@undefineds.co/xpod 0.3.57 → 0.3.61

package/dist/api/ai-gateway/connect/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/connect/index.ts"],"names":[],"mappings":";;;AAAA,6CAAsG;AACtG,gEAAuE;AACvE,kDAI+B;AAK/B,oEAA6E;AAsK7E,MAAa,gCAAgC;IAO3C,YAAmB,UAAmD,EAAE;QACtE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW;eACjC,+CAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kCAAkC,CAAC;QACzE,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAK1B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAKhC;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAI5B;QAgBC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CACtB,UAAU,EACV,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAkC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI;aACR,GAAG,CAAC,uBAAuB,CAAC;aAC5B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;aAC1D,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3C,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAC9B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,KAAK,CAAC,yBAAyB,CACpC,MAA+B,EAC/B,OAAgC;QAEhC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,GAAG,MAAM;YACT,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzF,OAAO,uBAAuB,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAO7B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,cAAc,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;aACxC,GAAG,CAAC;YACH,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;YACtD,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChD,mBAAmB,EAAE,KAAK,CAAC,eAAe,CAAC,SAAS;YACpD,UAAU,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;SACvC,CAAC;aACD,KAAK,CAAC,IAAA,mBAAG,EACR,IAAA,kBAAE,EAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EACrC,IAAA,kBAAE,EAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CACzD,CAAC;aACD,SAAS,EAAE;aACX,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,KAO/B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QAIxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AAlOD,4EAkOC;AAyCD,MAAa,2BAA2B;IAAxC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC7C,gBAAW,GAAG,KAAK,CAAC;IAsGvC,CAAC;IApGQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,GAAU;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAS;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,GAAS;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAU,EACV,KAIC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAChD,OAAO,CAAC,0BAA0B,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC9C,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAS,EAAE,QAAiB;QAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAxGD,kEAwGC;AAcD,MAAa,mCAAmC;IAW9C,YAAmB,OAAmD;QACpE,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAe,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;SACjC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAA0B;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC3C,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EACtB,aAAa,EACb,IAAI,CAAC,QAAQ,EACb,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACvE,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/F,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,QAAQ;YAClB,eAAe;YACf,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,QAAQ,CAAC,yBAAyB;SACpD,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzB,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,EAAE;SACxB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAsB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,KAAwB,EAAE,SAAe,EAAE,QAAiC,EAAE;QAC1G,MAAM,uBAAuB,GAAsC;YACjE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,aAAa;YACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS;YACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,GAAG,KAAK;SACT,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,uBAAuB,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,KAAsB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,KAAsB,EAAE,IAAiB;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,gBAAgB,CAAC,OAAuB;QAChD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAES,WAAW,CAAC,KAAwB,EAAE,IAAiB;QAC/D,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AAnLD,kFAmLC;AASD,MAAa,4BAA6B,SAAQ,mCAAmC;IAMnF,YAAmB,OAA4C;QAC7D,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,sDAAsD,CAAC;QACjI,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uCAAuC,CAAC;QACtF,kBAAkB,CAAC,IAAI,CAAC,2BAA2B,EAAE,iCAAiC,CAAC,CAAC;QACxF,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAEe,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;aAC9B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACtC,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE;YAC1F,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACxC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,0BAA0B,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACpC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,uBAAuB,EAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC;YACnE,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,aAAa,CAClB,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,EACpF,KAAK,CAAC,OAAO,CAAC,0BAA0B,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;oBACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;oBAC1B,MAAM,eAAe,GAAG,MAAM,KAAK,WAAW;wBAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;wBAC1E,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;oBACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE;wBACtD,eAAe;wBACf,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC;wBAC5D,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;oBACnE,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACnE,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAC/F,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe;SAC/E,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAmB,EACnB,OAAgC,EAChC,MAAsB;QAEtB,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,uBAAuB;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAEe,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAA2E,EAC3E,IAA6B,EAC7B,eAAwB;QAExB,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAmB;YAC7B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;YACnC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnC,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACzD,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACxF,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,eAAe;YACf,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE;gBACR,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClE;SACF,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AAvOD,oEAuOC;AAED,MAAa,sBAAsB;IAAnC;QACkB,aAAQ,GAAG,UAAU,CAAC;IAexC,CAAC;IAbQ,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,yBAAyB,EAAE,IAAI;YAC/B,OAAO,EAAE,8GAA8G;SACxH,CAAC;IACJ,CAAC;CACF;AAhBD,wDAgBC;AAyBD,MAAa,sBAAsB;IAMjC,YAAmB,OAAsC;QAFxC,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAGpE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAwB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI;gBAC7B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,yBAAyB;gBACvE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAI1B;QACC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,aAAa;gBACzD,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;oBAC9C,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC;gBACF,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;oBACrD,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC,CAAC;YACL,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,KAAK,QAAQ,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC;YACpE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBAC/B,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBACvE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,gBAAyB;oBAC3B,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,WAAoB;wBACtB,CAAC,CAAC,cAAuB;gBAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBAC1D,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAChD,OAAO,EAAE;oBACP,KAAK;oBACL,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK;oBACpD,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;iBAC3D;aACF,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,KAA0B;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,OAAO,CAAC,KAAmB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAmB,EACnB,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACtB,OAAO,CAAC,aAAa,EACrB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACjC,OAAO,CAAC,eAAe,CACxB,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC3E,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA1JD,wDA0JC;AAED,SAAS,KAAK,CAAC,WAAsC;IACnD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kCAAkC,CAAC,KAM3C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,UAAU;YACV,UAAU;SACX;KACF,CACkC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,2BAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU;QACjD,mBAAmB,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS;QACrD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;QAC9C,aAAa,EAAE,IAAI,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B;IAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WAC1D,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,OAAO;QACL,EAAE;QACF,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,KAAK;QACL,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ;QACvF,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACnE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;QAChF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAC5E,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,MAAiC;gBACnC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6C;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA6C;IAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA6C;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA6C;IAClF,MAAM,KAAK,GAAG,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAU;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,0BAA0B,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,OAA0G,EAC1G,MAAc;IAEd,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;SACF,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB;IAC3C,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAS;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAsB,EACtB,MAA4B,EAC5B,eAAwB;IAExB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,MAAM,KAAK,uBAAuB;WACnC,GAAG,CAAC,QAAQ,KAAK,QAAQ;WACzB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IACtE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAE,IAAI,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,KAAK,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, createHmac, randomBytes as nodeRandomBytes, timingSafeEqual } from 'node:crypto';\nimport { alias, and, drizzle, eq } from '@undefineds.co/drizzle-solid';\nimport {\n  aiProviderResource,\n  aiRuntimeRepository,\n  credentialResource,\n} from '@undefineds.co/models';\nimport type { EncryptedCredentialSecret } from '../credentials/KeyWrapper';\nimport type { CredentialVault, GatewayPrincipal, ProviderSecret } from '../credentials/CredentialVault';\nimport type { GatewayDeployment } from '../auth/GatewayApiKey';\nimport type { ProviderRegistry } from '../providers/ProviderRegistry';\nimport { DEFAULT_PROVIDER_DESCRIPTORS } from '../providers/ProviderRegistry';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { InternalPodAccessTokenProvider } from '../auth/PodGatewayAccessKeyRepository';\n\nexport type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';\nexport type ConnectAttemptStatus =\n  | 'pending'\n  | 'authorization_pending'\n  | 'slow_down'\n  | 'completed'\n  | 'expired'\n  | 'unsupported';\n\nexport interface ConnectBeginInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  requestedMode: ConnectMode;\n  expectedCredentialVersion?: number;\n  auth?: AuthContext;\n}\n\nexport interface ConnectBeginResult {\n  mode: ConnectMode;\n  status: ConnectAttemptStatus;\n  provider: string;\n  deployment: GatewayDeployment;\n  attemptId?: string;\n  state?: string;\n  signature?: string;\n  expiresAt?: string;\n  authorizationUrl?: string;\n  pkceChallenge?: string;\n  deviceCode?: string;\n  userCode?: string;\n  verificationUri?: string;\n  verificationUriComplete?: string;\n  intervalSeconds?: number;\n  apiKeyManagementSupported?: boolean;\n  credentialId?: string;\n  message?: string;\n}\n\nexport interface CompleteApiKeyInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  apiKey: string;\n  accountLabel?: string;\n  auth?: AuthContext;\n}\n\nexport interface PollDeviceInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  auth?: AuthContext;\n}\n\nexport interface RefreshInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface DisconnectInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface ConnectCredentialRecord {\n  id: string;\n  credentialIri: string;\n  webId: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  authMode: 'apiKey' | 'deviceCodeOAuth';\n  encryptedSecret: EncryptedCredentialSecret;\n  status: 'active' | 'revoked';\n  accountLabel?: string;\n  expiresAt?: Date;\n  scopes?: string[];\n  expectedVersion?: number;\n  version?: number;\n  reauthRequired?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface PodCredentialRepository {\n  getCredential?(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord>;\n  rewrapCredential?(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    credentialId: string;\n    expectedVersion?: number;\n    encryptedSecret: EncryptedCredentialSecret;\n    auth?: AuthContext;\n  }): Promise<boolean>;\n  markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ntype ConnectedCredentialDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  insert(resource: typeof credentialResource): {\n    values(value: unknown): { execute(): Promise<unknown[]> };\n  };\n  select(): {\n    from(resource: typeof credentialResource): {\n      where(condition: unknown): { execute(): Promise<Record<string, unknown>[]> };\n    };\n  };\n  findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;\n  update(resource: typeof credentialResource): {\n    set(patch: unknown): {\n      where(condition: unknown): {\n        returning(): { execute(): Promise<Record<string, unknown>[]> };\n      };\n    };\n  };\n};\n\nexport interface PodConnectedCredentialRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  providerIds?: string[];\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n    credential?: typeof credentialResource;\n    aiProvider?: typeof aiProviderResource;\n  }) => Promise<ConnectedCredentialDb>;\n}\n\nexport class PodConnectedCredentialRepository implements PodCredentialRepository {\n  private readonly dbFactory: NonNullable<PodConnectedCredentialRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n  private readonly providerIds: string[];\n  private readonly credentialTemplate: typeof credentialResource;\n  private readonly aiProviderTemplate: typeof aiProviderResource;\n\n  public constructor(options: PodConnectedCredentialRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.providerIds = options.providerIds\n      ?? DEFAULT_PROVIDER_DESCRIPTORS.map((provider) => provider.id);\n    this.dbFactory = options.dbFactory ?? createDefaultConnectedCredentialDb;\n    this.credentialTemplate = alias(credentialResource, 'credentialTemplate');\n    this.aiProviderTemplate = alias(aiProviderResource, 'aiProviderTemplate');\n  }\n\n  public async getCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const row = await db.findById<Record<string, unknown>>(credential, id);\n    const record = row ? recordFromCredentialRow(row) : undefined;\n    if (!record) {\n      return undefined;\n    }\n    return record;\n  }\n\n  public async getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const record = await this.getCredential(input);\n    return record?.status === 'active' && !record.reauthRequired ? record : undefined;\n  }\n\n  public async listCredentials(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<Array<{\n    id: string;\n    credentialIri: string;\n    provider: string;\n    authMode: 'apiKey' | 'deviceCodeOAuth';\n    enabled: boolean;\n    priority?: number;\n    models?: string[];\n    defaultModel?: string;\n    health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error';\n    quota?: { status: 'available' | 'unsupported' | 'exhausted' | 'error' };\n    encryptedSecret: EncryptedCredentialSecret;\n    version?: number;\n    runtimeCredential?: Record<string, unknown>;\n    metadata?: Record<string, unknown>;\n  }>> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const rows = (await Promise.all(\n      this.providerIds.map(async (provider) => {\n        try {\n          return await db.findById<Record<string, unknown>>(\n            credential,\n            aiRuntimeRepository.credentialId({ deployment: input.deployment, provider }),\n          );\n        } catch (error) {\n          if (isPodResourceNotFound(error)) {\n            return null;\n          }\n          throw error;\n        }\n      }),\n    )).filter((row): row is Record<string, unknown> => row !== null);\n    return rows\n      .map(recordFromCredentialRow)\n      .filter((record) => record.webId === input.webId)\n      .filter((record) => record.deployment === input.deployment)\n      .filter((record) => record.status === 'active')\n      .map((record) => ({\n        id: record.id,\n        credentialIri: record.credentialIri,\n        provider: record.provider,\n        authMode: record.authMode,\n        enabled: !record.reauthRequired,\n        models: modelsFromMetadata(record.metadata),\n        defaultModel: defaultModelFromMetadata(record.metadata),\n        priority: priorityFromMetadata(record.metadata),\n        health: record.reauthRequired ? 'reauthRequired' : 'healthy',\n        quota: { status: 'available' },\n        encryptedSecret: record.encryptedSecret,\n        version: record.version,\n        runtimeCredential: runtimeCredentialFromMetadata(record.metadata),\n        metadata: record.metadata,\n      }));\n  }\n\n  public async upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord> {\n    const { db, credential } = await this.dbForOwner(record.webId, context?.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, record.id);\n    const existingVersion = existing ? versionFromRow(existing) : 0;\n    if (record.expectedVersion !== undefined && record.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const nextVersion = existingVersion + 1;\n    const row = credentialRowFromRecord({\n      ...record,\n      version: nextVersion,\n    });\n    if (existing) {\n      const updated = await db.updateById<Record<string, unknown>>(credential, record.id, row);\n      return recordFromCredentialRow(updated ?? row);\n    }\n    await db.insert(credential).values(row).execute();\n    return recordFromCredentialRow(row);\n  }\n\n  public async rewrapCredential(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    credentialId: string;\n    expectedVersion?: number;\n    encryptedSecret: EncryptedCredentialSecret;\n    auth?: AuthContext;\n  }): Promise<boolean> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, input.credentialId);\n    if (!existing) {\n      return false;\n    }\n    const current = recordFromCredentialRow(existing);\n    if (current.webId !== input.webId || current.deployment !== input.deployment) {\n      return false;\n    }\n    const currentVersion = versionFromRow(existing);\n    if (input.expectedVersion === undefined || currentVersion !== input.expectedVersion) {\n      return false;\n    }\n    const updated = await db.update(credential)\n      .set({\n        encryptedSecret: JSON.stringify(input.encryptedSecret),\n        wrappedDataKey: input.encryptedSecret.wrappedDek,\n        encryptionAlgorithm: input.encryptedSecret.algorithm,\n        keyVersion: String(currentVersion + 1),\n      })\n      .where(and(\n        eq(credential.id, input.credentialId),\n        eq(credential.keyVersion, String(input.expectedVersion)),\n      ))\n      .returning()\n      .execute();\n    return updated.length === 1;\n  }\n\n  public async markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const existingVersion = versionFromRow(existing);\n    if (input.expectedVersion !== undefined && input.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      reauthRequired: true,\n      status: 'active',\n      keyVersion: String(existingVersion + 1),\n    });\n    return updated ? recordFromCredentialRow(updated) : undefined;\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      status: 'revoked',\n      keyVersion: String(versionFromRow(existing) + 1),\n    });\n    return updated ? recordFromCredentialRow(updated) : undefined;\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<{\n    db: ConnectedCredentialDb;\n    credential: typeof credentialResource;\n  }> {\n    const trustedFetch = await this.resolveTrustedFetch(owner);\n    const credential = alias(this.credentialTemplate, 'credential');\n    const aiProvider = alias(this.aiProviderTemplate, 'aiProvider');\n    const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });\n    await db.init?.(credential, aiProvider);\n    return { db, credential };\n  }\n\n  private async resolveTrustedFetch(owner: string): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport interface ProviderConnectAdapter {\n  readonly provider: string;\n  begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;\n  status?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;\n  pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  refresh?(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined>;\n  disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ninterface ConnectAttempt {\n  id: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  webId: string;\n  mode: ConnectMode;\n  state: string;\n  signature: string;\n  expiresAt: Date;\n  consumedAt?: Date;\n  expectedCredentialVersion?: number;\n  codeVerifier?: string;\n  deviceCode?: string;\n  intervalSeconds?: number;\n  currentPollIntervalSeconds?: number;\n  nextPollAt?: Date;\n  pollClaimedAt?: Date;\n  lastPollStatus?: ConnectAttemptStatus;\n}\n\ninterface PollClaimResult {\n  attempt: ConnectAttempt;\n  claimed: boolean;\n}\n\nexport class InMemoryConnectAttemptStore {\n  private readonly attempts = new Map<string, ConnectAttempt>();\n  private readonly maxAttempts = 1_000;\n\n  public async create(attempt: ConnectAttempt): Promise<ConnectAttempt> {\n    this.pruneExpired(new Date());\n    this.attempts.set(attempt.id, cloneAttempt(attempt));\n    this.pruneBounded();\n    return cloneAttempt(attempt);\n  }\n\n  public async get(id: string, now?: Date): Promise<ConnectAttempt | undefined> {\n    this.pruneExpired(now ?? new Date(), id);\n    const attempt = this.attempts.get(id);\n    if (attempt && now && attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n    }\n    return attempt ? cloneAttempt(attempt) : undefined;\n  }\n\n  public async consume(id: string, now: Date): Promise<ConnectAttempt> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    attempt.consumedAt = new Date(now);\n    return cloneAttempt(attempt);\n  }\n\n  public async claimPoll(id: string, now: Date): Promise<PollClaimResult> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.nextPollAt && attempt.nextPollAt.getTime() > now.getTime()) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    if (attempt.pollClaimedAt) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    attempt.pollClaimedAt = new Date(now);\n    return { attempt: cloneAttempt(attempt), claimed: true };\n  }\n\n  public async updatePollSchedule(\n    id: string,\n    patch: {\n      intervalSeconds: number;\n      nextPollAt: Date;\n      lastPollStatus: ConnectAttemptStatus;\n    },\n  ): Promise<ConnectAttempt | undefined> {\n    const attempt = this.attempts.get(id);\n    if (!attempt || attempt.consumedAt) {\n      return undefined;\n    }\n    attempt.intervalSeconds = patch.intervalSeconds;\n    attempt.currentPollIntervalSeconds = patch.intervalSeconds;\n    attempt.nextPollAt = new Date(patch.nextPollAt);\n    attempt.lastPollStatus = patch.lastPollStatus;\n    attempt.pollClaimedAt = undefined;\n    return cloneAttempt(attempt);\n  }\n\n  public async releasePollClaim(id: string): Promise<void> {\n    const attempt = this.attempts.get(id);\n    if (attempt) {\n      attempt.pollClaimedAt = undefined;\n    }\n  }\n\n  private pruneExpired(now: Date, exceptId?: string): void {\n    for (const [id, attempt] of this.attempts) {\n      if (id !== exceptId && attempt.expiresAt.getTime() <= now.getTime()) {\n        this.attempts.delete(id);\n      }\n    }\n  }\n\n  private pruneBounded(): void {\n    while (this.attempts.size > this.maxAttempts) {\n      const oldest = this.attempts.keys().next().value;\n      if (typeof oldest !== 'string') {\n        return;\n      }\n      this.attempts.delete(oldest);\n    }\n  }\n}\n\nexport interface BrowserAssistedApiKeyConnectAdapterOptions {\n  provider: string;\n  consoleUrl: string;\n  attempts: InMemoryConnectAttemptStore;\n  credentialRepository: PodCredentialRepository;\n  vault: CredentialVault;\n  deployment: GatewayDeployment;\n  now?: () => Date;\n  randomBytes?: (bytes: number) => Buffer;\n  signingSecret: string;\n}\n\nexport class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider: string;\n  private readonly consoleUrl: string;\n  protected readonly attempts: InMemoryConnectAttemptStore;\n  protected readonly credentialRepository: PodCredentialRepository;\n  protected readonly vault: CredentialVault;\n  protected readonly deployment: GatewayDeployment;\n  protected readonly now: () => Date;\n  protected readonly randomBytes: (bytes: number) => Buffer;\n  private readonly signingSecret: string;\n\n  public constructor(options: BrowserAssistedApiKeyConnectAdapterOptions) {\n    this.provider = normalizeProvider(options.provider);\n    this.consoleUrl = options.consoleUrl;\n    this.attempts = options.attempts;\n    this.credentialRepository = options.credentialRepository;\n    this.vault = options.vault;\n    this.deployment = options.deployment;\n    this.now = options.now ?? (() => new Date());\n    this.randomBytes = options.randomBytes ?? nodeRandomBytes;\n    this.signingSecret = options.signingSecret;\n  }\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'browserAssistedApiKey');\n    const now = this.now();\n    const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);\n    const attempt = await this.createAttempt(input, expiresAt);\n    const url = new URL(this.consoleUrl);\n    url.searchParams.set('xpod_connect_attempt', attempt.id);\n    url.searchParams.set('xpod_provider', this.provider);\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'pending',\n      provider: this.provider,\n      deployment: this.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: expiresAt.toISOString(),\n      authorizationUrl: url.toString(),\n    };\n  }\n\n  public async completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    if (!input.apiKey.trim()) {\n      throw new Error('API key is required');\n    }\n    const attempt = await this.loadConsumableAttempt(input, 'browserAssistedApiKey');\n    const consumed = await this.attempts.consume(input.attemptId, this.now());\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: this.provider,\n    });\n    const encryptedSecret = await this.vault.seal(\n      principal(input.webId),\n      credentialIri,\n      this.provider,\n      { type: 'apiKey', apiKey: input.apiKey },\n    );\n    const record = await this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),\n      credentialIri,\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      authMode: 'apiKey',\n      encryptedSecret,\n      status: 'active',\n      accountLabel: input.accountLabel,\n      expectedVersion: consumed.expectedCredentialVersion,\n    }, { auth: input.auth });\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'completed',\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      credentialId: record.id,\n    };\n  }\n\n  public async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'browserAssistedApiKey');\n    return {\n      mode: attempt.mode,\n      status: this.statusForAttempt(attempt),\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n    };\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  protected async createAttempt(input: ConnectBeginInput, expiresAt: Date, extra: Partial<ConnectAttempt> = {}): Promise<ConnectAttempt> {\n    const attemptWithoutSignature: Omit<ConnectAttempt, 'signature'> = {\n      id: token(this.randomBytes),\n      provider: this.provider,\n      deployment: input.deployment,\n      webId: input.webId,\n      mode: input.requestedMode,\n      state: token(this.randomBytes),\n      expiresAt,\n      expectedCredentialVersion: input.expectedCredentialVersion,\n      ...extra,\n    };\n    const signature = signAttempt(attemptWithoutSignature, this.signingSecret);\n    return this.attempts.create({ ...attemptWithoutSignature, signature });\n  }\n\n  protected async loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.attempts.get(input.attemptId, this.now());\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.webId !== input.webId) {\n      throw new Error('Connect attempt is bound to a different WebID');\n    }\n    if (attempt.deployment !== input.deployment) {\n      throw new Error('Connect attempt is bound to a different deployment');\n    }\n    if (attempt.provider !== normalizeProvider(input.provider)) {\n      throw new Error('Connect attempt is bound to a different provider');\n    }\n    if (attempt.mode !== mode) {\n      throw new Error('Connect attempt mode mismatch');\n    }\n    if (attempt.state !== input.state) {\n      throw new Error('Invalid Connect attempt state');\n    }\n    if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {\n      throw new Error('Invalid Connect attempt signature');\n    }\n    return attempt;\n  }\n\n  protected async loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.loadAttemptForStatus(input, mode);\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    return attempt;\n  }\n\n  protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus {\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      return 'expired';\n    }\n    return attempt.consumedAt ? 'completed' : 'pending';\n  }\n\n  protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    if (input.deployment !== this.deployment) {\n      throw new Error('Connect deployment mismatch');\n    }\n    if (input.requestedMode !== mode) {\n      throw new Error('Unsupported Connect mode');\n    }\n    if (!input.webId) {\n      throw new Error('Connect WebID is required');\n    }\n  }\n}\n\nexport interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {\n  fetch?: typeof fetch;\n  clientId: string;\n  deviceAuthorizationEndpoint?: string;\n  tokenEndpoint?: string;\n}\n\nexport class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientId: string;\n  private readonly deviceAuthorizationEndpoint: string;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: KimiDeviceCodeConnectAdapterOptions) {\n    super({\n      ...options,\n      provider: 'kimi',\n      consoleUrl: 'https://kimi.moonshot.cn/device',\n    });\n    this.fetchImpl = options.fetch ?? fetch;\n    this.clientId = options.clientId;\n    this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';\n    this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';\n    assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');\n    assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');\n  }\n\n  public override async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'deviceCodeOAuth');\n    const now = this.now();\n    const verifier = token(this.randomBytes);\n    const challenge = codeChallenge(verifier);\n    const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: this.clientId,\n        code_challenge: challenge,\n        code_challenge_method: 'S256',\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);\n    }\n    requireStringField(body, 'device_code');\n    requireStringField(body, 'user_code');\n    requireStringField(body, 'verification_uri_complete');\n    const expiresIn = numberFrom(body.expires_in, 300);\n    const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {\n      mode: 'deviceCodeOAuth',\n      codeVerifier: verifier,\n      deviceCode: stringFrom(body.device_code),\n      intervalSeconds: numberFrom(body.interval, 5),\n      currentPollIntervalSeconds: numberFrom(body.interval, 5),\n      nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),\n    });\n    return {\n      mode: 'deviceCodeOAuth',\n      status: 'pending',\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: attempt.expiresAt.toISOString(),\n      pkceChallenge: challenge,\n      deviceCode: attempt.deviceCode,\n      userCode: stringFrom(body.user_code),\n      verificationUri: stringFrom(body.verification_uri),\n      verificationUriComplete: stringFrom(body.verification_uri_complete),\n      intervalSeconds: attempt.intervalSeconds,\n    };\n  }\n\n  public async pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');\n    const now = this.nowForConsume();\n    const claim = await this.attempts.claimPoll(input.attemptId, now);\n    if (!claim.claimed) {\n      return pendingResult(\n        input,\n        claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending',\n        claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds,\n      );\n    }\n    try {\n      const response = await this.fetchImpl(this.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: attempt.deviceCode ?? '',\n          client_id: this.clientId,\n          code_verifier: attempt.codeVerifier ?? '',\n        }),\n      });\n      const body = await safeJson(response);\n      if (!response.ok) {\n        if (body.error === 'authorization_pending' || body.error === 'slow_down') {\n          const status = body.error;\n          const intervalSeconds = status === 'slow_down'\n            ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5\n            : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);\n          await this.attempts.updatePollSchedule(input.attemptId, {\n            intervalSeconds,\n            nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),\n            lastPollStatus: status,\n          });\n          return pendingResult(input, status, intervalSeconds);\n        }\n        if (body.error === 'expired_token') {\n          await this.attempts.consume(input.attemptId, this.nowForConsume());\n          return pendingResult(input, 'expired');\n        }\n        throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);\n      }\n      await this.attempts.consume(input.attemptId, this.nowForConsume());\n      requireStringField(body, 'access_token');\n      requireStringField(body, 'refresh_token');\n      const record = await this.storeOAuthCredential(input, body, attempt.expectedCredentialVersion);\n      return {\n        mode: 'deviceCodeOAuth',\n        status: 'completed',\n        provider: 'kimi',\n        deployment: input.deployment,\n        attemptId: input.attemptId,\n        credentialId: record.id,\n      };\n    } catch (error) {\n      await this.attempts.releasePollClaim(input.attemptId);\n      throw error;\n    }\n  }\n\n  public override async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');\n    return {\n      mode: 'deviceCodeOAuth',\n      status: this.statusForAttempt(attempt),\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n      deviceCode: attempt.deviceCode,\n      intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,\n    };\n  }\n\n  public async refresh(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const refreshToken = stringFrom(secret.refreshToken);\n    if (!refreshToken) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: 'missing_refresh_token',\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    const response = await this.fetchImpl(this.tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: this.clientId,\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: safeProviderError(body),\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    requireStringField(body, 'access_token');\n    requireStringField(body, 'refresh_token');\n    return this.storeOAuthCredential(input, body, current.version);\n  }\n\n  public override async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  private nowForConsume(): Date {\n    return this.now();\n  }\n\n  private async storeOAuthCredential(\n    input: { webId: string; deployment: GatewayDeployment; auth?: AuthContext },\n    body: Record<string, unknown>,\n    expectedVersion?: number,\n  ): Promise<ConnectCredentialRecord> {\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: 'kimi',\n    });\n    const expiresAt = expiresAtFrom(body.expires_in, this.now());\n    const secret: ProviderSecret = {\n      type: 'deviceCodeOAuth',\n      accessToken: stringFrom(body.access_token),\n      refreshToken: stringFrom(body.refresh_token),\n      expiresAt: expiresAt?.toISOString(),\n      scope: stringFrom(body.scope),\n      idToken: stringFrom(body.id_token),\n    };\n    const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, 'kimi', secret);\n    return this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),\n      credentialIri,\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      authMode: 'deviceCodeOAuth',\n      encryptedSecret,\n      status: 'active',\n      expiresAt,\n      expectedVersion,\n      metadata: {\n        authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),\n      },\n    }, { auth: input.auth });\n  }\n}\n\nexport class DeepSeekConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider = 'deepseek';\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    return {\n      mode: 'connectUnsupported',\n      status: 'unsupported',\n      provider: 'deepseek',\n      deployment: input.deployment,\n      apiKeyManagementSupported: true,\n      message: 'DeepSeek does not expose a supported third-party browser Connect flow; use authenticated API key management.',\n    };\n  }\n}\n\nexport interface ProviderConnectServiceOptions {\n  registry: ProviderRegistry;\n  adapters: ProviderConnectAdapter[];\n  credentialRepository?: PodCredentialRepository;\n  vault?: CredentialVault;\n}\n\nexport interface ProviderConnectionSummary {\n  provider: string;\n  status: 'connected' | 'disconnected' | 'reauthRequired';\n  authMode?: 'apiKey' | 'deviceCodeOAuth';\n  accountLabel?: string;\n  expiresAt?: string;\n  reauthRequired?: boolean;\n  credentialIri?: string;\n  version?: number;\n  connect: {\n    modes: string[];\n    configured: boolean;\n    message?: string;\n  };\n}\n\nexport class ProviderConnectService {\n  private readonly registry: ProviderRegistry;\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly vault?: CredentialVault;\n  private readonly adapters = new Map<string, ProviderConnectAdapter>();\n\n  public constructor(options: ProviderConnectServiceOptions) {\n    this.registry = options.registry;\n    this.credentialRepository = options.credentialRepository;\n    this.vault = options.vault;\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    const descriptor = this.registry.requireProvider(input.provider);\n    if (descriptor.connect?.mode !== input.requestedMode) {\n      throw new Error('Requested Connect mode does not match provider capability');\n    }\n    if (descriptor.connect?.configured === false) {\n      return Promise.resolve({\n        mode: descriptor.connect.mode,\n        status: 'unsupported',\n        provider: normalizeProvider(input.provider),\n        deployment: input.deployment,\n        apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,\n        message: descriptor.connect.notes?.join(' '),\n      });\n    }\n    return this.requireAdapter(input.provider).begin(input);\n  }\n\n  public async listProviders(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ProviderConnectionSummary[]> {\n    return Promise.all(this.registry.listProviders().map(async (descriptor) => {\n      const credential = this.credentialRepository?.getCredential\n        ? await this.credentialRepository.getCredential({\n          ...input,\n          provider: descriptor.id,\n        })\n        : await this.credentialRepository?.getActiveCredential({\n          ...input,\n          provider: descriptor.id,\n        });\n      const active = credential?.status === 'active';\n      const reauthRequired = active && credential.reauthRequired === true;\n      const modes = Array.from(new Set([\n        ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),\n        ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),\n      ]));\n      return {\n        provider: descriptor.id,\n        status: reauthRequired\n          ? 'reauthRequired' as const\n          : active\n            ? 'connected' as const\n            : 'disconnected' as const,\n        authMode: active ? credential.authMode : undefined,\n        accountLabel: active ? credential.accountLabel : undefined,\n        expiresAt: active ? credential.expiresAt?.toISOString() : undefined,\n        reauthRequired: reauthRequired || undefined,\n        credentialIri: active ? credential.credentialIri : undefined,\n        version: active ? credential.version : undefined,\n        connect: {\n          modes,\n          configured: descriptor.connect?.configured !== false,\n          message: descriptor.connect?.notes?.join(' ') || undefined,\n        },\n      };\n    }));\n  }\n\n  public completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.completeApiKey) {\n      throw new Error('Provider does not support API key Connect completion');\n    }\n    return adapter.completeApiKey(input);\n  }\n\n  public pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.pollDevice) {\n      throw new Error('Provider does not support device-code polling');\n    }\n    return adapter.pollDevice(input);\n  }\n\n  public status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.status) {\n      throw new Error('Provider does not support Connect status');\n    }\n    return adapter.status(input);\n  }\n\n  public refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.refreshWithRetry(input, 2);\n  }\n\n  private async refreshWithRetry(\n    input: RefreshInput,\n    remainingAttempts: number,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.refresh) {\n      throw new Error('Provider does not support refresh');\n    }\n    if (!this.credentialRepository || !this.vault) {\n      throw new Error('CredentialVault and PodCredentialRepository are required for provider refresh');\n    }\n    const current = await this.credentialRepository.getActiveCredential(input);\n    if (!current) {\n      throw new Error('Active provider credential not found');\n    }\n    const secret = await this.vault.open(\n      { webId: input.webId },\n      current.credentialIri,\n      normalizeProvider(input.provider),\n      current.encryptedSecret,\n    );\n    try {\n      return await adapter.refresh(input, current, secret);\n    } catch (error) {\n      if (remainingAttempts > 0 && isVersionConflict(error)) {\n        const latest = await this.credentialRepository.getActiveCredential(input);\n        if (latest && latest.version !== current.version && !latest.reauthRequired) {\n          return latest;\n        }\n        return this.refreshWithRetry(input, remainingAttempts - 1);\n      }\n      throw error;\n    }\n  }\n\n  public disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.disconnect) {\n      throw new Error('Provider does not support disconnect');\n    }\n    return adapter.disconnect(input);\n  }\n\n  private requireAdapter(provider: string): ProviderConnectAdapter {\n    const adapter = this.adapters.get(normalizeProvider(provider));\n    if (!adapter) {\n      throw new Error(`No Connect adapter registered for ${provider}`);\n    }\n    return adapter;\n  }\n}\n\nfunction token(randomBytes: (bytes: number) => Buffer): string {\n  return randomBytes(32).toString('base64url');\n}\n\nfunction createDefaultConnectedCredentialDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n  credential?: typeof credentialResource;\n  aiProvider?: typeof aiProviderResource;\n}): Promise<ConnectedCredentialDb> {\n  const credential = input.credential ?? credentialResource;\n  const aiProvider = input.aiProvider ?? aiProviderResource;\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        credential,\n        aiProvider,\n      },\n    },\n  ) as unknown as ConnectedCredentialDb);\n}\n\nfunction credentialRowFromRecord(record: ConnectCredentialRecord): Record<string, unknown> {\n  return {\n    id: record.id,\n    provider: aiProviderResource.buildId({ id: normalizeProvider(record.provider) }),\n    service: 'ai',\n    authMode: record.authMode,\n    status: record.status,\n    encryptedSecret: JSON.stringify(record.encryptedSecret),\n    wrappedDataKey: record.encryptedSecret.wrappedDek,\n    encryptionAlgorithm: record.encryptedSecret.algorithm,\n    keyVersion: String(record.version ?? 1),\n    scopes: record.scopes ?? [],\n    expiresAt: record.expiresAt,\n    accountLabel: record.accountLabel,\n    label: record.accountLabel,\n    reauthRequired: record.reauthRequired ?? false,\n    lastRefreshAt: new Date(),\n  };\n}\n\nfunction recordFromCredentialRow(row: Record<string, unknown>): ConnectCredentialRecord {\n  const encrypted = parseEncryptedSecret(row.encryptedSecret);\n  const id = stringFrom(row.id);\n  const provider = providerFromRelation(stringFrom(row.provider))\n    || providerFromCredentialId(id);\n  const deployment = deploymentFromCredentialId(id);\n  const webId = encrypted.webId;\n  return {\n    id,\n    credentialIri: encrypted.credentialIri,\n    webId,\n    provider,\n    deployment,\n    authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',\n    encryptedSecret: encrypted,\n    status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',\n    accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,\n    expiresAt: dateFrom(row.expiresAt),\n    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,\n    version: versionFromRow(row),\n    reauthRequired: row.reauthRequired === true || row.reauthRequired === 'true',\n    metadata: metadataFromRow(row),\n  };\n}\n\nfunction providerFromRelation(value: string): string | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const withoutFragment = value.split('#', 1)[0] ?? value;\n  const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;\n  const provider = fileName.replace(/\\.ttl$/u, '');\n  return provider ? normalizeProvider(provider) : undefined;\n}\n\nfunction isPodResourceNotFound(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  return /\\b404\\b|not found/i.test(error.message);\n}\n\nfunction metadataFromRow(row: Record<string, unknown>): Record<string, unknown> | undefined {\n  const value = row.metadata;\n  if (!value) {\n    return undefined;\n  }\n  if (typeof value === 'object' && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  if (typeof value === 'string') {\n    try {\n      const parsed = JSON.parse(value);\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? parsed as Record<string, unknown>\n        : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nfunction modelsFromMetadata(metadata: Record<string, unknown> | undefined): string[] | undefined {\n  const value = metadata?.models;\n  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : undefined;\n}\n\nfunction defaultModelFromMetadata(metadata: Record<string, unknown> | undefined): string | undefined {\n  const value = metadata?.defaultModel;\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction priorityFromMetadata(metadata: Record<string, unknown> | undefined): number | undefined {\n  const value = metadata?.priority;\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction runtimeCredentialFromMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> | undefined {\n  const value = metadata?.runtimeCredential;\n  return value && typeof value === 'object' && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : undefined;\n}\n\nfunction parseEncryptedSecret(value: unknown): EncryptedCredentialSecret {\n  if (typeof value !== 'string' || !value.trim()) {\n    throw new Error('Credential row is missing encrypted secret payload');\n  }\n  const parsed = JSON.parse(value);\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('Credential row encrypted secret payload is invalid');\n  }\n  return parsed as EncryptedCredentialSecret;\n}\n\nfunction versionFromRow(row: Record<string, unknown>): number {\n  const value = row.keyVersion;\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : 0;\n  }\n  return 0;\n}\n\nfunction providerFromCredentialId(id: string): string {\n  const match = /\\/([^/#]+)\\.ttl#/u.exec(id);\n  return match?.[1] ?? '';\n}\n\nfunction deploymentFromCredentialId(id: string): GatewayDeployment {\n  return id.includes('#cloud-') ? 'cloud' : 'local';\n}\n\nfunction dateFrom(value: unknown): Date | undefined {\n  if (value instanceof Date) {\n    return value;\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n  }\n  return undefined;\n}\n\nfunction signAttempt(\n  attempt: Pick<ConnectAttempt, 'id' | 'provider' | 'deployment' | 'webId' | 'mode' | 'state' | 'expiresAt'>,\n  secret: string,\n): string {\n  return createHmac('sha256', secret)\n    .update(JSON.stringify({\n      id: attempt.id,\n      provider: attempt.provider,\n      deployment: attempt.deployment,\n      webId: attempt.webId,\n      mode: attempt.mode,\n      state: attempt.state,\n      expiresAt: attempt.expiresAt.toISOString(),\n    }))\n    .digest('base64url');\n}\n\nfunction signatureMatches(actual: string, expected: string): boolean {\n  const actualBuffer = Buffer.from(actual, 'utf8');\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction codeChallenge(verifier: string): string {\n  return createHash('sha256').update(verifier).digest('base64url');\n}\n\nfunction principal(webId: string): GatewayPrincipal {\n  return { webId };\n}\n\nfunction cloneAttempt(attempt: ConnectAttempt): ConnectAttempt {\n  return {\n    ...attempt,\n    expiresAt: new Date(attempt.expiresAt),\n    consumedAt: attempt.consumedAt ? new Date(attempt.consumedAt) : undefined,\n    nextPollAt: attempt.nextPollAt ? new Date(attempt.nextPollAt) : undefined,\n    pollClaimedAt: attempt.pollClaimedAt ? new Date(attempt.pollClaimedAt) : undefined,\n  };\n}\n\nfunction normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nasync function safeJson(response: Response): Promise<Record<string, unknown>> {\n  const text = await response.text();\n  if (!text) {\n    if (response.ok) {\n      throw new Error('Provider returned an empty JSON response');\n    }\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(text);\n    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n      if (response.ok) {\n        throw new Error('Provider returned a non-object JSON response');\n      }\n      return {};\n    }\n    return parsed as Record<string, unknown>;\n  } catch {\n    if (response.ok) {\n      throw new Error('Provider returned invalid JSON');\n    }\n    return {};\n  }\n}\n\nfunction stringFrom(value: unknown): string {\n  return typeof value === 'string' ? value : '';\n}\n\nfunction numberFrom(value: unknown, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) ? value : fallback;\n}\n\nfunction expiresAtFrom(expiresIn: unknown, now: Date): Date | undefined {\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {\n    return undefined;\n  }\n  return new Date(now.getTime() + expiresIn * 1000);\n}\n\nfunction safeProviderError(body: Record<string, unknown>): string {\n  const code = stringFrom(body.error);\n  if (SAFE_PROVIDER_ERROR_CODES.has(code)) {\n    return code;\n  }\n  if (!code) {\n    return 'provider_error';\n  }\n  if (code.endsWith('_error')) {\n    return 'provider_error';\n  }\n  return 'provider_error';\n}\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  'authorization_pending',\n  'slow_down',\n  'expired_token',\n  'access_denied',\n  'invalid_grant',\n  'invalid_client',\n]);\n\nfunction pendingResult(\n  input: PollDeviceInput,\n  status: ConnectAttemptStatus,\n  intervalSeconds?: number,\n): ConnectBeginResult {\n  return {\n    mode: 'deviceCodeOAuth',\n    status,\n    provider: 'kimi',\n    deployment: input.deployment,\n    attemptId: input.attemptId,\n    intervalSeconds,\n  };\n}\n\nfunction assertKimiEndpoint(endpoint: string, pathname: string): void {\n  const url = new URL(endpoint);\n  if (\n    url.origin !== 'https://auth.kimi.com'\n    || url.pathname !== pathname\n    || url.search\n    || url.hash\n    || url.username\n    || url.password\n  ) {\n    throw new Error('Kimi Connect endpoint is not allowlisted');\n  }\n}\n\nfunction requireStringField(body: Record<string, unknown>, field: string): void {\n  if (typeof body[field] !== 'string' || !(body[field] as string).trim()) {\n    throw new Error(`Provider response missing required field: ${field}`);\n  }\n}\n\nfunction isVersionConflict(error: unknown): boolean {\n  return error instanceof Error && /version_conflict|credential_version_conflict/u.test(error.message);\n}\n\nfunction decodeJwtSubject(idToken: string): string | undefined {\n  const payload = idToken.split('.')[1];\n  if (!payload) {\n    return undefined;\n  }\n  try {\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));\n    return typeof decoded.sub === 'string' ? decoded.sub : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/api/ai-gateway/credentials/CloudKmsWrapper.d.ts

@@ -0,0 +1,40 @@
+import type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';
+export declare const CLOUD_KMS_WRAP_CONTEXT_PURPOSE = "xpod.ai-gateway.cloud-kms-dek-wrap";
+export declare const CLOUD_KMS_WRAP_CONTEXT_VERSION = "v1";
+export interface CloudKmsEncryptInput {
+    keyArn: string;
+    plaintext: Uint8Array;
+    encryptionContext: Record<string, string>;
+}
+export interface CloudKmsDecryptInput {
+    keyArn?: string;
+    ciphertext: Uint8Array;
+    encryptionContext: Record<string, string>;
+}
+export interface CloudKmsClient {
+    encrypt(input: CloudKmsEncryptInput): Promise<{
+        ciphertext: Uint8Array;
+        keyId?: string;
+        keyVersion?: string;
+    }>;
+    decrypt(input: CloudKmsDecryptInput): Promise<{
+        plaintext: Uint8Array;
+        keyId?: string;
+        keyVersion?: string;
+    }>;
+}
+export interface CloudKmsWrapperOptions {
+    kmsClient: CloudKmsClient;
+    keyArn: string;
+}
+/**
+ * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the
+ * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.
+ */
+export declare class CloudKmsWrapper implements KeyWrapper {
+    private readonly kmsClient;
+    private readonly keyArn;
+    constructor(options: CloudKmsWrapperOptions);
+    wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey>;
+    unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array>;
+}

package/dist/api/ai-gateway/credentials/CloudKmsWrapper.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudKmsWrapper = exports.CLOUD_KMS_WRAP_CONTEXT_VERSION = exports.CLOUD_KMS_WRAP_CONTEXT_PURPOSE = void 0;
+exports.CLOUD_KMS_WRAP_CONTEXT_PURPOSE = 'xpod.ai-gateway.cloud-kms-dek-wrap';
+exports.CLOUD_KMS_WRAP_CONTEXT_VERSION = 'v1';
+/**
+ * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the
+ * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.
+ */
+class CloudKmsWrapper {
+    constructor(options) {
+        this.kmsClient = options.kmsClient;
+        this.keyArn = options.keyArn;
+    }
+    async wrapDek(context, dek) {
+        const encrypted = await this.kmsClient.encrypt({
+            keyArn: this.keyArn,
+            plaintext: dek,
+            encryptionContext: kmsEncryptionContext(context),
+        });
+        return {
+            algorithm: 'cloud-kms',
+            keyId: encrypted.keyId ?? this.keyArn,
+            keyVersion: encrypted.keyVersion,
+            wrappedDek: Buffer.from(encrypted.ciphertext).toString('base64url'),
+            metadata: {
+                keyArn: this.keyArn,
+                purpose: exports.CLOUD_KMS_WRAP_CONTEXT_PURPOSE,
+                version: exports.CLOUD_KMS_WRAP_CONTEXT_VERSION,
+            },
+        };
+    }
+    async unwrapDek(context, wrapped) {
+        if (wrapped.algorithm !== 'cloud-kms') {
+            throw new Error('unsupported cloud KMS wrap algorithm');
+        }
+        if (wrapped.metadata?.purpose !== exports.CLOUD_KMS_WRAP_CONTEXT_PURPOSE
+            || wrapped.metadata?.version !== exports.CLOUD_KMS_WRAP_CONTEXT_VERSION) {
+            throw new Error('cloud KMS wrap domain mismatch');
+        }
+        const decrypted = await this.kmsClient.decrypt({
+            keyArn: wrapped.metadata?.keyArn ?? this.keyArn,
+            ciphertext: new Uint8Array(Buffer.from(wrapped.wrappedDek, 'base64url')),
+            encryptionContext: kmsEncryptionContext(context),
+        });
+        return decrypted.plaintext;
+    }
+}
+exports.CloudKmsWrapper = CloudKmsWrapper;
+function kmsEncryptionContext(context) {
+    return {
+        purpose: exports.CLOUD_KMS_WRAP_CONTEXT_PURPOSE,
+        version: exports.CLOUD_KMS_WRAP_CONTEXT_VERSION,
+        webId: context.webId,
+        credentialIri: context.credentialIri,
+        provider: context.provider,
+    };
+}
+//# sourceMappingURL=CloudKmsWrapper.js.map

package/dist/api/ai-gateway/credentials/CloudKmsWrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudKmsWrapper.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/CloudKmsWrapper.ts"],"names":[],"mappings":";;;AAEa,QAAA,8BAA8B,GAAG,oCAAoC,CAAC;AACtE,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAiCnD;;;GAGG;AACH,MAAa,eAAe;IAI1B,YAAmB,OAA+B;QAChD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,GAAe;QAC3D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,GAAG;YACd,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,CAAC;SACjD,CAAC,CAAC;QAEH,OAAO;YACL,SAAS,EAAE,WAAW;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YACrC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnE,QAAQ,EAAE;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,sCAA8B;gBACvC,OAAO,EAAE,sCAA8B;aACxC;SACF,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,OAAuB,EAAE,OAAuB;QACrE,IAAI,OAAO,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IACE,OAAO,CAAC,QAAQ,EAAE,OAAO,KAAK,sCAA8B;eACzD,OAAO,CAAC,QAAQ,EAAE,OAAO,KAAK,sCAA8B,EAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7C,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;YAC/C,UAAU,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACxE,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,SAAS,CAAC;IAC7B,CAAC;CACF;AA9CD,0CA8CC;AAED,SAAS,oBAAoB,CAAC,OAAuB;IACnD,OAAO;QACL,OAAO,EAAE,sCAA8B;QACvC,OAAO,EAAE,sCAA8B;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';\n\nexport const CLOUD_KMS_WRAP_CONTEXT_PURPOSE = 'xpod.ai-gateway.cloud-kms-dek-wrap';\nexport const CLOUD_KMS_WRAP_CONTEXT_VERSION = 'v1';\n\nexport interface CloudKmsEncryptInput {\n  keyArn: string;\n  plaintext: Uint8Array;\n  encryptionContext: Record<string, string>;\n}\n\nexport interface CloudKmsDecryptInput {\n  keyArn?: string;\n  ciphertext: Uint8Array;\n  encryptionContext: Record<string, string>;\n}\n\nexport interface CloudKmsClient {\n  encrypt(input: CloudKmsEncryptInput): Promise<{\n    ciphertext: Uint8Array;\n    keyId?: string;\n    keyVersion?: string;\n  }>;\n\n  decrypt(input: CloudKmsDecryptInput): Promise<{\n    plaintext: Uint8Array;\n    keyId?: string;\n    keyVersion?: string;\n  }>;\n}\n\nexport interface CloudKmsWrapperOptions {\n  kmsClient: CloudKmsClient;\n  keyArn: string;\n}\n\n/**\n * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the\n * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.\n */\nexport class CloudKmsWrapper implements KeyWrapper {\n  private readonly kmsClient: CloudKmsClient;\n  private readonly keyArn: string;\n\n  public constructor(options: CloudKmsWrapperOptions) {\n    this.kmsClient = options.kmsClient;\n    this.keyArn = options.keyArn;\n  }\n\n  public async wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey> {\n    const encrypted = await this.kmsClient.encrypt({\n      keyArn: this.keyArn,\n      plaintext: dek,\n      encryptionContext: kmsEncryptionContext(context),\n    });\n\n    return {\n      algorithm: 'cloud-kms',\n      keyId: encrypted.keyId ?? this.keyArn,\n      keyVersion: encrypted.keyVersion,\n      wrappedDek: Buffer.from(encrypted.ciphertext).toString('base64url'),\n      metadata: {\n        keyArn: this.keyArn,\n        purpose: CLOUD_KMS_WRAP_CONTEXT_PURPOSE,\n        version: CLOUD_KMS_WRAP_CONTEXT_VERSION,\n      },\n    };\n  }\n\n  public async unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array> {\n    if (wrapped.algorithm !== 'cloud-kms') {\n      throw new Error('unsupported cloud KMS wrap algorithm');\n    }\n    if (\n      wrapped.metadata?.purpose !== CLOUD_KMS_WRAP_CONTEXT_PURPOSE\n      || wrapped.metadata?.version !== CLOUD_KMS_WRAP_CONTEXT_VERSION\n    ) {\n      throw new Error('cloud KMS wrap domain mismatch');\n    }\n    const decrypted = await this.kmsClient.decrypt({\n      keyArn: wrapped.metadata?.keyArn ?? this.keyArn,\n      ciphertext: new Uint8Array(Buffer.from(wrapped.wrappedDek, 'base64url')),\n      encryptionContext: kmsEncryptionContext(context),\n    });\n    return decrypted.plaintext;\n  }\n}\n\nfunction kmsEncryptionContext(context: KeyWrapContext): Record<string, string> {\n  return {\n    purpose: CLOUD_KMS_WRAP_CONTEXT_PURPOSE,\n    version: CLOUD_KMS_WRAP_CONTEXT_VERSION,\n    webId: context.webId,\n    credentialIri: context.credentialIri,\n    provider: context.provider,\n  };\n}\n"]}

package/dist/api/ai-gateway/credentials/CredentialVault.d.ts

@@ -0,0 +1,14 @@
+import type { EncryptedCredentialSecret } from './KeyWrapper';
+export interface GatewayPrincipal {
+    webId: string;
+}
+export type ProviderSecret = Record<string, unknown>;
+export interface CredentialVault {
+    seal(principal: GatewayPrincipal, credentialIri: string, provider: string, secret: ProviderSecret): Promise<EncryptedCredentialSecret>;
+    open(principal: GatewayPrincipal, credentialIri: string, provider: string, encrypted: EncryptedCredentialSecret): Promise<ProviderSecret>;
+    rewrap(principal: GatewayPrincipal, encrypted: EncryptedCredentialSecret): Promise<EncryptedCredentialSecret>;
+    needsRewrap?(encrypted: EncryptedCredentialSecret): boolean;
+}
+export declare class CredentialVaultError extends Error {
+    constructor(message?: string);
+}

package/dist/api/ai-gateway/credentials/CredentialVault.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialVaultError = void 0;
+class CredentialVaultError extends Error {
+    constructor(message = 'Credential secret could not be decrypted') {
+        super(message);
+        this.name = 'CredentialVaultError';
+    }
+}
+exports.CredentialVaultError = CredentialVaultError;
+//# sourceMappingURL=CredentialVault.js.map

package/dist/api/ai-gateway/credentials/CredentialVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialVault.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/CredentialVault.ts"],"names":[],"mappings":";;;AA+BA,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAmB,OAAO,GAAG,0CAA0C;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC","sourcesContent":["import type { EncryptedCredentialSecret } from './KeyWrapper';\n\nexport interface GatewayPrincipal {\n  webId: string;\n}\n\nexport type ProviderSecret = Record<string, unknown>;\n\nexport interface CredentialVault {\n  seal(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    secret: ProviderSecret,\n  ): Promise<EncryptedCredentialSecret>;\n\n  open(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    encrypted: EncryptedCredentialSecret,\n  ): Promise<ProviderSecret>;\n\n  rewrap(\n    principal: GatewayPrincipal,\n    encrypted: EncryptedCredentialSecret,\n  ): Promise<EncryptedCredentialSecret>;\n\n  needsRewrap?(encrypted: EncryptedCredentialSecret): boolean;\n}\n\nexport class CredentialVaultError extends Error {\n  public constructor(message = 'Credential secret could not be decrypted') {\n    super(message);\n    this.name = 'CredentialVaultError';\n  }\n}\n"]}

package/dist/api/ai-gateway/credentials/KeyWrapper.d.ts

@@ -0,0 +1,27 @@
+export interface KeyWrapContext {
+    webId: string;
+    credentialIri: string;
+    provider: string;
+}
+export interface WrappedDataKey {
+    algorithm: string;
+    keyId: string;
+    keyVersion?: string;
+    wrappedDek: string;
+    metadata?: Record<string, string>;
+}
+export interface EncryptedCredentialSecret extends WrappedDataKey {
+    algorithm: 'AES-256-GCM';
+    aadPurpose: string;
+    aadVersion: string;
+    ciphertext: string;
+    nonce: string;
+    webId: string;
+    credentialIri: string;
+    provider: string;
+    dekWrapAlgorithm: string;
+}
+export interface KeyWrapper {
+    wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey>;
+    unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array>;
+}

package/dist/api/ai-gateway/credentials/KeyWrapper.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=KeyWrapper.js.map

package/dist/api/ai-gateway/credentials/KeyWrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyWrapper.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/KeyWrapper.ts"],"names":[],"mappings":"","sourcesContent":["export interface KeyWrapContext {\n  webId: string;\n  credentialIri: string;\n  provider: string;\n}\n\nexport interface WrappedDataKey {\n  algorithm: string;\n  keyId: string;\n  keyVersion?: string;\n  wrappedDek: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface EncryptedCredentialSecret extends WrappedDataKey {\n  algorithm: 'AES-256-GCM';\n  aadPurpose: string;\n  aadVersion: string;\n  ciphertext: string;\n  nonce: string;\n  webId: string;\n  credentialIri: string;\n  provider: string;\n  dekWrapAlgorithm: string;\n}\n\nexport interface KeyWrapper {\n  wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey>;\n  unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array>;\n}\n"]}

package/dist/api/ai-gateway/credentials/LocalKeychainWrapper.d.ts

@@ -0,0 +1,27 @@
+import type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';
+export declare const LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE = "xpod.ai-gateway.local-keychain-dek-wrap";
+export declare const LOCAL_KEYCHAIN_WRAP_AAD_VERSION = "v1";
+export interface LocalSecureStore {
+    getSecret(key: string): Promise<string | null>;
+    setSecret(key: string, value: string): Promise<void>;
+    getOrCreateSecret?(key: string, create: () => Promise<string>): Promise<string>;
+}
+export interface LocalKeychainWrapperOptions {
+    secureStore: LocalSecureStore;
+    keyId: string;
+    keyVersion?: string;
+}
+/**
+ * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the
+ * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.
+ */
+export declare class LocalKeychainWrapper implements KeyWrapper {
+    private readonly secureStore;
+    private readonly keyId;
+    private readonly keyVersion?;
+    constructor(options: LocalKeychainWrapperOptions);
+    wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey>;
+    unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array>;
+    private getOrCreateMasterKey;
+    private getExistingMasterKey;
+}

package/dist/api/ai-gateway/credentials/LocalKeychainWrapper.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalKeychainWrapper = exports.LOCAL_KEYCHAIN_WRAP_AAD_VERSION = exports.LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE = void 0;
+const node_crypto_1 = require("node:crypto");
+const LOCAL_MASTER_KEY_BYTES = 32;
+const LOCAL_WRAP_NONCE_BYTES = 12;
+exports.LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE = 'xpod.ai-gateway.local-keychain-dek-wrap';
+exports.LOCAL_KEYCHAIN_WRAP_AAD_VERSION = 'v1';
+/**
+ * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the
+ * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.
+ */
+class LocalKeychainWrapper {
+    constructor(options) {
+        this.secureStore = options.secureStore;
+        this.keyId = options.keyId;
+        this.keyVersion = options.keyVersion;
+    }
+    async wrapDek(context, dek) {
+        const masterKey = await this.getOrCreateMasterKey();
+        try {
+            const nonce = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(LOCAL_WRAP_NONCE_BYTES));
+            const cryptoKey = await importMasterKey(masterKey, ['encrypt']);
+            const ciphertext = new Uint8Array(await node_crypto_1.webcrypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: localWrapAad(context, this.keyId) }, cryptoKey, dek));
+            return {
+                algorithm: 'local-keychain-aes-256-gcm',
+                keyId: this.keyId,
+                keyVersion: this.keyVersion,
+                wrappedDek: encodeBase64Url(ciphertext),
+                metadata: {
+                    nonce: encodeBase64Url(nonce),
+                    purpose: exports.LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE,
+                    version: exports.LOCAL_KEYCHAIN_WRAP_AAD_VERSION,
+                },
+            };
+        }
+        finally {
+            // This wipes only the decoded master-key bytes owned by this wrapper call.
+            // The secure-store string and WebCrypto internal/native copies are outside
+            // JavaScript's reliable zeroization boundary.
+            masterKey.fill(0);
+        }
+    }
+    async unwrapDek(context, wrapped) {
+        if (wrapped.algorithm !== 'local-keychain-aes-256-gcm') {
+            throw new Error('unsupported local keychain wrap algorithm');
+        }
+        const nonce = wrapped.metadata?.nonce;
+        if (!nonce) {
+            throw new Error('missing local keychain wrap nonce');
+        }
+        if (wrapped.metadata?.purpose !== exports.LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE
+            || wrapped.metadata?.version !== exports.LOCAL_KEYCHAIN_WRAP_AAD_VERSION) {
+            throw new Error('local keychain wrap domain mismatch');
+        }
+        const masterKey = await this.getExistingMasterKey(wrapped.keyId);
+        try {
+            const cryptoKey = await importMasterKey(masterKey, ['decrypt']);
+            const dek = await node_crypto_1.webcrypto.subtle.decrypt({
+                name: 'AES-GCM',
+                iv: decodeBase64Url(nonce),
+                additionalData: localWrapAad(context, wrapped.keyId),
+            }, cryptoKey, decodeBase64Url(wrapped.wrappedDek));
+            return new Uint8Array(dek);
+        }
+        finally {
+            masterKey.fill(0);
+        }
+    }
+    async getOrCreateMasterKey() {
+        if (this.secureStore.getOrCreateSecret) {
+            return decodeBase64Url(await this.secureStore.getOrCreateSecret(this.keyId, async () => generateMasterKeySecret()));
+        }
+        return decodeBase64Url(await getOrCreateLocalSecret(this.secureStore, this.keyId));
+    }
+    async getExistingMasterKey(keyId) {
+        const existing = await this.secureStore.getSecret(keyId);
+        if (!existing) {
+            throw new Error('missing local keychain master key');
+        }
+        return decodeBase64Url(existing);
+    }
+}
+exports.LocalKeychainWrapper = LocalKeychainWrapper;
+async function importMasterKey(keyMaterial, usages) {
+    return await node_crypto_1.webcrypto.subtle.importKey('raw', toArrayBuffer(keyMaterial), { name: 'AES-GCM', length: 256 }, false, usages);
+}
+function localWrapAad(context, keyId) {
+    return new TextEncoder().encode(JSON.stringify({
+        purpose: exports.LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE,
+        version: exports.LOCAL_KEYCHAIN_WRAP_AAD_VERSION,
+        keyId,
+        webId: context.webId,
+        credentialIri: context.credentialIri,
+        provider: context.provider,
+    }));
+}
+function toArrayBuffer(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function encodeBase64Url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+function decodeBase64Url(value) {
+    return new Uint8Array(Buffer.from(value, 'base64url'));
+}
+const localMasterKeyInitializers = new Map();
+async function getOrCreateLocalSecret(secureStore, keyId) {
+    const existing = await secureStore.getSecret(keyId);
+    if (existing) {
+        return existing;
+    }
+    const running = localMasterKeyInitializers.get(keyId);
+    if (running) {
+        return await running;
+    }
+    const created = (async () => {
+        const existingInsideSingleflight = await secureStore.getSecret(keyId);
+        if (existingInsideSingleflight) {
+            return existingInsideSingleflight;
+        }
+        const secret = generateMasterKeySecret();
+        await secureStore.setSecret(keyId, secret);
+        return secret;
+    })();
+    localMasterKeyInitializers.set(keyId, created);
+    try {
+        return await created;
+    }
+    finally {
+        if (localMasterKeyInitializers.get(keyId) === created) {
+            localMasterKeyInitializers.delete(keyId);
+        }
+    }
+}
+function generateMasterKeySecret() {
+    const key = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(LOCAL_MASTER_KEY_BYTES));
+    try {
+        return encodeBase64Url(key);
+    }
+    finally {
+        key.fill(0);
+    }
+}
+//# sourceMappingURL=LocalKeychainWrapper.js.map

package/dist/api/ai-gateway/credentials/LocalKeychainWrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalKeychainWrapper.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/LocalKeychainWrapper.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAGxC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAErB,QAAA,+BAA+B,GAAG,yCAAyC,CAAC;AAC5E,QAAA,+BAA+B,GAAG,IAAI,CAAC;AAcpD;;;GAGG;AACH,MAAa,oBAAoB;IAK/B,YAAmB,OAAoC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,GAAe;QAC3D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC;YAChF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EACjF,SAAS,EACT,GAAG,CACJ,CAAC,CAAC;YAEH,OAAO;gBACL,SAAS,EAAE,4BAA4B;gBACvC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;gBACvC,QAAQ,EAAE;oBACR,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;oBAC7B,OAAO,EAAE,uCAA+B;oBACxC,OAAO,EAAE,uCAA+B;iBACzC;aACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,2EAA2E;YAC3E,2EAA2E;YAC3E,8CAA8C;YAC9C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,OAAuB,EAAE,OAAuB;QACrE,IAAI,OAAO,CAAC,SAAS,KAAK,4BAA4B,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IACE,OAAO,CAAC,QAAQ,EAAE,OAAO,KAAK,uCAA+B;eAC1D,OAAO,CAAC,QAAQ,EAAE,OAAO,KAAK,uCAA+B,EAChE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CACxC;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC1B,cAAc,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;aACrD,EACD,SAAS,EACT,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CACpC,CAAC;YACF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YACvC,OAAO,eAAe,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAC7D,IAAI,CAAC,KAAK,EACV,KAAK,IAAI,EAAE,CAAC,uBAAuB,EAAE,CACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF;AA1FD,oDA0FC;AAED,KAAK,UAAU,eAAe,CAAC,WAAuB,EAAE,MAAkB;IACxE,OAAO,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,aAAa,CAAC,WAAW,CAAC,EAC1B,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB,EAAE,KAAa;IAC1D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7C,OAAO,EAAE,uCAA+B;QACxC,OAAO,EAAE,uCAA+B;QACxC,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEtE,KAAK,UAAU,sBAAsB,CAAC,WAA6B,EAAE,KAAa;IAChF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,IAAqB,EAAE;QAC3C,MAAM,0BAA0B,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,0BAA0B,EAAE,CAAC;YAC/B,OAAO,0BAA0B,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACzC,MAAM,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,EAAE,CAAC;IACL,0BAA0B,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;YACtD,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { webcrypto } from 'node:crypto';\nimport type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';\n\nconst LOCAL_MASTER_KEY_BYTES = 32;\nconst LOCAL_WRAP_NONCE_BYTES = 12;\n\nexport const LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE = 'xpod.ai-gateway.local-keychain-dek-wrap';\nexport const LOCAL_KEYCHAIN_WRAP_AAD_VERSION = 'v1';\n\nexport interface LocalSecureStore {\n  getSecret(key: string): Promise<string | null>;\n  setSecret(key: string, value: string): Promise<void>;\n  getOrCreateSecret?(key: string, create: () => Promise<string>): Promise<string>;\n}\n\nexport interface LocalKeychainWrapperOptions {\n  secureStore: LocalSecureStore;\n  keyId: string;\n  keyVersion?: string;\n}\n\n/**\n * @deprecated Compatibility-only adapter. Production Xpod bootstrap uses the\n * generic Pod SecretCell keyring configured through XPOD_SECRET_CELL_*.\n */\nexport class LocalKeychainWrapper implements KeyWrapper {\n  private readonly secureStore: LocalSecureStore;\n  private readonly keyId: string;\n  private readonly keyVersion?: string;\n\n  public constructor(options: LocalKeychainWrapperOptions) {\n    this.secureStore = options.secureStore;\n    this.keyId = options.keyId;\n    this.keyVersion = options.keyVersion;\n  }\n\n  public async wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey> {\n    const masterKey = await this.getOrCreateMasterKey();\n    try {\n      const nonce = webcrypto.getRandomValues(new Uint8Array(LOCAL_WRAP_NONCE_BYTES));\n      const cryptoKey = await importMasterKey(masterKey, ['encrypt']);\n      const ciphertext = new Uint8Array(await webcrypto.subtle.encrypt(\n        { name: 'AES-GCM', iv: nonce, additionalData: localWrapAad(context, this.keyId) },\n        cryptoKey,\n        dek,\n      ));\n\n      return {\n        algorithm: 'local-keychain-aes-256-gcm',\n        keyId: this.keyId,\n        keyVersion: this.keyVersion,\n        wrappedDek: encodeBase64Url(ciphertext),\n        metadata: {\n          nonce: encodeBase64Url(nonce),\n          purpose: LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE,\n          version: LOCAL_KEYCHAIN_WRAP_AAD_VERSION,\n        },\n      };\n    } finally {\n      // This wipes only the decoded master-key bytes owned by this wrapper call.\n      // The secure-store string and WebCrypto internal/native copies are outside\n      // JavaScript's reliable zeroization boundary.\n      masterKey.fill(0);\n    }\n  }\n\n  public async unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array> {\n    if (wrapped.algorithm !== 'local-keychain-aes-256-gcm') {\n      throw new Error('unsupported local keychain wrap algorithm');\n    }\n    const nonce = wrapped.metadata?.nonce;\n    if (!nonce) {\n      throw new Error('missing local keychain wrap nonce');\n    }\n    if (\n      wrapped.metadata?.purpose !== LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE\n      || wrapped.metadata?.version !== LOCAL_KEYCHAIN_WRAP_AAD_VERSION\n    ) {\n      throw new Error('local keychain wrap domain mismatch');\n    }\n    const masterKey = await this.getExistingMasterKey(wrapped.keyId);\n    try {\n      const cryptoKey = await importMasterKey(masterKey, ['decrypt']);\n      const dek = await webcrypto.subtle.decrypt(\n        {\n          name: 'AES-GCM',\n          iv: decodeBase64Url(nonce),\n          additionalData: localWrapAad(context, wrapped.keyId),\n        },\n        cryptoKey,\n        decodeBase64Url(wrapped.wrappedDek),\n      );\n      return new Uint8Array(dek);\n    } finally {\n      masterKey.fill(0);\n    }\n  }\n\n  private async getOrCreateMasterKey(): Promise<Uint8Array> {\n    if (this.secureStore.getOrCreateSecret) {\n      return decodeBase64Url(await this.secureStore.getOrCreateSecret(\n        this.keyId,\n        async () => generateMasterKeySecret(),\n      ));\n    }\n    return decodeBase64Url(await getOrCreateLocalSecret(this.secureStore, this.keyId));\n  }\n\n  private async getExistingMasterKey(keyId: string): Promise<Uint8Array> {\n    const existing = await this.secureStore.getSecret(keyId);\n    if (!existing) {\n      throw new Error('missing local keychain master key');\n    }\n    return decodeBase64Url(existing);\n  }\n}\n\nasync function importMasterKey(keyMaterial: Uint8Array, usages: KeyUsage[]): Promise<CryptoKey> {\n  return await webcrypto.subtle.importKey(\n    'raw',\n    toArrayBuffer(keyMaterial),\n    { name: 'AES-GCM', length: 256 },\n    false,\n    usages,\n  );\n}\n\nfunction localWrapAad(context: KeyWrapContext, keyId: string): Uint8Array {\n  return new TextEncoder().encode(JSON.stringify({\n    purpose: LOCAL_KEYCHAIN_WRAP_AAD_PURPOSE,\n    version: LOCAL_KEYCHAIN_WRAP_AAD_VERSION,\n    keyId,\n    webId: context.webId,\n    credentialIri: context.credentialIri,\n    provider: context.provider,\n  }));\n}\n\nfunction toArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);\n}\n\nfunction encodeBase64Url(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString('base64url');\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64url'));\n}\n\nconst localMasterKeyInitializers = new Map<string, Promise<string>>();\n\nasync function getOrCreateLocalSecret(secureStore: LocalSecureStore, keyId: string): Promise<string> {\n  const existing = await secureStore.getSecret(keyId);\n  if (existing) {\n    return existing;\n  }\n\n  const running = localMasterKeyInitializers.get(keyId);\n  if (running) {\n    return await running;\n  }\n\n  const created = (async (): Promise<string> => {\n    const existingInsideSingleflight = await secureStore.getSecret(keyId);\n    if (existingInsideSingleflight) {\n      return existingInsideSingleflight;\n    }\n    const secret = generateMasterKeySecret();\n    await secureStore.setSecret(keyId, secret);\n    return secret;\n  })();\n  localMasterKeyInitializers.set(keyId, created);\n  try {\n    return await created;\n  } finally {\n    if (localMasterKeyInitializers.get(keyId) === created) {\n      localMasterKeyInitializers.delete(keyId);\n    }\n  }\n}\n\nfunction generateMasterKeySecret(): string {\n  const key = webcrypto.getRandomValues(new Uint8Array(LOCAL_MASTER_KEY_BYTES));\n  try {\n    return encodeBase64Url(key);\n  } finally {\n    key.fill(0);\n  }\n}\n"]}

package/dist/api/ai-gateway/credentials/SecretCellCredentialVault.d.ts

@@ -0,0 +1,13 @@
+import type { CredentialVault, GatewayPrincipal, ProviderSecret } from './CredentialVault';
+import type { EncryptedCredentialSecret } from './KeyWrapper';
+import { SecretCellVault } from '../../../security/secret-cell';
+export declare class SecretCellCredentialVault implements CredentialVault {
+    private readonly vault;
+    constructor(options: {
+        vault: SecretCellVault;
+    });
+    seal(principal: GatewayPrincipal, credentialIri: string, provider: string, secret: ProviderSecret): Promise<EncryptedCredentialSecret>;
+    open(principal: GatewayPrincipal, credentialIri: string, provider: string, encrypted: EncryptedCredentialSecret): Promise<ProviderSecret>;
+    rewrap(principal: GatewayPrincipal, encrypted: EncryptedCredentialSecret): Promise<EncryptedCredentialSecret>;
+    needsRewrap(encrypted: EncryptedCredentialSecret): boolean;
+}