticated user
- */
-export interface AuthenticatedRequest extends FastifyRequest {
-    user: {
-        userId: string;
-        email: string;
-        roles: Role[];
-        permissions: Permission[];
-        organizationId?: string;
-        sessionId: string;
-        mfaVerified: boolean;
-    };
-}
-/**
- * Authorization middleware factory
- */
-export declare function requirePermission(...permissions: Permission[]): (request: AuthenticatedRequest) => Promise<void>;
-/**
- * Require all permissions
- */
-export declare function requireAllPermissions(...permissions: Permission[]): (request: AuthenticatedRequest) => Promise<void>;
-/**
- * Require role
- */
-export declare function requireRole(...roles: Role[]): (request: AuthenticatedRequest) => Promise<void>;
-//# sourceMappingURL=rbac.d.ts.map

package/dist/bundled-agents/analytics-hub-agents/dist/auth/rbac.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/auth/rbac.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,oBAAY,IAAI;IACd,WAAW,gBAAgB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,UAAU,eAAe;CAC1B;AAED,oBAAY,UAAU;IAEpB,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAG7B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAGjC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IAGrC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAG3B,QAAQ,aAAa;IACrB,SAAS,cAAc;IACvB,UAAU,eAAe;IAGzB,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAGjC,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;CAC9B;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,CAqDtD,CAAC;AAEF;;GAEG;AACH,qBAAa,WAAW;IACtB;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO;IAK1D;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO;IAIjE;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,EAAE;IAI5C;;OAEG;IACH,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,UAAU,EAAE;IAS/C;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO;IAInE;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO;IAIpE;;OAEG;IACH,iBAAiB,CACf,KAAK,EAAE,IAAI,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EACtD,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO;CAmCX;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,IAAI,EAAE,CAAC;QACd,WAAW,EAAE,UAAU,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,WAAW,EAAE,UAAU,EAAE,IAC9C,SAAS,oBAAoB,mBAa5C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,WAAW,EAAE,UAAU,EAAE,IAClD,SAAS,oBAAoB,mBAgB5C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,IAC5B,SAAS,oBAAoB,mBAW5C"}