@shin1ohno/sage 0.8.8 → 0.9.1

package/dist/oauth/encryption-service.js

@@ -0,0 +1,271 @@
+/**
+ * Encryption Service for OAuth Data
+ * Requirements: FR-4 (Encryption Key Management)
+ *
+ * Provides AES-256-GCM encryption/decryption for sensitive OAuth data.
+ * Supports key derivation via scrypt and secure key management.
+ */
+import { createCipheriv, createDecipheriv, randomBytes, scrypt } from 'crypto';
+import { promisify } from 'util';
+import { readFile, writeFile, mkdir, chmod, unlink, rename } from 'fs/promises';
+import { join } from 'path';
+import { homedir } from 'os';
+import { existsSync } from 'fs';
+import { FileMutex } from './file-mutex.js';
+const scryptAsync = promisify(scrypt);
+/**
+ * Encryption Service Class
+ *
+ * Handles AES-256-GCM encryption/decryption for OAuth data persistence.
+ * Manages encryption key lifecycle and secure file operations.
+ */
+export class EncryptionService {
+    encryptionKey;
+    keyStoragePath;
+    initialized = false;
+    fileMutex = new FileMutex();
+    constructor(config = {}) {
+        this.keyStoragePath = config.keyStoragePath || join(homedir(), '.sage', 'oauth_encryption_key');
+        this.encryptionKey = config.encryptionKey || '';
+    }
+    /**
+     * Initialize encryption service and load/generate key
+     *
+     * Key loading priority:
+     * 1. SAGE_ENCRYPTION_KEY environment variable (highest priority)
+     * 2. Persistent key file at ~/.sage/oauth_encryption_key
+     * 3. Generate new key and save (with warning)
+     */
+    async initialize() {
+        if (this.initialized) {
+            return; // Already initialized
+        }
+        // Priority 1: Use SAGE_ENCRYPTION_KEY environment variable
+        if (process.env.SAGE_ENCRYPTION_KEY) {
+            this.encryptionKey = process.env.SAGE_ENCRYPTION_KEY;
+            console.log('[OAuth] Using encryption key from SAGE_ENCRYPTION_KEY environment variable');
+            this.initialized = true;
+            return;
+        }
+        // Priority 2: Load existing key from storage
+        if (existsSync(this.keyStoragePath)) {
+            try {
+                this.encryptionKey = (await readFile(this.keyStoragePath, 'utf-8')).trim();
+                console.log('[OAuth] Loaded encryption key from storage');
+                this.initialized = true;
+                return;
+            }
+            catch (error) {
+                console.error('[OAuth] Failed to load encryption key:', error);
+                // Fall through to generation
+            }
+        }
+        // Priority 3: Generate new key and store it
+        console.warn('[OAuth] No encryption key found. Generating new key...');
+        console.warn('[OAuth] Warning: Set SAGE_ENCRYPTION_KEY environment variable for production use');
+        this.encryptionKey = randomBytes(32).toString('hex');
+        // Ensure directory exists with secure permissions
+        const dir = join(homedir(), '.sage');
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        // Write key with restricted permissions (read/write for owner only)
+        await writeFile(this.keyStoragePath, this.encryptionKey, { mode: 0o600 });
+        // Ensure permissions are set correctly (some systems ignore mode in writeFile)
+        try {
+            await chmod(this.keyStoragePath, 0o600);
+        }
+        catch (error) {
+            // chmod may fail on Windows, log but continue
+            console.warn('[OAuth] Could not set file permissions (may not be supported on this OS)');
+        }
+        console.log(`[OAuth] Generated encryption key stored at: ${this.keyStoragePath}`);
+        this.initialized = true;
+    }
+    /**
+     * Encrypt data using AES-256-GCM
+     *
+     * Format: salt:iv:authTag:encrypted
+     *
+     * @param data - Plain text data to encrypt
+     * @returns Encrypted data in format "salt:iv:authTag:encrypted"
+     */
+    async encrypt(data) {
+        if (!this.initialized) {
+            throw new Error('EncryptionService not initialized. Call initialize() first.');
+        }
+        try {
+            // Generate salt and derive key using scrypt
+            const salt = randomBytes(16);
+            const key = (await scryptAsync(this.encryptionKey, salt, 32));
+            // Generate initialization vector
+            const iv = randomBytes(16);
+            // Create cipher
+            const cipher = createCipheriv('aes-256-gcm', key, iv);
+            // Encrypt data
+            let encrypted = cipher.update(data, 'utf8', 'hex');
+            encrypted += cipher.final('hex');
+            // Get authentication tag for integrity verification
+            const authTag = cipher.getAuthTag();
+            // Combine: salt:iv:authTag:encrypted
+            return `${salt.toString('hex')}:${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+        }
+        catch (error) {
+            console.error('[OAuth] Encryption failed:', error);
+            throw new Error('Failed to encrypt data');
+        }
+    }
+    /**
+     * Decrypt data using AES-256-GCM
+     *
+     * @param encryptedData - Encrypted data in format "salt:iv:authTag:encrypted"
+     * @returns Decrypted plain text data
+     */
+    async decrypt(encryptedData) {
+        if (!this.initialized) {
+            throw new Error('EncryptionService not initialized. Call initialize() first.');
+        }
+        try {
+            // Split encrypted data
+            const parts = encryptedData.split(':');
+            if (parts.length !== 4) {
+                throw new Error('Invalid encrypted data format');
+            }
+            const [saltHex, ivHex, authTagHex, encrypted] = parts;
+            // Convert from hex
+            const salt = Buffer.from(saltHex, 'hex');
+            const iv = Buffer.from(ivHex, 'hex');
+            const authTag = Buffer.from(authTagHex, 'hex');
+            // Derive key from encryption key using scrypt
+            const key = (await scryptAsync(this.encryptionKey, salt, 32));
+            // Create decipher
+            const decipher = createDecipheriv('aes-256-gcm', key, iv);
+            decipher.setAuthTag(authTag);
+            // Decrypt data
+            let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+            decrypted += decipher.final('utf8');
+            return decrypted;
+        }
+        catch (error) {
+            console.error('[OAuth] Decryption failed:', error);
+            throw new Error('Failed to decrypt data');
+        }
+    }
+    /**
+     * Encrypt and save data to file
+     *
+     * Uses atomic write pattern (temp file + rename) to prevent corruption.
+     * Serialized with mutex to prevent concurrent write race conditions.
+     *
+     * @param data - Plain text data to encrypt and save
+     * @param filePath - Destination file path
+     */
+    async encryptToFile(data, filePath) {
+        await this.fileMutex.withLock(filePath, async () => {
+            const encrypted = await this.encrypt(data);
+            // Ensure directory exists with secure permissions
+            const { dirname } = require('path');
+            const dir = dirname(filePath);
+            await mkdir(dir, { recursive: true, mode: 0o700 });
+            // Atomic write using temp file + rename pattern
+            const tempPath = `${filePath}.tmp`;
+            try {
+                // Write to temp file with restricted permissions
+                await writeFile(tempPath, encrypted, { mode: 0o600 });
+                // Ensure permissions are set (some systems ignore mode in writeFile)
+                try {
+                    await chmod(tempPath, 0o600);
+                }
+                catch (error) {
+                    // chmod may fail on Windows, log but continue
+                    console.warn('[OAuth] Could not set file permissions (may not be supported on this OS)');
+                }
+                // Rename is atomic on most filesystems - prevents corruption
+                await rename(tempPath, filePath);
+            }
+            catch (error) {
+                console.error(`[OAuth] Failed to write ${filePath}:`, error);
+                // Clean up temp file if it exists
+                try {
+                    await unlink(tempPath);
+                }
+                catch {
+                    // Ignore cleanup errors
+                }
+                throw error;
+            }
+        });
+    }
+    /**
+     * Load and decrypt data from file
+     *
+     * Serialized with mutex to prevent read-during-write issues.
+     *
+     * @param filePath - Source file path
+     * @returns Decrypted data or null if file doesn't exist
+     */
+    async decryptFromFile(filePath) {
+        return await this.fileMutex.withLock(filePath, async () => {
+            try {
+                if (!existsSync(filePath)) {
+                    return null;
+                }
+                const encrypted = await readFile(filePath, 'utf-8');
+                return await this.decrypt(encrypted);
+            }
+            catch (error) {
+                console.error(`[OAuth] Failed to decrypt file ${filePath}:`, error);
+                return null;
+            }
+        });
+    }
+    /**
+     * Check if encryption service is initialized
+     */
+    isInitialized() {
+        return this.initialized;
+    }
+    /**
+     * Get the storage path for the encryption key
+     */
+    getKeyStoragePath() {
+        return this.keyStoragePath;
+    }
+    /**
+     * Get health status for monitoring
+     */
+    getHealthStatus() {
+        let keySource = 'generated';
+        if (process.env.SAGE_ENCRYPTION_KEY) {
+            keySource = 'environment';
+        }
+        else if (existsSync(this.keyStoragePath)) {
+            keySource = 'file';
+        }
+        return {
+            initialized: this.initialized,
+            keySource,
+            keyStoragePath: this.keyStoragePath,
+            mutex: this.fileMutex.getMetrics(),
+        };
+    }
+    /**
+     * Get mutex metrics for monitoring
+     */
+    getMutexMetrics() {
+        return this.fileMutex.getMetrics();
+    }
+    /**
+     * Wait for all pending file operations to complete
+     *
+     * Used for graceful shutdown to ensure all data is persisted.
+     */
+    async waitForPendingWrites() {
+        await this.fileMutex.waitForPending();
+    }
+    /**
+     * Check if there are pending file operations
+     */
+    hasPendingWrites() {
+        return this.fileMutex.hasPendingOperations();
+    }
+}
+//# sourceMappingURL=encryption-service.js.map

package/dist/oauth/encryption-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-service.js","sourceRoot":"","sources":["../../src/oauth/encryption-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAE9D,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAUtC;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACpB,aAAa,CAAS;IACtB,cAAc,CAAS;IACvB,WAAW,GAAY,KAAK,CAAC;IAC7B,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;IAE/C,YAAY,SAAkC,EAAE;QAC9C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAChG,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,sBAAsB;QAChC,CAAC;QAED,2DAA2D;QAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC1F,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3E,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;gBAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;gBAC/D,6BAA6B;YAC/B,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAEjG,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,kDAAkD;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnD,oEAAoE;QACpE,MAAM,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE1E,+EAA+E;QAC/E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8CAA8C;YAC9C,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAW,CAAC;YAExE,iCAAiC;YACjC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAE3B,gBAAgB;YAChB,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAEtD,eAAe;YACf,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEjC,oDAAoD;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEpC,qCAAqC;YACrC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACjG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,uBAAuB;YACvB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;YAEtD,mBAAmB;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE/C,8CAA8C;YAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAW,CAAC;YAExE,kBAAkB;YAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAE7B,eAAe;YACf,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEpC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB;QAChD,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAE3C,kDAAkD;YAClD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEnD,gDAAgD;YAChD,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,CAAC;YAEnC,IAAI,CAAC;gBACH,iDAAiD;gBACjD,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEtD,qEAAqE;gBACrE,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,8CAA8C;oBAC9C,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;gBAC3F,CAAC;gBAED,6DAA6D;gBAC7D,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;gBAE7D,kCAAkC;gBAClC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;gBAED,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACxD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACpD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,eAAe;QAMb,IAAI,SAAS,GAAyC,WAAW,CAAC;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACpC,SAAS,GAAG,aAAa,CAAC;QAC5B,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QAED,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS;YACT,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB;QACxB,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/oauth/file-mutex.d.ts

@@ -0,0 +1,68 @@
+/**
+ * File Mutex for Serializing File Operations
+ * Requirements: FR-1 (File Write Serialization), FR-2 (Per-File Mutex)
+ *
+ * Provides per-file mutex to prevent race conditions during concurrent
+ * encrypted file operations. Uses Promise queue pattern for serialization.
+ */
+/**
+ * Metrics for monitoring mutex performance
+ */
+export interface FileMutexMetrics {
+    activeFiles: number;
+    totalWaitTimeMs: number;
+    longestWaitMs: number;
+    queueDepthWarnings: number;
+}
+/**
+ * File Mutex Class
+ *
+ * Provides per-file locking mechanism to serialize file operations.
+ * Each file path gets its own independent mutex, allowing parallel
+ * operations on different files while serializing operations on the same file.
+ */
+export declare class FileMutex {
+    private locks;
+    private metrics;
+    private static readonly QUEUE_DEPTH_WARNING_THRESHOLD;
+    private static readonly WAIT_TIME_WARNING_THRESHOLD_MS;
+    /**
+     * Execute an operation with exclusive lock on the specified file
+     *
+     * @param filePath - Path to the file to lock
+     * @param operation - Async operation to execute while holding the lock
+     * @returns Result of the operation
+     */
+    withLock<T>(filePath: string, operation: () => Promise<T>): Promise<T>;
+    /**
+     * Normalize file path for consistent lock identification
+     */
+    private normalizePath;
+    /**
+     * Check and warn if queue depth exceeds threshold
+     */
+    private checkQueueWarnings;
+    /**
+     * Record wait time and log if exceeds thresholds
+     */
+    private recordWaitTime;
+    /**
+     * Get metrics for monitoring/debugging
+     */
+    getMetrics(): FileMutexMetrics;
+    /**
+     * Check if there are pending operations for any file
+     */
+    hasPendingOperations(): boolean;
+    /**
+     * Wait for all pending operations to complete
+     *
+     * Used for graceful shutdown to ensure all queued operations finish.
+     */
+    waitForPending(): Promise<void>;
+    /**
+     * Reset metrics (primarily for testing)
+     */
+    resetMetrics(): void;
+}
+//# sourceMappingURL=file-mutex.d.ts.map

package/dist/oauth/file-mutex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-mutex.d.ts","sourceRoot":"","sources":["../../src/oauth/file-mutex.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAaD;;;;;;GAMG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAsC;IACnD,OAAO,CAAC,OAAO,CAKb;IAGF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAM;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAQ;IAE9D;;;;;;OAMG;IACG,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAyC5E;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;OAEG;IACH,UAAU,IAAI,gBAAgB;IAI9B;;OAEG;IACH,oBAAoB,IAAI,OAAO;IAS/B;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAQrC;;OAEG;IACH,YAAY,IAAI,IAAI;CAQrB"}

package/dist/oauth/file-mutex.js

@@ -0,0 +1,140 @@
+/**
+ * File Mutex for Serializing File Operations
+ * Requirements: FR-1 (File Write Serialization), FR-2 (Per-File Mutex)
+ *
+ * Provides per-file mutex to prevent race conditions during concurrent
+ * encrypted file operations. Uses Promise queue pattern for serialization.
+ */
+import { resolve } from 'path';
+/**
+ * File Mutex Class
+ *
+ * Provides per-file locking mechanism to serialize file operations.
+ * Each file path gets its own independent mutex, allowing parallel
+ * operations on different files while serializing operations on the same file.
+ */
+export class FileMutex {
+    locks = new Map();
+    metrics = {
+        activeFiles: 0,
+        totalWaitTimeMs: 0,
+        longestWaitMs: 0,
+        queueDepthWarnings: 0,
+    };
+    // Thresholds for warnings
+    static QUEUE_DEPTH_WARNING_THRESHOLD = 10;
+    static WAIT_TIME_WARNING_THRESHOLD_MS = 5000;
+    /**
+     * Execute an operation with exclusive lock on the specified file
+     *
+     * @param filePath - Path to the file to lock
+     * @param operation - Async operation to execute while holding the lock
+     * @returns Result of the operation
+     */
+    async withLock(filePath, operation) {
+        const normalizedPath = this.normalizePath(filePath);
+        // Get or create mutex state for this file
+        if (!this.locks.has(normalizedPath)) {
+            this.locks.set(normalizedPath, { queue: [], isLocked: false });
+            this.metrics.activeFiles++;
+        }
+        const state = this.locks.get(normalizedPath);
+        // Wait if locked
+        if (state.isLocked) {
+            const queuedAt = Date.now();
+            await new Promise((resolvePromise) => {
+                state.queue.push({ resolve: resolvePromise, queuedAt });
+                this.checkQueueWarnings(normalizedPath, state);
+            });
+        }
+        // Acquire lock
+        state.isLocked = true;
+        try {
+            return await operation();
+        }
+        finally {
+            // Release lock and notify next in queue
+            if (state.queue.length > 0) {
+                const next = state.queue.shift();
+                const waitTime = Date.now() - next.queuedAt;
+                this.recordWaitTime(waitTime, normalizedPath);
+                next.resolve();
+            }
+            else {
+                state.isLocked = false;
+                // Clean up empty mutex state
+                this.locks.delete(normalizedPath);
+                this.metrics.activeFiles = Math.max(0, this.metrics.activeFiles - 1);
+            }
+        }
+    }
+    /**
+     * Normalize file path for consistent lock identification
+     */
+    normalizePath(filePath) {
+        return resolve(filePath);
+    }
+    /**
+     * Check and warn if queue depth exceeds threshold
+     */
+    checkQueueWarnings(filePath, state) {
+        if (state.queue.length >= FileMutex.QUEUE_DEPTH_WARNING_THRESHOLD) {
+            this.metrics.queueDepthWarnings++;
+            console.warn(`[OAuth] High mutex contention on ${filePath}: ${state.queue.length} queued operations`);
+        }
+    }
+    /**
+     * Record wait time and log if exceeds thresholds
+     */
+    recordWaitTime(waitTimeMs, filePath) {
+        this.metrics.totalWaitTimeMs += waitTimeMs;
+        if (waitTimeMs > this.metrics.longestWaitMs) {
+            this.metrics.longestWaitMs = waitTimeMs;
+        }
+        // Log warnings for long wait times
+        if (waitTimeMs >= FileMutex.WAIT_TIME_WARNING_THRESHOLD_MS) {
+            console.warn(`[OAuth] Long mutex wait on ${filePath}: ${waitTimeMs}ms`);
+        }
+    }
+    /**
+     * Get metrics for monitoring/debugging
+     */
+    getMetrics() {
+        return { ...this.metrics };
+    }
+    /**
+     * Check if there are pending operations for any file
+     */
+    hasPendingOperations() {
+        for (const state of this.locks.values()) {
+            if (state.isLocked || state.queue.length > 0) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Wait for all pending operations to complete
+     *
+     * Used for graceful shutdown to ensure all queued operations finish.
+     */
+    async waitForPending() {
+        // Keep checking until no more pending operations
+        while (this.hasPendingOperations()) {
+            // Wait a short time before checking again
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        }
+    }
+    /**
+     * Reset metrics (primarily for testing)
+     */
+    resetMetrics() {
+        this.metrics = {
+            activeFiles: this.locks.size,
+            totalWaitTimeMs: 0,
+            longestWaitMs: 0,
+            queueDepthWarnings: 0,
+        };
+    }
+}
+//# sourceMappingURL=file-mutex.js.map

package/dist/oauth/file-mutex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-mutex.js","sourceRoot":"","sources":["../../src/oauth/file-mutex.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAuB/B;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACZ,KAAK,GAA4B,IAAI,GAAG,EAAE,CAAC;IAC3C,OAAO,GAAqB;QAClC,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,CAAC;QAClB,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;KACtB,CAAC;IAEF,0BAA0B;IAClB,MAAM,CAAU,6BAA6B,GAAG,EAAE,CAAC;IACnD,MAAM,CAAU,8BAA8B,GAAG,IAAI,CAAC;IAE9D;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,SAA2B;QAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;QAE9C,iBAAiB;QACjB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,EAAE;gBACzC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,eAAe;QACf,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QAEtB,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,wCAAwC;YACxC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAG,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACvB,6BAA6B;gBAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,QAAgB;QACpC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,QAAgB,EAAE,KAAiB;QAC5D,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,CAAC;YAClE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CACV,oCAAoC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,oBAAoB,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,UAAkB,EAAE,QAAgB;QACzD,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,UAAU,CAAC;QAE3C,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC;QAC1C,CAAC;QAED,mCAAmC;QACnC,IAAI,UAAU,IAAI,SAAS,CAAC,8BAA8B,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,8BAA8B,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,iDAAiD;QACjD,OAAO,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACnC,0CAA0C;YAC1C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC5B,eAAe,EAAE,CAAC;YAClB,aAAa,EAAE,CAAC;YAChB,kBAAkB,EAAE,CAAC;SACtB,CAAC;IACJ,CAAC"}

package/dist/oauth/google-oauth-handler.d.ts

@@ -36,21 +36,20 @@ export declare const GOOGLE_CALENDAR_SCOPES: string[];
 export declare class GoogleOAuthHandler {
     private codeVerifier;
     private config;
-    private readonly encryptionKey;
+    private readonly encryptionService;
     private readonly tokensStoragePath;
+    private initialized;
     constructor(config: GoogleOAuthConfig, encryptionKey?: string, userId?: string);
     /**
-     * Create OAuth2Client instance
-     */
-    private createOAuth2Client;
-    /**
-     * Encrypt data using AES-256-GCM
+     * Initialize encryption service
+     *
+     * Must be called before any token storage operations.
      */
-    private encrypt;
+    private ensureInitialized;
     /**
-     * Decrypt data using AES-256-GCM
+     * Create OAuth2Client instance
      */
-    private decrypt;
+    private createOAuth2Client;
     /**
      * Generate authorization URL with PKCE code_challenge
      *

package/dist/oauth/google-oauth-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth-handler.d.ts","sourceRoot":"","sources":["../../src/oauth/google-oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAUnD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAYD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB,UAGlC,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAU9E;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;OAEG;YACW,OAAO;IAsBrB;;OAEG;YACW,OAAO;IA4BrB;;;;;;;;OAQG;IACG,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoBhE;;;;;;;;;;;OAWG;IACG,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC;IAqC7B;;;;;;OAMG;IACG,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA6B1E;;;;;OAKG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrD;;;;;;;OAOG;IACG,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA2BpD;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IA2BnC;;;;;;;;OAQG;IACG,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAShE;;;;;;;;;OASG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAgCzC;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY;CAgBzD"}
+{"version":3,"file":"google-oauth-handler.d.ts","sourceRoot":"","sources":["../../src/oauth/google-oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMnD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAYD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB,UAGlC,CAAC;AAEF;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;IACtD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAY9E;;;;OAIG;YACW,iBAAiB;IAO/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;;;;;;;OAQG;IACG,mBAAmB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoBhE;;;;;;;;;;;OAWG;IACG,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC;IAqC7B;;;;;;OAMG;IACG,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA6B1E;;;;;OAKG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrD;;;;;;;OAOG;IACG,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA6BpD;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IA2BnC;;;;;;;;OAQG;IACG,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAShE;;;;;;;;;OASG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAgCzC;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY;CAgBzD"}