@trokky/trokky 2.0.3

package/dist/core/security/oauth2/authorization-server.js

@@ -0,0 +1,569 @@
+/**
+ * OAuth2 Authorization Server Service
+ *
+ * Implements RFC 8628 (Device Authorization Grant) and
+ * OAuth 2.0 Authorization Code Grant with PKCE for Trokky CMS.
+ *
+ * This allows Trokky Studio to act as an SSO provider for:
+ * - Trokky CLI (device flow)
+ * - External web applications (authorization code flow)
+ */
+import { randomBytes, createHash, timingSafeEqual } from 'crypto';
+import { SCOPE_TO_PERMISSIONS, BUILTIN_CLI_CLIENT as CLI_CLIENT } from '../../types/oauth2.js';
+/**
+ * OAuth2 Authorization Server
+ *
+ * Handles device authorization and authorization code flows.
+ */
+export class OAuth2AuthorizationServer {
+    config;
+    externalClients;
+    // In-memory stores (should be replaced with persistent storage in production)
+    deviceCodes = new Map();
+    authorizationCodes = new Map();
+    clients = new Map();
+    // Cleanup interval
+    cleanupInterval = null;
+    constructor(config) {
+        this.config = {
+            issuer: config.issuer,
+            jwtSecret: config.jwtSecret,
+            accessTokenTtl: config.accessTokenTtl ?? 3600,
+            refreshTokenTtl: config.refreshTokenTtl ?? 2592000,
+            deviceCodeTtl: config.deviceCodeTtl ?? 600,
+            authCodeTtl: config.authCodeTtl ?? 600,
+            pollingInterval: config.pollingInterval ?? 5
+        };
+        this.externalClients = config.clients || [];
+        // Register built-in CLI client
+        this.registerBuiltInClient();
+        // Register external clients from config
+        this.registerExternalClients();
+        // Start cleanup interval
+        this.startCleanup();
+    }
+    /**
+     * Register the built-in CLI client
+     */
+    registerBuiltInClient() {
+        const now = new Date().toISOString();
+        this.clients.set(CLI_CLIENT.id, {
+            ...CLI_CLIENT,
+            createdAt: now,
+            updatedAt: now
+        });
+    }
+    /**
+     * Register external OAuth2 clients from config
+     */
+    registerExternalClients() {
+        const now = new Date().toISOString();
+        for (const clientConfig of this.externalClients) {
+            const client = {
+                id: clientConfig.id,
+                name: clientConfig.name,
+                description: clientConfig.description,
+                type: clientConfig.type || 'public',
+                secretHash: clientConfig.secret ? this.hashSecret(clientConfig.secret) : undefined,
+                redirectUris: clientConfig.redirectUris,
+                allowedScopes: (clientConfig.allowedScopes || [
+                    'openid', 'profile', 'content:read', 'content:write',
+                    'content:delete', 'media:read', 'media:write', 'offline_access'
+                ]),
+                grantTypes: (clientConfig.grantTypes || ['authorization_code', 'refresh_token']),
+                isActive: true,
+                createdAt: now,
+                updatedAt: now
+            };
+            this.clients.set(client.id, client);
+        }
+    }
+    /**
+     * Start periodic cleanup of expired codes
+     */
+    startCleanup() {
+        this.cleanupInterval = setInterval(() => {
+            const now = Date.now();
+            // Clean expired device codes
+            for (const [key, state] of this.deviceCodes) {
+                if (state.expiresAt < now) {
+                    this.deviceCodes.delete(key);
+                }
+            }
+            // Clean expired authorization codes
+            for (const [key, state] of this.authorizationCodes) {
+                if (state.expiresAt < now) {
+                    this.authorizationCodes.delete(key);
+                }
+            }
+        }, 60000); // Run every minute
+    }
+    /**
+     * Stop cleanup interval (for testing/shutdown)
+     */
+    stopCleanup() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+    }
+    // ============================================
+    // Client Management
+    // ============================================
+    /**
+     * Get a registered client by ID
+     */
+    getClient(clientId) {
+        return this.clients.get(clientId) ?? null;
+    }
+    /**
+     * Validate client credentials (for confidential clients)
+     */
+    validateClientSecret(client, secret) {
+        if (client.type !== 'confidential' || !client.secretHash) {
+            return false;
+        }
+        const secretHash = this.hashSecret(secret);
+        const expectedHash = Buffer.from(client.secretHash, 'hex');
+        const providedHash = Buffer.from(secretHash, 'hex');
+        return timingSafeEqual(expectedHash, providedHash);
+    }
+    /**
+     * Hash a secret for storage
+     */
+    hashSecret(secret) {
+        return createHash('sha256').update(secret).digest('hex');
+    }
+    // ============================================
+    // Device Authorization Flow (RFC 8628)
+    // ============================================
+    /**
+     * Generate a user-friendly code (8 characters, easy to type)
+     */
+    generateUserCode() {
+        // Use uppercase letters and numbers, avoiding ambiguous characters (0, O, I, L, 1)
+        const chars = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+        let code = '';
+        const bytes = randomBytes(8);
+        for (let i = 0; i < 8; i++) {
+            code += chars[bytes[i] % chars.length];
+        }
+        // Format as XXXX-XXXX for readability
+        return `${code.slice(0, 4)}-${code.slice(4)}`;
+    }
+    /**
+     * Generate a device code (long, random string)
+     */
+    generateDeviceCode() {
+        return randomBytes(32).toString('base64url');
+    }
+    /**
+     * Start device authorization flow
+     * Returns device_code, user_code, and verification URI
+     */
+    startDeviceAuthorization(clientId, requestedScopes) {
+        // Validate client
+        const client = this.getClient(clientId);
+        if (!client) {
+            return {
+                success: false,
+                error: 'invalid_client',
+                error_description: 'Unknown client_id'
+            };
+        }
+        if (!client.isActive) {
+            return {
+                success: false,
+                error: 'invalid_client',
+                error_description: 'Client is not active'
+            };
+        }
+        // Check if client supports device flow
+        if (!client.grantTypes.includes('urn:ietf:params:oauth:grant-type:device_code')) {
+            return {
+                success: false,
+                error: 'unauthorized_client',
+                error_description: 'Client is not authorized for device authorization grant'
+            };
+        }
+        // Validate and filter scopes
+        const scopes = this.validateScopes(requestedScopes, client.allowedScopes);
+        if (scopes.length === 0 && requestedScopes.length > 0) {
+            return {
+                success: false,
+                error: 'invalid_scope',
+                error_description: 'None of the requested scopes are allowed for this client'
+            };
+        }
+        // Generate codes
+        const deviceCode = this.generateDeviceCode();
+        const userCode = this.generateUserCode();
+        const deviceCodeHash = this.hashSecret(deviceCode);
+        // Store device code state
+        const state = {
+            deviceCodeHash,
+            userCode,
+            clientId,
+            scopes,
+            expiresAt: Date.now() + (this.config.deviceCodeTtl * 1000),
+            interval: this.config.pollingInterval,
+            status: 'pending'
+        };
+        // Store by user code for lookup during verification
+        this.deviceCodes.set(userCode, state);
+        // Build verification URIs
+        const verificationUri = `${this.config.issuer}/studio/auth/device`;
+        const verificationUriComplete = `${verificationUri}?code=${userCode}`;
+        return {
+            success: true,
+            response: {
+                device_code: deviceCode,
+                user_code: userCode,
+                verification_uri: verificationUri,
+                verification_uri_complete: verificationUriComplete,
+                expires_in: this.config.deviceCodeTtl,
+                interval: this.config.pollingInterval
+            }
+        };
+    }
+    /**
+     * Get device code state by user code (for verification page)
+     */
+    getDeviceCodeByUserCode(userCode) {
+        // Normalize user code (remove dashes, uppercase)
+        const normalizedCode = userCode.replace(/-/g, '').toUpperCase();
+        const formattedCode = `${normalizedCode.slice(0, 4)}-${normalizedCode.slice(4)}`;
+        return this.deviceCodes.get(formattedCode) ?? null;
+    }
+    /**
+     * Authorize a device code (called when user approves in Studio)
+     */
+    authorizeDeviceCode(userCode, userId) {
+        const state = this.getDeviceCodeByUserCode(userCode);
+        if (!state) {
+            return false;
+        }
+        if (state.status !== 'pending') {
+            return false;
+        }
+        if (state.expiresAt < Date.now()) {
+            state.status = 'expired';
+            return false;
+        }
+        state.status = 'authorized';
+        state.userId = userId;
+        state.decidedAt = Date.now();
+        return true;
+    }
+    /**
+     * Deny a device code (called when user denies in Studio)
+     */
+    denyDeviceCode(userCode) {
+        const state = this.getDeviceCodeByUserCode(userCode);
+        if (!state) {
+            return false;
+        }
+        if (state.status !== 'pending') {
+            return false;
+        }
+        state.status = 'denied';
+        state.decidedAt = Date.now();
+        return true;
+    }
+    /**
+     * Poll for device token (called by CLI)
+     */
+    pollDeviceToken(deviceCode, clientId, generateToken) {
+        return this.checkDeviceCodeAndGenerateToken(deviceCode, clientId, generateToken);
+    }
+    async checkDeviceCodeAndGenerateToken(deviceCode, clientId, generateToken) {
+        const deviceCodeHash = this.hashSecret(deviceCode);
+        // Find the state by iterating (in production, use proper indexing)
+        let foundState = null;
+        let foundKey = null;
+        for (const [key, state] of this.deviceCodes) {
+            if (state.deviceCodeHash === deviceCodeHash && state.clientId === clientId) {
+                foundState = state;
+                foundKey = key;
+                break;
+            }
+        }
+        if (!foundState || !foundKey) {
+            return {
+                success: false,
+                error: 'invalid_grant',
+                error_description: 'Invalid device code'
+            };
+        }
+        // Check expiration
+        if (foundState.expiresAt < Date.now()) {
+            this.deviceCodes.delete(foundKey);
+            return {
+                success: false,
+                error: 'expired_token',
+                error_description: 'Device code has expired'
+            };
+        }
+        // Check status
+        switch (foundState.status) {
+            case 'pending':
+                return {
+                    success: false,
+                    error: 'authorization_pending',
+                    error_description: 'The authorization request is still pending'
+                };
+            case 'denied':
+                this.deviceCodes.delete(foundKey);
+                return {
+                    success: false,
+                    error: 'access_denied',
+                    error_description: 'The user denied the authorization request'
+                };
+            case 'expired':
+                this.deviceCodes.delete(foundKey);
+                return {
+                    success: false,
+                    error: 'expired_token',
+                    error_description: 'Device code has expired'
+                };
+            case 'authorized':
+                if (!foundState.userId) {
+                    return {
+                        success: false,
+                        error: 'server_error',
+                        error_description: 'User ID not found for authorized request'
+                    };
+                }
+                // Generate tokens
+                const tokenResponse = await generateToken(foundState.userId, foundState.scopes, foundState.clientId);
+                // Remove used device code
+                this.deviceCodes.delete(foundKey);
+                return {
+                    success: true,
+                    response: tokenResponse
+                };
+            default:
+                return {
+                    success: false,
+                    error: 'server_error',
+                    error_description: 'Unknown device code status'
+                };
+        }
+    }
+    // ============================================
+    // Authorization Code Flow with PKCE
+    // ============================================
+    /**
+     * Validate authorization request parameters
+     */
+    validateAuthorizationRequest(params) {
+        // Validate response_type
+        if (params.response_type !== 'code') {
+            return {
+                valid: false,
+                error: 'invalid_request',
+                error_description: 'response_type must be "code"'
+            };
+        }
+        // Validate client
+        const client = this.getClient(params.client_id);
+        if (!client || !client.isActive) {
+            return {
+                valid: false,
+                error: 'invalid_client',
+                error_description: 'Unknown or inactive client'
+            };
+        }
+        // Check if client supports authorization code flow
+        if (!client.grantTypes.includes('authorization_code')) {
+            return {
+                valid: false,
+                error: 'unauthorized_client',
+                error_description: 'Client is not authorized for authorization code grant'
+            };
+        }
+        // Validate redirect URI
+        if (!client.redirectUris.includes(params.redirect_uri)) {
+            return {
+                valid: false,
+                error: 'invalid_request',
+                error_description: 'Invalid redirect_uri'
+            };
+        }
+        // Validate PKCE
+        if (params.code_challenge_method !== 'S256') {
+            return {
+                valid: false,
+                error: 'invalid_request',
+                error_description: 'code_challenge_method must be "S256"'
+            };
+        }
+        if (!params.code_challenge || params.code_challenge.length < 43) {
+            return {
+                valid: false,
+                error: 'invalid_request',
+                error_description: 'Invalid code_challenge'
+            };
+        }
+        // Validate state
+        if (!params.state || params.state.length < 8) {
+            return {
+                valid: false,
+                error: 'invalid_request',
+                error_description: 'state parameter is required and must be at least 8 characters'
+            };
+        }
+        // Validate and filter scopes
+        const requestedScopes = params.scope ? params.scope.split(' ') : [];
+        const scopes = this.validateScopes(requestedScopes, client.allowedScopes);
+        return {
+            valid: true,
+            client,
+            scopes
+        };
+    }
+    /**
+     * Generate authorization code after user approval
+     */
+    generateAuthorizationCode(clientId, redirectUri, scopes, codeChallenge, userId) {
+        const code = randomBytes(32).toString('base64url');
+        const codeHash = this.hashSecret(code);
+        const state = {
+            codeHash,
+            clientId,
+            redirectUri,
+            scopes,
+            codeChallenge,
+            userId,
+            expiresAt: Date.now() + (this.config.authCodeTtl * 1000)
+        };
+        this.authorizationCodes.set(codeHash, state);
+        return code;
+    }
+    /**
+     * Exchange authorization code for tokens
+     */
+    async exchangeAuthorizationCode(code, clientId, redirectUri, codeVerifier, generateToken) {
+        const codeHash = this.hashSecret(code);
+        const state = this.authorizationCodes.get(codeHash);
+        if (!state) {
+            return {
+                success: false,
+                error: 'invalid_grant',
+                error_description: 'Invalid authorization code'
+            };
+        }
+        // Remove code immediately (single use)
+        this.authorizationCodes.delete(codeHash);
+        // Validate expiration
+        if (state.expiresAt < Date.now()) {
+            return {
+                success: false,
+                error: 'invalid_grant',
+                error_description: 'Authorization code has expired'
+            };
+        }
+        // Validate client_id
+        if (state.clientId !== clientId) {
+            return {
+                success: false,
+                error: 'invalid_grant',
+                error_description: 'client_id does not match'
+            };
+        }
+        // Validate redirect_uri
+        if (state.redirectUri !== redirectUri) {
+            return {
+                success: false,
+                error: 'invalid_grant',
+                error_description: 'redirect_uri does not match'
+            };
+        }
+        // Verify PKCE code verifier
+        const codeChallenge = createHash('sha256')
+            .update(codeVerifier)
+            .digest('base64url');
+        if (codeChallenge !== state.codeChallenge) {
+            return {
+                success: false,
+                error: 'invalid_grant',
+                error_description: 'Invalid code_verifier'
+            };
+        }
+        // Generate tokens
+        const tokenResponse = await generateToken(state.userId, state.scopes, state.clientId);
+        return {
+            success: true,
+            response: tokenResponse
+        };
+    }
+    // ============================================
+    // Utility Methods
+    // ============================================
+    /**
+     * Validate requested scopes against allowed scopes
+     */
+    validateScopes(requested, allowed) {
+        const validScopes = [];
+        for (const scope of requested) {
+            if (allowed.includes(scope)) {
+                validScopes.push(scope);
+            }
+        }
+        // If no scopes requested, return default scopes
+        if (validScopes.length === 0 && requested.length === 0) {
+            // Default to openid and profile if allowed
+            if (allowed.includes('openid'))
+                validScopes.push('openid');
+            if (allowed.includes('profile'))
+                validScopes.push('profile');
+        }
+        return validScopes;
+    }
+    /**
+     * Convert OAuth2 scopes to Trokky permissions
+     */
+    scopesToPermissions(scopes) {
+        const permissions = new Set();
+        for (const scope of scopes) {
+            const scopePermissions = SCOPE_TO_PERMISSIONS[scope];
+            if (scopePermissions) {
+                for (const perm of scopePermissions) {
+                    permissions.add(perm);
+                }
+            }
+        }
+        return Array.from(permissions);
+    }
+    /**
+     * Get server configuration (for .well-known/oauth-authorization-server)
+     */
+    getServerMetadata() {
+        return {
+            issuer: this.config.issuer,
+            authorization_endpoint: `${this.config.issuer}/auth/authorize`,
+            token_endpoint: `${this.config.issuer}/auth/token`,
+            device_authorization_endpoint: `${this.config.issuer}/auth/device`,
+            revocation_endpoint: `${this.config.issuer}/auth/revoke`,
+            scopes_supported: [
+                'openid',
+                'profile',
+                'content:read',
+                'content:write',
+                'content:delete',
+                'media:read',
+                'media:write',
+                'offline_access'
+            ],
+            response_types_supported: ['code'],
+            grant_types_supported: [
+                'authorization_code',
+                'urn:ietf:params:oauth:grant-type:device_code',
+                'refresh_token'
+            ],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none', 'client_secret_post']
+        };
+    }
+}
+//# sourceMappingURL=authorization-server.js.map

package/dist/core/security/oauth2/authorization-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-server.js","sourceRoot":"","sources":["../../../../src/core/security/oauth2/authorization-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAYjE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,IAAI,UAAU,EAAE,MAAM,uBAAuB,CAAA;AA8C9F;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IAC5B,MAAM,CAA+C;IACrD,eAAe,CAAsB;IAE7C,8EAA8E;IACtE,WAAW,GAAiC,IAAI,GAAG,EAAE,CAAA;IACrD,kBAAkB,GAAwC,IAAI,GAAG,EAAE,CAAA;IACnE,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAA;IAEtD,mBAAmB;IACX,eAAe,GAA0B,IAAI,CAAA;IAErD,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;YAC7C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,OAAO;YAClD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,GAAG;YAC1C,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACtC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC;SAC7C,CAAA;QACD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;QAE3C,+BAA+B;QAC/B,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAE5B,wCAAwC;QACxC,IAAI,CAAC,uBAAuB,EAAE,CAAA;QAE9B,yBAAyB;QACzB,IAAI,CAAC,YAAY,EAAE,CAAA;IACrB,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE;YAC9B,GAAG,UAAU;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACK,uBAAuB;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACpC,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,MAAM,MAAM,GAAiB;gBAC3B,EAAE,EAAE,YAAY,CAAC,EAAE;gBACnB,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,QAAQ;gBACnC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,YAAY,EAAE,YAAY,CAAC,YAAY;gBACvC,aAAa,EAAE,CAAC,YAAY,CAAC,aAAa,IAAI;oBAC5C,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe;oBACpD,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB;iBAChE,CAAkB;gBACnB,UAAU,EAAE,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAsB;gBACrG,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAA;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAEtB,6BAA6B;YAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC9B,CAAC;YACH,CAAC;YAED,oCAAoC;YACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACnD,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACrC,CAAC;YACH,CAAC;QACH,CAAC,EAAE,KAAK,CAAC,CAAA,CAAC,mBAAmB;IAC/B,CAAC;IAED;;OAEG;IACI,WAAW;QAChB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,oBAAoB;IACpB,+CAA+C;IAE/C;;OAEG;IACI,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAA;IAC3C,CAAC;IAED;;OAEG;IACI,oBAAoB,CAAC,MAAoB,EAAE,MAAc;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAEnD,OAAO,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACpD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAc;QAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1D,CAAC;IAED,+CAA+C;IAC/C,uCAAuC;IACvC,+CAA+C;IAE/C;;OAEG;IACK,gBAAgB;QACtB,mFAAmF;QACnF,MAAM,KAAK,GAAG,iCAAiC,CAAA;QAC/C,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QACD,sCAAsC;QACtC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/C,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACI,wBAAwB,CAC7B,QAAgB,EAChB,eAAyB;QASzB,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,mBAAmB;aACvC,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,8CAA8C,CAAC,EAAE,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,yDAAyD;aAC7E,CAAA;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0DAA0D;aAC9E,CAAA;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAElD,0BAA0B;QAC1B,MAAM,KAAK,GAAoB;YAC7B,cAAc;YACd,QAAQ;YACR,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1D,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YACrC,MAAM,EAAE,SAAS;SAClB,CAAA;QAED,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAErC,0BAA0B;QAC1B,MAAM,eAAe,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,qBAAqB,CAAA;QAClE,MAAM,uBAAuB,GAAG,GAAG,eAAe,SAAS,QAAQ,EAAE,CAAA;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE;gBACR,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,QAAQ;gBACnB,gBAAgB,EAAE,eAAe;gBACjC,yBAAyB,EAAE,uBAAuB;gBAClD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACrC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aACtC;SACF,CAAA;IACH,CAAC;IAED;;OAEG;IACI,uBAAuB,CAAC,QAAgB;QAC7C,iDAAiD;QACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/D,MAAM,aAAa,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAEhF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAA;IACpD,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,QAAgB,EAAE,MAAc;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAA;YACxB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,YAAY,CAAA;QAC3B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;QACrB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,cAAc,CAAC,QAAgB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAA;QACvB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,UAAkB,EAClB,QAAgB,EAChB,aAAkG;QAKlG,OAAO,IAAI,CAAC,+BAA+B,CAAC,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;IAClF,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAC3C,UAAkB,EAClB,QAAgB,EAChB,aAAkG;QAKlG,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAElD,mEAAmE;QACnE,IAAI,UAAU,GAA2B,IAAI,CAAA;QAC7C,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC3E,UAAU,GAAG,KAAK,CAAA;gBAClB,QAAQ,GAAG,GAAG,CAAA;gBACd,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,qBAAqB;aACzC,CAAA;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,yBAAyB;aAC7C,CAAA;QACH,CAAC;QAED,eAAe;QACf,QAAQ,UAAU,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,SAAS;gBACZ,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB;oBAC9B,iBAAiB,EAAE,4CAA4C;iBAChE,CAAA;YAEH,KAAK,QAAQ;gBACX,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACjC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,2CAA2C;iBAC/D,CAAA;YAEH,KAAK,SAAS;gBACZ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACjC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,yBAAyB;iBAC7C,CAAA;YAEH,KAAK,YAAY;gBACf,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,cAAc;wBACrB,iBAAiB,EAAE,0CAA0C;qBAC9D,CAAA;gBACH,CAAC;gBAED,kBAAkB;gBAClB,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,QAAQ,CACpB,CAAA;gBAED,0BAA0B;gBAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAEjC,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,aAAa;iBACxB,CAAA;YAEH;gBACE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,cAAc;oBACrB,iBAAiB,EAAE,4BAA4B;iBAChD,CAAA;QACL,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,oCAAoC;IACpC,+CAA+C;IAE/C;;OAEG;IACI,4BAA4B,CAAC,MAQnC;QACC,yBAAyB;QACzB,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,8BAA8B;aAClD,CAAA;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,4BAA4B;aAChD,CAAA;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,uDAAuD;aAC3E,CAAA;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAA;QACH,CAAC;QAED,gBAAgB;QAChB,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YAC5C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,sCAAsC;aAC1D,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,wBAAwB;aAC5C,CAAA;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EAAE,+DAA+D;aACnF,CAAA;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QAEzE,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM;YACN,MAAM;SACP,CAAA;IACH,CAAC;IAED;;OAEG;IACI,yBAAyB,CAC9B,QAAgB,EAChB,WAAmB,EACnB,MAAqB,EACrB,aAAqB,EACrB,MAAc;QAEd,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAEtC,MAAM,KAAK,GAA2B;YACpC,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,MAAM;YACN,aAAa;YACb,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;SACzD,CAAA;QAED,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE5C,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAAY,EACZ,QAAgB,EAChB,WAAmB,EACnB,YAAoB,EACpB,aAAkG;QAKlG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,4BAA4B;aAChD,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAExC,sBAAsB;QACtB,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,gCAAgC;aACpD,CAAA;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0BAA0B;aAC9C,CAAA;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,6BAA6B;aACjD,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;aACvC,MAAM,CAAC,YAAY,CAAC;aACpB,MAAM,CAAC,WAAW,CAAC,CAAA;QAEtB,IAAI,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAA;QACH,CAAC;QAED,kBAAkB;QAClB,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,CACf,CAAA;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,aAAa;SACxB,CAAA;IACH,CAAC;IAED,+CAA+C;IAC/C,kBAAkB;IAClB,+CAA+C;IAE/C;;OAEG;IACK,cAAc,CAAC,SAAmB,EAAE,OAAsB;QAChE,MAAM,WAAW,GAAkB,EAAE,CAAA;QAErC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAoB,CAAC,EAAE,CAAC;gBAC3C,WAAW,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,2CAA2C;YAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,MAAqB;QAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAc,CAAA;QAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;oBACpC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAChC,CAAC;IAED;;OAEG;IACI,iBAAiB;QACtB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,sBAAsB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,iBAAiB;YAC9D,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,aAAa;YAClD,6BAA6B,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc;YAClE,mBAAmB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc;YACxD,gBAAgB,EAAE;gBAChB,QAAQ;gBACR,SAAS;gBACT,cAAc;gBACd,eAAe;gBACf,gBAAgB;gBAChB,YAAY;gBACZ,aAAa;gBACb,gBAAgB;aACjB;YACD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE;gBACrB,oBAAoB;gBACpB,8CAA8C;gBAC9C,eAAe;aAChB;YACD,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;SACtE,CAAA;IACH,CAAC;CACF"}

package/dist/core/security/oauth2/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OAuth2 Authorization Server
+ *
+ * Enables Trokky Studio to act as an OAuth2 provider for:
+ * - CLI authentication (Device Authorization Grant - RFC 8628)
+ * - External application SSO (Authorization Code Grant with PKCE)
+ */
+export { OAuth2AuthorizationServer, type OAuth2ServerConfig, type OAuth2ClientConfig } from './authorization-server.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/security/oauth2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/security/oauth2/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAA"}

package/dist/core/security/oauth2/index.js

@@ -0,0 +1,9 @@
+/**
+ * OAuth2 Authorization Server
+ *
+ * Enables Trokky Studio to act as an OAuth2 provider for:
+ * - CLI authentication (Device Authorization Grant - RFC 8628)
+ * - External application SSO (Authorization Code Grant with PKCE)
+ */
+export { OAuth2AuthorizationServer } from './authorization-server.js';
+//# sourceMappingURL=index.js.map

package/dist/core/security/oauth2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/security/oauth2/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,yBAAyB,EAG1B,MAAM,2BAA2B,CAAA"}

package/dist/core/security/rate-limiter.d.ts

@@ -0,0 +1,15 @@
+export interface RateLimitConfig {
+    windowMs: number;
+    maxRequests: number;
+    keyGenerator?: (operation: string, context?: Record<string, unknown>) => string;
+}
+export declare class RateLimiter {
+    private operationCounts;
+    private readonly defaultConfig;
+    constructor(config?: Partial<RateLimitConfig>);
+    private config;
+    checkRateLimit(operation: string, context?: Record<string, unknown>): Promise<void>;
+    cleanup(): void;
+    getRemainingRequests(operation: string): number;
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/core/security/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/core/security/rate-limiter.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAA;CAChF;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,eAAe,CAA4D;IACnF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAG7B;gBAEW,MAAM,GAAE,OAAO,CAAC,eAAe,CAAM;IAIjD,OAAO,CAAC,MAAM,CAAiB;IAElB,cAAc,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;IAuBT,OAAO,IAAI,IAAI;IAWf,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAYvD"}