@mp-consulting/homebridge-daikin-cloud 1.5.1 → 1.6.0

package/dist/src/api/token-client.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * Token Client
+ *
+ * Token lifecycle shared by both OAuth flows (Developer Portal and Mobile
+ * App): persistence to the token file, expiry checks with a refresh buffer,
+ * single-flight refresh, and strict parsing of token endpoint responses.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenClient = void 0;
+exports.withExpiresAt = withExpiresAt;
+exports.isTokenExpiring = isTokenExpiring;
+exports.parseJsonBody = parseJsonBody;
+exports.parseTokenResponse = parseTokenResponse;
+const daikin_schemas_1 = require("./daikin-schemas");
+const token_storage_1 = require("./token-storage");
+const constants_1 = require("../constants");
+const errors_1 = require("../utils/errors");
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+/**
+ * Return a copy of the token set with `expires_at` derived from `expires_in`
+ * when the server only sent the relative lifetime.
+ */
+function withExpiresAt(tokenSet) {
+    if (tokenSet.expires_in && !tokenSet.expires_at) {
+        return { ...tokenSet, expires_at: nowSeconds() + tokenSet.expires_in };
+    }
+    return tokenSet;
+}
+/**
+ * Whether the token is expired or expires within TOKEN_EXPIRY_BUFFER_SECONDS.
+ * A token without `expires_at` is treated as expired.
+ */
+function isTokenExpiring(tokenSet) {
+    return (tokenSet.expires_at ?? 0) < nowSeconds() + constants_1.TOKEN_EXPIRY_BUFFER_SECONDS;
+}
+/**
+ * Parse a JSON response body, reporting the endpoint and status instead of a
+ * bare "Unexpected token <" when a proxy/WAF answers with HTML or nothing.
+ */
+function parseJsonBody(response, url, context) {
+    try {
+        return JSON.parse(response.body);
+    }
+    catch {
+        const { hostname } = new URL(url);
+        const snippet = response.body.trim().replace(/\s+/g, ' ').slice(0, 200);
+        throw new Error(`${context}: ${hostname} returned a non-JSON response (HTTP ${response.statusCode})`
+            + (snippet ? `: ${snippet}` : ' with an empty body'));
+    }
+}
+/**
+ * Validate a token endpoint response: OAuth error bodies, non-2xx statuses and
+ * malformed token sets all become errors with a readable message. The message
+ * keeps the OAuth error code (e.g. `invalid_grant`), which callers match on.
+ * Token values are never included.
+ */
+function parseTokenResponse(response, url, context) {
+    const body = parseJsonBody(response, url, context);
+    const oauthError = daikin_schemas_1.OAuthErrorSchema.safeParse(body);
+    if (oauthError.success) {
+        const { error, error_description: description } = oauthError.data;
+        throw new Error(`${context}: ${error}${description ? ` - ${description}` : ''} (HTTP ${response.statusCode})`);
+    }
+    const { hostname } = new URL(url);
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        throw new Error(`${context}: ${hostname} returned HTTP ${response.statusCode}`);
+    }
+    const result = daikin_schemas_1.TokenSetSchema.safeParse(body);
+    if (!result.success) {
+        const fields = [...new Set(result.error.issues.map((issue) => issue.path.join('.') || '(body)'))];
+        throw new Error(`${context}: ${hostname} returned an invalid token response (missing or malformed: ${fields.join(', ')})`);
+    }
+    return result.data;
+}
+/**
+ * Base class holding the current token set and its refresh logic. Subclasses
+ * implement only the grant-specific refresh request.
+ */
+class TokenClient {
+    tokenFilePath;
+    onTokenUpdate;
+    onError;
+    tokenSet = null;
+    refreshPromise = null;
+    constructor(tokenFilePath, onTokenUpdate, onError) {
+        this.tokenFilePath = tokenFilePath;
+        this.onTokenUpdate = onTokenUpdate;
+        this.onError = onError;
+        this.loadFromFile();
+    }
+    /**
+     * Refresh the access token. Concurrent callers share one in-flight request;
+     * a failed refresh is not cached, so the next call retries.
+     */
+    refreshToken() {
+        const refreshToken = this.tokenSet?.refresh_token;
+        if (!refreshToken) {
+            return Promise.reject(new Error('No refresh token available'));
+        }
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.requestTokenRefresh(refreshToken)
+                // Providers may omit refresh_token when they do not rotate it; the
+                // previous one stays valid then (RFC 6749 section 6).
+                .then((tokenSet) => this.setTokenSet({ ...tokenSet, refresh_token: tokenSet.refresh_token ?? refreshToken }))
+                .finally(() => {
+                this.refreshPromise = null;
+            });
+        }
+        return this.refreshPromise;
+    }
+    /**
+     * Get a valid access token, refreshing if necessary
+     */
+    async getAccessToken() {
+        const current = this.tokenSet;
+        if (!current) {
+            throw new Error('Not authenticated. Please authenticate first.');
+        }
+        if (!isTokenExpiring(current)) {
+            return current.access_token;
+        }
+        if (!current.refresh_token) {
+            throw new Error('Token expired and no refresh token available. Please re-authenticate.');
+        }
+        const refreshed = await this.refreshToken();
+        return refreshed.access_token;
+    }
+    /**
+     * Check if we have a token (it may still need a refresh)
+     */
+    isAuthenticated() {
+        return !!this.tokenSet?.access_token;
+    }
+    /**
+     * Get token expiration date
+     */
+    getTokenExpiration() {
+        if (!this.tokenSet?.expires_at) {
+            return null;
+        }
+        return new Date(this.tokenSet.expires_at * 1000);
+    }
+    /**
+     * Get current token set (for status display)
+     */
+    getTokenSet() {
+        return this.tokenSet;
+    }
+    /**
+     * Forget the current tokens and delete the token file
+     */
+    clearTokens() {
+        (0, token_storage_1.deleteTokenFile)(this.tokenFilePath);
+        this.tokenSet = null;
+    }
+    /**
+     * Store a new token set (in memory and on disk) and notify listeners.
+     * Returns the stored set, with `expires_at` filled in.
+     */
+    setTokenSet(tokenSet) {
+        const stored = withExpiresAt(tokenSet);
+        this.tokenSet = stored;
+        this.saveToFile(stored);
+        this.onTokenUpdate?.(stored);
+        return stored;
+    }
+    loadFromFile() {
+        try {
+            this.tokenSet = (0, token_storage_1.loadTokenFromFile)(this.tokenFilePath);
+        }
+        catch (error) {
+            this.onError?.(new Error(`Failed to load token file: ${(0, errors_1.toMessage)(error)}`));
+        }
+    }
+    saveToFile(tokenSet) {
+        try {
+            (0, token_storage_1.saveTokenToFile)(this.tokenFilePath, tokenSet);
+        }
+        catch (error) {
+            this.onError?.(new Error(`Failed to save token file: ${(0, errors_1.toMessage)(error)}`));
+        }
+    }
+}
+exports.TokenClient = TokenClient;
+//# sourceMappingURL=token-client.js.map

package/dist/src/api/token-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-client.js","sourceRoot":"","sources":["../../../src/api/token-client.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAmBH,sCAKC;AAMD,0CAEC;AAMD,sCAWC;AAQD,gDAwBC;AA7ED,qDAAoE;AACpE,mDAAsF;AACtF,4CAA2D;AAC3D,4CAA4C;AAI5C,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,QAAkB;IAC9C,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,QAAkB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,uCAA2B,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,QAAsB,EAAE,GAAW,EAAE,OAAe;IAChF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,KAAK,QAAQ,uCAAuC,QAAQ,CAAC,UAAU,GAAG;cAClF,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CACrD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,QAAsB,EAAE,GAAW,EAAE,OAAe;IACrF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAG,iCAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,KAAK,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,QAAQ,CAAC,UAAU,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,KAAK,QAAQ,kBAAkB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,MAAM,GAAG,+BAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClG,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,KAAK,QAAQ,8DAA8D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAsB,WAAW;IAKZ;IACA;IACA;IANT,QAAQ,GAAoB,IAAI,CAAC;IACnC,cAAc,GAA6B,IAAI,CAAC;IAExD,YACmB,aAAqB,EACrB,aAA4C,EAC5C,OAAgC;QAFhC,kBAAa,GAAb,aAAa,CAAQ;QACrB,kBAAa,GAAb,aAAa,CAA+B;QAC5C,YAAO,GAAP,OAAO,CAAyB;QAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAOD;;;OAGG;IACH,YAAY;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC;gBAC1D,mEAAmE;gBACnE,sDAAsD;iBACrD,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,YAAY,EAAE,CAAC,CAAC;iBAC5G,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,YAAY,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,YAAY,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAA,+BAAe,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;OAGG;IACO,WAAW,CAAC,QAAkB;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAA,iCAAiB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,IAAA,kBAAS,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAkB;QACnC,IAAI,CAAC;YACH,IAAA,+BAAe,EAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,IAAA,kBAAS,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF;AAtHD,kCAsHC"}

package/dist/src/api/token-storage.d.ts

@@ -12,6 +12,12 @@ import type { TokenSet } from './daikin-types';
 export declare function loadTokenFromFile(filePath: string): TokenSet | null;
 /**
  * Save a token set to a file with restricted permissions.
+ *
+ * Writes atomically (temp file + rename) so a crash mid-write never leaves a
+ * truncated token file behind. `mode` on writeFileSync only applies when a
+ * file is created, so a pre-existing world-readable token file would keep its
+ * permissions: the temp file is always freshly created with 0600 and replaces
+ * the old inode, and the final file is chmod'ed again for good measure.
  */
 export declare function saveTokenToFile(filePath: string, tokenSet: TokenSet): void;
 /**

package/dist/src/api/token-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-storage.d.ts","sourceRoot":"","sources":["../../../src/api/token-storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAM/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAgBnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAM1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQtD"}
+{"version":3,"file":"token-storage.d.ts","sourceRoot":"","sources":["../../../src/api/token-storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAM/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAgBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAsB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQtD"}

package/dist/src/api/token-storage.js

@@ -43,6 +43,7 @@ exports.loadTokenFromFile = loadTokenFromFile;
 exports.saveTokenToFile = saveTokenToFile;
 exports.deleteTokenFile = deleteTokenFile;
 const fs = __importStar(require("node:fs"));
+const crypto = __importStar(require("node:crypto"));
 const daikin_schemas_1 = require("./daikin-schemas");
 /** File permissions: owner read/write only */
 const TOKEN_FILE_MODE = 0o600;
@@ -70,9 +71,34 @@ function loadTokenFromFile(filePath) {
 }
 /**
  * Save a token set to a file with restricted permissions.
+ *
+ * Writes atomically (temp file + rename) so a crash mid-write never leaves a
+ * truncated token file behind. `mode` on writeFileSync only applies when a
+ * file is created, so a pre-existing world-readable token file would keep its
+ * permissions: the temp file is always freshly created with 0600 and replaces
+ * the old inode, and the final file is chmod'ed again for good measure.
  */
 function saveTokenToFile(filePath, tokenSet) {
-    fs.writeFileSync(filePath, JSON.stringify(tokenSet, null, 2), { encoding: 'utf8', mode: TOKEN_FILE_MODE });
+    const tempPath = `${filePath}.tmp-${crypto.randomBytes(8).toString('hex')}`;
+    try {
+        fs.writeFileSync(tempPath, JSON.stringify(tokenSet, null, 2), { encoding: 'utf8', mode: TOKEN_FILE_MODE, flag: 'wx' });
+        fs.renameSync(tempPath, filePath);
+    }
+    catch (error) {
+        try {
+            fs.rmSync(tempPath, { force: true });
+        }
+        catch {
+            // Best effort cleanup
+        }
+        throw error;
+    }
+    try {
+        fs.chmodSync(filePath, TOKEN_FILE_MODE);
+    }
+    catch {
+        // Platforms without POSIX permissions (Windows)
+    }
 }
 /**
  * Delete a token file if it exists.

package/dist/src/api/token-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-storage.js","sourceRoot":"","sources":["../../../src/api/token-storage.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaH,8CAgBC;AAKD,0CAMC;AAKD,0CAQC;AAnDD,4CAA8B;AAE9B,qDAAkD;AAElD,8CAA8C;AAC9C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,+BAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC,IAAgB,CAAC;YACjC,CAAC;YACD,sDAAsD;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,QAAgB,EAAE,QAAkB;IAClE,EAAE,CAAC,aAAa,CACd,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACjC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;AACH,CAAC"}
+{"version":3,"file":"token-storage.js","sourceRoot":"","sources":["../../../src/api/token-storage.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcH,8CAgBC;AAWD,0CAsBC;AAKD,0CAQC;AA1ED,4CAA8B;AAC9B,oDAAsC;AAEtC,qDAAkD;AAElD,8CAA8C;AAC9C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,+BAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;YACD,sDAAsD;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,QAAgB,EAAE,QAAkB;IAClE,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACjC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CACxD,CAAC;QACF,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;AACH,CAAC"}

package/dist/src/config/config-manager.d.ts

@@ -1,18 +1,42 @@
 /**
  * Configuration Manager
  *
- * Centralizes configuration management with validation,
- * defaults, and type-safe access to config values.
+ * Single source of truth for the plugin configuration: the raw Homebridge
+ * platform config is normalized once (type coercion, schema bounds, defaults)
+ * and every consumer reads it through the typed getters below.
  */
-import type { AuthMode } from '../api/daikin-types';
-export interface PluginConfig {
+import type { AuthMode, DaikinControllerConfig } from '../api/daikin-types';
+import type { HttpTransportMode } from '../api/http-transport';
+/**
+ * Per-feature config toggles (the `show*` keys of config.schema.json).
+ *
+ * - `extra`: switches that follow the legacy `showExtraFeatures` catch-all when
+ *   their own key is not set.
+ * - `standalone`: default off and never follow `showExtraFeatures` (a separate
+ *   Fan tile, and a switch that installs firmware).
+ *
+ * Kept in sync with config.schema.json and homebridge-ui/public/script.js by
+ * test/unit/config/feature-config-keys.test.ts.
+ */
+export declare const FEATURE_CONFIG_KEYS: {
+    readonly extra: readonly ["showPowerfulMode", "showEconoMode", "showStreamerMode", "showOutdoorSilentMode", "showIndoorSilentMode", "showAutoFanMode", "showOscillationSwitch", "showDryMode", "showFanOnlyMode", "showHolidayMode"];
+    readonly standalone: readonly ["showSeparateFanControl", "showFirmwareUpdateSwitch"];
+};
+export type ExtraFeatureConfigKey = typeof FEATURE_CONFIG_KEYS.extra[number];
+export type StandaloneFeatureConfigKey = typeof FEATURE_CONFIG_KEYS.standalone[number];
+export type FeatureConfigKey = ExtraFeatureConfigKey | StandaloneFeatureConfigKey;
+/**
+ * Raw plugin config as written by Homebridge. Values come from a user-edited
+ * JSON file, so the declared types are what the schema intends, not a guarantee.
+ */
+export interface PluginConfig extends Partial<Record<FeatureConfigKey, boolean | null>> {
     platform: string;
     name?: string;
     authMode?: AuthMode;
     clientId?: string;
     clientSecret?: string;
     callbackServerExternalAddress?: string;
-    callbackServerPort?: number;
+    callbackServerPort?: number | string;
     oidcCallbackServerBindAddr?: string;
     daikinEmail?: string;
     daikinPassword?: string;
@@ -24,139 +48,59 @@ export interface PluginConfig {
      */
     email?: string;
     password?: string;
-    updateIntervalInMinutes?: number;
-    forceUpdateDelay?: number;
+    updateIntervalInMinutes?: number | string;
+    forceUpdateDelay?: number | string;
     excludedDevicesByDeviceId?: string[];
-    showPowerfulMode?: boolean;
-    showEconoMode?: boolean;
-    showStreamerMode?: boolean;
-    showOutdoorSilentMode?: boolean;
-    showIndoorSilentMode?: boolean;
-    showAutoFanMode?: boolean;
-    showOscillationSwitch?: boolean;
-    showDryMode?: boolean;
-    showFanOnlyMode?: boolean;
-    showHolidayMode?: boolean;
-    showExtraFeatures?: boolean;
-    showSeparateFanControl?: boolean;
-    showFirmwareUpdateSwitch?: boolean;
-    httpTransport?: 'node' | 'curl';
+    showExtraFeatures?: boolean | null;
+    httpTransport?: HttpTransportMode;
     enableWebSocket?: boolean;
 }
-export interface NormalizedConfig {
-    authMode: AuthMode;
-    updateIntervalMs: number;
-    forceUpdateDelayMs: number;
-    excludedDeviceIds: Set<string>;
-    features: {
-        powerfulMode: boolean;
-        econoMode: boolean;
-        streamerMode: boolean;
-        outdoorSilentMode: boolean;
-        indoorSilentMode: boolean;
-        autoFanMode: boolean;
-        oscillationMode: boolean;
-        dryMode: boolean;
-        fanOnlyMode: boolean;
-        holidayMode: boolean;
-    };
-    websocketEnabled: boolean;
+export interface ConfigValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
 }
+/**
+ * Validate a raw plugin config. Pure: also used by the custom UI server
+ * (homebridge-ui/server.js) for its /config/validate endpoint.
+ *
+ * Errors are configurations the plugin cannot work with; out-of-range numeric
+ * settings are only warnings, because normalization clamps them.
+ */
+export declare function validateConfig(config: PluginConfig): ConfigValidationResult;
 export declare class ConfigManager {
     private readonly config;
-    private normalized;
+    private readonly normalized;
     constructor(config: PluginConfig);
-    /**
-       * Get the normalized configuration with defaults applied
-       */
-    getNormalized(): NormalizedConfig;
-    /**
-       * Get authentication mode
-       */
+    /** Platform name as configured in Homebridge */
+    getName(): string | undefined;
+    /** HTTP transport from the config (the DAIKIN_HTTP_TRANSPORT env var still wins, see configureHttpTransport) */
+    getHttpTransport(): HttpTransportMode | undefined;
+    /** Polling interval in milliseconds, clamped to 1-60 minutes */
+    getUpdateIntervalMs(): number;
+    /** Delay before refreshing after a change, in milliseconds, clamped to 5-300 seconds */
+    getForceUpdateDelayMs(): number;
+    /** Whether the device (raw Daikin device ID) is listed in excludedDevicesByDeviceId */
+    isDeviceExcluded(deviceId: string): boolean;
+    /** WebSocket push updates are on unless explicitly disabled */
+    isWebSocketEnabled(): boolean;
     getAuthMode(): AuthMode;
-    /**
-       * Check if mobile app mode is enabled
-       */
     isMobileAppMode(): boolean;
-    /**
-       * Check if developer portal mode is enabled
-       */
-    isDeveloperPortalMode(): boolean;
-    /**
-       * Get developer portal credentials
-       */
-    getDeveloperCredentials(): {
-        clientId: string;
-        clientSecret: string;
-        callbackServerExternalAddress: string;
-        callbackServerPort: number;
-        oidcCallbackServerBindAddr?: string;
-    } | null;
-    /**
-       * Get mobile app credentials
-       */
+    /** Client ID and secret are present (the minimum to start the Developer Portal controller) */
+    hasDeveloperCredentials(): boolean;
+    /** Mobile app email and password (falling back to the legacy keys), or null when either is missing */
     getMobileCredentials(): {
         email: string;
         password: string;
     } | null;
-    /**
-       * Mobile app email, falling back to the legacy `email` key
-       */
-    getMobileEmail(): string | undefined;
-    /**
-       * Mobile app password, falling back to the legacy `password` key
-       */
-    getMobilePassword(): string | undefined;
-    /**
-       * Legacy credential keys that are in use because the canonical key is absent
-       */
+    /** Legacy credential keys that are in use because the canonical key is absent */
     getLegacyCredentialKeysInUse(): string[];
-    /**
-       * Get update interval in milliseconds
-       */
-    getUpdateIntervalMs(): number;
-    /**
-       * Get force update delay in milliseconds
-       */
-    getForceUpdateDelayMs(): number;
-    /**
-       * Get excluded device IDs as a Set
-       */
-    getExcludedDeviceIds(): Set<string>;
-    /**
-       * Check if a device is excluded
-       */
-    isDeviceExcluded(deviceId: string): boolean;
-    /**
-       * Get feature configuration
-       */
-    getFeatures(): NormalizedConfig['features'];
-    /**
-       * Check if WebSocket is enabled
-       */
-    isWebSocketEnabled(): boolean;
-    /**
-       * Validate configuration using Zod schemas
-       */
-    validateWithZod(): {
-        valid: boolean;
-        errors: string[];
-    };
-    /**
-       * Validate configuration
-       */
-    validate(): {
-        valid: boolean;
-        errors: string[];
-        warnings: string[];
-    };
-    /**
-       * Normalize the configuration with all defaults applied
-       */
-    private normalize;
-    /**
-       * Get raw config value (escape hatch for migration)
-       */
-    getRawConfig(): PluginConfig;
+    /** Configuration for the DaikinCloudController, with defaults applied */
+    getControllerConfig(tokenFilePath: string): DaikinControllerConfig;
+    /** Whether a feature switch / service is enabled (see resolveFeatures for the semantics) */
+    isFeatureEnabled(key: FeatureConfigKey): boolean;
+    validate(): ConfigValidationResult;
+    /** The raw config with credentials and device IDs masked, for debug logging */
+    getRedactedConfig(): object;
 }
 //# sourceMappingURL=config-manager.d.ts.map

package/dist/src/config/config-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-manager.d.ts","sourceRoot":"","sources":["../../../src/config/config-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAQpD,MAAM,WAAW,YAAY;IAEzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IAGd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAGpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGrC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAG5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAIjC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAInC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAGhC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE;QACN,YAAY,EAAE,OAAO,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,WAAW,EAAE,OAAO,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,EAAE,OAAO,CAAC;QACrB,WAAW,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,gBAAgB,EAAE,OAAO,CAAC;CAC7B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,YAAY;IAIhC;;SAEK;IACL,aAAa,IAAI,gBAAgB;IAOjC;;SAEK;IACL,WAAW,IAAI,QAAQ;IAIvB;;SAEK;IACL,eAAe,IAAI,OAAO;IAI1B;;SAEK;IACL,qBAAqB,IAAI,OAAO;IAIhC;;SAEK;IACL,uBAAuB,IAAI;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,6BAA6B,EAAE,MAAM,CAAC;QACtC,kBAAkB,EAAE,MAAM,CAAC;QAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;KACvC,GAAG,IAAI;IAgBV;;SAEK;IACL,oBAAoB,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAWlE;;SAEK;IACL,cAAc,IAAI,MAAM,GAAG,SAAS;IAIpC;;SAEK;IACL,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAIvC;;SAEK;IACL,4BAA4B,IAAI,MAAM,EAAE;IAWxC;;SAEK;IACL,mBAAmB,IAAI,MAAM;IAK7B;;SAEK;IACL,qBAAqB,IAAI,MAAM;IAI/B;;SAEK;IACL,oBAAoB,IAAI,GAAG,CAAC,MAAM,CAAC;IAInC;;SAEK;IACL,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C;;SAEK;IACL,WAAW,IAAI,gBAAgB,CAAC,UAAU,CAAC;IAiB3C;;SAEK;IACL,kBAAkB,IAAI,OAAO;IAI7B;;SAEK;IACL,eAAe,IAAI;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAwBvD;;SAEK;IACL,QAAQ,IAAI;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE;IA4EpE;;SAEK;IACL,OAAO,CAAC,SAAS;IAWjB;;SAEK;IACL,YAAY,IAAI,YAAY;CAG7B"}
+{"version":3,"file":"config-manager.d.ts","sourceRoot":"","sources":["../../../src/config/config-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAW/D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;CAiBtB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7E,MAAM,MAAM,0BAA0B,GAAG,OAAO,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACvF,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,0BAA0B,CAAC;AAYlF;;;GAGG;AACH,MAAM,WAAW,YAAa,SAAQ,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IAErF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IAGd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAGpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,uBAAuB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAGnC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;IAGrC,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAInC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAGlC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA2HD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,sBAAsB,CAwE3E;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAElC,MAAM,EAAE,YAAY;IAShC,gDAAgD;IAChD,OAAO,IAAI,MAAM,GAAG,SAAS;IAI7B,gHAAgH;IAChH,gBAAgB,IAAI,iBAAiB,GAAG,SAAS;IAIjD,gEAAgE;IAChE,mBAAmB,IAAI,MAAM;IAI7B,wFAAwF;IACxF,qBAAqB,IAAI,MAAM;IAI/B,uFAAuF;IACvF,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C,+DAA+D;IAC/D,kBAAkB,IAAI,OAAO;IAQ7B,WAAW,IAAI,QAAQ;IAIvB,eAAe,IAAI,OAAO;IAI1B,8FAA8F;IAC9F,uBAAuB,IAAI,OAAO;IAIlC,sGAAsG;IACtG,oBAAoB,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAQlE,iFAAiF;IACjF,4BAA4B,IAAI,MAAM,EAAE;IAIxC,yEAAyE;IACzE,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,sBAAsB;IAqBlE,4FAA4F;IAC5F,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO;IAQhD,QAAQ,IAAI,sBAAsB;IAIlC,+EAA+E;IAC/E,iBAAiB,IAAI,MAAM;CAc5B"}