@undefineds.co/xpod 0.3.70 → 0.3.71-rc.13

package/dist/api/ai-gateway/connect/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/connect/index.ts"],"names":[],"mappings":";;;AAAA,6CAAsG;AACtG,gEAAuE;AACvE,kDAI+B;AAK/B,oEAA6E;AAsK7E,MAAa,gCAAgC;IAO3C,YAAmB,UAAmD,EAAE;QACtE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW;eACjC,+CAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kCAAkC,CAAC;QACzE,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAK1B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAKhC;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAI5B;QAgBC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CACtB,UAAU,EACV,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAkC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI;aACR,GAAG,CAAC,uBAAuB,CAAC;aAC5B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;aAC1D,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3C,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAC9B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,KAAK,CAAC,yBAAyB,CACpC,MAA+B,EAC/B,OAAgC;QAEhC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,GAAG,MAAM;YACT,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzF,OAAO,uBAAuB,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAO7B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,cAAc,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;aACxC,GAAG,CAAC;YACH,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;YACtD,cAAc,EAAE,KAAK,CAAC,eAAe,CAAC,UAAU;YAChD,mBAAmB,EAAE,KAAK,CAAC,eAAe,CAAC,SAAS;YACpD,UAAU,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;SACvC,CAAC;aACD,KAAK,CAAC,IAAA,mBAAG,EACR,IAAA,kBAAE,EAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EACrC,IAAA,kBAAE,EAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CACzD,CAAC;aACD,SAAS,EAAE;aACX,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,KAO/B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QAIxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AAlOD,4EAkOC;AAyCD,MAAa,2BAA2B;IAAxC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC7C,gBAAW,GAAG,KAAK,CAAC;IAsGvC,CAAC;IApGQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,GAAU;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAS;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,GAAS;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAU,EACV,KAIC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAChD,OAAO,CAAC,0BAA0B,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC9C,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAS,EAAE,QAAiB;QAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAxGD,kEAwGC;AAcD,MAAa,mCAAmC;IAW9C,YAAmB,OAAmD;QACpE,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAe,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;SACjC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAA0B;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC3C,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EACtB,aAAa,EACb,IAAI,CAAC,QAAQ,EACb,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACvE,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/F,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,QAAQ;YAClB,eAAe;YACf,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,QAAQ,CAAC,yBAAyB;SACpD,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzB,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,EAAE;SACxB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAsB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,KAAwB,EAAE,SAAe,EAAE,QAAiC,EAAE;QAC1G,MAAM,uBAAuB,GAAsC;YACjE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,aAAa;YACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS;YACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,GAAG,KAAK;SACT,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,uBAAuB,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,KAAsB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,KAAsB,EAAE,IAAiB;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,gBAAgB,CAAC,OAAuB;QAChD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAES,WAAW,CAAC,KAAwB,EAAE,IAAiB;QAC/D,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AAnLD,kFAmLC;AASD,MAAa,4BAA6B,SAAQ,mCAAmC;IAMnF,YAAmB,OAA4C;QAC7D,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,sDAAsD,CAAC;QACjI,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uCAAuC,CAAC;QACtF,kBAAkB,CAAC,IAAI,CAAC,2BAA2B,EAAE,iCAAiC,CAAC,CAAC;QACxF,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAEe,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;aAC9B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACtC,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE;YAC1F,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACxC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,0BAA0B,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACpC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,uBAAuB,EAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC;YACnE,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,aAAa,CAClB,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,EACpF,KAAK,CAAC,OAAO,CAAC,0BAA0B,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;oBACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;oBAC1B,MAAM,eAAe,GAAG,MAAM,KAAK,WAAW;wBAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;wBAC1E,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;oBACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE;wBACtD,eAAe;wBACf,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC;wBAC5D,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;oBACnE,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACnE,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAC/F,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe;SAC/E,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAmB,EACnB,OAAgC,EAChC,MAAsB;QAEtB,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,uBAAuB;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAEe,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAA2E,EAC3E,IAA6B,EAC7B,eAAwB;QAExB,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAmB;YAC7B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;YACnC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnC,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACzD,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACxF,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,eAAe;YACf,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE;gBACR,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClE;SACF,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AAvOD,oEAuOC;AAED,MAAa,sBAAsB;IAAnC;QACkB,aAAQ,GAAG,UAAU,CAAC;IAexC,CAAC;IAbQ,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,yBAAyB,EAAE,IAAI;YAC/B,OAAO,EAAE,8GAA8G;SACxH,CAAC;IACJ,CAAC;CACF;AAhBD,wDAgBC;AAyBD,MAAa,sBAAsB;IAMjC,YAAmB,OAAsC;QAFxC,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAGpE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAwB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI;gBAC7B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,yBAAyB;gBACvE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAI1B;QACC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,aAAa;gBACzD,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;oBAC9C,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC;gBACF,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;oBACrD,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC,CAAC;YACL,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,KAAK,QAAQ,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC;YACpE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBAC/B,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBACvE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,gBAAyB;oBAC3B,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,WAAoB;wBACtB,CAAC,CAAC,cAAuB;gBAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBAC1D,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAChD,OAAO,EAAE;oBACP,KAAK;oBACL,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK;oBACpD,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;iBAC3D;aACF,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,KAA0B;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,OAAO,CAAC,KAAmB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAmB,EACnB,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACtB,OAAO,CAAC,aAAa,EACrB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACjC,OAAO,CAAC,eAAe,CACxB,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC3E,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA1JD,wDA0JC;AAED,SAAS,KAAK,CAAC,WAAsC;IACnD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kCAAkC,CAAC,KAM3C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,UAAU;YACV,UAAU;SACX;KACF,CACkC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,2BAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU;QACjD,mBAAmB,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS;QACrD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;QAC9C,aAAa,EAAE,IAAI,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B;IAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WAC1D,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,OAAO;QACL,EAAE;QACF,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,KAAK;QACL,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ;QACvF,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACnE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;QAChF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAC5E,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,MAAiC;gBACnC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6C;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA6C;IAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA6C;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA6C;IAClF,MAAM,KAAK,GAAG,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAU;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,0BAA0B,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,OAA0G,EAC1G,MAAc;IAEd,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;SACF,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB;IAC3C,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAS;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAsB,EACtB,MAA4B,EAC5B,eAAwB;IAExB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,MAAM,KAAK,uBAAuB;WACnC,GAAG,CAAC,QAAQ,KAAK,QAAQ;WACzB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IACtE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAE,IAAI,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,KAAK,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, createHmac, randomBytes as nodeRandomBytes, timingSafeEqual } from 'node:crypto';\nimport { alias, and, drizzle, eq } from '@undefineds.co/drizzle-solid';\nimport {\n  aiProviderResource,\n  aiRuntimeRepository,\n  credentialResource,\n} from '@undefineds.co/models';\nimport type { EncryptedCredentialSecret } from '../credentials/KeyWrapper';\nimport type { CredentialVault, GatewayPrincipal, ProviderSecret } from '../credentials/CredentialVault';\nimport type { GatewayDeployment } from '../auth/GatewayApiKey';\nimport type { ProviderRegistry } from '../providers/ProviderRegistry';\nimport { DEFAULT_PROVIDER_DESCRIPTORS } from '../providers/ProviderRegistry';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { InternalPodAccessTokenProvider } from '../auth/PodGatewayAccessKeyRepository';\n\nexport type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';\nexport type ConnectAttemptStatus =\n  | 'pending'\n  | 'authorization_pending'\n  | 'slow_down'\n  | 'completed'\n  | 'expired'\n  | 'unsupported';\n\nexport interface ConnectBeginInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  requestedMode: ConnectMode;\n  expectedCredentialVersion?: number;\n  auth?: AuthContext;\n}\n\nexport interface ConnectBeginResult {\n  mode: ConnectMode;\n  status: ConnectAttemptStatus;\n  provider: string;\n  deployment: GatewayDeployment;\n  attemptId?: string;\n  state?: string;\n  signature?: string;\n  expiresAt?: string;\n  authorizationUrl?: string;\n  pkceChallenge?: string;\n  deviceCode?: string;\n  userCode?: string;\n  verificationUri?: string;\n  verificationUriComplete?: string;\n  intervalSeconds?: number;\n  apiKeyManagementSupported?: boolean;\n  credentialId?: string;\n  message?: string;\n}\n\nexport interface CompleteApiKeyInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  apiKey: string;\n  accountLabel?: string;\n  auth?: AuthContext;\n}\n\nexport interface PollDeviceInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  auth?: AuthContext;\n}\n\nexport interface RefreshInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface DisconnectInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface ConnectCredentialRecord {\n  id: string;\n  credentialIri: string;\n  webId: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  authMode: 'apiKey' | 'deviceCodeOAuth';\n  encryptedSecret: EncryptedCredentialSecret;\n  status: 'active' | 'revoked';\n  accountLabel?: string;\n  expiresAt?: Date;\n  scopes?: string[];\n  expectedVersion?: number;\n  version?: number;\n  reauthRequired?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface PodCredentialRepository {\n  getCredential?(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord>;\n  rewrapCredential?(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    credentialId: string;\n    expectedVersion?: number;\n    encryptedSecret: EncryptedCredentialSecret;\n    auth?: AuthContext;\n  }): Promise<boolean>;\n  markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ntype ConnectedCredentialDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  insert(resource: typeof credentialResource): {\n    values(value: unknown): { execute(): Promise<unknown[]> };\n  };\n  select(): {\n    from(resource: typeof credentialResource): {\n      where(condition: unknown): { execute(): Promise<Record<string, unknown>[]> };\n    };\n  };\n  findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;\n  update(resource: typeof credentialResource): {\n    set(patch: unknown): {\n      where(condition: unknown): {\n        returning(): { execute(): Promise<Record<string, unknown>[]> };\n      };\n    };\n  };\n};\n\nexport interface PodConnectedCredentialRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  providerIds?: string[];\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n    credential?: typeof credentialResource;\n    aiProvider?: typeof aiProviderResource;\n  }) => Promise<ConnectedCredentialDb>;\n}\n\nexport class PodConnectedCredentialRepository implements PodCredentialRepository {\n  private readonly dbFactory: NonNullable<PodConnectedCredentialRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n  private readonly providerIds: string[];\n  private readonly credentialTemplate: typeof credentialResource;\n  private readonly aiProviderTemplate: typeof aiProviderResource;\n\n  public constructor(options: PodConnectedCredentialRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.providerIds = options.providerIds\n      ?? DEFAULT_PROVIDER_DESCRIPTORS.map((provider) => provider.id);\n    this.dbFactory = options.dbFactory ?? createDefaultConnectedCredentialDb;\n    this.credentialTemplate = alias(credentialResource, 'credentialTemplate');\n    this.aiProviderTemplate = alias(aiProviderResource, 'aiProviderTemplate');\n  }\n\n  public async getCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const row = await db.findById<Record<string, unknown>>(credential, id);\n    const record = row ? recordFromCredentialRow(row) : undefined;\n    if (!record) {\n      return undefined;\n    }\n    return record;\n  }\n\n  public async getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const record = await this.getCredential(input);\n    return record?.status === 'active' && !record.reauthRequired ? record : undefined;\n  }\n\n  public async listCredentials(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<Array<{\n    id: string;\n    credentialIri: string;\n    provider: string;\n    authMode: 'apiKey' | 'deviceCodeOAuth';\n    enabled: boolean;\n    priority?: number;\n    models?: string[];\n    defaultModel?: string;\n    health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error';\n    quota?: { status: 'available' | 'unsupported' | 'exhausted' | 'error' };\n    encryptedSecret: EncryptedCredentialSecret;\n    version?: number;\n    runtimeCredential?: Record<string, unknown>;\n    metadata?: Record<string, unknown>;\n  }>> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const rows = (await Promise.all(\n      this.providerIds.map(async (provider) => {\n        try {\n          return await db.findById<Record<string, unknown>>(\n            credential,\n            aiRuntimeRepository.credentialId({ deployment: input.deployment, provider }),\n          );\n        } catch (error) {\n          if (isPodResourceNotFound(error)) {\n            return null;\n          }\n          throw error;\n        }\n      }),\n    )).filter((row): row is Record<string, unknown> => row !== null);\n    return rows\n      .map(recordFromCredentialRow)\n      .filter((record) => record.webId === input.webId)\n      .filter((record) => record.deployment === input.deployment)\n      .filter((record) => record.status === 'active')\n      .map((record) => ({\n        id: record.id,\n        credentialIri: record.credentialIri,\n        provider: record.provider,\n        authMode: record.authMode,\n        enabled: !record.reauthRequired,\n        models: modelsFromMetadata(record.metadata),\n        defaultModel: defaultModelFromMetadata(record.metadata),\n        priority: priorityFromMetadata(record.metadata),\n        health: record.reauthRequired ? 'reauthRequired' : 'healthy',\n        quota: { status: 'available' },\n        encryptedSecret: record.encryptedSecret,\n        version: record.version,\n        runtimeCredential: runtimeCredentialFromMetadata(record.metadata),\n        metadata: record.metadata,\n      }));\n  }\n\n  public async upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord> {\n    const { db, credential } = await this.dbForOwner(record.webId, context?.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, record.id);\n    const existingVersion = existing ? versionFromRow(existing) : 0;\n    if (record.expectedVersion !== undefined && record.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const nextVersion = existingVersion + 1;\n    const row = credentialRowFromRecord({\n      ...record,\n      version: nextVersion,\n    });\n    if (existing) {\n      const updated = await db.updateById<Record<string, unknown>>(credential, record.id, row);\n      return recordFromCredentialRow(updated ?? row);\n    }\n    await db.insert(credential).values(row).execute();\n    return recordFromCredentialRow(row);\n  }\n\n  public async rewrapCredential(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    credentialId: string;\n    expectedVersion?: number;\n    encryptedSecret: EncryptedCredentialSecret;\n    auth?: AuthContext;\n  }): Promise<boolean> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, input.credentialId);\n    if (!existing) {\n      return false;\n    }\n    const current = recordFromCredentialRow(existing);\n    if (current.webId !== input.webId || current.deployment !== input.deployment) {\n      return false;\n    }\n    const currentVersion = versionFromRow(existing);\n    if (input.expectedVersion === undefined || currentVersion !== input.expectedVersion) {\n      return false;\n    }\n    const updated = await db.update(credential)\n      .set({\n        encryptedSecret: JSON.stringify(input.encryptedSecret),\n        wrappedDataKey: input.encryptedSecret.wrappedDek,\n        encryptionAlgorithm: input.encryptedSecret.algorithm,\n        keyVersion: String(currentVersion + 1),\n      })\n      .where(and(\n        eq(credential.id, input.credentialId),\n        eq(credential.keyVersion, String(input.expectedVersion)),\n      ))\n      .returning()\n      .execute();\n    return updated.length === 1;\n  }\n\n  public async markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const existingVersion = versionFromRow(existing);\n    if (input.expectedVersion !== undefined && input.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      reauthRequired: true,\n      status: 'active',\n      keyVersion: String(existingVersion + 1),\n    });\n    return updated ? recordFromCredentialRow(updated) : undefined;\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      status: 'revoked',\n      keyVersion: String(versionFromRow(existing) + 1),\n    });\n    return updated ? recordFromCredentialRow(updated) : undefined;\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<{\n    db: ConnectedCredentialDb;\n    credential: typeof credentialResource;\n  }> {\n    const trustedFetch = await this.resolveTrustedFetch(owner);\n    const credential = alias(this.credentialTemplate, 'credential');\n    const aiProvider = alias(this.aiProviderTemplate, 'aiProvider');\n    const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });\n    await db.init?.(credential, aiProvider);\n    return { db, credential };\n  }\n\n  private async resolveTrustedFetch(owner: string): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport interface ProviderConnectAdapter {\n  readonly provider: string;\n  begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;\n  status?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;\n  pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  refresh?(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined>;\n  disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ninterface ConnectAttempt {\n  id: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  webId: string;\n  mode: ConnectMode;\n  state: string;\n  signature: string;\n  expiresAt: Date;\n  consumedAt?: Date;\n  expectedCredentialVersion?: number;\n  codeVerifier?: string;\n  deviceCode?: string;\n  intervalSeconds?: number;\n  currentPollIntervalSeconds?: number;\n  nextPollAt?: Date;\n  pollClaimedAt?: Date;\n  lastPollStatus?: ConnectAttemptStatus;\n}\n\ninterface PollClaimResult {\n  attempt: ConnectAttempt;\n  claimed: boolean;\n}\n\nexport class InMemoryConnectAttemptStore {\n  private readonly attempts = new Map<string, ConnectAttempt>();\n  private readonly maxAttempts = 1_000;\n\n  public async create(attempt: ConnectAttempt): Promise<ConnectAttempt> {\n    this.pruneExpired(new Date());\n    this.attempts.set(attempt.id, cloneAttempt(attempt));\n    this.pruneBounded();\n    return cloneAttempt(attempt);\n  }\n\n  public async get(id: string, now?: Date): Promise<ConnectAttempt | undefined> {\n    this.pruneExpired(now ?? new Date(), id);\n    const attempt = this.attempts.get(id);\n    if (attempt && now && attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n    }\n    return attempt ? cloneAttempt(attempt) : undefined;\n  }\n\n  public async consume(id: string, now: Date): Promise<ConnectAttempt> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    attempt.consumedAt = new Date(now);\n    return cloneAttempt(attempt);\n  }\n\n  public async claimPoll(id: string, now: Date): Promise<PollClaimResult> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.nextPollAt && attempt.nextPollAt.getTime() > now.getTime()) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    if (attempt.pollClaimedAt) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    attempt.pollClaimedAt = new Date(now);\n    return { attempt: cloneAttempt(attempt), claimed: true };\n  }\n\n  public async updatePollSchedule(\n    id: string,\n    patch: {\n      intervalSeconds: number;\n      nextPollAt: Date;\n      lastPollStatus: ConnectAttemptStatus;\n    },\n  ): Promise<ConnectAttempt | undefined> {\n    const attempt = this.attempts.get(id);\n    if (!attempt || attempt.consumedAt) {\n      return undefined;\n    }\n    attempt.intervalSeconds = patch.intervalSeconds;\n    attempt.currentPollIntervalSeconds = patch.intervalSeconds;\n    attempt.nextPollAt = new Date(patch.nextPollAt);\n    attempt.lastPollStatus = patch.lastPollStatus;\n    attempt.pollClaimedAt = undefined;\n    return cloneAttempt(attempt);\n  }\n\n  public async releasePollClaim(id: string): Promise<void> {\n    const attempt = this.attempts.get(id);\n    if (attempt) {\n      attempt.pollClaimedAt = undefined;\n    }\n  }\n\n  private pruneExpired(now: Date, exceptId?: string): void {\n    for (const [id, attempt] of this.attempts) {\n      if (id !== exceptId && attempt.expiresAt.getTime() <= now.getTime()) {\n        this.attempts.delete(id);\n      }\n    }\n  }\n\n  private pruneBounded(): void {\n    while (this.attempts.size > this.maxAttempts) {\n      const oldest = this.attempts.keys().next().value;\n      if (typeof oldest !== 'string') {\n        return;\n      }\n      this.attempts.delete(oldest);\n    }\n  }\n}\n\nexport interface BrowserAssistedApiKeyConnectAdapterOptions {\n  provider: string;\n  consoleUrl: string;\n  attempts: InMemoryConnectAttemptStore;\n  credentialRepository: PodCredentialRepository;\n  vault: CredentialVault;\n  deployment: GatewayDeployment;\n  now?: () => Date;\n  randomBytes?: (bytes: number) => Buffer;\n  signingSecret: string;\n}\n\nexport class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider: string;\n  private readonly consoleUrl: string;\n  protected readonly attempts: InMemoryConnectAttemptStore;\n  protected readonly credentialRepository: PodCredentialRepository;\n  protected readonly vault: CredentialVault;\n  protected readonly deployment: GatewayDeployment;\n  protected readonly now: () => Date;\n  protected readonly randomBytes: (bytes: number) => Buffer;\n  private readonly signingSecret: string;\n\n  public constructor(options: BrowserAssistedApiKeyConnectAdapterOptions) {\n    this.provider = normalizeProvider(options.provider);\n    this.consoleUrl = options.consoleUrl;\n    this.attempts = options.attempts;\n    this.credentialRepository = options.credentialRepository;\n    this.vault = options.vault;\n    this.deployment = options.deployment;\n    this.now = options.now ?? (() => new Date());\n    this.randomBytes = options.randomBytes ?? nodeRandomBytes;\n    this.signingSecret = options.signingSecret;\n  }\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'browserAssistedApiKey');\n    const now = this.now();\n    const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);\n    const attempt = await this.createAttempt(input, expiresAt);\n    const url = new URL(this.consoleUrl);\n    url.searchParams.set('xpod_connect_attempt', attempt.id);\n    url.searchParams.set('xpod_provider', this.provider);\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'pending',\n      provider: this.provider,\n      deployment: this.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: expiresAt.toISOString(),\n      authorizationUrl: url.toString(),\n    };\n  }\n\n  public async completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    if (!input.apiKey.trim()) {\n      throw new Error('API key is required');\n    }\n    const attempt = await this.loadConsumableAttempt(input, 'browserAssistedApiKey');\n    const consumed = await this.attempts.consume(input.attemptId, this.now());\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: this.provider,\n    });\n    const encryptedSecret = await this.vault.seal(\n      principal(input.webId),\n      credentialIri,\n      this.provider,\n      { type: 'apiKey', apiKey: input.apiKey },\n    );\n    const record = await this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),\n      credentialIri,\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      authMode: 'apiKey',\n      encryptedSecret,\n      status: 'active',\n      accountLabel: input.accountLabel,\n      expectedVersion: consumed.expectedCredentialVersion,\n    }, { auth: input.auth });\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'completed',\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      credentialId: record.id,\n    };\n  }\n\n  public async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'browserAssistedApiKey');\n    return {\n      mode: attempt.mode,\n      status: this.statusForAttempt(attempt),\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n    };\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  protected async createAttempt(input: ConnectBeginInput, expiresAt: Date, extra: Partial<ConnectAttempt> = {}): Promise<ConnectAttempt> {\n    const attemptWithoutSignature: Omit<ConnectAttempt, 'signature'> = {\n      id: token(this.randomBytes),\n      provider: this.provider,\n      deployment: input.deployment,\n      webId: input.webId,\n      mode: input.requestedMode,\n      state: token(this.randomBytes),\n      expiresAt,\n      expectedCredentialVersion: input.expectedCredentialVersion,\n      ...extra,\n    };\n    const signature = signAttempt(attemptWithoutSignature, this.signingSecret);\n    return this.attempts.create({ ...attemptWithoutSignature, signature });\n  }\n\n  protected async loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.attempts.get(input.attemptId, this.now());\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.webId !== input.webId) {\n      throw new Error('Connect attempt is bound to a different WebID');\n    }\n    if (attempt.deployment !== input.deployment) {\n      throw new Error('Connect attempt is bound to a different deployment');\n    }\n    if (attempt.provider !== normalizeProvider(input.provider)) {\n      throw new Error('Connect attempt is bound to a different provider');\n    }\n    if (attempt.mode !== mode) {\n      throw new Error('Connect attempt mode mismatch');\n    }\n    if (attempt.state !== input.state) {\n      throw new Error('Invalid Connect attempt state');\n    }\n    if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {\n      throw new Error('Invalid Connect attempt signature');\n    }\n    return attempt;\n  }\n\n  protected async loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.loadAttemptForStatus(input, mode);\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    return attempt;\n  }\n\n  protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus {\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      return 'expired';\n    }\n    return attempt.consumedAt ? 'completed' : 'pending';\n  }\n\n  protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    if (input.deployment !== this.deployment) {\n      throw new Error('Connect deployment mismatch');\n    }\n    if (input.requestedMode !== mode) {\n      throw new Error('Unsupported Connect mode');\n    }\n    if (!input.webId) {\n      throw new Error('Connect WebID is required');\n    }\n  }\n}\n\nexport interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {\n  fetch?: typeof fetch;\n  clientId: string;\n  deviceAuthorizationEndpoint?: string;\n  tokenEndpoint?: string;\n}\n\nexport class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientId: string;\n  private readonly deviceAuthorizationEndpoint: string;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: KimiDeviceCodeConnectAdapterOptions) {\n    super({\n      ...options,\n      provider: 'kimi',\n      consoleUrl: 'https://kimi.moonshot.cn/device',\n    });\n    this.fetchImpl = options.fetch ?? fetch;\n    this.clientId = options.clientId;\n    this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';\n    this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';\n    assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');\n    assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');\n  }\n\n  public override async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'deviceCodeOAuth');\n    const now = this.now();\n    const verifier = token(this.randomBytes);\n    const challenge = codeChallenge(verifier);\n    const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: this.clientId,\n        code_challenge: challenge,\n        code_challenge_method: 'S256',\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);\n    }\n    requireStringField(body, 'device_code');\n    requireStringField(body, 'user_code');\n    requireStringField(body, 'verification_uri_complete');\n    const expiresIn = numberFrom(body.expires_in, 300);\n    const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {\n      mode: 'deviceCodeOAuth',\n      codeVerifier: verifier,\n      deviceCode: stringFrom(body.device_code),\n      intervalSeconds: numberFrom(body.interval, 5),\n      currentPollIntervalSeconds: numberFrom(body.interval, 5),\n      nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),\n    });\n    return {\n      mode: 'deviceCodeOAuth',\n      status: 'pending',\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: attempt.expiresAt.toISOString(),\n      pkceChallenge: challenge,\n      deviceCode: attempt.deviceCode,\n      userCode: stringFrom(body.user_code),\n      verificationUri: stringFrom(body.verification_uri),\n      verificationUriComplete: stringFrom(body.verification_uri_complete),\n      intervalSeconds: attempt.intervalSeconds,\n    };\n  }\n\n  public async pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');\n    const now = this.nowForConsume();\n    const claim = await this.attempts.claimPoll(input.attemptId, now);\n    if (!claim.claimed) {\n      return pendingResult(\n        input,\n        claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending',\n        claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds,\n      );\n    }\n    try {\n      const response = await this.fetchImpl(this.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: attempt.deviceCode ?? '',\n          client_id: this.clientId,\n          code_verifier: attempt.codeVerifier ?? '',\n        }),\n      });\n      const body = await safeJson(response);\n      if (!response.ok) {\n        if (body.error === 'authorization_pending' || body.error === 'slow_down') {\n          const status = body.error;\n          const intervalSeconds = status === 'slow_down'\n            ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5\n            : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);\n          await this.attempts.updatePollSchedule(input.attemptId, {\n            intervalSeconds,\n            nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),\n            lastPollStatus: status,\n          });\n          return pendingResult(input, status, intervalSeconds);\n        }\n        if (body.error === 'expired_token') {\n          await this.attempts.consume(input.attemptId, this.nowForConsume());\n          return pendingResult(input, 'expired');\n        }\n        throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);\n      }\n      await this.attempts.consume(input.attemptId, this.nowForConsume());\n      requireStringField(body, 'access_token');\n      requireStringField(body, 'refresh_token');\n      const record = await this.storeOAuthCredential(input, body, attempt.expectedCredentialVersion);\n      return {\n        mode: 'deviceCodeOAuth',\n        status: 'completed',\n        provider: 'kimi',\n        deployment: input.deployment,\n        attemptId: input.attemptId,\n        credentialId: record.id,\n      };\n    } catch (error) {\n      await this.attempts.releasePollClaim(input.attemptId);\n      throw error;\n    }\n  }\n\n  public override async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');\n    return {\n      mode: 'deviceCodeOAuth',\n      status: this.statusForAttempt(attempt),\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n      deviceCode: attempt.deviceCode,\n      intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,\n    };\n  }\n\n  public async refresh(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const refreshToken = stringFrom(secret.refreshToken);\n    if (!refreshToken) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: 'missing_refresh_token',\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    const response = await this.fetchImpl(this.tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: this.clientId,\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: safeProviderError(body),\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    requireStringField(body, 'access_token');\n    requireStringField(body, 'refresh_token');\n    return this.storeOAuthCredential(input, body, current.version);\n  }\n\n  public override async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  private nowForConsume(): Date {\n    return this.now();\n  }\n\n  private async storeOAuthCredential(\n    input: { webId: string; deployment: GatewayDeployment; auth?: AuthContext },\n    body: Record<string, unknown>,\n    expectedVersion?: number,\n  ): Promise<ConnectCredentialRecord> {\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: 'kimi',\n    });\n    const expiresAt = expiresAtFrom(body.expires_in, this.now());\n    const secret: ProviderSecret = {\n      type: 'deviceCodeOAuth',\n      accessToken: stringFrom(body.access_token),\n      refreshToken: stringFrom(body.refresh_token),\n      expiresAt: expiresAt?.toISOString(),\n      scope: stringFrom(body.scope),\n      idToken: stringFrom(body.id_token),\n    };\n    const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, 'kimi', secret);\n    return this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),\n      credentialIri,\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      authMode: 'deviceCodeOAuth',\n      encryptedSecret,\n      status: 'active',\n      expiresAt,\n      expectedVersion,\n      metadata: {\n        authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),\n      },\n    }, { auth: input.auth });\n  }\n}\n\nexport class DeepSeekConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider = 'deepseek';\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    return {\n      mode: 'connectUnsupported',\n      status: 'unsupported',\n      provider: 'deepseek',\n      deployment: input.deployment,\n      apiKeyManagementSupported: true,\n      message: 'DeepSeek does not expose a supported third-party browser Connect flow; use authenticated API key management.',\n    };\n  }\n}\n\nexport interface ProviderConnectServiceOptions {\n  registry: ProviderRegistry;\n  adapters: ProviderConnectAdapter[];\n  credentialRepository?: PodCredentialRepository;\n  vault?: CredentialVault;\n}\n\nexport interface ProviderConnectionSummary {\n  provider: string;\n  status: 'connected' | 'disconnected' | 'reauthRequired';\n  authMode?: 'apiKey' | 'deviceCodeOAuth';\n  accountLabel?: string;\n  expiresAt?: string;\n  reauthRequired?: boolean;\n  credentialIri?: string;\n  version?: number;\n  connect: {\n    modes: string[];\n    configured: boolean;\n    message?: string;\n  };\n}\n\nexport class ProviderConnectService {\n  private readonly registry: ProviderRegistry;\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly vault?: CredentialVault;\n  private readonly adapters = new Map<string, ProviderConnectAdapter>();\n\n  public constructor(options: ProviderConnectServiceOptions) {\n    this.registry = options.registry;\n    this.credentialRepository = options.credentialRepository;\n    this.vault = options.vault;\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    const descriptor = this.registry.requireProvider(input.provider);\n    if (descriptor.connect?.mode !== input.requestedMode) {\n      throw new Error('Requested Connect mode does not match provider capability');\n    }\n    if (descriptor.connect?.configured === false) {\n      return Promise.resolve({\n        mode: descriptor.connect.mode,\n        status: 'unsupported',\n        provider: normalizeProvider(input.provider),\n        deployment: input.deployment,\n        apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,\n        message: descriptor.connect.notes?.join(' '),\n      });\n    }\n    return this.requireAdapter(input.provider).begin(input);\n  }\n\n  public async listProviders(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ProviderConnectionSummary[]> {\n    return Promise.all(this.registry.listProviders().map(async (descriptor) => {\n      const credential = this.credentialRepository?.getCredential\n        ? await this.credentialRepository.getCredential({\n          ...input,\n          provider: descriptor.id,\n        })\n        : await this.credentialRepository?.getActiveCredential({\n          ...input,\n          provider: descriptor.id,\n        });\n      const active = credential?.status === 'active';\n      const reauthRequired = active && credential.reauthRequired === true;\n      const modes = Array.from(new Set([\n        ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),\n        ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),\n      ]));\n      return {\n        provider: descriptor.id,\n        status: reauthRequired\n          ? 'reauthRequired' as const\n          : active\n            ? 'connected' as const\n            : 'disconnected' as const,\n        authMode: active ? credential.authMode : undefined,\n        accountLabel: active ? credential.accountLabel : undefined,\n        expiresAt: active ? credential.expiresAt?.toISOString() : undefined,\n        reauthRequired: reauthRequired || undefined,\n        credentialIri: active ? credential.credentialIri : undefined,\n        version: active ? credential.version : undefined,\n        connect: {\n          modes,\n          configured: descriptor.connect?.configured !== false,\n          message: descriptor.connect?.notes?.join(' ') || undefined,\n        },\n      };\n    }));\n  }\n\n  public completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.completeApiKey) {\n      throw new Error('Provider does not support API key Connect completion');\n    }\n    return adapter.completeApiKey(input);\n  }\n\n  public pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.pollDevice) {\n      throw new Error('Provider does not support device-code polling');\n    }\n    return adapter.pollDevice(input);\n  }\n\n  public status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.status) {\n      throw new Error('Provider does not support Connect status');\n    }\n    return adapter.status(input);\n  }\n\n  public refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.refreshWithRetry(input, 2);\n  }\n\n  private async refreshWithRetry(\n    input: RefreshInput,\n    remainingAttempts: number,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.refresh) {\n      throw new Error('Provider does not support refresh');\n    }\n    if (!this.credentialRepository || !this.vault) {\n      throw new Error('CredentialVault and PodCredentialRepository are required for provider refresh');\n    }\n    const current = await this.credentialRepository.getActiveCredential(input);\n    if (!current) {\n      throw new Error('Active provider credential not found');\n    }\n    const secret = await this.vault.open(\n      { webId: input.webId },\n      current.credentialIri,\n      normalizeProvider(input.provider),\n      current.encryptedSecret,\n    );\n    try {\n      return await adapter.refresh(input, current, secret);\n    } catch (error) {\n      if (remainingAttempts > 0 && isVersionConflict(error)) {\n        const latest = await this.credentialRepository.getActiveCredential(input);\n        if (latest && latest.version !== current.version && !latest.reauthRequired) {\n          return latest;\n        }\n        return this.refreshWithRetry(input, remainingAttempts - 1);\n      }\n      throw error;\n    }\n  }\n\n  public disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.disconnect) {\n      throw new Error('Provider does not support disconnect');\n    }\n    return adapter.disconnect(input);\n  }\n\n  private requireAdapter(provider: string): ProviderConnectAdapter {\n    const adapter = this.adapters.get(normalizeProvider(provider));\n    if (!adapter) {\n      throw new Error(`No Connect adapter registered for ${provider}`);\n    }\n    return adapter;\n  }\n}\n\nfunction token(randomBytes: (bytes: number) => Buffer): string {\n  return randomBytes(32).toString('base64url');\n}\n\nfunction createDefaultConnectedCredentialDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n  credential?: typeof credentialResource;\n  aiProvider?: typeof aiProviderResource;\n}): Promise<ConnectedCredentialDb> {\n  const credential = input.credential ?? credentialResource;\n  const aiProvider = input.aiProvider ?? aiProviderResource;\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        credential,\n        aiProvider,\n      },\n    },\n  ) as unknown as ConnectedCredentialDb);\n}\n\nfunction credentialRowFromRecord(record: ConnectCredentialRecord): Record<string, unknown> {\n  return {\n    id: record.id,\n    provider: aiProviderResource.buildId({ id: normalizeProvider(record.provider) }),\n    service: 'ai',\n    authMode: record.authMode,\n    status: record.status,\n    encryptedSecret: JSON.stringify(record.encryptedSecret),\n    wrappedDataKey: record.encryptedSecret.wrappedDek,\n    encryptionAlgorithm: record.encryptedSecret.algorithm,\n    keyVersion: String(record.version ?? 1),\n    scopes: record.scopes ?? [],\n    expiresAt: record.expiresAt,\n    accountLabel: record.accountLabel,\n    label: record.accountLabel,\n    reauthRequired: record.reauthRequired ?? false,\n    lastRefreshAt: new Date(),\n  };\n}\n\nfunction recordFromCredentialRow(row: Record<string, unknown>): ConnectCredentialRecord {\n  const encrypted = parseEncryptedSecret(row.encryptedSecret);\n  const id = stringFrom(row.id);\n  const provider = providerFromRelation(stringFrom(row.provider))\n    || providerFromCredentialId(id);\n  const deployment = deploymentFromCredentialId(id);\n  const webId = encrypted.webId;\n  return {\n    id,\n    credentialIri: encrypted.credentialIri,\n    webId,\n    provider,\n    deployment,\n    authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',\n    encryptedSecret: encrypted,\n    status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',\n    accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,\n    expiresAt: dateFrom(row.expiresAt),\n    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,\n    version: versionFromRow(row),\n    reauthRequired: row.reauthRequired === true || row.reauthRequired === 'true',\n    metadata: metadataFromRow(row),\n  };\n}\n\nfunction providerFromRelation(value: string): string | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const withoutFragment = value.split('#', 1)[0] ?? value;\n  const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;\n  const provider = fileName.replace(/\\.ttl$/u, '');\n  return provider ? normalizeProvider(provider) : undefined;\n}\n\nfunction isPodResourceNotFound(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  return /\\b404\\b|not found/i.test(error.message);\n}\n\nfunction metadataFromRow(row: Record<string, unknown>): Record<string, unknown> | undefined {\n  const value = row.metadata;\n  if (!value) {\n    return undefined;\n  }\n  if (typeof value === 'object' && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  if (typeof value === 'string') {\n    try {\n      const parsed = JSON.parse(value);\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? parsed as Record<string, unknown>\n        : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nfunction modelsFromMetadata(metadata: Record<string, unknown> | undefined): string[] | undefined {\n  const value = metadata?.models;\n  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : undefined;\n}\n\nfunction defaultModelFromMetadata(metadata: Record<string, unknown> | undefined): string | undefined {\n  const value = metadata?.defaultModel;\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction priorityFromMetadata(metadata: Record<string, unknown> | undefined): number | undefined {\n  const value = metadata?.priority;\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction runtimeCredentialFromMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> | undefined {\n  const value = metadata?.runtimeCredential;\n  return value && typeof value === 'object' && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : undefined;\n}\n\nfunction parseEncryptedSecret(value: unknown): EncryptedCredentialSecret {\n  if (typeof value !== 'string' || !value.trim()) {\n    throw new Error('Credential row is missing encrypted secret payload');\n  }\n  const parsed = JSON.parse(value);\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('Credential row encrypted secret payload is invalid');\n  }\n  return parsed as EncryptedCredentialSecret;\n}\n\nfunction versionFromRow(row: Record<string, unknown>): number {\n  const value = row.keyVersion;\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : 0;\n  }\n  return 0;\n}\n\nfunction providerFromCredentialId(id: string): string {\n  const match = /\\/([^/#]+)\\.ttl#/u.exec(id);\n  return match?.[1] ?? '';\n}\n\nfunction deploymentFromCredentialId(id: string): GatewayDeployment {\n  return id.includes('#cloud-') ? 'cloud' : 'local';\n}\n\nfunction dateFrom(value: unknown): Date | undefined {\n  if (value instanceof Date) {\n    return value;\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n  }\n  return undefined;\n}\n\nfunction signAttempt(\n  attempt: Pick<ConnectAttempt, 'id' | 'provider' | 'deployment' | 'webId' | 'mode' | 'state' | 'expiresAt'>,\n  secret: string,\n): string {\n  return createHmac('sha256', secret)\n    .update(JSON.stringify({\n      id: attempt.id,\n      provider: attempt.provider,\n      deployment: attempt.deployment,\n      webId: attempt.webId,\n      mode: attempt.mode,\n      state: attempt.state,\n      expiresAt: attempt.expiresAt.toISOString(),\n    }))\n    .digest('base64url');\n}\n\nfunction signatureMatches(actual: string, expected: string): boolean {\n  const actualBuffer = Buffer.from(actual, 'utf8');\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction codeChallenge(verifier: string): string {\n  return createHash('sha256').update(verifier).digest('base64url');\n}\n\nfunction principal(webId: string): GatewayPrincipal {\n  return { webId };\n}\n\nfunction cloneAttempt(attempt: ConnectAttempt): ConnectAttempt {\n  return {\n    ...attempt,\n    expiresAt: new Date(attempt.expiresAt),\n    consumedAt: attempt.consumedAt ? new Date(attempt.consumedAt) : undefined,\n    nextPollAt: attempt.nextPollAt ? new Date(attempt.nextPollAt) : undefined,\n    pollClaimedAt: attempt.pollClaimedAt ? new Date(attempt.pollClaimedAt) : undefined,\n  };\n}\n\nfunction normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nasync function safeJson(response: Response): Promise<Record<string, unknown>> {\n  const text = await response.text();\n  if (!text) {\n    if (response.ok) {\n      throw new Error('Provider returned an empty JSON response');\n    }\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(text);\n    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n      if (response.ok) {\n        throw new Error('Provider returned a non-object JSON response');\n      }\n      return {};\n    }\n    return parsed as Record<string, unknown>;\n  } catch {\n    if (response.ok) {\n      throw new Error('Provider returned invalid JSON');\n    }\n    return {};\n  }\n}\n\nfunction stringFrom(value: unknown): string {\n  return typeof value === 'string' ? value : '';\n}\n\nfunction numberFrom(value: unknown, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) ? value : fallback;\n}\n\nfunction expiresAtFrom(expiresIn: unknown, now: Date): Date | undefined {\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {\n    return undefined;\n  }\n  return new Date(now.getTime() + expiresIn * 1000);\n}\n\nfunction safeProviderError(body: Record<string, unknown>): string {\n  const code = stringFrom(body.error);\n  if (SAFE_PROVIDER_ERROR_CODES.has(code)) {\n    return code;\n  }\n  if (!code) {\n    return 'provider_error';\n  }\n  if (code.endsWith('_error')) {\n    return 'provider_error';\n  }\n  return 'provider_error';\n}\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  'authorization_pending',\n  'slow_down',\n  'expired_token',\n  'access_denied',\n  'invalid_grant',\n  'invalid_client',\n]);\n\nfunction pendingResult(\n  input: PollDeviceInput,\n  status: ConnectAttemptStatus,\n  intervalSeconds?: number,\n): ConnectBeginResult {\n  return {\n    mode: 'deviceCodeOAuth',\n    status,\n    provider: 'kimi',\n    deployment: input.deployment,\n    attemptId: input.attemptId,\n    intervalSeconds,\n  };\n}\n\nfunction assertKimiEndpoint(endpoint: string, pathname: string): void {\n  const url = new URL(endpoint);\n  if (\n    url.origin !== 'https://auth.kimi.com'\n    || url.pathname !== pathname\n    || url.search\n    || url.hash\n    || url.username\n    || url.password\n  ) {\n    throw new Error('Kimi Connect endpoint is not allowlisted');\n  }\n}\n\nfunction requireStringField(body: Record<string, unknown>, field: string): void {\n  if (typeof body[field] !== 'string' || !(body[field] as string).trim()) {\n    throw new Error(`Provider response missing required field: ${field}`);\n  }\n}\n\nfunction isVersionConflict(error: unknown): boolean {\n  return error instanceof Error && /version_conflict|credential_version_conflict/u.test(error.message);\n}\n\nfunction decodeJwtSubject(idToken: string): string | undefined {\n  const payload = idToken.split('.')[1];\n  if (!payload) {\n    return undefined;\n  }\n  try {\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));\n    return typeof decoded.sub === 'string' ? decoded.sub : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/connect/index.ts"],"names":[],"mappings":";;;AAAA,6CAAsG;AACtG,gEAAuE;AACvE,kDAI+B;AAE/B,0FAImD;AAGnD,oEAA6E;AA+J7E,MAAa,gCAAgC;IAO3C,YAAmB,UAAmD,EAAE;QACtE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW;eACjC,+CAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kCAAkC,CAAC;QACzE,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAK1B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAKhC;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAI5B;QAiBC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CACtB,UAAU,EACV,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAkC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACvD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;aAC1D,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3C,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,KAAK,CAAC,yBAAyB,CACpC,MAA+B,EAC/B,OAAgC;QAEhC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,GAAG,MAAM;YACT,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzF,OAAO,uBAAuB,CAAC,OAAO,IAAI,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,KAO/B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QAIxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,IAAkB;QACjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AA/LD,4EA+LC;AAyCD,MAAa,2BAA2B;IAAxC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC7C,gBAAW,GAAG,KAAK,CAAC;IAsGvC,CAAC;IApGQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,GAAU;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAS;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,GAAS;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAU,EACV,KAIC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAChD,OAAO,CAAC,0BAA0B,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC9C,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAS,EAAE,QAAiB;QAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAxGD,kEAwGC;AAaD,MAAa,mCAAmC;IAU9C,YAAmB,OAAmD;QACpE,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAe,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;SACjC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAA0B;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAA,sDAAyB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACvE,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/F,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,8DAAiC;YAC9C,aAAa;YACb,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,QAAQ,CAAC,yBAAyB;SACpD,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzB,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,EAAE;SACxB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAsB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,KAAwB,EAAE,SAAe,EAAE,QAAiC,EAAE;QAC1G,MAAM,uBAAuB,GAAsC;YACjE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,aAAa;YACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS;YACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,GAAG,KAAK;SACT,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,uBAAuB,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,KAAsB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,KAAsB,EAAE,IAAiB;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,gBAAgB,CAAC,OAAuB;QAChD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAES,WAAW,CAAC,KAAwB,EAAE,IAAiB;QAC/D,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AA7KD,kFA6KC;AASD,MAAa,4BAA6B,SAAQ,mCAAmC;IAMnF,YAAmB,OAA4C;QAC7D,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,sDAAsD,CAAC;QACjI,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uCAAuC,CAAC;QACtF,kBAAkB,CAAC,IAAI,CAAC,2BAA2B,EAAE,iCAAiC,CAAC,CAAC;QACxF,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAEe,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;aAC9B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACtC,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE;YAC1F,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACxC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,0BAA0B,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACpC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,uBAAuB,EAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC;YACnE,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,aAAa,CAClB,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,EACpF,KAAK,CAAC,OAAO,CAAC,0BAA0B,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;oBACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;oBAC1B,MAAM,eAAe,GAAG,MAAM,KAAK,WAAW;wBAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;wBAC1E,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;oBACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE;wBACtD,eAAe;wBACf,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC;wBAC5D,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;oBACnE,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACnE,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAC/F,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe;SAC/E,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAmB,EACnB,OAAgC,EAChC,MAAsB;QAEtB,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,uBAAuB;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAEe,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAA2E,EAC3E,IAA6B,EAC7B,eAAwB;QAExB,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAmB;YAC7B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;YACnC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnC,CAAC;QACF,OAAO,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACzD,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACxF,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,WAAW,EAAE,8DAAiC;YAC9C,aAAa,EAAE,IAAA,sDAAyB,EAAC,MAAM,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE;gBACR,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClE;SACF,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AAvOD,oEAuOC;AAED,MAAa,sBAAsB;IAAnC;QACkB,aAAQ,GAAG,UAAU,CAAC;IAexC,CAAC;IAbQ,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,yBAAyB,EAAE,IAAI;YAC/B,OAAO,EAAE,8GAA8G;SACxH,CAAC;IACJ,CAAC;CACF;AAhBD,wDAgBC;AAwBD,MAAa,sBAAsB;IAKjC,YAAmB,OAAsC;QAFxC,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAGpE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAwB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI;gBAC7B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,yBAAyB;gBACvE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAI1B;QACC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,aAAa;gBACzD,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;oBAC9C,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC;gBACF,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;oBACrD,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC,CAAC;YACL,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,KAAK,QAAQ,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC;YACpE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBAC/B,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBACvE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,gBAAyB;oBAC3B,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,WAAoB;wBACtB,CAAC,CAAC,cAAuB;gBAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBAC1D,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAChD,OAAO,EAAE;oBACP,KAAK;oBACL,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK;oBACpD,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;iBAC3D;aACF,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,KAA0B;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,OAAO,CAAC,KAAmB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAmB,EACnB,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,sDAAyB,EAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC3E,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAnJD,wDAmJC;AAED,SAAS,KAAK,CAAC,WAAsC;IACnD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kCAAkC,CAAC,KAM3C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,UAAU;YACV,UAAU;SACX;KACF,CACkC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,2BAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;QAC9C,aAAa,EAAE,IAAI,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B,EAAE,KAAa;IAC1E,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,8DAAiC;QACnF,CAAC,CAAC,8DAAiC;QACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAA,sDAAyB,EAAC;QACxB,WAAW;QACX,aAAa;QACb,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WAC1D,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;WAC9C,4BAAmB,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,EAAE;QACF,aAAa;QACb,KAAK,EAAE,KAAK;QACZ,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ;QACvF,WAAW,EAAE,8DAAiC;QAC9C,aAAa;QACb,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACnE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;QAChF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAC5E,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,MAAiC;gBACnC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6C;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA6C;IAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA6C;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA6C;IAClF,MAAM,KAAK,GAAG,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAU;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,0BAA0B,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,OAA0G,EAC1G,MAAc;IAEd,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;SACF,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAGD,SAAS,YAAY,CAAC,OAAuB;IAC3C,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAS;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAsB,EACtB,MAA4B,EAC5B,eAAwB;IAExB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,MAAM,KAAK,uBAAuB;WACnC,GAAG,CAAC,QAAQ,KAAK,QAAQ;WACzB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IACtE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAE,IAAI,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,KAAK,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, createHmac, randomBytes as nodeRandomBytes, timingSafeEqual } from 'node:crypto';\nimport { alias, and, drizzle, eq } from '@undefineds.co/drizzle-solid';\nimport {\n  aiProviderResource,\n  aiRuntimeRepository,\n  credentialResource,\n} from '@undefineds.co/models';\nimport type { ProviderSecret } from '../credentials/CredentialVault';\nimport {\n  decodePlaintextCredential,\n  encodePlaintextCredential,\n  PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n} from '../credentials/PlaintextCredentialPayload';\nimport type { GatewayDeployment } from '../auth/InvocationTokenCodec';\nimport type { ProviderRegistry } from '../providers/ProviderRegistry';\nimport { DEFAULT_PROVIDER_DESCRIPTORS } from '../providers/ProviderRegistry';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';\n\nexport type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';\nexport type ConnectAttemptStatus =\n  | 'pending'\n  | 'authorization_pending'\n  | 'slow_down'\n  | 'completed'\n  | 'expired'\n  | 'unsupported';\n\nexport interface ConnectBeginInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  requestedMode: ConnectMode;\n  expectedCredentialVersion?: number;\n  auth?: AuthContext;\n}\n\nexport interface ConnectBeginResult {\n  mode: ConnectMode;\n  status: ConnectAttemptStatus;\n  provider: string;\n  deployment: GatewayDeployment;\n  attemptId?: string;\n  state?: string;\n  signature?: string;\n  expiresAt?: string;\n  authorizationUrl?: string;\n  pkceChallenge?: string;\n  deviceCode?: string;\n  userCode?: string;\n  verificationUri?: string;\n  verificationUriComplete?: string;\n  intervalSeconds?: number;\n  apiKeyManagementSupported?: boolean;\n  credentialId?: string;\n  message?: string;\n}\n\nexport interface CompleteApiKeyInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  apiKey: string;\n  accountLabel?: string;\n  auth?: AuthContext;\n}\n\nexport interface PollDeviceInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  auth?: AuthContext;\n}\n\nexport interface RefreshInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface DisconnectInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface ConnectCredentialRecord {\n  id: string;\n  credentialIri: string;\n  webId: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  authMode: 'apiKey' | 'deviceCodeOAuth';\n  storageMode: 'plaintext-v1';\n  secretPayload: string;\n  status: 'active' | 'revoked';\n  accountLabel?: string;\n  expiresAt?: Date;\n  scopes?: string[];\n  expectedVersion?: number;\n  version?: number;\n  reauthRequired?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface PodCredentialRepository {\n  getCredential?(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord>;\n  markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ntype ConnectedCredentialDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  insert(resource: typeof credentialResource): {\n    values(value: unknown): { execute(): Promise<unknown[]> };\n  };\n  select(): {\n    from(resource: typeof credentialResource): {\n      where(condition: unknown): { execute(): Promise<Record<string, unknown>[]> };\n    };\n  };\n  findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;\n  update(resource: typeof credentialResource): {\n    set(patch: unknown): {\n      where(condition: unknown): {\n        returning(): { execute(): Promise<Record<string, unknown>[]> };\n      };\n    };\n  };\n};\n\nexport interface PodConnectedCredentialRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  providerIds?: string[];\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n    credential?: typeof credentialResource;\n    aiProvider?: typeof aiProviderResource;\n  }) => Promise<ConnectedCredentialDb>;\n}\n\nexport class PodConnectedCredentialRepository implements PodCredentialRepository {\n  private readonly dbFactory: NonNullable<PodConnectedCredentialRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n  private readonly providerIds: string[];\n  private readonly credentialTemplate: typeof credentialResource;\n  private readonly aiProviderTemplate: typeof aiProviderResource;\n\n  public constructor(options: PodConnectedCredentialRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.providerIds = options.providerIds\n      ?? DEFAULT_PROVIDER_DESCRIPTORS.map((provider) => provider.id);\n    this.dbFactory = options.dbFactory ?? createDefaultConnectedCredentialDb;\n    this.credentialTemplate = alias(credentialResource, 'credentialTemplate');\n    this.aiProviderTemplate = alias(aiProviderResource, 'aiProviderTemplate');\n  }\n\n  public async getCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const row = await db.findById<Record<string, unknown>>(credential, id);\n    const record = row ? recordFromCredentialRow(row, input.webId) : undefined;\n    if (!record) {\n      return undefined;\n    }\n    return record;\n  }\n\n  public async getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const record = await this.getCredential(input);\n    return record?.status === 'active' && !record.reauthRequired ? record : undefined;\n  }\n\n  public async listCredentials(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<Array<{\n    id: string;\n    credentialIri: string;\n    provider: string;\n    authMode: 'apiKey' | 'deviceCodeOAuth';\n    enabled: boolean;\n    priority?: number;\n    models?: string[];\n    defaultModel?: string;\n    health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error';\n    quota?: { status: 'available' | 'unsupported' | 'exhausted' | 'error' };\n    storageMode: 'plaintext-v1';\n    secretPayload: string;\n    version?: number;\n    runtimeCredential?: Record<string, unknown>;\n    metadata?: Record<string, unknown>;\n  }>> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const rows = (await Promise.all(\n      this.providerIds.map(async (provider) => {\n        try {\n          return await db.findById<Record<string, unknown>>(\n            credential,\n            aiRuntimeRepository.credentialId({ deployment: input.deployment, provider }),\n          );\n        } catch (error) {\n          if (isPodResourceNotFound(error)) {\n            return null;\n          }\n          throw error;\n        }\n      }),\n    )).filter((row): row is Record<string, unknown> => row !== null);\n    return rows\n      .map((row) => recordFromCredentialRow(row, input.webId))\n      .filter((record) => record.webId === input.webId)\n      .filter((record) => record.deployment === input.deployment)\n      .filter((record) => record.status === 'active')\n      .map((record) => ({\n        id: record.id,\n        credentialIri: record.credentialIri,\n        provider: record.provider,\n        authMode: record.authMode,\n        enabled: !record.reauthRequired,\n        models: modelsFromMetadata(record.metadata),\n        defaultModel: defaultModelFromMetadata(record.metadata),\n        priority: priorityFromMetadata(record.metadata),\n        health: record.reauthRequired ? 'reauthRequired' : 'healthy',\n        quota: { status: 'available' },\n        storageMode: record.storageMode,\n        secretPayload: record.secretPayload,\n        version: record.version,\n        runtimeCredential: runtimeCredentialFromMetadata(record.metadata),\n        metadata: record.metadata,\n      }));\n  }\n\n  public async upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord> {\n    const { db, credential } = await this.dbForOwner(record.webId, context?.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, record.id);\n    const existingVersion = existing ? versionFromRow(existing) : 0;\n    if (record.expectedVersion !== undefined && record.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const nextVersion = existingVersion + 1;\n    const row = credentialRowFromRecord({\n      ...record,\n      version: nextVersion,\n    });\n    if (existing) {\n      const updated = await db.updateById<Record<string, unknown>>(credential, record.id, row);\n      return recordFromCredentialRow(updated ?? row, record.webId);\n    }\n    await db.insert(credential).values(row).execute();\n    return recordFromCredentialRow(row, record.webId);\n  }\n\n  public async markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const existingVersion = versionFromRow(existing);\n    if (input.expectedVersion !== undefined && input.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      reauthRequired: true,\n      status: 'active',\n      keyVersion: String(existingVersion + 1),\n    });\n    return updated ? recordFromCredentialRow(updated, input.webId) : undefined;\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      status: 'revoked',\n      keyVersion: String(versionFromRow(existing) + 1),\n    });\n    return updated ? recordFromCredentialRow(updated, input.webId) : undefined;\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<{\n    db: ConnectedCredentialDb;\n    credential: typeof credentialResource;\n  }> {\n    const trustedFetch = await this.resolveTrustedFetch(owner, auth);\n    const credential = alias(this.credentialTemplate, 'credential');\n    const aiProvider = alias(this.aiProviderTemplate, 'aiProvider');\n    const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });\n    await db.init?.(credential, aiProvider);\n    return { db, credential };\n  }\n\n  private async resolveTrustedFetch(owner: string, auth?: AuthContext): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner, auth);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport interface ProviderConnectAdapter {\n  readonly provider: string;\n  begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;\n  status?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;\n  pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  refresh?(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined>;\n  disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ninterface ConnectAttempt {\n  id: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  webId: string;\n  mode: ConnectMode;\n  state: string;\n  signature: string;\n  expiresAt: Date;\n  consumedAt?: Date;\n  expectedCredentialVersion?: number;\n  codeVerifier?: string;\n  deviceCode?: string;\n  intervalSeconds?: number;\n  currentPollIntervalSeconds?: number;\n  nextPollAt?: Date;\n  pollClaimedAt?: Date;\n  lastPollStatus?: ConnectAttemptStatus;\n}\n\ninterface PollClaimResult {\n  attempt: ConnectAttempt;\n  claimed: boolean;\n}\n\nexport class InMemoryConnectAttemptStore {\n  private readonly attempts = new Map<string, ConnectAttempt>();\n  private readonly maxAttempts = 1_000;\n\n  public async create(attempt: ConnectAttempt): Promise<ConnectAttempt> {\n    this.pruneExpired(new Date());\n    this.attempts.set(attempt.id, cloneAttempt(attempt));\n    this.pruneBounded();\n    return cloneAttempt(attempt);\n  }\n\n  public async get(id: string, now?: Date): Promise<ConnectAttempt | undefined> {\n    this.pruneExpired(now ?? new Date(), id);\n    const attempt = this.attempts.get(id);\n    if (attempt && now && attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n    }\n    return attempt ? cloneAttempt(attempt) : undefined;\n  }\n\n  public async consume(id: string, now: Date): Promise<ConnectAttempt> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    attempt.consumedAt = new Date(now);\n    return cloneAttempt(attempt);\n  }\n\n  public async claimPoll(id: string, now: Date): Promise<PollClaimResult> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.nextPollAt && attempt.nextPollAt.getTime() > now.getTime()) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    if (attempt.pollClaimedAt) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    attempt.pollClaimedAt = new Date(now);\n    return { attempt: cloneAttempt(attempt), claimed: true };\n  }\n\n  public async updatePollSchedule(\n    id: string,\n    patch: {\n      intervalSeconds: number;\n      nextPollAt: Date;\n      lastPollStatus: ConnectAttemptStatus;\n    },\n  ): Promise<ConnectAttempt | undefined> {\n    const attempt = this.attempts.get(id);\n    if (!attempt || attempt.consumedAt) {\n      return undefined;\n    }\n    attempt.intervalSeconds = patch.intervalSeconds;\n    attempt.currentPollIntervalSeconds = patch.intervalSeconds;\n    attempt.nextPollAt = new Date(patch.nextPollAt);\n    attempt.lastPollStatus = patch.lastPollStatus;\n    attempt.pollClaimedAt = undefined;\n    return cloneAttempt(attempt);\n  }\n\n  public async releasePollClaim(id: string): Promise<void> {\n    const attempt = this.attempts.get(id);\n    if (attempt) {\n      attempt.pollClaimedAt = undefined;\n    }\n  }\n\n  private pruneExpired(now: Date, exceptId?: string): void {\n    for (const [id, attempt] of this.attempts) {\n      if (id !== exceptId && attempt.expiresAt.getTime() <= now.getTime()) {\n        this.attempts.delete(id);\n      }\n    }\n  }\n\n  private pruneBounded(): void {\n    while (this.attempts.size > this.maxAttempts) {\n      const oldest = this.attempts.keys().next().value;\n      if (typeof oldest !== 'string') {\n        return;\n      }\n      this.attempts.delete(oldest);\n    }\n  }\n}\n\nexport interface BrowserAssistedApiKeyConnectAdapterOptions {\n  provider: string;\n  consoleUrl: string;\n  attempts: InMemoryConnectAttemptStore;\n  credentialRepository: PodCredentialRepository;\n  deployment: GatewayDeployment;\n  now?: () => Date;\n  randomBytes?: (bytes: number) => Buffer;\n  signingSecret: string;\n}\n\nexport class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider: string;\n  private readonly consoleUrl: string;\n  protected readonly attempts: InMemoryConnectAttemptStore;\n  protected readonly credentialRepository: PodCredentialRepository;\n  protected readonly deployment: GatewayDeployment;\n  protected readonly now: () => Date;\n  protected readonly randomBytes: (bytes: number) => Buffer;\n  private readonly signingSecret: string;\n\n  public constructor(options: BrowserAssistedApiKeyConnectAdapterOptions) {\n    this.provider = normalizeProvider(options.provider);\n    this.consoleUrl = options.consoleUrl;\n    this.attempts = options.attempts;\n    this.credentialRepository = options.credentialRepository;\n    this.deployment = options.deployment;\n    this.now = options.now ?? (() => new Date());\n    this.randomBytes = options.randomBytes ?? nodeRandomBytes;\n    this.signingSecret = options.signingSecret;\n  }\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'browserAssistedApiKey');\n    const now = this.now();\n    const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);\n    const attempt = await this.createAttempt(input, expiresAt);\n    const url = new URL(this.consoleUrl);\n    url.searchParams.set('xpod_connect_attempt', attempt.id);\n    url.searchParams.set('xpod_provider', this.provider);\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'pending',\n      provider: this.provider,\n      deployment: this.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: expiresAt.toISOString(),\n      authorizationUrl: url.toString(),\n    };\n  }\n\n  public async completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    if (!input.apiKey.trim()) {\n      throw new Error('API key is required');\n    }\n    const attempt = await this.loadConsumableAttempt(input, 'browserAssistedApiKey');\n    const consumed = await this.attempts.consume(input.attemptId, this.now());\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: this.provider,\n    });\n    const secretPayload = encodePlaintextCredential({ type: 'apiKey', apiKey: input.apiKey });\n    const record = await this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),\n      credentialIri,\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      authMode: 'apiKey',\n      storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n      secretPayload,\n      status: 'active',\n      accountLabel: input.accountLabel,\n      expectedVersion: consumed.expectedCredentialVersion,\n    }, { auth: input.auth });\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'completed',\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      credentialId: record.id,\n    };\n  }\n\n  public async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'browserAssistedApiKey');\n    return {\n      mode: attempt.mode,\n      status: this.statusForAttempt(attempt),\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n    };\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  protected async createAttempt(input: ConnectBeginInput, expiresAt: Date, extra: Partial<ConnectAttempt> = {}): Promise<ConnectAttempt> {\n    const attemptWithoutSignature: Omit<ConnectAttempt, 'signature'> = {\n      id: token(this.randomBytes),\n      provider: this.provider,\n      deployment: input.deployment,\n      webId: input.webId,\n      mode: input.requestedMode,\n      state: token(this.randomBytes),\n      expiresAt,\n      expectedCredentialVersion: input.expectedCredentialVersion,\n      ...extra,\n    };\n    const signature = signAttempt(attemptWithoutSignature, this.signingSecret);\n    return this.attempts.create({ ...attemptWithoutSignature, signature });\n  }\n\n  protected async loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.attempts.get(input.attemptId, this.now());\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.webId !== input.webId) {\n      throw new Error('Connect attempt is bound to a different WebID');\n    }\n    if (attempt.deployment !== input.deployment) {\n      throw new Error('Connect attempt is bound to a different deployment');\n    }\n    if (attempt.provider !== normalizeProvider(input.provider)) {\n      throw new Error('Connect attempt is bound to a different provider');\n    }\n    if (attempt.mode !== mode) {\n      throw new Error('Connect attempt mode mismatch');\n    }\n    if (attempt.state !== input.state) {\n      throw new Error('Invalid Connect attempt state');\n    }\n    if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {\n      throw new Error('Invalid Connect attempt signature');\n    }\n    return attempt;\n  }\n\n  protected async loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.loadAttemptForStatus(input, mode);\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    return attempt;\n  }\n\n  protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus {\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      return 'expired';\n    }\n    return attempt.consumedAt ? 'completed' : 'pending';\n  }\n\n  protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    if (input.deployment !== this.deployment) {\n      throw new Error('Connect deployment mismatch');\n    }\n    if (input.requestedMode !== mode) {\n      throw new Error('Unsupported Connect mode');\n    }\n    if (!input.webId) {\n      throw new Error('Connect WebID is required');\n    }\n  }\n}\n\nexport interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {\n  fetch?: typeof fetch;\n  clientId: string;\n  deviceAuthorizationEndpoint?: string;\n  tokenEndpoint?: string;\n}\n\nexport class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientId: string;\n  private readonly deviceAuthorizationEndpoint: string;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: KimiDeviceCodeConnectAdapterOptions) {\n    super({\n      ...options,\n      provider: 'kimi',\n      consoleUrl: 'https://kimi.moonshot.cn/device',\n    });\n    this.fetchImpl = options.fetch ?? fetch;\n    this.clientId = options.clientId;\n    this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';\n    this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';\n    assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');\n    assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');\n  }\n\n  public override async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'deviceCodeOAuth');\n    const now = this.now();\n    const verifier = token(this.randomBytes);\n    const challenge = codeChallenge(verifier);\n    const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: this.clientId,\n        code_challenge: challenge,\n        code_challenge_method: 'S256',\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);\n    }\n    requireStringField(body, 'device_code');\n    requireStringField(body, 'user_code');\n    requireStringField(body, 'verification_uri_complete');\n    const expiresIn = numberFrom(body.expires_in, 300);\n    const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {\n      mode: 'deviceCodeOAuth',\n      codeVerifier: verifier,\n      deviceCode: stringFrom(body.device_code),\n      intervalSeconds: numberFrom(body.interval, 5),\n      currentPollIntervalSeconds: numberFrom(body.interval, 5),\n      nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),\n    });\n    return {\n      mode: 'deviceCodeOAuth',\n      status: 'pending',\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: attempt.expiresAt.toISOString(),\n      pkceChallenge: challenge,\n      deviceCode: attempt.deviceCode,\n      userCode: stringFrom(body.user_code),\n      verificationUri: stringFrom(body.verification_uri),\n      verificationUriComplete: stringFrom(body.verification_uri_complete),\n      intervalSeconds: attempt.intervalSeconds,\n    };\n  }\n\n  public async pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');\n    const now = this.nowForConsume();\n    const claim = await this.attempts.claimPoll(input.attemptId, now);\n    if (!claim.claimed) {\n      return pendingResult(\n        input,\n        claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending',\n        claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds,\n      );\n    }\n    try {\n      const response = await this.fetchImpl(this.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: attempt.deviceCode ?? '',\n          client_id: this.clientId,\n          code_verifier: attempt.codeVerifier ?? '',\n        }),\n      });\n      const body = await safeJson(response);\n      if (!response.ok) {\n        if (body.error === 'authorization_pending' || body.error === 'slow_down') {\n          const status = body.error;\n          const intervalSeconds = status === 'slow_down'\n            ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5\n            : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);\n          await this.attempts.updatePollSchedule(input.attemptId, {\n            intervalSeconds,\n            nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),\n            lastPollStatus: status,\n          });\n          return pendingResult(input, status, intervalSeconds);\n        }\n        if (body.error === 'expired_token') {\n          await this.attempts.consume(input.attemptId, this.nowForConsume());\n          return pendingResult(input, 'expired');\n        }\n        throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);\n      }\n      await this.attempts.consume(input.attemptId, this.nowForConsume());\n      requireStringField(body, 'access_token');\n      requireStringField(body, 'refresh_token');\n      const record = await this.storeOAuthCredential(input, body, attempt.expectedCredentialVersion);\n      return {\n        mode: 'deviceCodeOAuth',\n        status: 'completed',\n        provider: 'kimi',\n        deployment: input.deployment,\n        attemptId: input.attemptId,\n        credentialId: record.id,\n      };\n    } catch (error) {\n      await this.attempts.releasePollClaim(input.attemptId);\n      throw error;\n    }\n  }\n\n  public override async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');\n    return {\n      mode: 'deviceCodeOAuth',\n      status: this.statusForAttempt(attempt),\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n      deviceCode: attempt.deviceCode,\n      intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,\n    };\n  }\n\n  public async refresh(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const refreshToken = stringFrom(secret.refreshToken);\n    if (!refreshToken) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: 'missing_refresh_token',\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    const response = await this.fetchImpl(this.tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: this.clientId,\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: safeProviderError(body),\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    requireStringField(body, 'access_token');\n    requireStringField(body, 'refresh_token');\n    return this.storeOAuthCredential(input, body, current.version);\n  }\n\n  public override async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  private nowForConsume(): Date {\n    return this.now();\n  }\n\n  private async storeOAuthCredential(\n    input: { webId: string; deployment: GatewayDeployment; auth?: AuthContext },\n    body: Record<string, unknown>,\n    expectedVersion?: number,\n  ): Promise<ConnectCredentialRecord> {\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: 'kimi',\n    });\n    const expiresAt = expiresAtFrom(body.expires_in, this.now());\n    const secret: ProviderSecret = {\n      type: 'deviceCodeOAuth',\n      accessToken: stringFrom(body.access_token),\n      refreshToken: stringFrom(body.refresh_token),\n      expiresAt: expiresAt?.toISOString(),\n      scope: stringFrom(body.scope),\n      idToken: stringFrom(body.id_token),\n    };\n    return this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),\n      credentialIri,\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      authMode: 'deviceCodeOAuth',\n      storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n      secretPayload: encodePlaintextCredential(secret),\n      status: 'active',\n      expiresAt,\n      expectedVersion,\n      metadata: {\n        authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),\n      },\n    }, { auth: input.auth });\n  }\n}\n\nexport class DeepSeekConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider = 'deepseek';\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    return {\n      mode: 'connectUnsupported',\n      status: 'unsupported',\n      provider: 'deepseek',\n      deployment: input.deployment,\n      apiKeyManagementSupported: true,\n      message: 'DeepSeek does not expose a supported third-party browser Connect flow; use authenticated API key management.',\n    };\n  }\n}\n\nexport interface ProviderConnectServiceOptions {\n  registry: ProviderRegistry;\n  adapters: ProviderConnectAdapter[];\n  credentialRepository?: PodCredentialRepository;\n}\n\nexport interface ProviderConnectionSummary {\n  provider: string;\n  status: 'connected' | 'disconnected' | 'reauthRequired';\n  authMode?: 'apiKey' | 'deviceCodeOAuth';\n  accountLabel?: string;\n  expiresAt?: string;\n  reauthRequired?: boolean;\n  credentialIri?: string;\n  version?: number;\n  connect: {\n    modes: string[];\n    configured: boolean;\n    message?: string;\n  };\n}\n\nexport class ProviderConnectService {\n  private readonly registry: ProviderRegistry;\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly adapters = new Map<string, ProviderConnectAdapter>();\n\n  public constructor(options: ProviderConnectServiceOptions) {\n    this.registry = options.registry;\n    this.credentialRepository = options.credentialRepository;\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    const descriptor = this.registry.requireProvider(input.provider);\n    if (descriptor.connect?.mode !== input.requestedMode) {\n      throw new Error('Requested Connect mode does not match provider capability');\n    }\n    if (descriptor.connect?.configured === false) {\n      return Promise.resolve({\n        mode: descriptor.connect.mode,\n        status: 'unsupported',\n        provider: normalizeProvider(input.provider),\n        deployment: input.deployment,\n        apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,\n        message: descriptor.connect.notes?.join(' '),\n      });\n    }\n    return this.requireAdapter(input.provider).begin(input);\n  }\n\n  public async listProviders(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ProviderConnectionSummary[]> {\n    return Promise.all(this.registry.listProviders().map(async (descriptor) => {\n      const credential = this.credentialRepository?.getCredential\n        ? await this.credentialRepository.getCredential({\n          ...input,\n          provider: descriptor.id,\n        })\n        : await this.credentialRepository?.getActiveCredential({\n          ...input,\n          provider: descriptor.id,\n        });\n      const active = credential?.status === 'active';\n      const reauthRequired = active && credential.reauthRequired === true;\n      const modes = Array.from(new Set([\n        ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),\n        ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),\n      ]));\n      return {\n        provider: descriptor.id,\n        status: reauthRequired\n          ? 'reauthRequired' as const\n          : active\n            ? 'connected' as const\n            : 'disconnected' as const,\n        authMode: active ? credential.authMode : undefined,\n        accountLabel: active ? credential.accountLabel : undefined,\n        expiresAt: active ? credential.expiresAt?.toISOString() : undefined,\n        reauthRequired: reauthRequired || undefined,\n        credentialIri: active ? credential.credentialIri : undefined,\n        version: active ? credential.version : undefined,\n        connect: {\n          modes,\n          configured: descriptor.connect?.configured !== false,\n          message: descriptor.connect?.notes?.join(' ') || undefined,\n        },\n      };\n    }));\n  }\n\n  public completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.completeApiKey) {\n      throw new Error('Provider does not support API key Connect completion');\n    }\n    return adapter.completeApiKey(input);\n  }\n\n  public pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.pollDevice) {\n      throw new Error('Provider does not support device-code polling');\n    }\n    return adapter.pollDevice(input);\n  }\n\n  public status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.status) {\n      throw new Error('Provider does not support Connect status');\n    }\n    return adapter.status(input);\n  }\n\n  public refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.refreshWithRetry(input, 2);\n  }\n\n  private async refreshWithRetry(\n    input: RefreshInput,\n    remainingAttempts: number,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.refresh) {\n      throw new Error('Provider does not support refresh');\n    }\n    if (!this.credentialRepository) {\n      throw new Error('PodCredentialRepository is required for provider refresh');\n    }\n    const current = await this.credentialRepository.getActiveCredential(input);\n    if (!current) {\n      throw new Error('Active provider credential not found');\n    }\n    const secret = decodePlaintextCredential(current);\n    try {\n      return await adapter.refresh(input, current, secret);\n    } catch (error) {\n      if (remainingAttempts > 0 && isVersionConflict(error)) {\n        const latest = await this.credentialRepository.getActiveCredential(input);\n        if (latest && latest.version !== current.version && !latest.reauthRequired) {\n          return latest;\n        }\n        return this.refreshWithRetry(input, remainingAttempts - 1);\n      }\n      throw error;\n    }\n  }\n\n  public disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.disconnect) {\n      throw new Error('Provider does not support disconnect');\n    }\n    return adapter.disconnect(input);\n  }\n\n  private requireAdapter(provider: string): ProviderConnectAdapter {\n    const adapter = this.adapters.get(normalizeProvider(provider));\n    if (!adapter) {\n      throw new Error(`No Connect adapter registered for ${provider}`);\n    }\n    return adapter;\n  }\n}\n\nfunction token(randomBytes: (bytes: number) => Buffer): string {\n  return randomBytes(32).toString('base64url');\n}\n\nfunction createDefaultConnectedCredentialDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n  credential?: typeof credentialResource;\n  aiProvider?: typeof aiProviderResource;\n}): Promise<ConnectedCredentialDb> {\n  const credential = input.credential ?? credentialResource;\n  const aiProvider = input.aiProvider ?? aiProviderResource;\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        credential,\n        aiProvider,\n      },\n    },\n  ) as unknown as ConnectedCredentialDb);\n}\n\nfunction credentialRowFromRecord(record: ConnectCredentialRecord): Record<string, unknown> {\n  return {\n    id: record.id,\n    provider: aiProviderResource.buildId({ id: normalizeProvider(record.provider) }),\n    service: 'ai',\n    authMode: record.authMode,\n    status: record.status,\n    storageMode: record.storageMode,\n    secretPayload: record.secretPayload,\n    keyVersion: String(record.version ?? 1),\n    scopes: record.scopes ?? [],\n    expiresAt: record.expiresAt,\n    accountLabel: record.accountLabel,\n    label: record.accountLabel,\n    reauthRequired: record.reauthRequired ?? false,\n    lastRefreshAt: new Date(),\n  };\n}\n\nfunction recordFromCredentialRow(row: Record<string, unknown>, owner: string): ConnectCredentialRecord {\n  const storageMode = stringFrom(row.storageMode) === PLAINTEXT_CREDENTIAL_STORAGE_MODE\n    ? PLAINTEXT_CREDENTIAL_STORAGE_MODE\n    : stringFrom(row.storageMode);\n  const secretPayload = typeof row.secretPayload === 'string' ? row.secretPayload : '';\n  decodePlaintextCredential({\n    storageMode,\n    secretPayload,\n    encryptedSecret: row.encryptedSecret,\n    wrappedDataKey: row.wrappedDataKey,\n    encryptionAlgorithm: row.encryptionAlgorithm,\n  });\n  const id = stringFrom(row.id);\n  const provider = providerFromRelation(stringFrom(row.provider))\n    || providerFromCredentialId(id);\n  const deployment = deploymentFromCredentialId(id);\n  const credentialIri = stringFrom(row.credentialIri)\n    || aiRuntimeRepository.credentialIri(owner, { deployment, provider });\n  return {\n    id,\n    credentialIri,\n    webId: owner,\n    provider,\n    deployment,\n    authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',\n    storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n    secretPayload,\n    status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',\n    accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,\n    expiresAt: dateFrom(row.expiresAt),\n    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,\n    version: versionFromRow(row),\n    reauthRequired: row.reauthRequired === true || row.reauthRequired === 'true',\n    metadata: metadataFromRow(row),\n  };\n}\n\nfunction providerFromRelation(value: string): string | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const withoutFragment = value.split('#', 1)[0] ?? value;\n  const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;\n  const provider = fileName.replace(/\\.ttl$/u, '');\n  return provider ? normalizeProvider(provider) : undefined;\n}\n\nfunction isPodResourceNotFound(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  return /\\b404\\b|not found/i.test(error.message);\n}\n\nfunction metadataFromRow(row: Record<string, unknown>): Record<string, unknown> | undefined {\n  const value = row.metadata;\n  if (!value) {\n    return undefined;\n  }\n  if (typeof value === 'object' && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  if (typeof value === 'string') {\n    try {\n      const parsed = JSON.parse(value);\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? parsed as Record<string, unknown>\n        : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nfunction modelsFromMetadata(metadata: Record<string, unknown> | undefined): string[] | undefined {\n  const value = metadata?.models;\n  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : undefined;\n}\n\nfunction defaultModelFromMetadata(metadata: Record<string, unknown> | undefined): string | undefined {\n  const value = metadata?.defaultModel;\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction priorityFromMetadata(metadata: Record<string, unknown> | undefined): number | undefined {\n  const value = metadata?.priority;\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction runtimeCredentialFromMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> | undefined {\n  const value = metadata?.runtimeCredential;\n  return value && typeof value === 'object' && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : undefined;\n}\n\nfunction versionFromRow(row: Record<string, unknown>): number {\n  const value = row.keyVersion;\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : 0;\n  }\n  return 0;\n}\n\nfunction providerFromCredentialId(id: string): string {\n  const match = /\\/([^/#]+)\\.ttl#/u.exec(id);\n  return match?.[1] ?? '';\n}\n\nfunction deploymentFromCredentialId(id: string): GatewayDeployment {\n  return id.includes('#cloud-') ? 'cloud' : 'local';\n}\n\nfunction dateFrom(value: unknown): Date | undefined {\n  if (value instanceof Date) {\n    return value;\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n  }\n  return undefined;\n}\n\nfunction signAttempt(\n  attempt: Pick<ConnectAttempt, 'id' | 'provider' | 'deployment' | 'webId' | 'mode' | 'state' | 'expiresAt'>,\n  secret: string,\n): string {\n  return createHmac('sha256', secret)\n    .update(JSON.stringify({\n      id: attempt.id,\n      provider: attempt.provider,\n      deployment: attempt.deployment,\n      webId: attempt.webId,\n      mode: attempt.mode,\n      state: attempt.state,\n      expiresAt: attempt.expiresAt.toISOString(),\n    }))\n    .digest('base64url');\n}\n\nfunction signatureMatches(actual: string, expected: string): boolean {\n  const actualBuffer = Buffer.from(actual, 'utf8');\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction codeChallenge(verifier: string): string {\n  return createHash('sha256').update(verifier).digest('base64url');\n}\n\n\nfunction cloneAttempt(attempt: ConnectAttempt): ConnectAttempt {\n  return {\n    ...attempt,\n    expiresAt: new Date(attempt.expiresAt),\n    consumedAt: attempt.consumedAt ? new Date(attempt.consumedAt) : undefined,\n    nextPollAt: attempt.nextPollAt ? new Date(attempt.nextPollAt) : undefined,\n    pollClaimedAt: attempt.pollClaimedAt ? new Date(attempt.pollClaimedAt) : undefined,\n  };\n}\n\nfunction normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nasync function safeJson(response: Response): Promise<Record<string, unknown>> {\n  const text = await response.text();\n  if (!text) {\n    if (response.ok) {\n      throw new Error('Provider returned an empty JSON response');\n    }\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(text);\n    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n      if (response.ok) {\n        throw new Error('Provider returned a non-object JSON response');\n      }\n      return {};\n    }\n    return parsed as Record<string, unknown>;\n  } catch {\n    if (response.ok) {\n      throw new Error('Provider returned invalid JSON');\n    }\n    return {};\n  }\n}\n\nfunction stringFrom(value: unknown): string {\n  return typeof value === 'string' ? value : '';\n}\n\nfunction numberFrom(value: unknown, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) ? value : fallback;\n}\n\nfunction expiresAtFrom(expiresIn: unknown, now: Date): Date | undefined {\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {\n    return undefined;\n  }\n  return new Date(now.getTime() + expiresIn * 1000);\n}\n\nfunction safeProviderError(body: Record<string, unknown>): string {\n  const code = stringFrom(body.error);\n  if (SAFE_PROVIDER_ERROR_CODES.has(code)) {\n    return code;\n  }\n  if (!code) {\n    return 'provider_error';\n  }\n  if (code.endsWith('_error')) {\n    return 'provider_error';\n  }\n  return 'provider_error';\n}\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  'authorization_pending',\n  'slow_down',\n  'expired_token',\n  'access_denied',\n  'invalid_grant',\n  'invalid_client',\n]);\n\nfunction pendingResult(\n  input: PollDeviceInput,\n  status: ConnectAttemptStatus,\n  intervalSeconds?: number,\n): ConnectBeginResult {\n  return {\n    mode: 'deviceCodeOAuth',\n    status,\n    provider: 'kimi',\n    deployment: input.deployment,\n    attemptId: input.attemptId,\n    intervalSeconds,\n  };\n}\n\nfunction assertKimiEndpoint(endpoint: string, pathname: string): void {\n  const url = new URL(endpoint);\n  if (\n    url.origin !== 'https://auth.kimi.com'\n    || url.pathname !== pathname\n    || url.search\n    || url.hash\n    || url.username\n    || url.password\n  ) {\n    throw new Error('Kimi Connect endpoint is not allowlisted');\n  }\n}\n\nfunction requireStringField(body: Record<string, unknown>, field: string): void {\n  if (typeof body[field] !== 'string' || !(body[field] as string).trim()) {\n    throw new Error(`Provider response missing required field: ${field}`);\n  }\n}\n\nfunction isVersionConflict(error: unknown): boolean {\n  return error instanceof Error && /version_conflict|credential_version_conflict/u.test(error.message);\n}\n\nfunction decodeJwtSubject(idToken: string): string | undefined {\n  const payload = idToken.split('.')[1];\n  if (!payload) {\n    return undefined;\n  }\n  try {\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));\n    return typeof decoded.sub === 'string' ? decoded.sub : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/api/ai-gateway/credentials/PlaintextCredentialPayload.d.ts

@@ -0,0 +1,17 @@
+import type { ProviderSecret } from './CredentialVault';
+export declare const PLAINTEXT_CREDENTIAL_STORAGE_MODE = "plaintext-v1";
+export declare const SECRET_CELL_CREDENTIAL_STORAGE_MODE = "secret-cell-v1";
+export type PlaintextCredentialStorageMode = typeof PLAINTEXT_CREDENTIAL_STORAGE_MODE;
+export interface PlaintextCredentialRow {
+    storageMode?: unknown;
+    secretPayload?: unknown;
+    encryptedSecret?: unknown;
+    wrappedDataKey?: unknown;
+    encryptionAlgorithm?: unknown;
+}
+export declare class UnsupportedCredentialStorageModeError extends Error {
+    readonly storageMode: string;
+    constructor(storageMode: string);
+}
+export declare function encodePlaintextCredential(secret: ProviderSecret): string;
+export declare function decodePlaintextCredential(row: PlaintextCredentialRow): ProviderSecret;

package/dist/api/ai-gateway/credentials/PlaintextCredentialPayload.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedCredentialStorageModeError = exports.SECRET_CELL_CREDENTIAL_STORAGE_MODE = exports.PLAINTEXT_CREDENTIAL_STORAGE_MODE = void 0;
+exports.encodePlaintextCredential = encodePlaintextCredential;
+exports.decodePlaintextCredential = decodePlaintextCredential;
+exports.PLAINTEXT_CREDENTIAL_STORAGE_MODE = 'plaintext-v1';
+exports.SECRET_CELL_CREDENTIAL_STORAGE_MODE = 'secret-cell-v1';
+class UnsupportedCredentialStorageModeError extends Error {
+    constructor(storageMode) {
+        super(`Unsupported credential storage mode: ${storageMode}`);
+        this.name = 'UnsupportedCredentialStorageModeError';
+        this.storageMode = storageMode;
+    }
+}
+exports.UnsupportedCredentialStorageModeError = UnsupportedCredentialStorageModeError;
+function encodePlaintextCredential(secret) {
+    if (!isValidProviderSecret(secret)) {
+        throw new UnsupportedCredentialStorageModeError(exports.PLAINTEXT_CREDENTIAL_STORAGE_MODE);
+    }
+    return JSON.stringify(secret);
+}
+function decodePlaintextCredential(row) {
+    const storageMode = storageModeFromRow(row);
+    if (storageMode !== exports.PLAINTEXT_CREDENTIAL_STORAGE_MODE) {
+        throw new UnsupportedCredentialStorageModeError(storageMode);
+    }
+    if (typeof row.secretPayload !== 'string' || !row.secretPayload.trim()) {
+        throw new UnsupportedCredentialStorageModeError(storageMode);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(row.secretPayload);
+    }
+    catch {
+        throw new UnsupportedCredentialStorageModeError(storageMode);
+    }
+    if (!isValidProviderSecret(parsed)) {
+        throw new UnsupportedCredentialStorageModeError(storageMode);
+    }
+    return parsed;
+}
+function storageModeFromRow(row) {
+    if (row.encryptedSecret !== undefined
+        || row.wrappedDataKey !== undefined
+        || row.encryptionAlgorithm !== undefined) {
+        return exports.SECRET_CELL_CREDENTIAL_STORAGE_MODE;
+    }
+    if (typeof row.storageMode === 'string' && row.storageMode.trim()) {
+        return row.storageMode.trim();
+    }
+    return 'missing';
+}
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function isValidProviderSecret(value) {
+    if (!isPlainObject(value)) {
+        return false;
+    }
+    return ['apiKey', 'accessToken', 'refreshToken', 'token'].some((field) => {
+        const token = value[field];
+        return typeof token === 'string' && token.trim().length > 0;
+    });
+}
+//# sourceMappingURL=PlaintextCredentialPayload.js.map

package/dist/api/ai-gateway/credentials/PlaintextCredentialPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlaintextCredentialPayload.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/PlaintextCredentialPayload.ts"],"names":[],"mappings":";;;AAyBA,8DAKC;AAED,8DAkBC;AAhDY,QAAA,iCAAiC,GAAG,cAAc,CAAC;AACnD,QAAA,mCAAmC,GAAG,gBAAgB,CAAC;AAYpE,MAAa,qCAAsC,SAAQ,KAAK;IAG9D,YAAmB,WAAmB;QACpC,KAAK,CAAC,wCAAwC,WAAW,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AARD,sFAQC;AAED,SAAgB,yBAAyB,CAAC,MAAsB;IAC9D,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,qCAAqC,CAAC,yCAAiC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAgB,yBAAyB,CAAC,GAA2B;IACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,yCAAiC,EAAE,CAAC;QACtD,MAAM,IAAI,qCAAqC,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,qCAAqC,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qCAAqC,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,qCAAqC,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,IACE,GAAG,CAAC,eAAe,KAAK,SAAS;WAC9B,GAAG,CAAC,cAAc,KAAK,SAAS;WAChC,GAAG,CAAC,mBAAmB,KAAK,SAAS,EACxC,CAAC;QACD,OAAO,2CAAmC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAClE,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ProviderSecret } from './CredentialVault';\n\nexport const PLAINTEXT_CREDENTIAL_STORAGE_MODE = 'plaintext-v1';\nexport const SECRET_CELL_CREDENTIAL_STORAGE_MODE = 'secret-cell-v1';\n\nexport type PlaintextCredentialStorageMode = typeof PLAINTEXT_CREDENTIAL_STORAGE_MODE;\n\nexport interface PlaintextCredentialRow {\n  storageMode?: unknown;\n  secretPayload?: unknown;\n  encryptedSecret?: unknown;\n  wrappedDataKey?: unknown;\n  encryptionAlgorithm?: unknown;\n}\n\nexport class UnsupportedCredentialStorageModeError extends Error {\n  public readonly storageMode: string;\n\n  public constructor(storageMode: string) {\n    super(`Unsupported credential storage mode: ${storageMode}`);\n    this.name = 'UnsupportedCredentialStorageModeError';\n    this.storageMode = storageMode;\n  }\n}\n\nexport function encodePlaintextCredential(secret: ProviderSecret): string {\n  if (!isValidProviderSecret(secret)) {\n    throw new UnsupportedCredentialStorageModeError(PLAINTEXT_CREDENTIAL_STORAGE_MODE);\n  }\n  return JSON.stringify(secret);\n}\n\nexport function decodePlaintextCredential(row: PlaintextCredentialRow): ProviderSecret {\n  const storageMode = storageModeFromRow(row);\n  if (storageMode !== PLAINTEXT_CREDENTIAL_STORAGE_MODE) {\n    throw new UnsupportedCredentialStorageModeError(storageMode);\n  }\n  if (typeof row.secretPayload !== 'string' || !row.secretPayload.trim()) {\n    throw new UnsupportedCredentialStorageModeError(storageMode);\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(row.secretPayload);\n  } catch {\n    throw new UnsupportedCredentialStorageModeError(storageMode);\n  }\n  if (!isValidProviderSecret(parsed)) {\n    throw new UnsupportedCredentialStorageModeError(storageMode);\n  }\n  return parsed;\n}\n\nfunction storageModeFromRow(row: PlaintextCredentialRow): string {\n  if (\n    row.encryptedSecret !== undefined\n    || row.wrappedDataKey !== undefined\n    || row.encryptionAlgorithm !== undefined\n  ) {\n    return SECRET_CELL_CREDENTIAL_STORAGE_MODE;\n  }\n  if (typeof row.storageMode === 'string' && row.storageMode.trim()) {\n    return row.storageMode.trim();\n  }\n  return 'missing';\n}\n\nfunction isPlainObject(value: unknown): value is ProviderSecret {\n  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction isValidProviderSecret(value: unknown): value is ProviderSecret {\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  return ['apiKey', 'accessToken', 'refreshToken', 'token'].some((field) => {\n    const token = value[field];\n    return typeof token === 'string' && token.trim().length > 0;\n  });\n}\n"]}

package/dist/api/ai-gateway/pod/HostedPodDataAccess.d.ts

@@ -0,0 +1,24 @@
+import type { AuthContext } from '../../auth/AuthContext';
+export interface InternalPodAccessTokenProvider {
+    getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined>;
+}
+export type InternalPodAccessAuthContext = AuthContext | undefined;
+export interface HostedPodDataAccessOptions {
+    cssBaseUrl: string;
+    gatewayAdminProxyAuthSecret?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+    nonce?: () => string;
+}
+export declare class HostedPodDataAccess implements InternalPodAccessTokenProvider {
+    private readonly cssBaseUrl;
+    private readonly gatewayAdminProxyAuthSecret?;
+    private readonly fetch;
+    private readonly now;
+    private readonly nonce;
+    constructor(options: HostedPodDataAccessOptions);
+    getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined>;
+    private authorize;
+    private assertHostedAllowedResource;
+    private headersForLoopback;
+}