@trokky/trokky 2.0.3

package/dist/core/security/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/core/security/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqBH,MAAM,OAAO,cAAc;IACjB,WAAW,CAAuB;IAClC,WAAW,CAA+B;IAC1C,iBAAiB,CAAiC;IAE1D,YAAY,MAA4B;QACtC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;QACrC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAA;QACrC,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAA;IACnD,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC/D,IAAI,CAAC;gBACH,sDAAsD;gBACtD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;gBAC5C,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;oBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;oBAE1D,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnC,0DAA0D;wBAC1D,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;4BACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;4BAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gCAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAA;4BACpE,CAAC;4BACD,sCAAsC;4BACtC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;gCACpB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI;gCACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gCACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gCACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;6BACxB,CAAA;wBACH,CAAC;wBAED,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAA;wBACzB,OAAO,IAAI,EAAE,CAAA;oBACf,CAAC;gBACH,CAAC;gBAED,oDAAoD;gBACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAW,CAAA;gBACrD,IAAI,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;oBAEpE,IAAI,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;wBACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;wBAE9D,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;4BAClC,mBAAmB;4BACnB,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gCACpE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAA;4BACjE,CAAC;4BAED,wBAAwB;4BACxB,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;4BAC9C,QAAQ,CAAC,UAAU,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;4BAEpD,GAAG,CAAC,IAAI,GAAG;gCACT,IAAI,EAAE,WAAW;gCACjB,KAAK,EAAE;oCACL,EAAE,EAAE,QAAQ,CAAC,EAAE;oCACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oCACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;oCACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;oCAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iCAC5B;6BACF,CAAA;4BACD,OAAO,IAAI,EAAE,CAAA;wBACf,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,gCAAgC;gBAChC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAChC,IAAI,EAAE,CAAA;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;gBAC7C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;YACxE,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,yBAAyB;oBAChC,OAAO,EAAE,2DAA2D;iBACrE,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAsB;QACtC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;YACnE,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,UAAU;iBACrB,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,WAAyB;QAC5C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;YACnE,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC9C,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAyB;QAC7C,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;YACnE,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC/D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC9C,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;YACxE,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,uBAAuB;oBAC9B,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;iBAChC,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,EAAE,CAAA;QACR,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC/D,8DAA8D;YAC9D,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAW,EAAE,EAAE;gBAClD,iDAAiD;gBACjD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACd,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;gBAClC,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,CAAA;YACb,CAAC,CAAC,CAAA;QACJ,CAAC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,GAAY;QAChC,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,GAAY;QACrC,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAA;IAClC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,GAAY;QAC5B,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,CAAA;IACvC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,GAAY;QAC3B,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,GAAY;QAC/B,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;IAE7C,OAAO;QACL,kBAAkB;QAClB,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;QACvC,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE;QACrC,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;QAEvC,8BAA8B;QAC9B,iBAAiB,EAAE,CAAC,UAAsB,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC;QACvF,oBAAoB,EAAE,CAAC,WAAyB,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,WAAW,CAAC;QACjG,qBAAqB,EAAE,CAAC,WAAyB,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,WAAW,CAAC;QAEnG,wBAAwB;QACxB,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;QACvC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;QAErD,sBAAsB;QACtB,iBAAiB,EAAE,CAAC,UAAsB,EAAE,EAAE,CAAC;YAC7C,UAAU,CAAC,YAAY,EAAE;YACzB,UAAU,CAAC,WAAW,EAAE;YACxB,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC;SACzC;QAED,UAAU,EAAE,GAAG,EAAE,CAAC;YAChB,UAAU,CAAC,YAAY,EAAE;YACzB,UAAU,CAAC,WAAW,EAAE;YACxB,UAAU,CAAC,mBAAmB,EAAE;SACjC;QAED,SAAS,EAAE,GAAG,EAAE,CAAC;YACf,UAAU,CAAC,YAAY,EAAE;YACzB,UAAU,CAAC,WAAW,EAAE;YACxB,UAAU,CAAC,YAAY,EAAE;SAC1B;QAED,oBAAoB;QACpB,cAAc,EAAE,cAAc,CAAC,cAAc;QAC7C,mBAAmB,EAAE,cAAc,CAAC,mBAAmB;QACvD,UAAU,EAAE,cAAc,CAAC,UAAU;QACrC,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,aAAa,EAAE,cAAc,CAAC,aAAa;KAC5C,CAAA;AACH,CAAC"}

package/dist/core/security/oauth/google.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Google OAuth Service
+ *
+ * Implements OAuth 2.0 Authorization Code flow with PKCE for Google authentication.
+ * Used for linking Google accounts to existing Trokky users and for OAuth login.
+ */
+export interface GoogleOAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+}
+export interface GoogleUserInfo {
+    sub: string;
+    email: string;
+    email_verified: boolean;
+    name: string;
+    picture?: string;
+    given_name?: string;
+    family_name?: string;
+}
+export interface GoogleTokenResponse {
+    access_token: string;
+    id_token: string;
+    refresh_token?: string;
+    expires_in: number;
+    token_type: string;
+    scope: string;
+}
+export interface PKCEChallenge {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare class GoogleOAuthService {
+    private config;
+    constructor(config: GoogleOAuthConfig);
+    /**
+     * Generate PKCE code verifier and challenge
+     * Uses SHA256 for the challenge as recommended by OAuth 2.0 PKCE spec
+     */
+    generatePKCE(): PKCEChallenge;
+    /**
+     * Generate state token for CSRF protection
+     */
+    generateState(): string;
+    /**
+     * Build Google authorization URL with all required parameters
+     *
+     * @param state - CSRF protection token
+     * @param codeChallenge - PKCE code challenge
+     * @param mode - 'link' requires consent for refresh token, 'login' skips consent if already granted
+     */
+    getAuthorizationUrl(state: string, codeChallenge: string, mode?: 'link' | 'login'): string;
+    /**
+     * Exchange authorization code for tokens using PKCE
+     */
+    exchangeCodeForTokens(code: string, codeVerifier: string): Promise<{
+        accessToken: string;
+        idToken: string;
+        refreshToken?: string;
+        expiresIn: number;
+    }>;
+    /**
+     * Get user info from Google using access token
+     */
+    getUserInfo(accessToken: string): Promise<GoogleUserInfo>;
+    /**
+     * Validate that the user's email is verified
+     * This is important for security - we shouldn't link unverified emails
+     */
+    validateUserInfo(userInfo: GoogleUserInfo): void;
+    /**
+     * Check if the service is properly configured
+     */
+    isConfigured(): boolean;
+}
+//# sourceMappingURL=google.d.ts.map

package/dist/core/security/oauth/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth/google.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,OAAO,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAMD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAmB;gBAErB,MAAM,EAAE,iBAAiB;IAKrC;;;OAGG;IACH,YAAY,IAAI,aAAa;IAY7B;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,GAAG,OAAgB,GAAG,MAAM;IAyBlG;;OAEG;IACG,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAA;QACnB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC;IAsCF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA8B/D;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI;IAehD;;OAEG;IACH,YAAY,IAAI,OAAO;CAOxB"}

package/dist/core/security/oauth/google.js

@@ -0,0 +1,154 @@
+/**
+ * Google OAuth Service
+ *
+ * Implements OAuth 2.0 Authorization Code flow with PKCE for Google authentication.
+ * Used for linking Google accounts to existing Trokky users and for OAuth login.
+ */
+import { randomBytes, createHash } from 'node:crypto';
+import { createLogger } from '../../utils/logger.js';
+const logger = createLogger('security', 'GoogleOAuth');
+// =============================================================================
+// GOOGLE OAUTH SERVICE
+// =============================================================================
+export class GoogleOAuthService {
+    config;
+    constructor(config) {
+        this.config = config;
+        logger.debug('GoogleOAuthService initialized', { clientId: config.clientId });
+    }
+    /**
+     * Generate PKCE code verifier and challenge
+     * Uses SHA256 for the challenge as recommended by OAuth 2.0 PKCE spec
+     */
+    generatePKCE() {
+        // Generate 32 random bytes for code verifier (43-128 chars when base64url encoded)
+        const codeVerifier = randomBytes(32).toString('base64url');
+        // Create SHA256 hash of verifier for challenge
+        const codeChallenge = createHash('sha256')
+            .update(codeVerifier)
+            .digest('base64url');
+        return { codeVerifier, codeChallenge };
+    }
+    /**
+     * Generate state token for CSRF protection
+     */
+    generateState() {
+        return randomBytes(32).toString('base64url');
+    }
+    /**
+     * Build Google authorization URL with all required parameters
+     *
+     * @param state - CSRF protection token
+     * @param codeChallenge - PKCE code challenge
+     * @param mode - 'link' requires consent for refresh token, 'login' skips consent if already granted
+     */
+    getAuthorizationUrl(state, codeChallenge, mode = 'link') {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: 'code',
+            scope: 'openid email profile',
+            state,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+        });
+        if (mode === 'link') {
+            // Linking mode: need refresh token, show consent screen
+            params.set('access_type', 'offline');
+            params.set('prompt', 'consent');
+        }
+        else {
+            // Login mode: just need to identify user, skip consent if already granted
+            params.set('prompt', 'select_account');
+        }
+        const authUrl = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+        logger.debug('Generated authorization URL', { state, mode });
+        return authUrl;
+    }
+    /**
+     * Exchange authorization code for tokens using PKCE
+     */
+    async exchangeCodeForTokens(code, codeVerifier) {
+        logger.debug('Exchanging code for tokens');
+        const response = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                client_secret: this.config.clientSecret,
+                code,
+                code_verifier: codeVerifier,
+                grant_type: 'authorization_code',
+                redirect_uri: this.config.redirectUri,
+            }),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            logger.error('Failed to exchange code for tokens', {
+                status: response.status,
+                error: errorText,
+            });
+            throw new Error(`Failed to exchange code for tokens: ${response.status}`);
+        }
+        const data = (await response.json());
+        logger.debug('Successfully exchanged code for tokens');
+        return {
+            accessToken: data.access_token,
+            idToken: data.id_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+        };
+    }
+    /**
+     * Get user info from Google using access token
+     */
+    async getUserInfo(accessToken) {
+        logger.debug('Fetching user info from Google');
+        const response = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            logger.error('Failed to get user info', {
+                status: response.status,
+                error: errorText,
+            });
+            throw new Error(`Failed to get user info: ${response.status}`);
+        }
+        const userInfo = (await response.json());
+        logger.debug('Successfully fetched user info', {
+            sub: userInfo.sub,
+            email: userInfo.email,
+        });
+        return userInfo;
+    }
+    /**
+     * Validate that the user's email is verified
+     * This is important for security - we shouldn't link unverified emails
+     */
+    validateUserInfo(userInfo) {
+        if (!userInfo.email_verified) {
+            logger.warn('Google account email not verified', { email: userInfo.email });
+            throw new Error('Google account email must be verified');
+        }
+        if (!userInfo.sub) {
+            throw new Error('Invalid Google user info: missing sub claim');
+        }
+        if (!userInfo.email) {
+            throw new Error('Invalid Google user info: missing email');
+        }
+    }
+    /**
+     * Check if the service is properly configured
+     */
+    isConfigured() {
+        return !!(this.config.clientId &&
+            this.config.clientSecret &&
+            this.config.redirectUri);
+    }
+}
+//# sourceMappingURL=google.js.map

package/dist/core/security/oauth/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../../src/core/security/oauth/google.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;AAoCtD,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,MAAM,OAAO,kBAAkB;IACrB,MAAM,CAAmB;IAEjC,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,mFAAmF;QACnF,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAE1D,+CAA+C;QAC/C,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;aACvC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC,WAAW,CAAC,CAAA;QAEtB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;IACxC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAa,EAAE,aAAqB,EAAE,OAAyB,MAAM;QACvF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QAEF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,wDAAwD;YACxD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;YACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,0EAA0E;YAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,OAAO,GAAG,gDAAgD,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;QACnF,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,IAAY,EACZ,YAAoB;QAOpB,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAE1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACvC,IAAI;gBACJ,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,oBAAoB;gBAChC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;aACtC,CAAC;SACH,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACvC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACjD,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YACF,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAEtD,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAA;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAA;QAE9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,+CAA+C,EAC/C;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CACF,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YACvC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBACtC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YACF,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAA;QAC1D,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC7C,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,QAAwB;QACvC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;YAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,MAAM,CAAC,QAAQ;YACpB,IAAI,CAAC,MAAM,CAAC,YAAY;YACxB,IAAI,CAAC,MAAM,CAAC,WAAW,CACxB,CAAA;IACH,CAAC;CACF"}

package/dist/core/security/oauth/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OAuth Services
+ *
+ * External authentication provider integrations for Trokky CMS.
+ */
+export { GoogleOAuthService } from './google.js';
+export type { GoogleOAuthConfig, GoogleUserInfo, GoogleTokenResponse, PKCEChallenge, } from './google.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/security/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAA"}

package/dist/core/security/oauth/index.js

@@ -0,0 +1,7 @@
+/**
+ * OAuth Services
+ *
+ * External authentication provider integrations for Trokky CMS.
+ */
+export { GoogleOAuthService } from './google.js';
+//# sourceMappingURL=index.js.map

package/dist/core/security/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/security/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}

package/dist/core/security/oauth2/authorization-server.d.ts

@@ -0,0 +1,195 @@
+/**
+ * OAuth2 Authorization Server Service
+ *
+ * Implements RFC 8628 (Device Authorization Grant) and
+ * OAuth 2.0 Authorization Code Grant with PKCE for Trokky CMS.
+ *
+ * This allows Trokky Studio to act as an SSO provider for:
+ * - Trokky CLI (device flow)
+ * - External web applications (authorization code flow)
+ */
+import type { OAuth2Client, OAuth2Scope, DeviceCodeState, TokenResponse, OAuth2ErrorCode } from '../../types/oauth2.js';
+import type { Permission } from '../../types/user.js';
+/**
+ * Configuration for registering an OAuth2 client
+ */
+export interface OAuth2ClientConfig {
+    /** Unique client identifier */
+    id: string;
+    /** Human-readable client name */
+    name: string;
+    /** Client description (optional) */
+    description?: string;
+    /** Client type: 'public' for SPAs/native apps, 'confidential' for server-side apps */
+    type?: 'public' | 'confidential';
+    /** Client secret (required for confidential clients) */
+    secret?: string;
+    /** Allowed redirect URIs */
+    redirectUris: string[];
+    /** Allowed scopes (default: all scopes) */
+    allowedScopes?: string[];
+    /** Allowed grant types (default: authorization_code, refresh_token) */
+    grantTypes?: string[];
+}
+/**
+ * Configuration for the OAuth2 Authorization Server
+ */
+export interface OAuth2ServerConfig {
+    /** Base URL of the authorization server (e.g., https://cms.example.com) */
+    issuer: string;
+    /** JWT secret for signing tokens */
+    jwtSecret: string;
+    /** Access token lifetime in seconds (default: 3600 = 1 hour) */
+    accessTokenTtl?: number;
+    /** Refresh token lifetime in seconds (default: 2592000 = 30 days) */
+    refreshTokenTtl?: number;
+    /** Device code lifetime in seconds (default: 600 = 10 minutes) */
+    deviceCodeTtl?: number;
+    /** Authorization code lifetime in seconds (default: 600 = 10 minutes) */
+    authCodeTtl?: number;
+    /** Minimum polling interval in seconds (default: 5) */
+    pollingInterval?: number;
+    /** External OAuth2 clients to register */
+    clients?: OAuth2ClientConfig[];
+}
+/**
+ * OAuth2 Authorization Server
+ *
+ * Handles device authorization and authorization code flows.
+ */
+export declare class OAuth2AuthorizationServer {
+    private config;
+    private externalClients;
+    private deviceCodes;
+    private authorizationCodes;
+    private clients;
+    private cleanupInterval;
+    constructor(config: OAuth2ServerConfig);
+    /**
+     * Register the built-in CLI client
+     */
+    private registerBuiltInClient;
+    /**
+     * Register external OAuth2 clients from config
+     */
+    private registerExternalClients;
+    /**
+     * Start periodic cleanup of expired codes
+     */
+    private startCleanup;
+    /**
+     * Stop cleanup interval (for testing/shutdown)
+     */
+    stopCleanup(): void;
+    /**
+     * Get a registered client by ID
+     */
+    getClient(clientId: string): OAuth2Client | null;
+    /**
+     * Validate client credentials (for confidential clients)
+     */
+    validateClientSecret(client: OAuth2Client, secret: string): boolean;
+    /**
+     * Hash a secret for storage
+     */
+    private hashSecret;
+    /**
+     * Generate a user-friendly code (8 characters, easy to type)
+     */
+    private generateUserCode;
+    /**
+     * Generate a device code (long, random string)
+     */
+    private generateDeviceCode;
+    /**
+     * Start device authorization flow
+     * Returns device_code, user_code, and verification URI
+     */
+    startDeviceAuthorization(clientId: string, requestedScopes: string[]): {
+        success: true;
+        response: {
+            device_code: string;
+            user_code: string;
+            verification_uri: string;
+            verification_uri_complete: string;
+            expires_in: number;
+            interval: number;
+        };
+    } | {
+        success: false;
+        error: OAuth2ErrorCode;
+        error_description: string;
+    };
+    /**
+     * Get device code state by user code (for verification page)
+     */
+    getDeviceCodeByUserCode(userCode: string): DeviceCodeState | null;
+    /**
+     * Authorize a device code (called when user approves in Studio)
+     */
+    authorizeDeviceCode(userCode: string, userId: string): boolean;
+    /**
+     * Deny a device code (called when user denies in Studio)
+     */
+    denyDeviceCode(userCode: string): boolean;
+    /**
+     * Poll for device token (called by CLI)
+     */
+    pollDeviceToken(deviceCode: string, clientId: string, generateToken: (userId: string, scopes: OAuth2Scope[], clientId: string) => Promise<TokenResponse>): Promise<{
+        success: true;
+        response: TokenResponse;
+    } | {
+        success: false;
+        error: OAuth2ErrorCode;
+        error_description: string;
+    }>;
+    private checkDeviceCodeAndGenerateToken;
+    /**
+     * Validate authorization request parameters
+     */
+    validateAuthorizationRequest(params: {
+        response_type: string;
+        client_id: string;
+        redirect_uri: string;
+        scope?: string;
+        state: string;
+        code_challenge: string;
+        code_challenge_method: string;
+    }): {
+        valid: true;
+        client: OAuth2Client;
+        scopes: OAuth2Scope[];
+    } | {
+        valid: false;
+        error: OAuth2ErrorCode;
+        error_description: string;
+    };
+    /**
+     * Generate authorization code after user approval
+     */
+    generateAuthorizationCode(clientId: string, redirectUri: string, scopes: OAuth2Scope[], codeChallenge: string, userId: string): string;
+    /**
+     * Exchange authorization code for tokens
+     */
+    exchangeAuthorizationCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, generateToken: (userId: string, scopes: OAuth2Scope[], clientId: string) => Promise<TokenResponse>): Promise<{
+        success: true;
+        response: TokenResponse;
+    } | {
+        success: false;
+        error: OAuth2ErrorCode;
+        error_description: string;
+    }>;
+    /**
+     * Validate requested scopes against allowed scopes
+     */
+    private validateScopes;
+    /**
+     * Convert OAuth2 scopes to Trokky permissions
+     */
+    scopesToPermissions(scopes: OAuth2Scope[]): Permission[];
+    /**
+     * Get server configuration (for .well-known/oauth-authorization-server)
+     */
+    getServerMetadata(): Record<string, unknown>;
+}
+//# sourceMappingURL=authorization-server.d.ts.map

package/dist/core/security/oauth2/authorization-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-server.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth2/authorization-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EAEX,eAAe,EAEf,aAAa,EACb,eAAe,EAEhB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAQ,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG3D;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sFAAsF;IACtF,IAAI,CAAC,EAAE,QAAQ,GAAG,cAAc,CAAA;IAChC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4BAA4B;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAC/B;AAED;;;;GAIG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,eAAe,CAAsB;IAG7C,OAAO,CAAC,WAAW,CAA0C;IAC7D,OAAO,CAAC,kBAAkB,CAAiD;IAC3E,OAAO,CAAC,OAAO,CAAuC;IAGtD,OAAO,CAAC,eAAe,CAA8B;gBAEzC,MAAM,EAAE,kBAAkB;IAsBtC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAuB/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACI,WAAW,IAAI,IAAI;IAW1B;;OAEG;IACI,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIvD;;OAEG;IACI,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAY1E;;OAEG;IACH,OAAO,CAAC,UAAU;IAQlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAYxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;;OAGG;IACI,wBAAwB,CAC7B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,GACxB;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,MAAM,CAAA;YACnB,SAAS,EAAE,MAAM,CAAA;YACjB,gBAAgB,EAAE,MAAM,CAAA;YACxB,yBAAyB,EAAE,MAAM,CAAA;YACjC,UAAU,EAAE,MAAM,CAAA;YAClB,QAAQ,EAAE,MAAM,CAAA;SACjB,CAAA;KAAC,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IA0E1E;;OAEG;IACI,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAQxE;;OAEG;IACI,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAsBrE;;OAEG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAgBhD;;OAEG;IACI,eAAe,CACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,GACjG,OAAO,CACN;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,GAC1C;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CACxE;YAIa,+BAA+B;IAsG7C;;OAEG;IACI,4BAA4B,CAAC,MAAM,EAAE;QAC1C,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,cAAc,EAAE,MAAM,CAAA;QACtB,qBAAqB,EAAE,MAAM,CAAA;KAC9B,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;IA2EtI;;OAEG;IACI,yBAAyB,CAC9B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,EAAE,EACrB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,GACb,MAAM;IAmBT;;OAEG;IACU,yBAAyB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,GACjG,OAAO,CACN;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,GAC1C;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,eAAe,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CACxE;IAwED;;OAEG;IACH,OAAO,CAAC,cAAc;IAmBtB;;OAEG;IACI,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE;IAe/D;;OAEG;IACI,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CA2BpD"}