@omniaseo/cli 0.1.0

package/dist/auth/oauth.js

@@ -0,0 +1,447 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { CliError, EXIT } from '../errors.js';
+import { readBoundedJson } from '../http/bounded.js';
+const MAX_ACCESS_TOKEN_TTL_SECONDS = 3_600;
+const MAX_GRANTED_SCOPES = 128;
+export class SystemBrowserOpener {
+    runner;
+    platform;
+    constructor(runner, platform = process.platform) {
+        this.runner = runner;
+        this.platform = platform;
+    }
+    async open(url) {
+        const invocation = this.platform === 'darwin'
+            ? { command: 'open', args: [url] }
+            : this.platform === 'linux'
+                ? { command: 'xdg-open', args: [url] }
+                : this.platform === 'win32'
+                    ? { command: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url] }
+                    : undefined;
+        if (!invocation || this.runner.run(invocation.command, invocation.args).status !== 0) {
+            throw new CliError('Could not open the system browser', 'BROWSER_OPEN_FAILED', EXIT.DEPENDENCY_MISSING);
+        }
+    }
+}
+function base64Url(value) {
+    return value.toString('base64url');
+}
+function remoteUrl(value, name) {
+    if (typeof value !== 'string')
+        throw new CliError(`OAuth metadata has no ${name}`, 'OAUTH_METADATA_INVALID', EXIT.AUTH_BLOCKED);
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError(`OAuth ${name} is not an absolute URL`, 'OAUTH_METADATA_INVALID', EXIT.AUTH_BLOCKED);
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.hash) {
+        throw new CliError(`OAuth ${name} must be an HTTPS URL`, 'OAUTH_METADATA_INVALID', EXIT.AUTH_BLOCKED);
+    }
+    return url.toString();
+}
+function parseTokens(value) {
+    if (!value || typeof value !== 'object')
+        throw new CliError('OAuth token response is invalid', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+    const token = value;
+    if (typeof token.access_token !== 'string' || token.access_token.length < 8 || token.access_token.length > 131_072
+        || String(token.token_type).toLowerCase() !== 'bearer'
+        || typeof token.expires_in !== 'number' || !Number.isFinite(token.expires_in) || token.expires_in <= 0 || token.expires_in > MAX_ACCESS_TOKEN_TTL_SECONDS
+        || (token.refresh_token !== undefined && (typeof token.refresh_token !== 'string' || token.refresh_token.length < 8 || token.refresh_token.length > 131_072))
+        || (token.scope !== undefined && typeof token.scope !== 'string')) {
+        throw new CliError('OAuth token response is invalid', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+    }
+    return token;
+}
+function grantedScopes(raw, fallback) {
+    const scopes = raw?.split(' ').filter(Boolean) ?? [...fallback];
+    if (scopes.length === 0
+        || scopes.length > MAX_GRANTED_SCOPES
+        || scopes.some((scope) => scope.length > 120 || /[\u0000-\u0020\u007f]/u.test(scope))) {
+        throw new CliError('OAuth token scopes are invalid', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+    }
+    return [...new Set(scopes)];
+}
+export class OAuthClient {
+    options;
+    fetchFn;
+    timeoutMs;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.fetchFn = options.fetchFn ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? 120_000;
+        this.now = options.now ?? Date.now;
+    }
+    async fetchMetadata(url) {
+        let response;
+        try {
+            response = await this.fetchFn(url, {
+                redirect: 'error',
+                signal: AbortSignal.timeout(Math.min(this.timeoutMs, 10_000)),
+            });
+        }
+        catch {
+            throw new CliError('OAuth discovery request failed', 'OAUTH_DISCOVERY_FAILED', EXIT.NETWORK);
+        }
+        if (!response.ok)
+            return { response };
+        return { response, data: await readBoundedJson(response, 65_536) };
+    }
+    async metadata() {
+        const issuer = new URL(this.options.config.oauthIssuer);
+        const oidc = new URL(issuer);
+        oidc.pathname = `${issuer.pathname.replace(/\/$/u, '')}/.well-known/openid-configuration`;
+        const oidcResult = await this.fetchMetadata(oidc);
+        let response = oidcResult.response;
+        let data = oidcResult.data;
+        if (!response.ok && [404, 405].includes(response.status)) {
+            const rfc8414 = new URL(issuer.origin);
+            const issuerPath = issuer.pathname === '/' ? '' : issuer.pathname.replace(/\/$/u, '');
+            rfc8414.pathname = `/.well-known/oauth-authorization-server${issuerPath}`;
+            const rfcResult = await this.fetchMetadata(rfc8414);
+            response = rfcResult.response;
+            data = rfcResult.data;
+        }
+        if (!response.ok)
+            throw new CliError('OAuth discovery request failed', 'OAUTH_DISCOVERY_FAILED', EXIT.AUTH_BLOCKED, { status: response.status });
+        if (!data || typeof data !== 'object')
+            throw new CliError('OAuth metadata is invalid', 'OAUTH_METADATA_INVALID', EXIT.AUTH_BLOCKED);
+        const value = data;
+        let discoveredIssuer;
+        try {
+            discoveredIssuer = typeof value.issuer === 'string' ? new URL(value.issuer).toString() : '';
+        }
+        catch {
+            throw new CliError('OAuth discovery issuer is malformed', 'OAUTH_METADATA_INVALID', EXIT.AUTH_BLOCKED);
+        }
+        if (discoveredIssuer !== issuer.toString()) {
+            throw new CliError('OAuth discovery issuer mismatch', 'OAUTH_ISSUER_MISMATCH', EXIT.AUTH_BLOCKED);
+        }
+        return {
+            authorizationEndpoint: remoteUrl(value.authorization_endpoint, 'authorization_endpoint'),
+            tokenEndpoint: remoteUrl(value.token_endpoint, 'token_endpoint'),
+            ...(typeof value.revocation_endpoint === 'string' ? { revocationEndpoint: remoteUrl(value.revocation_endpoint, 'revocation_endpoint') } : {}),
+        };
+    }
+    waitForCode(state) {
+        const redirect = new URL(this.options.config.oauthRedirectUri);
+        let settled = false;
+        let listening = false;
+        let timer;
+        const server = createServer((request, response) => {
+            const requestUrl = new URL(request.url ?? '/', this.options.config.oauthRedirectUri);
+            if (request.method !== 'GET' || requestUrl.pathname !== redirect.pathname) {
+                response.writeHead(404, { 'content-type': 'text/plain', 'cache-control': 'no-store' });
+                response.end('Not found');
+                return;
+            }
+            const receivedState = requestUrl.searchParams.get('state');
+            const code = requestUrl.searchParams.get('code');
+            const oauthError = requestUrl.searchParams.get('error');
+            if (receivedState !== state) {
+                response.writeHead(400, { 'content-type': 'text/plain', 'cache-control': 'no-store' });
+                response.end('Authorization state mismatch. Return to the terminal.');
+                server.emit('omnia-error', new CliError('OAuth state mismatch', 'OAUTH_STATE_MISMATCH', EXIT.AUTH_BLOCKED));
+                return;
+            }
+            if (oauthError || !code || code.length > 8_192) {
+                response.writeHead(400, { 'content-type': 'text/plain', 'cache-control': 'no-store' });
+                response.end('Authorization was not completed. Return to the terminal.');
+                server.emit('omnia-error', new CliError('OAuth authorization was denied or invalid', 'OAUTH_AUTHORIZATION_FAILED', EXIT.AUTH_BLOCKED));
+                return;
+            }
+            response.writeHead(200, { 'content-type': 'text/plain', 'cache-control': 'no-store' });
+            response.end('Authorization complete. You may close this window.');
+            server.emit('omnia-code', code);
+        });
+        let rejectReady = () => undefined;
+        const ready = new Promise((resolve, reject) => {
+            rejectReady = reject;
+            server.listen(Number(redirect.port), redirect.hostname.replace(/^\[|\]$/gu, ''), () => {
+                const address = server.address();
+                if (!address || address.port !== Number(redirect.port)) {
+                    reject(new CliError('OAuth loopback bound the wrong port', 'OAUTH_LOOPBACK_FAILED', EXIT.NETWORK));
+                    return;
+                }
+                listening = true;
+                resolve();
+            });
+        });
+        const code = new Promise((resolve, reject) => {
+            server.once('error', () => {
+                const error = new CliError('OAuth loopback listener failed', 'OAUTH_LOOPBACK_FAILED', EXIT.NETWORK);
+                if (!listening)
+                    rejectReady(error);
+                else if (!settled) {
+                    settled = true;
+                    reject(error);
+                }
+            });
+            server.once('omnia-error', (error) => { if (!settled) {
+                settled = true;
+                reject(error);
+            } });
+            server.once('omnia-code', (value) => { if (!settled) {
+                settled = true;
+                resolve(String(value));
+            } });
+            timer = setTimeout(() => {
+                if (!settled) {
+                    settled = true;
+                    reject(new CliError('OAuth login timed out', 'OAUTH_TIMEOUT', EXIT.AUTH_BLOCKED));
+                }
+            }, this.timeoutMs);
+        });
+        return { ready, code, close: () => { if (timer)
+                clearTimeout(timer); server.close(); } };
+    }
+    async login(profile) {
+        if (!await this.options.store.available()) {
+            throw new CliError('A supported OS keychain is unavailable; login was not started', 'KEYCHAIN_UNAVAILABLE', EXIT.DEPENDENCY_MISSING, { status: 'BLOCKED' });
+        }
+        const metadata = await this.metadata();
+        const verifier = base64Url(randomBytes(48));
+        const state = base64Url(randomBytes(32));
+        const challenge = base64Url(createHash('sha256').update(verifier).digest());
+        const authorization = new URL(metadata.authorizationEndpoint);
+        authorization.searchParams.set('response_type', 'code');
+        authorization.searchParams.set('client_id', this.options.config.oauthClientId);
+        authorization.searchParams.set('redirect_uri', this.options.config.oauthRedirectUri);
+        authorization.searchParams.set('scope', this.options.config.oauthScopes.join(' '));
+        authorization.searchParams.set('resource', this.options.config.oauthResource);
+        authorization.searchParams.set('state', state);
+        authorization.searchParams.set('code_challenge', challenge);
+        authorization.searchParams.set('code_challenge_method', 'S256');
+        const listener = this.waitForCode(state);
+        let code;
+        try {
+            await listener.ready;
+            await this.options.browser.open(authorization.toString());
+            code = await listener.code;
+        }
+        finally {
+            listener.close();
+        }
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: this.options.config.oauthClientId,
+            code,
+            redirect_uri: this.options.config.oauthRedirectUri,
+            code_verifier: verifier,
+            resource: this.options.config.oauthResource,
+        });
+        let response;
+        try {
+            response = await this.fetchFn(metadata.tokenEndpoint, {
+                method: 'POST',
+                redirect: 'error',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body,
+                signal: AbortSignal.timeout(Math.min(this.timeoutMs, 15_000)),
+            });
+        }
+        catch {
+            throw new CliError('OAuth token exchange failed', 'OAUTH_TOKEN_EXCHANGE_FAILED', EXIT.NETWORK);
+        }
+        if (!response.ok)
+            throw new CliError('OAuth token exchange failed', 'OAUTH_TOKEN_EXCHANGE_FAILED', EXIT.AUTH_BLOCKED, { status: response.status });
+        const token = parseTokens(await readBoundedJson(response, 262_144));
+        if (this.options.config.oauthScopes.includes('offline_access') && !token.refresh_token) {
+            throw new CliError('OAuth offline authorization did not return a refresh token', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+        }
+        const expiresAt = this.now() + Math.floor(token.expires_in * 1_000);
+        const granted = grantedScopes(token.scope, this.options.config.oauthScopes);
+        const missingScopes = this.options.config.oauthScopes.filter((scope) => !granted.includes(scope));
+        if (missingScopes.length > 0) {
+            throw new CliError('OAuth authorization did not grant all requested scopes', 'OAUTH_SCOPE_NOT_GRANTED', EXIT.AUTH_BLOCKED, { missingScopes });
+        }
+        const credential = {
+            accessToken: token.access_token,
+            ...(token.refresh_token ? { refreshToken: token.refresh_token } : {}),
+            tokenType: 'Bearer',
+            expiresAt,
+            scopes: granted,
+            issuer: this.options.config.oauthIssuer,
+            clientId: this.options.config.oauthClientId,
+            resource: this.options.config.oauthResource,
+        };
+        try {
+            await this.options.store.set(profile, credential);
+        }
+        catch (error) {
+            await this.revokeCredential(credential, metadata).catch(() => undefined);
+            throw error;
+        }
+        return { profile, expiresAt, scopes: granted };
+    }
+    async revokeCredential(credential, knownMetadata) {
+        let metadata;
+        try {
+            metadata = knownMetadata ?? await this.metadata();
+        }
+        catch {
+            return 'failed';
+        }
+        if (!metadata.revocationEndpoint)
+            return 'unsupported';
+        const credentials = [
+            ...(credential.refreshToken ? [{ token: credential.refreshToken, hint: 'refresh_token' }] : []),
+            { token: credential.accessToken, hint: 'access_token' },
+        ].filter((entry, index, all) => all.findIndex(candidate => candidate.token === entry.token) === index);
+        let completed = true;
+        for (const entry of credentials) {
+            try {
+                const response = await this.fetchFn(metadata.revocationEndpoint, {
+                    method: 'POST',
+                    redirect: 'error',
+                    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                    body: new URLSearchParams({
+                        token: entry.token,
+                        token_type_hint: entry.hint,
+                        client_id: this.options.config.oauthClientId,
+                    }),
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (!response.ok)
+                    completed = false;
+            }
+            catch {
+                completed = false;
+            }
+        }
+        return completed ? 'completed' : 'failed';
+    }
+    async logout(profile, options = {}) {
+        const credential = await this.options.store.get(profile);
+        if (!credential)
+            return { profile, hadCredential: false, localDeleted: false, remoteRevocation: 'unsupported' };
+        if (options.localOnly) {
+            return { profile, hadCredential: true, localDeleted: await this.options.store.delete(profile), remoteRevocation: 'skipped_local_only' };
+        }
+        let remoteRevocation = 'failed';
+        const bindingMatches = credential.issuer === this.options.config.oauthIssuer
+            && credential.clientId === this.options.config.oauthClientId
+            && credential.resource === this.options.config.oauthResource;
+        if (bindingMatches)
+            remoteRevocation = await this.revokeCredential(credential);
+        const localDeleted = remoteRevocation === 'completed'
+            ? await this.options.store.delete(profile)
+            : false;
+        return { profile, hadCredential: true, localDeleted, remoteRevocation };
+    }
+    async refresh(profile) {
+        const current = await this.options.store.get(profile);
+        if (!current?.refreshToken) {
+            throw new CliError('CLI OAuth session cannot be refreshed; run omnia login', 'CLI_REAUTHORIZATION_REQUIRED', EXIT.AUTH_BLOCKED);
+        }
+        if (current.issuer !== this.options.config.oauthIssuer
+            || current.clientId !== this.options.config.oauthClientId
+            || current.resource !== this.options.config.oauthResource
+            || this.options.config.oauthScopes.some((scope) => !current.scopes.includes(scope))) {
+            throw new CliError('Stored session does not match current OAuth configuration; run omnia login', 'CLI_SESSION_BINDING_MISMATCH', EXIT.AUTH_BLOCKED);
+        }
+        const metadata = await this.metadata();
+        let response;
+        try {
+            response = await this.fetchFn(metadata.tokenEndpoint, {
+                method: 'POST',
+                redirect: 'error',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({
+                    grant_type: 'refresh_token',
+                    client_id: this.options.config.oauthClientId,
+                    refresh_token: current.refreshToken,
+                    resource: this.options.config.oauthResource,
+                }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch {
+            throw new CliError('OAuth refresh failed; run omnia login if it persists', 'OAUTH_REFRESH_FAILED', EXIT.NETWORK);
+        }
+        if (response.status === 429 || response.status >= 500) {
+            throw new CliError('OAuth refresh is temporarily unavailable; retry later', 'OAUTH_REFRESH_FAILED', EXIT.NETWORK, { status: response.status });
+        }
+        if (!response.ok)
+            throw new CliError('OAuth refresh was rejected; run omnia login', 'CLI_REAUTHORIZATION_REQUIRED', EXIT.AUTH_BLOCKED, { status: response.status });
+        const token = parseTokens(await readBoundedJson(response, 262_144));
+        if (!token.refresh_token || token.refresh_token === current.refreshToken) {
+            throw new CliError('OAuth refresh did not rotate the refresh token', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+        }
+        const refreshedScopes = grantedScopes(token.scope, current.scopes);
+        if (refreshedScopes.some(scope => !current.scopes.includes(scope))
+            || this.options.config.oauthScopes.some(scope => !refreshedScopes.includes(scope))) {
+            throw new CliError('OAuth refresh returned unexpected scopes', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+        }
+        const refreshed = {
+            accessToken: token.access_token,
+            refreshToken: token.refresh_token,
+            tokenType: 'Bearer',
+            expiresAt: this.now() + Math.floor(token.expires_in * 1_000),
+            scopes: refreshedScopes,
+            issuer: current.issuer,
+            clientId: current.clientId,
+            resource: current.resource,
+        };
+        await this.options.store.set(profile, refreshed);
+        return refreshed;
+    }
+}
+export class SessionManager {
+    store;
+    profile;
+    now;
+    refresh;
+    expected;
+    refreshInFlight;
+    constructor(store, profile = 'default', now = Date.now, refresh, expected) {
+        this.store = store;
+        this.profile = profile;
+        this.now = now;
+        this.refresh = refresh;
+        this.expected = expected;
+    }
+    async refreshOnce() {
+        if (!this.refresh)
+            throw new CliError('CLI OAuth session expired; run omnia login', 'CLI_SESSION_EXPIRED', EXIT.AUTH_BLOCKED);
+        if (!this.refreshInFlight) {
+            this.refreshInFlight = this.refresh().finally(() => {
+                this.refreshInFlight = undefined;
+            });
+        }
+        return this.refreshInFlight;
+    }
+    assertBinding(credential) {
+        if (this.expected && (credential.issuer !== this.expected.issuer
+            || credential.clientId !== this.expected.clientId
+            || credential.resource !== this.expected.resource
+            || this.expected.scopes.some((scope) => !credential.scopes.includes(scope)))) {
+            throw new CliError('Stored session does not match current OAuth configuration; run omnia login', 'CLI_SESSION_BINDING_MISMATCH', EXIT.AUTH_BLOCKED);
+        }
+    }
+    async accessToken() {
+        let credential = await this.store.get(this.profile);
+        if (!credential)
+            throw new CliError('No CLI OAuth session; run omnia login', 'CLI_NOT_AUTHENTICATED', EXIT.AUTH_BLOCKED);
+        this.assertBinding(credential);
+        if (credential.expiresAt <= this.now() + 30_000) {
+            credential = await this.refreshOnce();
+            this.assertBinding(credential);
+            if (credential.expiresAt <= this.now() + 30_000) {
+                throw new CliError('OAuth refresh returned an already-expired session', 'OAUTH_TOKEN_INVALID', EXIT.AUTH_BLOCKED);
+            }
+        }
+        return credential.accessToken;
+    }
+    async session() {
+        const credential = await this.store.get(this.profile);
+        if (!credential)
+            return null;
+        const { accessToken: _accessToken, refreshToken: _refreshToken, ...metadata } = credential;
+        return metadata;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAmBrD,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAM/B,MAAM,OAAO,mBAAmB;IACD;IAAwC;IAArE,YAA6B,MAAqB,EAAmB,WAAW,OAAO,CAAC,QAAQ;QAAnE,WAAM,GAAN,MAAM,CAAe;QAAmB,aAAQ,GAAR,QAAQ,CAAmB;IAAG,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAC3C,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;YAClC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;gBACtC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;oBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE;oBACzE,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,qBAAqB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;CACF;AAWD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,IAAI,EAAE,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChI,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,yBAAyB,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,uBAAuB,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzI,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IACE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,OAAO;WAC3G,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;WACnD,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,4BAA4B;WACtJ,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;WAC1J,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAA2B,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB,EAAE,QAA2B;IACzE,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChE,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;WAChB,MAAM,CAAC,MAAM,GAAG,kBAAkB;WAClC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACrF,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,OAAO,WAAW;IAKO;IAJZ,OAAO,CAAe;IACtB,SAAS,CAAS;IAClB,GAAG,CAAe;IAEnC,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QACtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QAC9C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAQ;QAClC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;gBACjC,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,mCAAmC,CAAC;QAC1F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACnC,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACtF,OAAO,CAAC,QAAQ,GAAG,0CAA0C,UAAU,EAAE,CAAC;YAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACpD,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;YAC9B,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACjJ,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,QAAQ,CAAC,2BAA2B,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpI,MAAM,KAAK,GAAG,IAA+B,CAAC;QAC9C,IAAI,gBAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,wBAAwB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,gBAAgB,KAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpG,CAAC;QACD,OAAO;YACL,qBAAqB,EAAE,SAAS,CAAC,KAAK,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;YACxF,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;YAChE,GAAG,CAAC,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9I,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,KAAiC,CAAC;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACrF,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC1E,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvF,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvF,QAAQ,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;gBACtE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC5G,OAAO;YACT,CAAC;YACD,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBAC/C,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvF,QAAQ,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACzE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,QAAQ,CAAC,2CAA2C,EAAE,4BAA4B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvI,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;YACvF,QAAQ,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,IAAI,WAAW,GAA8B,GAAG,EAAE,CAAC,SAAS,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClD,WAAW,GAAG,MAAM,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;gBACpF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAwB,CAAC;gBACvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvD,MAAM,CAAC,IAAI,QAAQ,CAAC,qCAAqC,EAAE,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnG,OAAO;gBACT,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,gCAAgC,EAAE,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpG,IAAI,CAAC,SAAS;oBAAE,WAAW,CAAC,KAAK,CAAC,CAAC;qBAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,uBAAuB,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;gBAAC,CAAC;YACtH,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe;QACzB,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE,sBAAsB,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9J,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC9D,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxD,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/E,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrF,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnF,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC5D,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,KAAK,CAAC;YACrB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1D,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;YAC5C,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;YAClD,aAAa,EAAE,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;SAC5C,CAAC,CAAC;QACH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE;gBACpD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE,6BAA6B,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE,6BAA6B,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnJ,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YACvF,MAAM,IAAI,QAAQ,CAAC,4DAA4D,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAClG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE,yBAAyB,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAChJ,CAAC;QACD,MAAM,UAAU,GAAsB;YACpC,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW;YACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;YAC3C,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;SAC5C,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,UAA6B,EAC7B,aAA6B;QAE7B,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,aAAa,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,kBAAkB;YAAE,OAAO,aAAa,CAAC;QACvD,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;QACvG,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE;oBAC/D,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,eAAe,EAAE,KAAK,CAAC,IAAI;wBAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;qBAC7C,CAAC;oBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,SAAS,GAAG,KAAK,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAe,EACf,UAAmC,EAAE;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;QAChH,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;QAC1I,CAAC;QACD,IAAI,gBAAgB,GAA2C,QAAQ,CAAC;QACxE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW;eACvE,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;eACzD,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/D,IAAI,cAAc;YAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/E,MAAM,YAAY,GAAG,gBAAgB,KAAK,WAAW;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE,8BAA8B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClI,CAAC;QACD,IACE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW;eAC/C,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;eACtD,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;eACtD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACnF,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,4EAA4E,EAAE,8BAA8B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE;gBACpD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,eAAe;oBAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;oBAC5C,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;iBAC5C,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE,sBAAsB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACjJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,8BAA8B,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpK,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;YACzE,MAAM,IAAI,QAAQ,CAAC,gDAAgD,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;eAC7D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,SAAS,GAAsB;YACnC,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,YAAY,EAAE,KAAK,CAAC,aAAa;YACjC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YAC5D,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAIN;IACA;IACA;IACA;IACA;IAPX,eAAe,CAAyC;IAEhE,YACmB,KAAsB,EACtB,UAAU,SAAS,EACnB,MAAoB,IAAI,CAAC,GAAG,EAC5B,OAA0C,EAC1C,QAA4F;QAJ5F,UAAK,GAAL,KAAK,CAAiB;QACtB,YAAO,GAAP,OAAO,CAAY;QACnB,QAAG,GAAH,GAAG,CAAyB;QAC5B,YAAO,GAAP,OAAO,CAAmC;QAC1C,aAAQ,GAAR,QAAQ,CAAoF;IAC5G,CAAC;IAEI,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACjD,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,aAAa,CAAC,UAA6B;QACjD,IAAI,IAAI,CAAC,QAAQ,IAAI,CACnB,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;eACvC,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ;eAC9C,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ;eAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC5E,EAAE,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,4EAA4E,EAAE,8BAA8B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,QAAQ,CAAC,uCAAuC,EAAE,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACzH,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YAChD,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;gBAChD,MAAM,IAAI,QAAQ,CAAC,mDAAmD,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,WAAW,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;QAC3F,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/auth/profile-lock.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Serializes keychain refresh-token rotation across CLI processes. The lock
+ * contains only a random nonce, pid and timestamp; credentials never touch it.
+ */
+export declare class ProfileLock {
+    private readonly directory;
+    private readonly path;
+    constructor(profile: string, root?: string);
+    private prepareDirectory;
+    private removeStale;
+    run<T>(operation: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=profile-lock.d.ts.map

package/dist/auth/profile-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-lock.d.ts","sourceRoot":"","sources":["../../src/auth/profile-lock.ts"],"names":[],"mappings":"AA2BA;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,OAAO,EAAE,MAAM,EAAE,IAAI,SAAyC;YAM5D,gBAAgB;YAYhB,WAAW;IAqBnB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAgCtD"}

package/dist/auth/profile-lock.js

@@ -0,0 +1,115 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, lstat, mkdir, open, readFile, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { CliError, EXIT } from '../errors.js';
+const LOCK_WAIT_MS = 30_000;
+const LOCK_STALE_MS = 120_000;
+function delay(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+function lockError(message) {
+    return new CliError(message, 'CLI_PROFILE_LOCK_FAILED', EXIT.AUTH_BLOCKED);
+}
+async function processIsAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+/**
+ * Serializes keychain refresh-token rotation across CLI processes. The lock
+ * contains only a random nonce, pid and timestamp; credentials never touch it.
+ */
+export class ProfileLock {
+    directory;
+    path;
+    constructor(profile, root = join(homedir(), '.omnia-cli', 'locks')) {
+        const digest = createHash('sha256').update(profile, 'utf8').digest('hex');
+        this.directory = root;
+        this.path = join(root, `${digest}.lock`);
+    }
+    async prepareDirectory() {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const metadata = await lstat(this.directory);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+            throw lockError('CLI profile lock directory is not a trusted directory');
+        }
+        if (typeof process.getuid === 'function' && metadata.uid !== process.getuid()) {
+            throw lockError('CLI profile lock directory is not owned by the current user');
+        }
+        if (process.platform !== 'win32')
+            await chmod(this.directory, 0o700);
+    }
+    async removeStale() {
+        let metadata;
+        try {
+            metadata = await lstat(this.path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        if (!metadata.isFile() || metadata.isSymbolicLink())
+            throw lockError('CLI profile lock path is unsafe');
+        if (Date.now() - metadata.mtimeMs < LOCK_STALE_MS)
+            return;
+        let pid = 0;
+        try {
+            const value = JSON.parse(await readFile(this.path, 'utf8'));
+            if (typeof value.pid === 'number')
+                pid = value.pid;
+        }
+        catch {
+            // A malformed stale lock is safe to remove because it contains no secret.
+        }
+        if (await processIsAlive(pid))
+            return;
+        await rm(this.path, { force: true });
+    }
+    async run(operation) {
+        await this.prepareDirectory();
+        const nonce = randomUUID();
+        const deadline = Date.now() + LOCK_WAIT_MS;
+        while (true) {
+            try {
+                const handle = await open(this.path, 'wx', 0o600);
+                try {
+                    await handle.writeFile(JSON.stringify({ nonce, pid: process.pid, createdAt: new Date().toISOString() }), 'utf8');
+                }
+                finally {
+                    await handle.close();
+                }
+                break;
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw lockError('CLI profile lock could not be created');
+                await this.removeStale();
+                if (Date.now() >= deadline)
+                    throw lockError('Timed out waiting for another CLI process to finish refreshing OAuth');
+                await delay(50 + Math.floor(Math.random() * 50));
+            }
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            try {
+                const value = JSON.parse(await readFile(this.path, 'utf8'));
+                if (value.nonce === nonce)
+                    await rm(this.path, { force: true });
+            }
+            catch {
+                // Never remove a lock that may have been replaced by another process.
+            }
+        }
+    }
+}
+//# sourceMappingURL=profile-lock.js.map

package/dist/auth/profile-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-lock.js","sourceRoot":"","sources":["../../src/auth/profile-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IACL,SAAS,CAAS;IAClB,IAAI,CAAS;IAE9B,YAAY,OAAe,EAAE,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC;QACxE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YACzD,MAAM,SAAS,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9E,MAAM,SAAS,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAC/D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;YAAE,MAAM,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,GAAG,aAAa;YAAE,OAAO;QAC1D,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;YACjF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAAE,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QACD,IAAI,MAAM,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO;QACtC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,SAA2B;QACtC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAC3C,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;gBACnH,CAAC;wBAAS,CAAC;oBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,CAAC;gBACD,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,SAAS,CAAC,uCAAuC,CAAC,CAAC;gBACjH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;oBAAE,MAAM,SAAS,CAAC,sEAAsE,CAAC,CAAC;gBACpH,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;gBACnF,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;oBAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;IACH,CAAC;CACF"}