@shipfox/api-auth 18.0.0 → 19.0.0

package/dist/db/agent-access.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/agent-access.ts"],"sourcesContent":["import {and, asc, eq, gt, inArray, isNull, lt, or, sql} from 'drizzle-orm';\nimport type {\n  AgentAuthorizationCode,\n  AgentAuthorizationRequest,\n  AgentClient,\n  AgentGrant,\n  AgentPersonalAccessToken,\n  AgentRefreshToken,\n} from '#core/entities/agent-access.js';\nimport {db} from './db.js';\nimport {\n  agentAuthorizationCodes,\n  agentAuthorizationRequests,\n  agentClients,\n  agentGrants,\n  agentPersonalAccessTokens,\n  agentRefreshTokens,\n  toAgentAuthorizationCode,\n  toAgentAuthorizationRequest,\n  toAgentClient,\n  toAgentGrant,\n  toAgentPersonalAccessToken,\n  toAgentRefreshToken,\n} from './schema/agent-access.js';\n\nexport type AgentAccessTx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\ntype AgentAccessExecutor = ReturnType<typeof db> | AgentAccessTx;\n\nexport interface CreateAgentClientParams {\n  clientId: string;\n  name: string;\n  redirectUris: string[];\n  kind: 'registered' | 'cimd';\n}\n\nexport async function createAgentClient(params: CreateAgentClientParams): Promise<AgentClient> {\n  return await db().transaction((tx) => createAgentClientTx(tx, params));\n}\n\nexport async function createAgentClientTx(\n  tx: AgentAccessTx,\n  params: CreateAgentClientParams,\n): Promise<AgentClient> {\n  const rows = await tx\n    .insert(agentClients)\n    .values(params)\n    .onConflictDoUpdate({\n      target: agentClients.clientId,\n      set: {\n        lastSeenAt: sql`now()`,\n        unreferencedAt: null,\n        updatedAt: sql`now()`,\n      },\n    })\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Upsert returned no rows');\n  return toAgentClient(row);\n}\n\nexport async function findAgentClientByClientId(params: {\n  clientId: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentClient | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentClients)\n    .where(eq(agentClients.clientId, params.clientId))\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentClient(row) : undefined;\n}\n\nexport async function markAgentClientReferenced(\n  tx: AgentAccessTx,\n  params: {clientUuid: string},\n): Promise<void> {\n  await tx\n    .update(agentClients)\n    .set({unreferencedAt: null, lastSeenAt: sql`now()`, updatedAt: sql`now()`})\n    .where(eq(agentClients.id, params.clientUuid));\n}\n\nexport async function markAgentClientUnreferenced(\n  tx: AgentAccessTx,\n  params: {clientUuid: string},\n): Promise<void> {\n  await tx\n    .update(agentClients)\n    .set({unreferencedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(eq(agentClients.id, params.clientUuid));\n}\n\nexport interface CreateAgentAuthorizationRequestParams {\n  /** Internal `auth_agent_clients.id`, not the public OAuth `client_id`. */\n  clientId: string;\n  redirectUri: string;\n  resource: string;\n  scopes: string[];\n  codeChallenge: string;\n  state: string | null;\n  expiresAt: Date;\n}\n\nexport async function createAgentAuthorizationRequest(\n  params: CreateAgentAuthorizationRequestParams,\n): Promise<AgentAuthorizationRequest> {\n  return await db().transaction((tx) => createAgentAuthorizationRequestTx(tx, params));\n}\n\nexport async function createAgentAuthorizationRequestTx(\n  tx: AgentAccessTx,\n  params: CreateAgentAuthorizationRequestParams,\n): Promise<AgentAuthorizationRequest> {\n  const rows = await tx.insert(agentAuthorizationRequests).values(params).returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAgentAuthorizationRequest(row);\n}\n\nexport async function findPendingAgentAuthorizationRequest(params: {\n  id: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentAuthorizationRequest | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentAuthorizationRequests)\n    .where(\n      and(\n        eq(agentAuthorizationRequests.id, params.id),\n        isNull(agentAuthorizationRequests.consumedAt),\n        gt(agentAuthorizationRequests.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentAuthorizationRequest(row) : undefined;\n}\n\nexport async function consumeAgentAuthorizationRequest(params: {\n  id: string;\n}): Promise<AgentAuthorizationRequest | undefined> {\n  return await db().transaction((tx) => consumeAgentAuthorizationRequestTx(tx, params));\n}\n\n/**\n * Claims a pending request in the caller's transaction. The expiry and\n * consumed-at predicates are part of the update so concurrent approval and\n * denial can have only one winner.\n */\nexport async function consumeAgentAuthorizationRequestTx(\n  tx: AgentAccessTx,\n  params: {id: string},\n): Promise<AgentAuthorizationRequest | undefined> {\n  const rows = await tx\n    .update(agentAuthorizationRequests)\n    .set({consumedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(agentAuthorizationRequests.id, params.id),\n        isNull(agentAuthorizationRequests.consumedAt),\n        gt(agentAuthorizationRequests.expiresAt, sql`now()`),\n      ),\n    )\n    .returning();\n  const row = rows[0];\n  return row ? toAgentAuthorizationRequest(row) : undefined;\n}\n\nexport interface CreateAgentGrantParams {\n  userId: string;\n  workspaceId: string;\n  /** Internal `auth_agent_clients.id`, not the public OAuth `client_id`. */\n  clientId: string;\n  scopes: string[];\n}\n\nexport async function createAgentGrant(params: CreateAgentGrantParams): Promise<AgentGrant> {\n  return await db().transaction((tx) => createAgentGrantTx(tx, params));\n}\n\nexport async function createAgentGrantTx(\n  tx: AgentAccessTx,\n  params: CreateAgentGrantParams,\n): Promise<AgentGrant> {\n  const rows = await tx\n    .insert(agentGrants)\n    .values(params)\n    .onConflictDoUpdate({\n      target: [agentGrants.userId, agentGrants.workspaceId, agentGrants.clientId],\n      targetWhere: sql`${agentGrants.revokedAt} IS NULL AND ${agentGrants.terminalAt} IS NULL`,\n      set: {\n        scopes: params.scopes,\n        updatedAt: sql`now()`,\n      },\n    })\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Upsert returned no rows');\n\n  // Refresh tokens derive their scopes from the grant. Reauthorization must\n  // invalidate existing tokens before the grant's scopes can be widened.\n  await tx\n    .update(agentRefreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(agentRefreshTokens.grantId, row.id),\n        isNull(agentRefreshTokens.rotatedAt),\n        isNull(agentRefreshTokens.revokedAt),\n      ),\n    );\n\n  await markAgentClientReferenced(tx, {clientUuid: params.clientId});\n  return toAgentGrant(row);\n}\n\nexport async function findAgentGrant(params: {\n  id: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentGrant | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentGrants)\n    .where(eq(agentGrants.id, params.id))\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentGrant(row) : undefined;\n}\n\n/**\n * Locks one grant row until the surrounding transaction ends. Code exchange\n * and lifecycle transitions must use this same primitive before inspecting or\n * changing grant state. Callers must keep the transaction database-only while\n * this lock is held; external I/O must happen after commit.\n */\nexport async function lockAgentGrant(\n  tx: AgentAccessTx,\n  params: {grantId: string},\n): Promise<AgentGrant | undefined> {\n  const rows = await tx\n    .select()\n    .from(agentGrants)\n    .where(eq(agentGrants.id, params.grantId))\n    .for('update')\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentGrant(row) : undefined;\n}\n\nexport interface CreateAgentAuthorizationCodeParams {\n  grantId: string;\n  hashedCode: string;\n  codeChallenge: string;\n  redirectUri: string;\n  resource: string;\n  expiresAt: Date;\n}\n\nexport async function createAgentAuthorizationCode(\n  params: CreateAgentAuthorizationCodeParams,\n): Promise<AgentAuthorizationCode> {\n  return await db().transaction((tx) => createAgentAuthorizationCodeTx(tx, params));\n}\n\nexport async function createAgentAuthorizationCodeTx(\n  tx: AgentAccessTx,\n  params: CreateAgentAuthorizationCodeParams,\n): Promise<AgentAuthorizationCode> {\n  const rows = await tx.insert(agentAuthorizationCodes).values(params).returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAgentAuthorizationCode(row);\n}\n\nexport async function findAgentAuthorizationCodeByHash(params: {\n  hashedCode: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentAuthorizationCode | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentAuthorizationCodes)\n    .where(eq(agentAuthorizationCodes.hashedCode, params.hashedCode))\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentAuthorizationCode(row) : undefined;\n}\n\nexport async function findActiveAgentAuthorizationCodeByHash(params: {\n  hashedCode: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentAuthorizationCode | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentAuthorizationCodes)\n    .where(\n      and(\n        eq(agentAuthorizationCodes.hashedCode, params.hashedCode),\n        isNull(agentAuthorizationCodes.consumedAt),\n        gt(agentAuthorizationCodes.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentAuthorizationCode(row) : undefined;\n}\n\nexport async function consumeAgentAuthorizationCode(params: {\n  hashedCode: string;\n}): Promise<AgentAuthorizationCode | undefined> {\n  return await db().transaction((tx) => consumeAgentAuthorizationCodeTx(tx, params));\n}\n\n/** Claims an authorization code exactly once, including its 60-second TTL. */\nexport async function consumeAgentAuthorizationCodeTx(\n  tx: AgentAccessTx,\n  params: {hashedCode: string},\n): Promise<AgentAuthorizationCode | undefined> {\n  const rows = await tx\n    .update(agentAuthorizationCodes)\n    .set({consumedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(agentAuthorizationCodes.hashedCode, params.hashedCode),\n        isNull(agentAuthorizationCodes.consumedAt),\n        gt(agentAuthorizationCodes.expiresAt, sql`now()`),\n      ),\n    )\n    .returning();\n  const row = rows[0];\n  return row ? toAgentAuthorizationCode(row) : undefined;\n}\n\nexport interface CreateAgentRefreshTokenParams {\n  grantId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createAgentRefreshToken(\n  params: CreateAgentRefreshTokenParams,\n): Promise<AgentRefreshToken> {\n  return await db().transaction((tx) => createAgentRefreshTokenTx(tx, params));\n}\n\nexport async function createAgentRefreshTokenTx(\n  tx: AgentAccessTx,\n  params: CreateAgentRefreshTokenParams,\n): Promise<AgentRefreshToken> {\n  const rows = await tx.insert(agentRefreshTokens).values(params).returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAgentRefreshToken(row);\n}\n\nexport async function findAgentRefreshTokenByHash(params: {\n  hashedToken: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentRefreshToken | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentRefreshTokens)\n    .where(eq(agentRefreshTokens.hashedToken, params.hashedToken))\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentRefreshToken(row) : undefined;\n}\n\nexport async function findActiveAgentRefreshTokenByHash(params: {\n  hashedToken: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentRefreshToken | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentRefreshTokens)\n    .where(\n      and(\n        eq(agentRefreshTokens.hashedToken, params.hashedToken),\n        isNull(agentRefreshTokens.rotatedAt),\n        isNull(agentRefreshTokens.revokedAt),\n        gt(agentRefreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentRefreshToken(row) : undefined;\n}\n\n/** Rotates a refresh token atomically; a concurrent rotation cannot win twice. */\nexport async function rotateAgentRefreshToken(params: {\n  hashedToken: string;\n  replacementHashedToken: string;\n  replacementExpiresAt: Date;\n}): Promise<AgentRefreshToken | undefined> {\n  return await db().transaction((tx) => rotateAgentRefreshTokenTx(tx, params));\n}\n\nexport async function rotateAgentRefreshTokenTx(\n  tx: AgentAccessTx,\n  params: {\n    hashedToken: string;\n    replacementHashedToken: string;\n    replacementExpiresAt: Date;\n  },\n): Promise<AgentRefreshToken | undefined> {\n  const rows = await tx\n    .update(agentRefreshTokens)\n    .set({rotatedAt: sql`now()`, lastUsedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(agentRefreshTokens.hashedToken, params.hashedToken),\n        isNull(agentRefreshTokens.rotatedAt),\n        isNull(agentRefreshTokens.revokedAt),\n        gt(agentRefreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .returning();\n  const row = rows[0];\n  if (!row) return undefined;\n\n  return await createAgentRefreshTokenTx(tx, {\n    grantId: row.grantId,\n    hashedToken: params.replacementHashedToken,\n    expiresAt: params.replacementExpiresAt,\n  });\n}\n\nexport async function revokeAgentRefreshToken(params: {\n  id: string;\n}): Promise<AgentRefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const rows = await tx\n      .update(agentRefreshTokens)\n      .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n      .where(and(eq(agentRefreshTokens.id, params.id), isNull(agentRefreshTokens.revokedAt)))\n      .returning();\n    const row = rows[0];\n    return row ? toAgentRefreshToken(row) : undefined;\n  });\n}\n\nexport interface CreateAgentPersonalAccessTokenParams {\n  userId: string;\n  workspaceId: string;\n  hashedToken: string;\n  prefix: string;\n  name: string;\n  scopes: string[];\n  expiresAt: Date;\n}\n\nexport async function createAgentPersonalAccessToken(\n  params: CreateAgentPersonalAccessTokenParams,\n): Promise<AgentPersonalAccessToken> {\n  return await db().transaction((tx) => createAgentPersonalAccessTokenTx(tx, params));\n}\n\nexport async function createAgentPersonalAccessTokenTx(\n  tx: AgentAccessTx,\n  params: CreateAgentPersonalAccessTokenParams,\n): Promise<AgentPersonalAccessToken> {\n  const rows = await tx.insert(agentPersonalAccessTokens).values(params).returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAgentPersonalAccessToken(row);\n}\n\nexport async function findAgentPersonalAccessTokenByHash(params: {\n  hashedToken: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentPersonalAccessToken | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentPersonalAccessTokens)\n    .where(eq(agentPersonalAccessTokens.hashedToken, params.hashedToken))\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentPersonalAccessToken(row) : undefined;\n}\n\nexport async function findActiveAgentPersonalAccessTokenByHash(params: {\n  hashedToken: string;\n  executor?: AgentAccessExecutor;\n}): Promise<AgentPersonalAccessToken | undefined> {\n  const executor = params.executor ?? db();\n  const rows = await executor\n    .select()\n    .from(agentPersonalAccessTokens)\n    .where(\n      and(\n        eq(agentPersonalAccessTokens.hashedToken, params.hashedToken),\n        isNull(agentPersonalAccessTokens.revokedAt),\n        gt(agentPersonalAccessTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n  const row = rows[0];\n  return row ? toAgentPersonalAccessToken(row) : undefined;\n}\n\nexport async function markAgentPersonalAccessTokenUsed(params: {\n  id: string;\n}): Promise<AgentPersonalAccessToken | undefined> {\n  const rows = await db()\n    .update(agentPersonalAccessTokens)\n    .set({lastUsedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(eq(agentPersonalAccessTokens.id, params.id))\n    .returning();\n  const row = rows[0];\n  return row ? toAgentPersonalAccessToken(row) : undefined;\n}\n\nexport async function revokeAgentPersonalAccessToken(params: {\n  id: string;\n}): Promise<AgentPersonalAccessToken | undefined> {\n  const rows = await db()\n    .update(agentPersonalAccessTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(eq(agentPersonalAccessTokens.id, params.id), isNull(agentPersonalAccessTokens.revokedAt)),\n    )\n    .returning();\n  const row = rows[0];\n  return row ? toAgentPersonalAccessToken(row) : undefined;\n}\n\nexport interface PruneAgentAccessParams {\n  retentionDays?: number;\n  limit?: number;\n  now?: Date;\n}\n\n/** Deletes terminal credentials and ephemeral authorization rows in bounded batches. */\nexport async function pruneAgentAccess(params: PruneAgentAccessParams = {}): Promise<number> {\n  const now = params.now ?? new Date();\n  const retentionDays = params.retentionDays ?? 7;\n  const limit = params.limit ?? 1000;\n  const cutoff = new Date(now.getTime() - retentionDays * 24 * 60 * 60 * 1000);\n\n  return await db().transaction(async (tx) => {\n    const requestIds = tx\n      .select({id: agentAuthorizationRequests.id})\n      .from(agentAuthorizationRequests)\n      .where(\n        or(\n          lt(agentAuthorizationRequests.consumedAt, cutoff),\n          and(\n            isNull(agentAuthorizationRequests.consumedAt),\n            lt(agentAuthorizationRequests.expiresAt, cutoff),\n          ),\n        ),\n      )\n      .orderBy(asc(agentAuthorizationRequests.expiresAt), asc(agentAuthorizationRequests.id))\n      .limit(limit);\n    const codeIds = tx\n      .select({id: agentAuthorizationCodes.id})\n      .from(agentAuthorizationCodes)\n      .where(\n        or(\n          lt(agentAuthorizationCodes.consumedAt, cutoff),\n          and(\n            isNull(agentAuthorizationCodes.consumedAt),\n            lt(agentAuthorizationCodes.expiresAt, cutoff),\n          ),\n        ),\n      )\n      .orderBy(asc(agentAuthorizationCodes.expiresAt), asc(agentAuthorizationCodes.id))\n      .limit(limit);\n    const refreshTokenIds = tx\n      .select({id: agentRefreshTokens.id})\n      .from(agentRefreshTokens)\n      .where(\n        or(\n          lt(agentRefreshTokens.rotatedAt, cutoff),\n          and(isNull(agentRefreshTokens.rotatedAt), lt(agentRefreshTokens.revokedAt, cutoff)),\n          and(\n            isNull(agentRefreshTokens.rotatedAt),\n            isNull(agentRefreshTokens.revokedAt),\n            lt(agentRefreshTokens.expiresAt, cutoff),\n          ),\n        ),\n      )\n      .orderBy(asc(agentRefreshTokens.expiresAt), asc(agentRefreshTokens.id))\n      .limit(limit);\n    const patIds = tx\n      .select({id: agentPersonalAccessTokens.id})\n      .from(agentPersonalAccessTokens)\n      .where(\n        or(\n          lt(agentPersonalAccessTokens.revokedAt, cutoff),\n          and(\n            isNull(agentPersonalAccessTokens.revokedAt),\n            lt(agentPersonalAccessTokens.expiresAt, cutoff),\n          ),\n        ),\n      )\n      .orderBy(asc(agentPersonalAccessTokens.expiresAt), asc(agentPersonalAccessTokens.id))\n      .limit(limit);\n\n    const [requests, codes, refreshTokens, pats] = await Promise.all([\n      tx\n        .delete(agentAuthorizationRequests)\n        .where(inArray(agentAuthorizationRequests.id, requestIds))\n        .returning({id: agentAuthorizationRequests.id}),\n      tx\n        .delete(agentAuthorizationCodes)\n        .where(inArray(agentAuthorizationCodes.id, codeIds))\n        .returning({id: agentAuthorizationCodes.id}),\n      tx\n        .delete(agentRefreshTokens)\n        .where(inArray(agentRefreshTokens.id, refreshTokenIds))\n        .returning({id: agentRefreshTokens.id}),\n      tx\n        .delete(agentPersonalAccessTokens)\n        .where(inArray(agentPersonalAccessTokens.id, patIds))\n        .returning({id: agentPersonalAccessTokens.id}),\n    ]);\n    return requests.length + codes.length + refreshTokens.length + pats.length;\n  });\n}\n"],"names":["and","asc","eq","gt","inArray","isNull","lt","or","sql","db","agentAuthorizationCodes","agentAuthorizationRequests","agentClients","agentGrants","agentPersonalAccessTokens","agentRefreshTokens","toAgentAuthorizationCode","toAgentAuthorizationRequest","toAgentClient","toAgentGrant","toAgentPersonalAccessToken","toAgentRefreshToken","createAgentClient","params","transaction","tx","createAgentClientTx","rows","insert","values","onConflictDoUpdate","target","clientId","set","lastSeenAt","unreferencedAt","updatedAt","returning","row","Error","findAgentClientByClientId","executor","select","from","where","limit","undefined","markAgentClientReferenced","update","id","clientUuid","markAgentClientUnreferenced","createAgentAuthorizationRequest","createAgentAuthorizationRequestTx","findPendingAgentAuthorizationRequest","consumedAt","expiresAt","consumeAgentAuthorizationRequest","consumeAgentAuthorizationRequestTx","createAgentGrant","createAgentGrantTx","userId","workspaceId","targetWhere","revokedAt","terminalAt","scopes","grantId","rotatedAt","findAgentGrant","lockAgentGrant","for","createAgentAuthorizationCode","createAgentAuthorizationCodeTx","findAgentAuthorizationCodeByHash","hashedCode","findActiveAgentAuthorizationCodeByHash","consumeAgentAuthorizationCode","consumeAgentAuthorizationCodeTx","createAgentRefreshToken","createAgentRefreshTokenTx","findAgentRefreshTokenByHash","hashedToken","findActiveAgentRefreshTokenByHash","rotateAgentRefreshToken","rotateAgentRefreshTokenTx","lastUsedAt","replacementHashedToken","replacementExpiresAt","revokeAgentRefreshToken","createAgentPersonalAccessToken","createAgentPersonalAccessTokenTx","findAgentPersonalAccessTokenByHash","findActiveAgentPersonalAccessTokenByHash","markAgentPersonalAccessTokenUsed","revokeAgentPersonalAccessToken","pruneAgentAccess","now","Date","retentionDays","cutoff","getTime","requestIds","orderBy","codeIds","refreshTokenIds","patIds","requests","codes","refreshTokens","pats","Promise","all","delete","length"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAS3E,SAAQC,EAAE,QAAO,UAAU;AAC3B,SACEC,uBAAuB,EACvBC,0BAA0B,EAC1BC,YAAY,EACZC,WAAW,EACXC,yBAAyB,EACzBC,kBAAkB,EAClBC,wBAAwB,EACxBC,2BAA2B,EAC3BC,aAAa,EACbC,YAAY,EACZC,0BAA0B,EAC1BC,mBAAmB,QACd,2BAA2B;AAalC,OAAO,eAAeC,kBAAkBC,MAA+B;IACrE,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOC,oBAAoBD,IAAIF;AAChE;AAEA,OAAO,eAAeG,oBACpBD,EAAiB,EACjBF,MAA+B;IAE/B,MAAMI,OAAO,MAAMF,GAChBG,MAAM,CAAChB,cACPiB,MAAM,CAACN,QACPO,kBAAkB,CAAC;QAClBC,QAAQnB,aAAaoB,QAAQ;QAC7BC,KAAK;YACHC,YAAY1B,GAAG,CAAC,KAAK,CAAC;YACtB2B,gBAAgB;YAChBC,WAAW5B,GAAG,CAAC,KAAK,CAAC;QACvB;IACF,GACC6B,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOrB,cAAcoB;AACvB;AAEA,OAAO,eAAeE,0BAA0BjB,MAG/C;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAC/B,cACLgC,KAAK,CAAC1C,GAAGU,aAAaoB,QAAQ,EAAET,OAAOS,QAAQ,GAC/Ca,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMpB,cAAcoB,OAAOQ;AACpC;AAEA,OAAO,eAAeC,0BACpBtB,EAAiB,EACjBF,MAA4B;IAE5B,MAAME,GACHuB,MAAM,CAACpC,cACPqB,GAAG,CAAC;QAACE,gBAAgB;QAAMD,YAAY1B,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GACxEoC,KAAK,CAAC1C,GAAGU,aAAaqC,EAAE,EAAE1B,OAAO2B,UAAU;AAChD;AAEA,OAAO,eAAeC,4BACpB1B,EAAiB,EACjBF,MAA4B;IAE5B,MAAME,GACHuB,MAAM,CAACpC,cACPqB,GAAG,CAAC;QAACE,gBAAgB3B,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GACtDoC,KAAK,CAAC1C,GAAGU,aAAaqC,EAAE,EAAE1B,OAAO2B,UAAU;AAChD;AAaA,OAAO,eAAeE,gCACpB7B,MAA6C;IAE7C,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAO4B,kCAAkC5B,IAAIF;AAC9E;AAEA,OAAO,eAAe8B,kCACpB5B,EAAiB,EACjBF,MAA6C;IAE7C,MAAMI,OAAO,MAAMF,GAAGG,MAAM,CAACjB,4BAA4BkB,MAAM,CAACN,QAAQc,SAAS;IACjF,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOtB,4BAA4BqB;AACrC;AAEA,OAAO,eAAegB,qCAAqC/B,MAG1D;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAChC,4BACLiC,KAAK,CACJ5C,IACEE,GAAGS,2BAA2BsC,EAAE,EAAE1B,OAAO0B,EAAE,GAC3C5C,OAAOM,2BAA2B4C,UAAU,GAC5CpD,GAAGQ,2BAA2B6C,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAGtDqC,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMrB,4BAA4BqB,OAAOQ;AAClD;AAEA,OAAO,eAAeW,iCAAiClC,MAEtD;IACC,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOiC,mCAAmCjC,IAAIF;AAC/E;AAEA;;;;CAIC,GACD,OAAO,eAAemC,mCACpBjC,EAAiB,EACjBF,MAAoB;IAEpB,MAAMI,OAAO,MAAMF,GAChBuB,MAAM,CAACrC,4BACPsB,GAAG,CAAC;QAACsB,YAAY/C,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GAClDoC,KAAK,CACJ5C,IACEE,GAAGS,2BAA2BsC,EAAE,EAAE1B,OAAO0B,EAAE,GAC3C5C,OAAOM,2BAA2B4C,UAAU,GAC5CpD,GAAGQ,2BAA2B6C,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAGtD6B,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMrB,4BAA4BqB,OAAOQ;AAClD;AAUA,OAAO,eAAea,iBAAiBpC,MAA8B;IACnE,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOmC,mBAAmBnC,IAAIF;AAC/D;AAEA,OAAO,eAAeqC,mBACpBnC,EAAiB,EACjBF,MAA8B;IAE9B,MAAMI,OAAO,MAAMF,GAChBG,MAAM,CAACf,aACPgB,MAAM,CAACN,QACPO,kBAAkB,CAAC;QAClBC,QAAQ;YAAClB,YAAYgD,MAAM;YAAEhD,YAAYiD,WAAW;YAAEjD,YAAYmB,QAAQ;SAAC;QAC3E+B,aAAavD,GAAG,CAAC,EAAEK,YAAYmD,SAAS,CAAC,aAAa,EAAEnD,YAAYoD,UAAU,CAAC,QAAQ,CAAC;QACxFhC,KAAK;YACHiC,QAAQ3C,OAAO2C,MAAM;YACrB9B,WAAW5B,GAAG,CAAC,KAAK,CAAC;QACvB;IACF,GACC6B,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,MAAM,IAAIC,MAAM;IAE1B,0EAA0E;IAC1E,uEAAuE;IACvE,MAAMd,GACHuB,MAAM,CAACjC,oBACPkB,GAAG,CAAC;QAAC+B,WAAWxD,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDoC,KAAK,CACJ5C,IACEE,GAAGa,mBAAmBoD,OAAO,EAAE7B,IAAIW,EAAE,GACrC5C,OAAOU,mBAAmBqD,SAAS,GACnC/D,OAAOU,mBAAmBiD,SAAS;IAIzC,MAAMjB,0BAA0BtB,IAAI;QAACyB,YAAY3B,OAAOS,QAAQ;IAAA;IAChE,OAAOb,aAAamB;AACtB;AAEA,OAAO,eAAe+B,eAAe9C,MAGpC;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAC9B,aACL+B,KAAK,CAAC1C,GAAGW,YAAYoC,EAAE,EAAE1B,OAAO0B,EAAE,GAClCJ,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMnB,aAAamB,OAAOQ;AACnC;AAEA;;;;;CAKC,GACD,OAAO,eAAewB,eACpB7C,EAAiB,EACjBF,MAAyB;IAEzB,MAAMI,OAAO,MAAMF,GAChBiB,MAAM,GACNC,IAAI,CAAC9B,aACL+B,KAAK,CAAC1C,GAAGW,YAAYoC,EAAE,EAAE1B,OAAO4C,OAAO,GACvCI,GAAG,CAAC,UACJ1B,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMnB,aAAamB,OAAOQ;AACnC;AAWA,OAAO,eAAe0B,6BACpBjD,MAA0C;IAE1C,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOgD,+BAA+BhD,IAAIF;AAC3E;AAEA,OAAO,eAAekD,+BACpBhD,EAAiB,EACjBF,MAA0C;IAE1C,MAAMI,OAAO,MAAMF,GAAGG,MAAM,CAAClB,yBAAyBmB,MAAM,CAACN,QAAQc,SAAS;IAC9E,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOvB,yBAAyBsB;AAClC;AAEA,OAAO,eAAeoC,iCAAiCnD,MAGtD;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAACjC,yBACLkC,KAAK,CAAC1C,GAAGQ,wBAAwBiE,UAAU,EAAEpD,OAAOoD,UAAU,GAC9D9B,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMtB,yBAAyBsB,OAAOQ;AAC/C;AAEA,OAAO,eAAe8B,uCAAuCrD,MAG5D;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAACjC,yBACLkC,KAAK,CACJ5C,IACEE,GAAGQ,wBAAwBiE,UAAU,EAAEpD,OAAOoD,UAAU,GACxDtE,OAAOK,wBAAwB6C,UAAU,GACzCpD,GAAGO,wBAAwB8C,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAGnDqC,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMtB,yBAAyBsB,OAAOQ;AAC/C;AAEA,OAAO,eAAe+B,8BAA8BtD,MAEnD;IACC,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOqD,gCAAgCrD,IAAIF;AAC5E;AAEA,4EAA4E,GAC5E,OAAO,eAAeuD,gCACpBrD,EAAiB,EACjBF,MAA4B;IAE5B,MAAMI,OAAO,MAAMF,GAChBuB,MAAM,CAACtC,yBACPuB,GAAG,CAAC;QAACsB,YAAY/C,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GAClDoC,KAAK,CACJ5C,IACEE,GAAGQ,wBAAwBiE,UAAU,EAAEpD,OAAOoD,UAAU,GACxDtE,OAAOK,wBAAwB6C,UAAU,GACzCpD,GAAGO,wBAAwB8C,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAGnD6B,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMtB,yBAAyBsB,OAAOQ;AAC/C;AAQA,OAAO,eAAeiC,wBACpBxD,MAAqC;IAErC,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOuD,0BAA0BvD,IAAIF;AACtE;AAEA,OAAO,eAAeyD,0BACpBvD,EAAiB,EACjBF,MAAqC;IAErC,MAAMI,OAAO,MAAMF,GAAGG,MAAM,CAACb,oBAAoBc,MAAM,CAACN,QAAQc,SAAS;IACzE,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOlB,oBAAoBiB;AAC7B;AAEA,OAAO,eAAe2C,4BAA4B1D,MAGjD;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAC5B,oBACL6B,KAAK,CAAC1C,GAAGa,mBAAmBmE,WAAW,EAAE3D,OAAO2D,WAAW,GAC3DrC,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMjB,oBAAoBiB,OAAOQ;AAC1C;AAEA,OAAO,eAAeqC,kCAAkC5D,MAGvD;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAC5B,oBACL6B,KAAK,CACJ5C,IACEE,GAAGa,mBAAmBmE,WAAW,EAAE3D,OAAO2D,WAAW,GACrD7E,OAAOU,mBAAmBqD,SAAS,GACnC/D,OAAOU,mBAAmBiD,SAAS,GACnC7D,GAAGY,mBAAmByC,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAG9CqC,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMjB,oBAAoBiB,OAAOQ;AAC1C;AAEA,gFAAgF,GAChF,OAAO,eAAesC,wBAAwB7D,MAI7C;IACC,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAO4D,0BAA0B5D,IAAIF;AACtE;AAEA,OAAO,eAAe8D,0BACpB5D,EAAiB,EACjBF,MAIC;IAED,MAAMI,OAAO,MAAMF,GAChBuB,MAAM,CAACjC,oBACPkB,GAAG,CAAC;QAACmC,WAAW5D,GAAG,CAAC,KAAK,CAAC;QAAE8E,YAAY9E,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GACzEoC,KAAK,CACJ5C,IACEE,GAAGa,mBAAmBmE,WAAW,EAAE3D,OAAO2D,WAAW,GACrD7E,OAAOU,mBAAmBqD,SAAS,GACnC/D,OAAOU,mBAAmBiD,SAAS,GACnC7D,GAAGY,mBAAmByC,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAG9C6B,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,OAAOQ;IAEjB,OAAO,MAAMkC,0BAA0BvD,IAAI;QACzC0C,SAAS7B,IAAI6B,OAAO;QACpBe,aAAa3D,OAAOgE,sBAAsB;QAC1C/B,WAAWjC,OAAOiE,oBAAoB;IACxC;AACF;AAEA,OAAO,eAAeC,wBAAwBlE,MAE7C;IACC,OAAO,MAAMd,KAAKe,WAAW,CAAC,OAAOC;QACnC,MAAME,OAAO,MAAMF,GAChBuB,MAAM,CAACjC,oBACPkB,GAAG,CAAC;YAAC+B,WAAWxD,GAAG,CAAC,KAAK,CAAC;YAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;QAAA,GACjDoC,KAAK,CAAC5C,IAAIE,GAAGa,mBAAmBkC,EAAE,EAAE1B,OAAO0B,EAAE,GAAG5C,OAAOU,mBAAmBiD,SAAS,IACnF3B,SAAS;QACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;QACnB,OAAOW,MAAMjB,oBAAoBiB,OAAOQ;IAC1C;AACF;AAYA,OAAO,eAAe4C,+BACpBnE,MAA4C;IAE5C,OAAO,MAAMd,KAAKe,WAAW,CAAC,CAACC,KAAOkE,iCAAiClE,IAAIF;AAC7E;AAEA,OAAO,eAAeoE,iCACpBlE,EAAiB,EACjBF,MAA4C;IAE5C,MAAMI,OAAO,MAAMF,GAAGG,MAAM,CAACd,2BAA2Be,MAAM,CAACN,QAAQc,SAAS;IAChF,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,IAAI,CAACW,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOnB,2BAA2BkB;AACpC;AAEA,OAAO,eAAesD,mCAAmCrE,MAGxD;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAC7B,2BACL8B,KAAK,CAAC1C,GAAGY,0BAA0BoE,WAAW,EAAE3D,OAAO2D,WAAW,GAClErC,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMlB,2BAA2BkB,OAAOQ;AACjD;AAEA,OAAO,eAAe+C,yCAAyCtE,MAG9D;IACC,MAAMkB,WAAWlB,OAAOkB,QAAQ,IAAIhC;IACpC,MAAMkB,OAAO,MAAMc,SAChBC,MAAM,GACNC,IAAI,CAAC7B,2BACL8B,KAAK,CACJ5C,IACEE,GAAGY,0BAA0BoE,WAAW,EAAE3D,OAAO2D,WAAW,GAC5D7E,OAAOS,0BAA0BkD,SAAS,GAC1C7D,GAAGW,0BAA0B0C,SAAS,EAAEhD,GAAG,CAAC,KAAK,CAAC,IAGrDqC,KAAK,CAAC;IACT,MAAMP,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMlB,2BAA2BkB,OAAOQ;AACjD;AAEA,OAAO,eAAegD,iCAAiCvE,MAEtD;IACC,MAAMI,OAAO,MAAMlB,KAChBuC,MAAM,CAAClC,2BACPmB,GAAG,CAAC;QAACqD,YAAY9E,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GAClDoC,KAAK,CAAC1C,GAAGY,0BAA0BmC,EAAE,EAAE1B,OAAO0B,EAAE,GAChDZ,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMlB,2BAA2BkB,OAAOQ;AACjD;AAEA,OAAO,eAAeiD,+BAA+BxE,MAEpD;IACC,MAAMI,OAAO,MAAMlB,KAChBuC,MAAM,CAAClC,2BACPmB,GAAG,CAAC;QAAC+B,WAAWxD,GAAG,CAAC,KAAK,CAAC;QAAE4B,WAAW5B,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDoC,KAAK,CACJ5C,IAAIE,GAAGY,0BAA0BmC,EAAE,EAAE1B,OAAO0B,EAAE,GAAG5C,OAAOS,0BAA0BkD,SAAS,IAE5F3B,SAAS;IACZ,MAAMC,MAAMX,IAAI,CAAC,EAAE;IACnB,OAAOW,MAAMlB,2BAA2BkB,OAAOQ;AACjD;AAQA,sFAAsF,GACtF,OAAO,eAAekD,iBAAiBzE,SAAiC,CAAC,CAAC;IACxE,MAAM0E,MAAM1E,OAAO0E,GAAG,IAAI,IAAIC;IAC9B,MAAMC,gBAAgB5E,OAAO4E,aAAa,IAAI;IAC9C,MAAMtD,QAAQtB,OAAOsB,KAAK,IAAI;IAC9B,MAAMuD,SAAS,IAAIF,KAAKD,IAAII,OAAO,KAAKF,gBAAgB,KAAK,KAAK,KAAK;IAEvE,OAAO,MAAM1F,KAAKe,WAAW,CAAC,OAAOC;QACnC,MAAM6E,aAAa7E,GAChBiB,MAAM,CAAC;YAACO,IAAItC,2BAA2BsC,EAAE;QAAA,GACzCN,IAAI,CAAChC,4BACLiC,KAAK,CACJrC,GACED,GAAGK,2BAA2B4C,UAAU,EAAE6C,SAC1CpG,IACEK,OAAOM,2BAA2B4C,UAAU,GAC5CjD,GAAGK,2BAA2B6C,SAAS,EAAE4C,WAI9CG,OAAO,CAACtG,IAAIU,2BAA2B6C,SAAS,GAAGvD,IAAIU,2BAA2BsC,EAAE,GACpFJ,KAAK,CAACA;QACT,MAAM2D,UAAU/E,GACbiB,MAAM,CAAC;YAACO,IAAIvC,wBAAwBuC,EAAE;QAAA,GACtCN,IAAI,CAACjC,yBACLkC,KAAK,CACJrC,GACED,GAAGI,wBAAwB6C,UAAU,EAAE6C,SACvCpG,IACEK,OAAOK,wBAAwB6C,UAAU,GACzCjD,GAAGI,wBAAwB8C,SAAS,EAAE4C,WAI3CG,OAAO,CAACtG,IAAIS,wBAAwB8C,SAAS,GAAGvD,IAAIS,wBAAwBuC,EAAE,GAC9EJ,KAAK,CAACA;QACT,MAAM4D,kBAAkBhF,GACrBiB,MAAM,CAAC;YAACO,IAAIlC,mBAAmBkC,EAAE;QAAA,GACjCN,IAAI,CAAC5B,oBACL6B,KAAK,CACJrC,GACED,GAAGS,mBAAmBqD,SAAS,EAAEgC,SACjCpG,IAAIK,OAAOU,mBAAmBqD,SAAS,GAAG9D,GAAGS,mBAAmBiD,SAAS,EAAEoC,UAC3EpG,IACEK,OAAOU,mBAAmBqD,SAAS,GACnC/D,OAAOU,mBAAmBiD,SAAS,GACnC1D,GAAGS,mBAAmByC,SAAS,EAAE4C,WAItCG,OAAO,CAACtG,IAAIc,mBAAmByC,SAAS,GAAGvD,IAAIc,mBAAmBkC,EAAE,GACpEJ,KAAK,CAACA;QACT,MAAM6D,SAASjF,GACZiB,MAAM,CAAC;YAACO,IAAInC,0BAA0BmC,EAAE;QAAA,GACxCN,IAAI,CAAC7B,2BACL8B,KAAK,CACJrC,GACED,GAAGQ,0BAA0BkD,SAAS,EAAEoC,SACxCpG,IACEK,OAAOS,0BAA0BkD,SAAS,GAC1C1D,GAAGQ,0BAA0B0C,SAAS,EAAE4C,WAI7CG,OAAO,CAACtG,IAAIa,0BAA0B0C,SAAS,GAAGvD,IAAIa,0BAA0BmC,EAAE,GAClFJ,KAAK,CAACA;QAET,MAAM,CAAC8D,UAAUC,OAAOC,eAAeC,KAAK,GAAG,MAAMC,QAAQC,GAAG,CAAC;YAC/DvF,GACGwF,MAAM,CAACtG,4BACPiC,KAAK,CAACxC,QAAQO,2BAA2BsC,EAAE,EAAEqD,aAC7CjE,SAAS,CAAC;gBAACY,IAAItC,2BAA2BsC,EAAE;YAAA;YAC/CxB,GACGwF,MAAM,CAACvG,yBACPkC,KAAK,CAACxC,QAAQM,wBAAwBuC,EAAE,EAAEuD,UAC1CnE,SAAS,CAAC;gBAACY,IAAIvC,wBAAwBuC,EAAE;YAAA;YAC5CxB,GACGwF,MAAM,CAAClG,oBACP6B,KAAK,CAACxC,QAAQW,mBAAmBkC,EAAE,EAAEwD,kBACrCpE,SAAS,CAAC;gBAACY,IAAIlC,mBAAmBkC,EAAE;YAAA;YACvCxB,GACGwF,MAAM,CAACnG,2BACP8B,KAAK,CAACxC,QAAQU,0BAA0BmC,EAAE,EAAEyD,SAC5CrE,SAAS,CAAC;gBAACY,IAAInC,0BAA0BmC,EAAE;YAAA;SAC/C;QACD,OAAO0D,SAASO,MAAM,GAAGN,MAAMM,MAAM,GAAGL,cAAcK,MAAM,GAAGJ,KAAKI,MAAM;IAC5E;AACF"}