@undefineds.co/xpod 0.3.71-rc.8 → 0.3.71

package/dist/api/ai-gateway/connect/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/connect/index.ts"],"names":[],"mappings":";;;AAAA,6CAAsG;AACtG,gEAAuE;AACvE,kDAI+B;AAE/B,0FAImD;AAGnD,oEAA6E;AA+J7E,MAAa,gCAAgC;IAO3C,YAAmB,UAAmD,EAAE;QACtE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW;eACjC,+CAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kCAAkC,CAAC;QACzE,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAK1B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAKhC;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAI5B;QAiBC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CACtB,UAAU,EACV,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAkC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACvD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;aAC1D,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3C,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,KAAK,CAAC,yBAAyB,CACpC,MAA+B,EAC/B,OAAgC;QAEhC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,GAAG,MAAM;YACT,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzF,OAAO,uBAAuB,CAAC,OAAO,IAAI,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,KAO/B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QAIxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,IAAkB;QACjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AA/LD,4EA+LC;AAyCD,MAAa,2BAA2B;IAAxC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC7C,gBAAW,GAAG,KAAK,CAAC;IAsGvC,CAAC;IApGQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,GAAU;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAS;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,GAAS;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAU,EACV,KAIC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAChD,OAAO,CAAC,0BAA0B,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC9C,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAS,EAAE,QAAiB;QAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAxGD,kEAwGC;AAaD,MAAa,mCAAmC;IAU9C,YAAmB,OAAmD;QACpE,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAe,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;SACjC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAA0B;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAA,sDAAyB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACvE,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/F,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,8DAAiC;YAC9C,aAAa;YACb,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,QAAQ,CAAC,yBAAyB;SACpD,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzB,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,EAAE;SACxB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAsB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,KAAwB,EAAE,SAAe,EAAE,QAAiC,EAAE;QAC1G,MAAM,uBAAuB,GAAsC;YACjE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,aAAa;YACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS;YACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,GAAG,KAAK;SACT,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,uBAAuB,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,KAAsB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,KAAsB,EAAE,IAAiB;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,gBAAgB,CAAC,OAAuB;QAChD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAES,WAAW,CAAC,KAAwB,EAAE,IAAiB;QAC/D,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AA7KD,kFA6KC;AASD,MAAa,4BAA6B,SAAQ,mCAAmC;IAMnF,YAAmB,OAA4C;QAC7D,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,sDAAsD,CAAC;QACjI,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uCAAuC,CAAC;QACtF,kBAAkB,CAAC,IAAI,CAAC,2BAA2B,EAAE,iCAAiC,CAAC,CAAC;QACxF,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAEe,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;aAC9B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACtC,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE;YAC1F,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACxC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,0BAA0B,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACpC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,uBAAuB,EAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC;YACnE,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,aAAa,CAClB,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,EACpF,KAAK,CAAC,OAAO,CAAC,0BAA0B,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;oBACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;oBAC1B,MAAM,eAAe,GAAG,MAAM,KAAK,WAAW;wBAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;wBAC1E,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;oBACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE;wBACtD,eAAe;wBACf,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC;wBAC5D,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;oBACnE,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACnE,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAC/F,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe;SAC/E,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAmB,EACnB,OAAgC,EAChC,MAAsB;QAEtB,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,uBAAuB;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAEe,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAA2E,EAC3E,IAA6B,EAC7B,eAAwB;QAExB,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAmB;YAC7B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;YACnC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnC,CAAC;QACF,OAAO,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACzD,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACxF,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,WAAW,EAAE,8DAAiC;YAC9C,aAAa,EAAE,IAAA,sDAAyB,EAAC,MAAM,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE;gBACR,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClE;SACF,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AAvOD,oEAuOC;AAED,MAAa,sBAAsB;IAAnC;QACkB,aAAQ,GAAG,UAAU,CAAC;IAexC,CAAC;IAbQ,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,yBAAyB,EAAE,IAAI;YAC/B,OAAO,EAAE,8GAA8G;SACxH,CAAC;IACJ,CAAC;CACF;AAhBD,wDAgBC;AAwBD,MAAa,sBAAsB;IAKjC,YAAmB,OAAsC;QAFxC,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAGpE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAwB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI;gBAC7B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,yBAAyB;gBACvE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAI1B;QACC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,aAAa;gBACzD,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;oBAC9C,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC;gBACF,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;oBACrD,GAAG,KAAK;oBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;iBACxB,CAAC,CAAC;YACL,MAAM,MAAM,GAAG,UAAU,EAAE,MAAM,KAAK,QAAQ,CAAC;YAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC;YACpE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBAC/B,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBACvE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,gBAAyB;oBAC3B,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,WAAoB;wBACtB,CAAC,CAAC,cAAuB;gBAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBAC1D,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC5D,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAChD,OAAO,EAAE;oBACP,KAAK;oBACL,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK;oBACpD,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;iBAC3D;aACF,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,KAA0B;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,OAAO,CAAC,KAAmB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAmB,EACnB,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,sDAAyB,EAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC3E,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAnJD,wDAmJC;AAED,SAAS,KAAK,CAAC,WAAsC;IACnD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kCAAkC,CAAC,KAM3C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,UAAU;YACV,UAAU;SACX;KACF,CACkC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,2BAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;QAC9C,aAAa,EAAE,IAAI,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B,EAAE,KAAa;IAC1E,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,8DAAiC;QACnF,CAAC,CAAC,8DAAiC;QACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAA,sDAAyB,EAAC;QACxB,WAAW;QACX,aAAa;QACb,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WAC1D,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;WAC9C,4BAAmB,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,EAAE;QACF,aAAa;QACb,KAAK,EAAE,KAAK;QACZ,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ;QACvF,WAAW,EAAE,8DAAiC;QAC9C,aAAa;QACb,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACnE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;QAChF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAC5E,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,MAAiC;gBACnC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6C;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA6C;IAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA6C;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA6C;IAClF,MAAM,KAAK,GAAG,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAU;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,0BAA0B,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,OAA0G,EAC1G,MAAc;IAEd,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;SACF,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAGD,SAAS,YAAY,CAAC,OAAuB;IAC3C,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAS;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAsB,EACtB,MAA4B,EAC5B,eAAwB;IAExB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,MAAM,KAAK,uBAAuB;WACnC,GAAG,CAAC,QAAQ,KAAK,QAAQ;WACzB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IACtE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAE,IAAI,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,KAAK,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, createHmac, randomBytes as nodeRandomBytes, timingSafeEqual } from 'node:crypto';\nimport { alias, and, drizzle, eq } from '@undefineds.co/drizzle-solid';\nimport {\n  aiProviderResource,\n  aiRuntimeRepository,\n  credentialResource,\n} from '@undefineds.co/models';\nimport type { ProviderSecret } from '../credentials/CredentialVault';\nimport {\n  decodePlaintextCredential,\n  encodePlaintextCredential,\n  PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n} from '../credentials/PlaintextCredentialPayload';\nimport type { GatewayDeployment } from '../auth/InvocationTokenCodec';\nimport type { ProviderRegistry } from '../providers/ProviderRegistry';\nimport { DEFAULT_PROVIDER_DESCRIPTORS } from '../providers/ProviderRegistry';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';\n\nexport type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';\nexport type ConnectAttemptStatus =\n  | 'pending'\n  | 'authorization_pending'\n  | 'slow_down'\n  | 'completed'\n  | 'expired'\n  | 'unsupported';\n\nexport interface ConnectBeginInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  requestedMode: ConnectMode;\n  expectedCredentialVersion?: number;\n  auth?: AuthContext;\n}\n\nexport interface ConnectBeginResult {\n  mode: ConnectMode;\n  status: ConnectAttemptStatus;\n  provider: string;\n  deployment: GatewayDeployment;\n  attemptId?: string;\n  state?: string;\n  signature?: string;\n  expiresAt?: string;\n  authorizationUrl?: string;\n  pkceChallenge?: string;\n  deviceCode?: string;\n  userCode?: string;\n  verificationUri?: string;\n  verificationUriComplete?: string;\n  intervalSeconds?: number;\n  apiKeyManagementSupported?: boolean;\n  credentialId?: string;\n  message?: string;\n}\n\nexport interface CompleteApiKeyInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  apiKey: string;\n  accountLabel?: string;\n  auth?: AuthContext;\n}\n\nexport interface PollDeviceInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  auth?: AuthContext;\n}\n\nexport interface RefreshInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface DisconnectInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface ConnectCredentialRecord {\n  id: string;\n  credentialIri: string;\n  webId: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  authMode: 'apiKey' | 'deviceCodeOAuth';\n  storageMode: 'plaintext-v1';\n  secretPayload: string;\n  status: 'active' | 'revoked';\n  accountLabel?: string;\n  expiresAt?: Date;\n  scopes?: string[];\n  expectedVersion?: number;\n  version?: number;\n  reauthRequired?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface PodCredentialRepository {\n  getCredential?(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord>;\n  markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ntype ConnectedCredentialDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  insert(resource: typeof credentialResource): {\n    values(value: unknown): { execute(): Promise<unknown[]> };\n  };\n  select(): {\n    from(resource: typeof credentialResource): {\n      where(condition: unknown): { execute(): Promise<Record<string, unknown>[]> };\n    };\n  };\n  findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;\n  update(resource: typeof credentialResource): {\n    set(patch: unknown): {\n      where(condition: unknown): {\n        returning(): { execute(): Promise<Record<string, unknown>[]> };\n      };\n    };\n  };\n};\n\nexport interface PodConnectedCredentialRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  providerIds?: string[];\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n    credential?: typeof credentialResource;\n    aiProvider?: typeof aiProviderResource;\n  }) => Promise<ConnectedCredentialDb>;\n}\n\nexport class PodConnectedCredentialRepository implements PodCredentialRepository {\n  private readonly dbFactory: NonNullable<PodConnectedCredentialRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n  private readonly providerIds: string[];\n  private readonly credentialTemplate: typeof credentialResource;\n  private readonly aiProviderTemplate: typeof aiProviderResource;\n\n  public constructor(options: PodConnectedCredentialRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.providerIds = options.providerIds\n      ?? DEFAULT_PROVIDER_DESCRIPTORS.map((provider) => provider.id);\n    this.dbFactory = options.dbFactory ?? createDefaultConnectedCredentialDb;\n    this.credentialTemplate = alias(credentialResource, 'credentialTemplate');\n    this.aiProviderTemplate = alias(aiProviderResource, 'aiProviderTemplate');\n  }\n\n  public async getCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const row = await db.findById<Record<string, unknown>>(credential, id);\n    const record = row ? recordFromCredentialRow(row, input.webId) : undefined;\n    if (!record) {\n      return undefined;\n    }\n    return record;\n  }\n\n  public async getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const record = await this.getCredential(input);\n    return record?.status === 'active' && !record.reauthRequired ? record : undefined;\n  }\n\n  public async listCredentials(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<Array<{\n    id: string;\n    credentialIri: string;\n    provider: string;\n    authMode: 'apiKey' | 'deviceCodeOAuth';\n    enabled: boolean;\n    priority?: number;\n    models?: string[];\n    defaultModel?: string;\n    health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error';\n    quota?: { status: 'available' | 'unsupported' | 'exhausted' | 'error' };\n    storageMode: 'plaintext-v1';\n    secretPayload: string;\n    version?: number;\n    runtimeCredential?: Record<string, unknown>;\n    metadata?: Record<string, unknown>;\n  }>> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const rows = (await Promise.all(\n      this.providerIds.map(async (provider) => {\n        try {\n          return await db.findById<Record<string, unknown>>(\n            credential,\n            aiRuntimeRepository.credentialId({ deployment: input.deployment, provider }),\n          );\n        } catch (error) {\n          if (isPodResourceNotFound(error)) {\n            return null;\n          }\n          throw error;\n        }\n      }),\n    )).filter((row): row is Record<string, unknown> => row !== null);\n    return rows\n      .map((row) => recordFromCredentialRow(row, input.webId))\n      .filter((record) => record.webId === input.webId)\n      .filter((record) => record.deployment === input.deployment)\n      .filter((record) => record.status === 'active')\n      .map((record) => ({\n        id: record.id,\n        credentialIri: record.credentialIri,\n        provider: record.provider,\n        authMode: record.authMode,\n        enabled: !record.reauthRequired,\n        models: modelsFromMetadata(record.metadata),\n        defaultModel: defaultModelFromMetadata(record.metadata),\n        priority: priorityFromMetadata(record.metadata),\n        health: record.reauthRequired ? 'reauthRequired' : 'healthy',\n        quota: { status: 'available' },\n        storageMode: record.storageMode,\n        secretPayload: record.secretPayload,\n        version: record.version,\n        runtimeCredential: runtimeCredentialFromMetadata(record.metadata),\n        metadata: record.metadata,\n      }));\n  }\n\n  public async upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord> {\n    const { db, credential } = await this.dbForOwner(record.webId, context?.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, record.id);\n    const existingVersion = existing ? versionFromRow(existing) : 0;\n    if (record.expectedVersion !== undefined && record.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const nextVersion = existingVersion + 1;\n    const row = credentialRowFromRecord({\n      ...record,\n      version: nextVersion,\n    });\n    if (existing) {\n      const updated = await db.updateById<Record<string, unknown>>(credential, record.id, row);\n      return recordFromCredentialRow(updated ?? row, record.webId);\n    }\n    await db.insert(credential).values(row).execute();\n    return recordFromCredentialRow(row, record.webId);\n  }\n\n  public async markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const existingVersion = versionFromRow(existing);\n    if (input.expectedVersion !== undefined && input.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      reauthRequired: true,\n      status: 'active',\n      keyVersion: String(existingVersion + 1),\n    });\n    return updated ? recordFromCredentialRow(updated, input.webId) : undefined;\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      status: 'revoked',\n      keyVersion: String(versionFromRow(existing) + 1),\n    });\n    return updated ? recordFromCredentialRow(updated, input.webId) : undefined;\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<{\n    db: ConnectedCredentialDb;\n    credential: typeof credentialResource;\n  }> {\n    const trustedFetch = await this.resolveTrustedFetch(owner, auth);\n    const credential = alias(this.credentialTemplate, 'credential');\n    const aiProvider = alias(this.aiProviderTemplate, 'aiProvider');\n    const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });\n    await db.init?.(credential, aiProvider);\n    return { db, credential };\n  }\n\n  private async resolveTrustedFetch(owner: string, auth?: AuthContext): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner, auth);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport interface ProviderConnectAdapter {\n  readonly provider: string;\n  begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;\n  status?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;\n  pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  refresh?(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined>;\n  disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ninterface ConnectAttempt {\n  id: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  webId: string;\n  mode: ConnectMode;\n  state: string;\n  signature: string;\n  expiresAt: Date;\n  consumedAt?: Date;\n  expectedCredentialVersion?: number;\n  codeVerifier?: string;\n  deviceCode?: string;\n  intervalSeconds?: number;\n  currentPollIntervalSeconds?: number;\n  nextPollAt?: Date;\n  pollClaimedAt?: Date;\n  lastPollStatus?: ConnectAttemptStatus;\n}\n\ninterface PollClaimResult {\n  attempt: ConnectAttempt;\n  claimed: boolean;\n}\n\nexport class InMemoryConnectAttemptStore {\n  private readonly attempts = new Map<string, ConnectAttempt>();\n  private readonly maxAttempts = 1_000;\n\n  public async create(attempt: ConnectAttempt): Promise<ConnectAttempt> {\n    this.pruneExpired(new Date());\n    this.attempts.set(attempt.id, cloneAttempt(attempt));\n    this.pruneBounded();\n    return cloneAttempt(attempt);\n  }\n\n  public async get(id: string, now?: Date): Promise<ConnectAttempt | undefined> {\n    this.pruneExpired(now ?? new Date(), id);\n    const attempt = this.attempts.get(id);\n    if (attempt && now && attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n    }\n    return attempt ? cloneAttempt(attempt) : undefined;\n  }\n\n  public async consume(id: string, now: Date): Promise<ConnectAttempt> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    attempt.consumedAt = new Date(now);\n    return cloneAttempt(attempt);\n  }\n\n  public async claimPoll(id: string, now: Date): Promise<PollClaimResult> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.nextPollAt && attempt.nextPollAt.getTime() > now.getTime()) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    if (attempt.pollClaimedAt) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    attempt.pollClaimedAt = new Date(now);\n    return { attempt: cloneAttempt(attempt), claimed: true };\n  }\n\n  public async updatePollSchedule(\n    id: string,\n    patch: {\n      intervalSeconds: number;\n      nextPollAt: Date;\n      lastPollStatus: ConnectAttemptStatus;\n    },\n  ): Promise<ConnectAttempt | undefined> {\n    const attempt = this.attempts.get(id);\n    if (!attempt || attempt.consumedAt) {\n      return undefined;\n    }\n    attempt.intervalSeconds = patch.intervalSeconds;\n    attempt.currentPollIntervalSeconds = patch.intervalSeconds;\n    attempt.nextPollAt = new Date(patch.nextPollAt);\n    attempt.lastPollStatus = patch.lastPollStatus;\n    attempt.pollClaimedAt = undefined;\n    return cloneAttempt(attempt);\n  }\n\n  public async releasePollClaim(id: string): Promise<void> {\n    const attempt = this.attempts.get(id);\n    if (attempt) {\n      attempt.pollClaimedAt = undefined;\n    }\n  }\n\n  private pruneExpired(now: Date, exceptId?: string): void {\n    for (const [id, attempt] of this.attempts) {\n      if (id !== exceptId && attempt.expiresAt.getTime() <= now.getTime()) {\n        this.attempts.delete(id);\n      }\n    }\n  }\n\n  private pruneBounded(): void {\n    while (this.attempts.size > this.maxAttempts) {\n      const oldest = this.attempts.keys().next().value;\n      if (typeof oldest !== 'string') {\n        return;\n      }\n      this.attempts.delete(oldest);\n    }\n  }\n}\n\nexport interface BrowserAssistedApiKeyConnectAdapterOptions {\n  provider: string;\n  consoleUrl: string;\n  attempts: InMemoryConnectAttemptStore;\n  credentialRepository: PodCredentialRepository;\n  deployment: GatewayDeployment;\n  now?: () => Date;\n  randomBytes?: (bytes: number) => Buffer;\n  signingSecret: string;\n}\n\nexport class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider: string;\n  private readonly consoleUrl: string;\n  protected readonly attempts: InMemoryConnectAttemptStore;\n  protected readonly credentialRepository: PodCredentialRepository;\n  protected readonly deployment: GatewayDeployment;\n  protected readonly now: () => Date;\n  protected readonly randomBytes: (bytes: number) => Buffer;\n  private readonly signingSecret: string;\n\n  public constructor(options: BrowserAssistedApiKeyConnectAdapterOptions) {\n    this.provider = normalizeProvider(options.provider);\n    this.consoleUrl = options.consoleUrl;\n    this.attempts = options.attempts;\n    this.credentialRepository = options.credentialRepository;\n    this.deployment = options.deployment;\n    this.now = options.now ?? (() => new Date());\n    this.randomBytes = options.randomBytes ?? nodeRandomBytes;\n    this.signingSecret = options.signingSecret;\n  }\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'browserAssistedApiKey');\n    const now = this.now();\n    const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);\n    const attempt = await this.createAttempt(input, expiresAt);\n    const url = new URL(this.consoleUrl);\n    url.searchParams.set('xpod_connect_attempt', attempt.id);\n    url.searchParams.set('xpod_provider', this.provider);\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'pending',\n      provider: this.provider,\n      deployment: this.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: expiresAt.toISOString(),\n      authorizationUrl: url.toString(),\n    };\n  }\n\n  public async completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    if (!input.apiKey.trim()) {\n      throw new Error('API key is required');\n    }\n    const attempt = await this.loadConsumableAttempt(input, 'browserAssistedApiKey');\n    const consumed = await this.attempts.consume(input.attemptId, this.now());\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: this.provider,\n    });\n    const secretPayload = encodePlaintextCredential({ type: 'apiKey', apiKey: input.apiKey });\n    const record = await this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),\n      credentialIri,\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      authMode: 'apiKey',\n      storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n      secretPayload,\n      status: 'active',\n      accountLabel: input.accountLabel,\n      expectedVersion: consumed.expectedCredentialVersion,\n    }, { auth: input.auth });\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'completed',\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      credentialId: record.id,\n    };\n  }\n\n  public async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'browserAssistedApiKey');\n    return {\n      mode: attempt.mode,\n      status: this.statusForAttempt(attempt),\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n    };\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  protected async createAttempt(input: ConnectBeginInput, expiresAt: Date, extra: Partial<ConnectAttempt> = {}): Promise<ConnectAttempt> {\n    const attemptWithoutSignature: Omit<ConnectAttempt, 'signature'> = {\n      id: token(this.randomBytes),\n      provider: this.provider,\n      deployment: input.deployment,\n      webId: input.webId,\n      mode: input.requestedMode,\n      state: token(this.randomBytes),\n      expiresAt,\n      expectedCredentialVersion: input.expectedCredentialVersion,\n      ...extra,\n    };\n    const signature = signAttempt(attemptWithoutSignature, this.signingSecret);\n    return this.attempts.create({ ...attemptWithoutSignature, signature });\n  }\n\n  protected async loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.attempts.get(input.attemptId, this.now());\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.webId !== input.webId) {\n      throw new Error('Connect attempt is bound to a different WebID');\n    }\n    if (attempt.deployment !== input.deployment) {\n      throw new Error('Connect attempt is bound to a different deployment');\n    }\n    if (attempt.provider !== normalizeProvider(input.provider)) {\n      throw new Error('Connect attempt is bound to a different provider');\n    }\n    if (attempt.mode !== mode) {\n      throw new Error('Connect attempt mode mismatch');\n    }\n    if (attempt.state !== input.state) {\n      throw new Error('Invalid Connect attempt state');\n    }\n    if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {\n      throw new Error('Invalid Connect attempt signature');\n    }\n    return attempt;\n  }\n\n  protected async loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.loadAttemptForStatus(input, mode);\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    return attempt;\n  }\n\n  protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus {\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      return 'expired';\n    }\n    return attempt.consumedAt ? 'completed' : 'pending';\n  }\n\n  protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    if (input.deployment !== this.deployment) {\n      throw new Error('Connect deployment mismatch');\n    }\n    if (input.requestedMode !== mode) {\n      throw new Error('Unsupported Connect mode');\n    }\n    if (!input.webId) {\n      throw new Error('Connect WebID is required');\n    }\n  }\n}\n\nexport interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {\n  fetch?: typeof fetch;\n  clientId: string;\n  deviceAuthorizationEndpoint?: string;\n  tokenEndpoint?: string;\n}\n\nexport class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientId: string;\n  private readonly deviceAuthorizationEndpoint: string;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: KimiDeviceCodeConnectAdapterOptions) {\n    super({\n      ...options,\n      provider: 'kimi',\n      consoleUrl: 'https://kimi.moonshot.cn/device',\n    });\n    this.fetchImpl = options.fetch ?? fetch;\n    this.clientId = options.clientId;\n    this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';\n    this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';\n    assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');\n    assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');\n  }\n\n  public override async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'deviceCodeOAuth');\n    const now = this.now();\n    const verifier = token(this.randomBytes);\n    const challenge = codeChallenge(verifier);\n    const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: this.clientId,\n        code_challenge: challenge,\n        code_challenge_method: 'S256',\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);\n    }\n    requireStringField(body, 'device_code');\n    requireStringField(body, 'user_code');\n    requireStringField(body, 'verification_uri_complete');\n    const expiresIn = numberFrom(body.expires_in, 300);\n    const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {\n      mode: 'deviceCodeOAuth',\n      codeVerifier: verifier,\n      deviceCode: stringFrom(body.device_code),\n      intervalSeconds: numberFrom(body.interval, 5),\n      currentPollIntervalSeconds: numberFrom(body.interval, 5),\n      nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),\n    });\n    return {\n      mode: 'deviceCodeOAuth',\n      status: 'pending',\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: attempt.expiresAt.toISOString(),\n      pkceChallenge: challenge,\n      deviceCode: attempt.deviceCode,\n      userCode: stringFrom(body.user_code),\n      verificationUri: stringFrom(body.verification_uri),\n      verificationUriComplete: stringFrom(body.verification_uri_complete),\n      intervalSeconds: attempt.intervalSeconds,\n    };\n  }\n\n  public async pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');\n    const now = this.nowForConsume();\n    const claim = await this.attempts.claimPoll(input.attemptId, now);\n    if (!claim.claimed) {\n      return pendingResult(\n        input,\n        claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending',\n        claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds,\n      );\n    }\n    try {\n      const response = await this.fetchImpl(this.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: attempt.deviceCode ?? '',\n          client_id: this.clientId,\n          code_verifier: attempt.codeVerifier ?? '',\n        }),\n      });\n      const body = await safeJson(response);\n      if (!response.ok) {\n        if (body.error === 'authorization_pending' || body.error === 'slow_down') {\n          const status = body.error;\n          const intervalSeconds = status === 'slow_down'\n            ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5\n            : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);\n          await this.attempts.updatePollSchedule(input.attemptId, {\n            intervalSeconds,\n            nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),\n            lastPollStatus: status,\n          });\n          return pendingResult(input, status, intervalSeconds);\n        }\n        if (body.error === 'expired_token') {\n          await this.attempts.consume(input.attemptId, this.nowForConsume());\n          return pendingResult(input, 'expired');\n        }\n        throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);\n      }\n      await this.attempts.consume(input.attemptId, this.nowForConsume());\n      requireStringField(body, 'access_token');\n      requireStringField(body, 'refresh_token');\n      const record = await this.storeOAuthCredential(input, body, attempt.expectedCredentialVersion);\n      return {\n        mode: 'deviceCodeOAuth',\n        status: 'completed',\n        provider: 'kimi',\n        deployment: input.deployment,\n        attemptId: input.attemptId,\n        credentialId: record.id,\n      };\n    } catch (error) {\n      await this.attempts.releasePollClaim(input.attemptId);\n      throw error;\n    }\n  }\n\n  public override async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');\n    return {\n      mode: 'deviceCodeOAuth',\n      status: this.statusForAttempt(attempt),\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n      deviceCode: attempt.deviceCode,\n      intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,\n    };\n  }\n\n  public async refresh(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const refreshToken = stringFrom(secret.refreshToken);\n    if (!refreshToken) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: 'missing_refresh_token',\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    const response = await this.fetchImpl(this.tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: this.clientId,\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: safeProviderError(body),\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    requireStringField(body, 'access_token');\n    requireStringField(body, 'refresh_token');\n    return this.storeOAuthCredential(input, body, current.version);\n  }\n\n  public override async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  private nowForConsume(): Date {\n    return this.now();\n  }\n\n  private async storeOAuthCredential(\n    input: { webId: string; deployment: GatewayDeployment; auth?: AuthContext },\n    body: Record<string, unknown>,\n    expectedVersion?: number,\n  ): Promise<ConnectCredentialRecord> {\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: 'kimi',\n    });\n    const expiresAt = expiresAtFrom(body.expires_in, this.now());\n    const secret: ProviderSecret = {\n      type: 'deviceCodeOAuth',\n      accessToken: stringFrom(body.access_token),\n      refreshToken: stringFrom(body.refresh_token),\n      expiresAt: expiresAt?.toISOString(),\n      scope: stringFrom(body.scope),\n      idToken: stringFrom(body.id_token),\n    };\n    return this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),\n      credentialIri,\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      authMode: 'deviceCodeOAuth',\n      storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n      secretPayload: encodePlaintextCredential(secret),\n      status: 'active',\n      expiresAt,\n      expectedVersion,\n      metadata: {\n        authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),\n      },\n    }, { auth: input.auth });\n  }\n}\n\nexport class DeepSeekConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider = 'deepseek';\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    return {\n      mode: 'connectUnsupported',\n      status: 'unsupported',\n      provider: 'deepseek',\n      deployment: input.deployment,\n      apiKeyManagementSupported: true,\n      message: 'DeepSeek does not expose a supported third-party browser Connect flow; use authenticated API key management.',\n    };\n  }\n}\n\nexport interface ProviderConnectServiceOptions {\n  registry: ProviderRegistry;\n  adapters: ProviderConnectAdapter[];\n  credentialRepository?: PodCredentialRepository;\n}\n\nexport interface ProviderConnectionSummary {\n  provider: string;\n  status: 'connected' | 'disconnected' | 'reauthRequired';\n  authMode?: 'apiKey' | 'deviceCodeOAuth';\n  accountLabel?: string;\n  expiresAt?: string;\n  reauthRequired?: boolean;\n  credentialIri?: string;\n  version?: number;\n  connect: {\n    modes: string[];\n    configured: boolean;\n    message?: string;\n  };\n}\n\nexport class ProviderConnectService {\n  private readonly registry: ProviderRegistry;\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly adapters = new Map<string, ProviderConnectAdapter>();\n\n  public constructor(options: ProviderConnectServiceOptions) {\n    this.registry = options.registry;\n    this.credentialRepository = options.credentialRepository;\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    const descriptor = this.registry.requireProvider(input.provider);\n    if (descriptor.connect?.mode !== input.requestedMode) {\n      throw new Error('Requested Connect mode does not match provider capability');\n    }\n    if (descriptor.connect?.configured === false) {\n      return Promise.resolve({\n        mode: descriptor.connect.mode,\n        status: 'unsupported',\n        provider: normalizeProvider(input.provider),\n        deployment: input.deployment,\n        apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,\n        message: descriptor.connect.notes?.join(' '),\n      });\n    }\n    return this.requireAdapter(input.provider).begin(input);\n  }\n\n  public async listProviders(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ProviderConnectionSummary[]> {\n    return Promise.all(this.registry.listProviders().map(async (descriptor) => {\n      const credential = this.credentialRepository?.getCredential\n        ? await this.credentialRepository.getCredential({\n          ...input,\n          provider: descriptor.id,\n        })\n        : await this.credentialRepository?.getActiveCredential({\n          ...input,\n          provider: descriptor.id,\n        });\n      const active = credential?.status === 'active';\n      const reauthRequired = active && credential.reauthRequired === true;\n      const modes = Array.from(new Set([\n        ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),\n        ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),\n      ]));\n      return {\n        provider: descriptor.id,\n        status: reauthRequired\n          ? 'reauthRequired' as const\n          : active\n            ? 'connected' as const\n            : 'disconnected' as const,\n        authMode: active ? credential.authMode : undefined,\n        accountLabel: active ? credential.accountLabel : undefined,\n        expiresAt: active ? credential.expiresAt?.toISOString() : undefined,\n        reauthRequired: reauthRequired || undefined,\n        credentialIri: active ? credential.credentialIri : undefined,\n        version: active ? credential.version : undefined,\n        connect: {\n          modes,\n          configured: descriptor.connect?.configured !== false,\n          message: descriptor.connect?.notes?.join(' ') || undefined,\n        },\n      };\n    }));\n  }\n\n  public completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.completeApiKey) {\n      throw new Error('Provider does not support API key Connect completion');\n    }\n    return adapter.completeApiKey(input);\n  }\n\n  public pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.pollDevice) {\n      throw new Error('Provider does not support device-code polling');\n    }\n    return adapter.pollDevice(input);\n  }\n\n  public status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.status) {\n      throw new Error('Provider does not support Connect status');\n    }\n    return adapter.status(input);\n  }\n\n  public refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.refreshWithRetry(input, 2);\n  }\n\n  private async refreshWithRetry(\n    input: RefreshInput,\n    remainingAttempts: number,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.refresh) {\n      throw new Error('Provider does not support refresh');\n    }\n    if (!this.credentialRepository) {\n      throw new Error('PodCredentialRepository is required for provider refresh');\n    }\n    const current = await this.credentialRepository.getActiveCredential(input);\n    if (!current) {\n      throw new Error('Active provider credential not found');\n    }\n    const secret = decodePlaintextCredential(current);\n    try {\n      return await adapter.refresh(input, current, secret);\n    } catch (error) {\n      if (remainingAttempts > 0 && isVersionConflict(error)) {\n        const latest = await this.credentialRepository.getActiveCredential(input);\n        if (latest && latest.version !== current.version && !latest.reauthRequired) {\n          return latest;\n        }\n        return this.refreshWithRetry(input, remainingAttempts - 1);\n      }\n      throw error;\n    }\n  }\n\n  public disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.disconnect) {\n      throw new Error('Provider does not support disconnect');\n    }\n    return adapter.disconnect(input);\n  }\n\n  private requireAdapter(provider: string): ProviderConnectAdapter {\n    const adapter = this.adapters.get(normalizeProvider(provider));\n    if (!adapter) {\n      throw new Error(`No Connect adapter registered for ${provider}`);\n    }\n    return adapter;\n  }\n}\n\nfunction token(randomBytes: (bytes: number) => Buffer): string {\n  return randomBytes(32).toString('base64url');\n}\n\nfunction createDefaultConnectedCredentialDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n  credential?: typeof credentialResource;\n  aiProvider?: typeof aiProviderResource;\n}): Promise<ConnectedCredentialDb> {\n  const credential = input.credential ?? credentialResource;\n  const aiProvider = input.aiProvider ?? aiProviderResource;\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        credential,\n        aiProvider,\n      },\n    },\n  ) as unknown as ConnectedCredentialDb);\n}\n\nfunction credentialRowFromRecord(record: ConnectCredentialRecord): Record<string, unknown> {\n  return {\n    id: record.id,\n    provider: aiProviderResource.buildId({ id: normalizeProvider(record.provider) }),\n    service: 'ai',\n    authMode: record.authMode,\n    status: record.status,\n    storageMode: record.storageMode,\n    secretPayload: record.secretPayload,\n    keyVersion: String(record.version ?? 1),\n    scopes: record.scopes ?? [],\n    expiresAt: record.expiresAt,\n    accountLabel: record.accountLabel,\n    label: record.accountLabel,\n    reauthRequired: record.reauthRequired ?? false,\n    lastRefreshAt: new Date(),\n  };\n}\n\nfunction recordFromCredentialRow(row: Record<string, unknown>, owner: string): ConnectCredentialRecord {\n  const storageMode = stringFrom(row.storageMode) === PLAINTEXT_CREDENTIAL_STORAGE_MODE\n    ? PLAINTEXT_CREDENTIAL_STORAGE_MODE\n    : stringFrom(row.storageMode);\n  const secretPayload = typeof row.secretPayload === 'string' ? row.secretPayload : '';\n  decodePlaintextCredential({\n    storageMode,\n    secretPayload,\n    encryptedSecret: row.encryptedSecret,\n    wrappedDataKey: row.wrappedDataKey,\n    encryptionAlgorithm: row.encryptionAlgorithm,\n  });\n  const id = stringFrom(row.id);\n  const provider = providerFromRelation(stringFrom(row.provider))\n    || providerFromCredentialId(id);\n  const deployment = deploymentFromCredentialId(id);\n  const credentialIri = stringFrom(row.credentialIri)\n    || aiRuntimeRepository.credentialIri(owner, { deployment, provider });\n  return {\n    id,\n    credentialIri,\n    webId: owner,\n    provider,\n    deployment,\n    authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',\n    storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n    secretPayload,\n    status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',\n    accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,\n    expiresAt: dateFrom(row.expiresAt),\n    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,\n    version: versionFromRow(row),\n    reauthRequired: row.reauthRequired === true || row.reauthRequired === 'true',\n    metadata: metadataFromRow(row),\n  };\n}\n\nfunction providerFromRelation(value: string): string | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const withoutFragment = value.split('#', 1)[0] ?? value;\n  const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;\n  const provider = fileName.replace(/\\.ttl$/u, '');\n  return provider ? normalizeProvider(provider) : undefined;\n}\n\nfunction isPodResourceNotFound(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  return /\\b404\\b|not found/i.test(error.message);\n}\n\nfunction metadataFromRow(row: Record<string, unknown>): Record<string, unknown> | undefined {\n  const value = row.metadata;\n  if (!value) {\n    return undefined;\n  }\n  if (typeof value === 'object' && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  if (typeof value === 'string') {\n    try {\n      const parsed = JSON.parse(value);\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? parsed as Record<string, unknown>\n        : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nfunction modelsFromMetadata(metadata: Record<string, unknown> | undefined): string[] | undefined {\n  const value = metadata?.models;\n  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : undefined;\n}\n\nfunction defaultModelFromMetadata(metadata: Record<string, unknown> | undefined): string | undefined {\n  const value = metadata?.defaultModel;\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction priorityFromMetadata(metadata: Record<string, unknown> | undefined): number | undefined {\n  const value = metadata?.priority;\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction runtimeCredentialFromMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> | undefined {\n  const value = metadata?.runtimeCredential;\n  return value && typeof value === 'object' && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : undefined;\n}\n\nfunction versionFromRow(row: Record<string, unknown>): number {\n  const value = row.keyVersion;\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : 0;\n  }\n  return 0;\n}\n\nfunction providerFromCredentialId(id: string): string {\n  const match = /\\/([^/#]+)\\.ttl#/u.exec(id);\n  return match?.[1] ?? '';\n}\n\nfunction deploymentFromCredentialId(id: string): GatewayDeployment {\n  return id.includes('#cloud-') ? 'cloud' : 'local';\n}\n\nfunction dateFrom(value: unknown): Date | undefined {\n  if (value instanceof Date) {\n    return value;\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n  }\n  return undefined;\n}\n\nfunction signAttempt(\n  attempt: Pick<ConnectAttempt, 'id' | 'provider' | 'deployment' | 'webId' | 'mode' | 'state' | 'expiresAt'>,\n  secret: string,\n): string {\n  return createHmac('sha256', secret)\n    .update(JSON.stringify({\n      id: attempt.id,\n      provider: attempt.provider,\n      deployment: attempt.deployment,\n      webId: attempt.webId,\n      mode: attempt.mode,\n      state: attempt.state,\n      expiresAt: attempt.expiresAt.toISOString(),\n    }))\n    .digest('base64url');\n}\n\nfunction signatureMatches(actual: string, expected: string): boolean {\n  const actualBuffer = Buffer.from(actual, 'utf8');\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction codeChallenge(verifier: string): string {\n  return createHash('sha256').update(verifier).digest('base64url');\n}\n\n\nfunction cloneAttempt(attempt: ConnectAttempt): ConnectAttempt {\n  return {\n    ...attempt,\n    expiresAt: new Date(attempt.expiresAt),\n    consumedAt: attempt.consumedAt ? new Date(attempt.consumedAt) : undefined,\n    nextPollAt: attempt.nextPollAt ? new Date(attempt.nextPollAt) : undefined,\n    pollClaimedAt: attempt.pollClaimedAt ? new Date(attempt.pollClaimedAt) : undefined,\n  };\n}\n\nfunction normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nasync function safeJson(response: Response): Promise<Record<string, unknown>> {\n  const text = await response.text();\n  if (!text) {\n    if (response.ok) {\n      throw new Error('Provider returned an empty JSON response');\n    }\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(text);\n    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n      if (response.ok) {\n        throw new Error('Provider returned a non-object JSON response');\n      }\n      return {};\n    }\n    return parsed as Record<string, unknown>;\n  } catch {\n    if (response.ok) {\n      throw new Error('Provider returned invalid JSON');\n    }\n    return {};\n  }\n}\n\nfunction stringFrom(value: unknown): string {\n  return typeof value === 'string' ? value : '';\n}\n\nfunction numberFrom(value: unknown, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) ? value : fallback;\n}\n\nfunction expiresAtFrom(expiresIn: unknown, now: Date): Date | undefined {\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {\n    return undefined;\n  }\n  return new Date(now.getTime() + expiresIn * 1000);\n}\n\nfunction safeProviderError(body: Record<string, unknown>): string {\n  const code = stringFrom(body.error);\n  if (SAFE_PROVIDER_ERROR_CODES.has(code)) {\n    return code;\n  }\n  if (!code) {\n    return 'provider_error';\n  }\n  if (code.endsWith('_error')) {\n    return 'provider_error';\n  }\n  return 'provider_error';\n}\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  'authorization_pending',\n  'slow_down',\n  'expired_token',\n  'access_denied',\n  'invalid_grant',\n  'invalid_client',\n]);\n\nfunction pendingResult(\n  input: PollDeviceInput,\n  status: ConnectAttemptStatus,\n  intervalSeconds?: number,\n): ConnectBeginResult {\n  return {\n    mode: 'deviceCodeOAuth',\n    status,\n    provider: 'kimi',\n    deployment: input.deployment,\n    attemptId: input.attemptId,\n    intervalSeconds,\n  };\n}\n\nfunction assertKimiEndpoint(endpoint: string, pathname: string): void {\n  const url = new URL(endpoint);\n  if (\n    url.origin !== 'https://auth.kimi.com'\n    || url.pathname !== pathname\n    || url.search\n    || url.hash\n    || url.username\n    || url.password\n  ) {\n    throw new Error('Kimi Connect endpoint is not allowlisted');\n  }\n}\n\nfunction requireStringField(body: Record<string, unknown>, field: string): void {\n  if (typeof body[field] !== 'string' || !(body[field] as string).trim()) {\n    throw new Error(`Provider response missing required field: ${field}`);\n  }\n}\n\nfunction isVersionConflict(error: unknown): boolean {\n  return error instanceof Error && /version_conflict|credential_version_conflict/u.test(error.message);\n}\n\nfunction decodeJwtSubject(idToken: string): string | undefined {\n  const payload = idToken.split('.')[1];\n  if (!payload) {\n    return undefined;\n  }\n  try {\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));\n    return typeof decoded.sub === 'string' ? decoded.sub : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/connect/index.ts"],"names":[],"mappings":";;;AAAA,6CAAsG;AACtG,gEAAuE;AACvE,kDAI+B;AAE/B,0FAKmD;AAGnD,oEAA6E;AAiK7E,MAAa,gCAAgC;IAO3C,YAAmB,UAAmD,EAAE;QACtE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW;eACjC,+CAA4B,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kCAAkC,CAAC;QACzE,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,kBAAkB,GAAG,IAAA,qBAAK,EAAC,2BAAkB,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAK1B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAKhC;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAI5B;QAiBC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CACtB,UAAU,EACV,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAkC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI;aACR,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,kEAAqC,EAAE,CAAC;oBAC3D,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;aAChD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;aAC1D,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC3C,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvD,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,iBAAiB,EAAE,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjE,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC,CAAC;IACR,CAAC;IAEM,KAAK,CAAC,yBAAyB,CACpC,MAA+B,EAC/B,OAAgC;QAEhC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,yBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC;eAC9C,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,8DAAiC,CAAC;QAC7E,IAAI,CAAC,yBAAyB;eACzB,MAAM,CAAC,eAAe,KAAK,SAAS;eACpC,MAAM,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC;YAClC,GAAG,MAAM;YACT,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,0BAA0B,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;gBACzD,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,MAAM,0BAA0B,CAAC,yBAAyB,EAAE,aAAa,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,0BAA0B,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,0BAA0B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,KAO/B;QACC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,4BAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAA0B,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAA0B,UAAU,EAAE,EAAE,EAAE;YAC3E,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QAIxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACtG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,IAAkB;QACjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AAlOD,4EAkOC;AAyCD,MAAa,2BAA2B;IAAxC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC7C,gBAAW,GAAG,KAAK,CAAC;IAsGvC,CAAC;IApGQ,KAAK,CAAC,MAAM,CAAC,OAAuB;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAU,EAAE,GAAU;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAS;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,GAAS;QAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,aAAa,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAU,EACV,KAIC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAChD,OAAO,CAAC,0BAA0B,GAAG,KAAK,CAAC,eAAe,CAAC;QAC3D,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC9C,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QAClC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAS,EAAE,QAAiB;QAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAxGD,kEAwGC;AAaD,MAAa,mCAAmC;IAU9C,YAAmB,OAAmD;QACpE,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAe,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;SACjC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAA0B;QACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAA,sDAAyB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACvE,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/F,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,8DAAiC;YAC9C,aAAa;YACb,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,eAAe,EAAE,QAAQ,CAAC,yBAAyB;SACpD,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzB,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,YAAY,EAAE,MAAM,CAAC,EAAE;SACxB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAsB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC3C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,KAAwB,EAAE,SAAe,EAAE,QAAiC,EAAE;QAC1G,MAAM,uBAAuB,GAAsC;YACjE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,aAAa;YACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9B,SAAS;YACT,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;YAC1D,GAAG,KAAK;SACT,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,uBAAuB,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAES,KAAK,CAAC,oBAAoB,CAAC,KAAsB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,qBAAqB,CAAC,KAAsB,EAAE,IAAiB;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,gBAAgB,CAAC,OAAuB;QAChD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAES,WAAW,CAAC,KAAwB,EAAE,IAAiB;QAC/D,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AA7KD,kFA6KC;AASD,MAAa,4BAA6B,SAAQ,mCAAmC;IAMnF,YAAmB,OAA4C;QAC7D,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,iCAAiC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,sDAAsD,CAAC;QACjI,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uCAAuC,CAAC;QACtF,kBAAkB,CAAC,IAAI,CAAC,2BAA2B,EAAE,iCAAiC,CAAC,CAAC;QACxF,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IAEe,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;aAC9B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACtC,kBAAkB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE;YAC1F,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACxC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,0BAA0B,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YACpC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAClD,uBAAuB,EAAE,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC;YACnE,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAsB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,aAAa,CAClB,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,EACpF,KAAK,CAAC,OAAO,CAAC,0BAA0B,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;oBACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,IAAI,CAAC,KAAK,KAAK,uBAAuB,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;oBAC1B,MAAM,eAAe,GAAG,MAAM,KAAK,WAAW;wBAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;wBAC1E,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;oBACzE,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE;wBACtD,eAAe;wBACf,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC;wBAC5D,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;oBACnE,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACnE,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAC/F,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,MAAM,CAAC,EAAE;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACtC,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,0BAA0B,IAAI,OAAO,CAAC,eAAe;SAC/E,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,KAAmB,EACnB,OAAgC,EAChC,MAAsB;QAEtB,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,uBAAuB;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC;gBAClD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;gBAC/B,eAAe,EAAE,OAAO,CAAC,OAAO;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzC,kBAAkB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAEe,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAA2E,EAC3E,IAA6B,EAC7B,eAAwB;QAExB,MAAM,aAAa,GAAG,4BAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE;YACnE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAmB;YAC7B,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;YACnC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnC,CAAC;QACF,OAAO,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC;YACzD,EAAE,EAAE,4BAAmB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACxF,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,WAAW,EAAE,8DAAiC;YAC9C,aAAa,EAAE,IAAA,sDAAyB,EAAC,MAAM,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE;gBACR,oBAAoB,EAAE,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAClE;SACF,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AAvOD,oEAuOC;AAED,MAAa,sBAAsB;IAAnC;QACkB,aAAQ,GAAG,UAAU,CAAC;IAexC,CAAC;IAbQ,KAAK,CAAC,KAAK,CAAC,KAAwB;QACzC,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,yBAAyB,EAAE,IAAI;YAC/B,OAAO,EAAE,8GAA8G;SACxH,CAAC;IACJ,CAAC;CACF;AAhBD,wDAgBC;AAwBD,MAAa,sBAAsB;IAKjC,YAAmB,OAAsC;QAFxC,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAGpE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAwB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI;gBAC7B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,yBAAyB;gBACvE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAI1B;QACC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACxE,IAAI,UAA+C,CAAC;YACpD,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,aAAa;oBACnD,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;wBAC9C,GAAG,KAAK;wBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;qBACxB,CAAC;oBACF,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;wBACrD,GAAG,KAAK;wBACR,QAAQ,EAAE,UAAU,CAAC,EAAE;qBACxB,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kEAAqC,CAAC,EAAE,CAAC;oBAC9D,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,gBAAgB,GAAG,UAAU,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,cAAc,GAAG,gBAAgB,EAAE,cAAc,KAAK,IAAI,CAAC;YACjE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;gBAC/B,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,CAAC;gBACvE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC,CAAC;YACJ,OAAO;gBACL,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,gBAAyB;oBAC3B,CAAC,CAAC,gBAAgB;wBAChB,CAAC,CAAC,WAAoB;wBACtB,CAAC,CAAC,cAAuB;gBAC7B,QAAQ,EAAE,gBAAgB,EAAE,QAAQ;gBACpC,YAAY,EAAE,gBAAgB,EAAE,YAAY;gBAC5C,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE;gBACrD,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,aAAa,EAAE,gBAAgB,EAAE,aAAa;gBAC9C,OAAO,EAAE,gBAAgB,EAAE,OAAO;gBAClC,OAAO,EAAE;oBACP,KAAK;oBACL,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,KAAK,KAAK;oBACpD,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;iBAC3D;aACF,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,cAAc,CAAC,KAA0B;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,OAAO,CAAC,KAAmB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAmB,EACnB,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,sDAAyB,EAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC1E,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC3E,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,UAAU,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA1JD,wDA0JC;AAED,SAAS,KAAK,CAAC,WAAsC;IACnD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kCAAkC,CAAC,KAO3C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,2BAAkB,CAAC;IAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;KAC9D,EACR;QACE,MAAM,EAAE;YACN,UAAU;YACV,UAAU;SACX;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CACkC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,2BAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;QAC9C,aAAa,EAAE,IAAI,IAAI,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAA4B,EAAE,KAAa;IAC1E,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,8DAAiC;QACnF,CAAC,CAAC,8DAAiC;QACnC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAA,sDAAyB,EAAC;QACxB,WAAW;QACX,aAAa;QACb,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WAC1D,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;WAC9C,4BAAmB,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,EAAE;QACF,aAAa;QACb,KAAK,EAAE,KAAK;QACZ,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ;QACvF,WAAW,EAAE,8DAAiC;QAC9C,aAAa;QACb,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACnE,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;QAChF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;QAC5E,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa,EAAE,KAAc;IAC/D,OAAO,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,MAAiC;gBACnC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6C;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA6C;IAC7E,MAAM,KAAK,GAAG,QAAQ,EAAE,YAAY,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA6C;IACzE,MAAM,KAAK,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA6C;IAClF,MAAM,KAAK,GAAG,QAAQ,EAAE,iBAAiB,CAAC;IAC1C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAU;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,0BAA0B,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,OAA0G,EAC1G,MAAc;IAEd,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;SACF,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,QAAgB;IACxD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAGD,SAAS,YAAY,CAAC,OAAuB;IAC3C,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,SAAkB,EAAE,GAAS;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;IACf,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,KAAsB,EACtB,MAA4B,EAC5B,eAAwB;IAExB,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,MAAM,KAAK,uBAAuB;WACnC,GAAG,CAAC,QAAQ,KAAK,QAAQ;WACzB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IACtE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAE,IAAI,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,KAAK,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, createHmac, randomBytes as nodeRandomBytes, timingSafeEqual } from 'node:crypto';\nimport { alias, and, drizzle, eq } from '@undefineds.co/drizzle-solid';\nimport {\n  aiProviderResource,\n  aiRuntimeRepository,\n  credentialResource,\n} from '@undefineds.co/models';\nimport type { ProviderSecret } from '../credentials/CredentialVault';\nimport {\n  decodePlaintextCredential,\n  encodePlaintextCredential,\n  PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n  UnsupportedCredentialStorageModeError,\n} from '../credentials/PlaintextCredentialPayload';\nimport type { GatewayDeployment } from '../auth/InvocationTokenCodec';\nimport type { ProviderRegistry } from '../providers/ProviderRegistry';\nimport { DEFAULT_PROVIDER_DESCRIPTORS } from '../providers/ProviderRegistry';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';\n\nexport type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';\nexport type ConnectAttemptStatus =\n  | 'pending'\n  | 'authorization_pending'\n  | 'slow_down'\n  | 'completed'\n  | 'expired'\n  | 'unsupported';\n\nexport interface ConnectBeginInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  requestedMode: ConnectMode;\n  expectedCredentialVersion?: number;\n  auth?: AuthContext;\n}\n\nexport interface ConnectBeginResult {\n  mode: ConnectMode;\n  status: ConnectAttemptStatus;\n  provider: string;\n  deployment: GatewayDeployment;\n  attemptId?: string;\n  state?: string;\n  signature?: string;\n  expiresAt?: string;\n  authorizationUrl?: string;\n  pkceChallenge?: string;\n  deviceCode?: string;\n  userCode?: string;\n  verificationUri?: string;\n  verificationUriComplete?: string;\n  intervalSeconds?: number;\n  apiKeyManagementSupported?: boolean;\n  credentialId?: string;\n  message?: string;\n}\n\nexport interface CompleteApiKeyInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  apiKey: string;\n  accountLabel?: string;\n  auth?: AuthContext;\n}\n\nexport interface PollDeviceInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  attemptId: string;\n  state: string;\n  signature: string;\n  auth?: AuthContext;\n}\n\nexport interface RefreshInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface DisconnectInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  auth?: AuthContext;\n}\n\nexport interface ConnectCredentialRecord {\n  id: string;\n  credentialIri: string;\n  webId: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  authMode: 'apiKey' | 'deviceCodeOAuth';\n  storageMode: 'plaintext-v1';\n  secretPayload: string;\n  status: 'active' | 'revoked';\n  accountLabel?: string;\n  expiresAt?: Date;\n  scopes?: string[];\n  expectedVersion?: number;\n  version?: number;\n  reauthRequired?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface PodCredentialRepository {\n  getCredential?(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord>;\n  markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined>;\n  disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ntype ConnectedCredentialDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  insert(resource: typeof credentialResource): {\n    values(value: unknown): { execute(): Promise<unknown[]> };\n  };\n  select(): {\n    from(resource: typeof credentialResource): {\n      where(condition: unknown): { execute(): Promise<Record<string, unknown>[]> };\n    };\n  };\n  findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;\n  deleteById(resource: typeof credentialResource, id: string): Promise<boolean>;\n  updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;\n  update(resource: typeof credentialResource): {\n    set(patch: unknown): {\n      where(condition: unknown): {\n        returning(): { execute(): Promise<Record<string, unknown>[]> };\n      };\n    };\n  };\n};\n\nexport interface PodConnectedCredentialRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  providerIds?: string[];\n  dbFactory?: (input: {\n    owner: string;\n    podUrl: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n    credential?: typeof credentialResource;\n    aiProvider?: typeof aiProviderResource;\n  }) => Promise<ConnectedCredentialDb>;\n}\n\nexport class PodConnectedCredentialRepository implements PodCredentialRepository {\n  private readonly dbFactory: NonNullable<PodConnectedCredentialRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n  private readonly providerIds: string[];\n  private readonly credentialTemplate: typeof credentialResource;\n  private readonly aiProviderTemplate: typeof aiProviderResource;\n\n  public constructor(options: PodConnectedCredentialRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.providerIds = options.providerIds\n      ?? DEFAULT_PROVIDER_DESCRIPTORS.map((provider) => provider.id);\n    this.dbFactory = options.dbFactory ?? createDefaultConnectedCredentialDb;\n    this.credentialTemplate = alias(credentialResource, 'credentialTemplate');\n    this.aiProviderTemplate = alias(aiProviderResource, 'aiProviderTemplate');\n  }\n\n  public async getCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const row = await db.findById<Record<string, unknown>>(credential, id);\n    const record = row ? recordFromCredentialRow(row, input.webId) : undefined;\n    if (!record) {\n      return undefined;\n    }\n    return record;\n  }\n\n  public async getActiveCredential(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const record = await this.getCredential(input);\n    return record?.status === 'active' && !record.reauthRequired ? record : undefined;\n  }\n\n  public async listCredentials(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<Array<{\n    id: string;\n    credentialIri: string;\n    provider: string;\n    authMode: 'apiKey' | 'deviceCodeOAuth';\n    enabled: boolean;\n    priority?: number;\n    models?: string[];\n    defaultModel?: string;\n    health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error';\n    quota?: { status: 'available' | 'unsupported' | 'exhausted' | 'error' };\n    storageMode: 'plaintext-v1';\n    secretPayload: string;\n    version?: number;\n    runtimeCredential?: Record<string, unknown>;\n    metadata?: Record<string, unknown>;\n  }>> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const rows = (await Promise.all(\n      this.providerIds.map(async (provider) => {\n        try {\n          return await db.findById<Record<string, unknown>>(\n            credential,\n            aiRuntimeRepository.credentialId({ deployment: input.deployment, provider }),\n          );\n        } catch (error) {\n          if (isPodResourceNotFound(error)) {\n            return null;\n          }\n          throw error;\n        }\n      }),\n    )).filter((row): row is Record<string, unknown> => row !== null);\n    return rows\n      .flatMap((row) => {\n        try {\n          return [recordFromCredentialRow(row, input.webId)];\n        } catch (error) {\n          if (error instanceof UnsupportedCredentialStorageModeError) {\n            return [];\n          }\n          throw error;\n        }\n      })\n      .filter((record) => record.webId === input.webId)\n      .filter((record) => record.deployment === input.deployment)\n      .filter((record) => record.status === 'active')\n      .map((record) => ({\n        id: record.id,\n        credentialIri: record.credentialIri,\n        provider: record.provider,\n        authMode: record.authMode,\n        enabled: !record.reauthRequired,\n        models: modelsFromMetadata(record.metadata),\n        defaultModel: defaultModelFromMetadata(record.metadata),\n        priority: priorityFromMetadata(record.metadata),\n        health: record.reauthRequired ? 'reauthRequired' : 'healthy',\n        quota: { status: 'available' },\n        storageMode: record.storageMode,\n        secretPayload: record.secretPayload,\n        version: record.version,\n        runtimeCredential: runtimeCredentialFromMetadata(record.metadata),\n        metadata: record.metadata,\n      }));\n  }\n\n  public async upsertConnectedCredential(\n    record: ConnectCredentialRecord,\n    context?: { auth?: AuthContext },\n  ): Promise<ConnectCredentialRecord> {\n    const { db, credential } = await this.dbForOwner(record.webId, context?.auth);\n    const existing = await db.findById<Record<string, unknown>>(credential, record.id);\n    const existingVersion = existing ? versionFromRow(existing) : 0;\n    const replacesUnsupportedRecord = Boolean(existing)\n      && stringFrom(existing?.storageMode) !== PLAINTEXT_CREDENTIAL_STORAGE_MODE;\n    if (!replacesUnsupportedRecord\n      && record.expectedVersion !== undefined\n      && record.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const nextVersion = existingVersion + 1;\n    const row = credentialRowFromRecord({\n      ...record,\n      version: nextVersion,\n    });\n    if (existing) {\n      try {\n        const deleted = await db.deleteById(credential, record.id);\n        if (!deleted) {\n          throw new Error('exact credential resource was not deleted');\n        }\n      } catch (error) {\n        throw credentialPersistenceError('replace-delete', error);\n      }\n      try {\n        await db.insert(credential).values(row).execute();\n      } catch (error) {\n        try {\n          await db.insert(credential).values(existing).execute();\n        } catch (rollbackError) {\n          throw credentialPersistenceError('replace-insert-rollback', rollbackError);\n        }\n        throw credentialPersistenceError('replace-insert', error);\n      }\n      return recordFromCredentialRow(row, record.webId);\n    }\n    try {\n      await db.insert(credential).values(row).execute();\n    } catch (error) {\n      throw credentialPersistenceError('insert', error);\n    }\n    return recordFromCredentialRow(row, record.webId);\n  }\n\n  public async markReauthRequired(input: {\n    webId: string;\n    provider: string;\n    deployment: GatewayDeployment;\n    reason: string;\n    expectedVersion?: number;\n    auth?: AuthContext;\n  }): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const existingVersion = versionFromRow(existing);\n    if (input.expectedVersion !== undefined && input.expectedVersion !== existingVersion) {\n      throw new Error('credential_version_conflict');\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      reauthRequired: true,\n      status: 'active',\n      keyVersion: String(existingVersion + 1),\n    });\n    return updated ? recordFromCredentialRow(updated, input.webId) : undefined;\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const { db, credential } = await this.dbForOwner(input.webId, input.auth);\n    const id = aiRuntimeRepository.credentialId(input);\n    const existing = await db.findById<Record<string, unknown>>(credential, id);\n    if (!existing) {\n      return undefined;\n    }\n    const updated = await db.updateById<Record<string, unknown>>(credential, id, {\n      status: 'revoked',\n      keyVersion: String(versionFromRow(existing) + 1),\n    });\n    return updated ? recordFromCredentialRow(updated, input.webId) : undefined;\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<{\n    db: ConnectedCredentialDb;\n    credential: typeof credentialResource;\n  }> {\n    const trustedFetch = await this.resolveTrustedFetch(owner, auth);\n    const credential = alias(this.credentialTemplate, 'credential');\n    const aiProvider = alias(this.aiProviderTemplate, 'aiProvider');\n    const podUrl = podUrlFromHostedWebId(owner);\n    const db = await this.dbFactory({ owner, podUrl, auth, fetch: trustedFetch, credential, aiProvider });\n    await db.init?.(credential, aiProvider);\n    return { db, credential };\n  }\n\n  private async resolveTrustedFetch(owner: string, auth?: AuthContext): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner, auth);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport interface ProviderConnectAdapter {\n  readonly provider: string;\n  begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;\n  status?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;\n  pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;\n  refresh?(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined>;\n  disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;\n}\n\ninterface ConnectAttempt {\n  id: string;\n  provider: string;\n  deployment: GatewayDeployment;\n  webId: string;\n  mode: ConnectMode;\n  state: string;\n  signature: string;\n  expiresAt: Date;\n  consumedAt?: Date;\n  expectedCredentialVersion?: number;\n  codeVerifier?: string;\n  deviceCode?: string;\n  intervalSeconds?: number;\n  currentPollIntervalSeconds?: number;\n  nextPollAt?: Date;\n  pollClaimedAt?: Date;\n  lastPollStatus?: ConnectAttemptStatus;\n}\n\ninterface PollClaimResult {\n  attempt: ConnectAttempt;\n  claimed: boolean;\n}\n\nexport class InMemoryConnectAttemptStore {\n  private readonly attempts = new Map<string, ConnectAttempt>();\n  private readonly maxAttempts = 1_000;\n\n  public async create(attempt: ConnectAttempt): Promise<ConnectAttempt> {\n    this.pruneExpired(new Date());\n    this.attempts.set(attempt.id, cloneAttempt(attempt));\n    this.pruneBounded();\n    return cloneAttempt(attempt);\n  }\n\n  public async get(id: string, now?: Date): Promise<ConnectAttempt | undefined> {\n    this.pruneExpired(now ?? new Date(), id);\n    const attempt = this.attempts.get(id);\n    if (attempt && now && attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n    }\n    return attempt ? cloneAttempt(attempt) : undefined;\n  }\n\n  public async consume(id: string, now: Date): Promise<ConnectAttempt> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    attempt.consumedAt = new Date(now);\n    return cloneAttempt(attempt);\n  }\n\n  public async claimPoll(id: string, now: Date): Promise<PollClaimResult> {\n    this.pruneExpired(now, id);\n    const attempt = this.attempts.get(id);\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    if (attempt.expiresAt.getTime() <= now.getTime()) {\n      this.attempts.delete(id);\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.nextPollAt && attempt.nextPollAt.getTime() > now.getTime()) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    if (attempt.pollClaimedAt) {\n      return { attempt: cloneAttempt(attempt), claimed: false };\n    }\n    attempt.pollClaimedAt = new Date(now);\n    return { attempt: cloneAttempt(attempt), claimed: true };\n  }\n\n  public async updatePollSchedule(\n    id: string,\n    patch: {\n      intervalSeconds: number;\n      nextPollAt: Date;\n      lastPollStatus: ConnectAttemptStatus;\n    },\n  ): Promise<ConnectAttempt | undefined> {\n    const attempt = this.attempts.get(id);\n    if (!attempt || attempt.consumedAt) {\n      return undefined;\n    }\n    attempt.intervalSeconds = patch.intervalSeconds;\n    attempt.currentPollIntervalSeconds = patch.intervalSeconds;\n    attempt.nextPollAt = new Date(patch.nextPollAt);\n    attempt.lastPollStatus = patch.lastPollStatus;\n    attempt.pollClaimedAt = undefined;\n    return cloneAttempt(attempt);\n  }\n\n  public async releasePollClaim(id: string): Promise<void> {\n    const attempt = this.attempts.get(id);\n    if (attempt) {\n      attempt.pollClaimedAt = undefined;\n    }\n  }\n\n  private pruneExpired(now: Date, exceptId?: string): void {\n    for (const [id, attempt] of this.attempts) {\n      if (id !== exceptId && attempt.expiresAt.getTime() <= now.getTime()) {\n        this.attempts.delete(id);\n      }\n    }\n  }\n\n  private pruneBounded(): void {\n    while (this.attempts.size > this.maxAttempts) {\n      const oldest = this.attempts.keys().next().value;\n      if (typeof oldest !== 'string') {\n        return;\n      }\n      this.attempts.delete(oldest);\n    }\n  }\n}\n\nexport interface BrowserAssistedApiKeyConnectAdapterOptions {\n  provider: string;\n  consoleUrl: string;\n  attempts: InMemoryConnectAttemptStore;\n  credentialRepository: PodCredentialRepository;\n  deployment: GatewayDeployment;\n  now?: () => Date;\n  randomBytes?: (bytes: number) => Buffer;\n  signingSecret: string;\n}\n\nexport class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider: string;\n  private readonly consoleUrl: string;\n  protected readonly attempts: InMemoryConnectAttemptStore;\n  protected readonly credentialRepository: PodCredentialRepository;\n  protected readonly deployment: GatewayDeployment;\n  protected readonly now: () => Date;\n  protected readonly randomBytes: (bytes: number) => Buffer;\n  private readonly signingSecret: string;\n\n  public constructor(options: BrowserAssistedApiKeyConnectAdapterOptions) {\n    this.provider = normalizeProvider(options.provider);\n    this.consoleUrl = options.consoleUrl;\n    this.attempts = options.attempts;\n    this.credentialRepository = options.credentialRepository;\n    this.deployment = options.deployment;\n    this.now = options.now ?? (() => new Date());\n    this.randomBytes = options.randomBytes ?? nodeRandomBytes;\n    this.signingSecret = options.signingSecret;\n  }\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'browserAssistedApiKey');\n    const now = this.now();\n    const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);\n    const attempt = await this.createAttempt(input, expiresAt);\n    const url = new URL(this.consoleUrl);\n    url.searchParams.set('xpod_connect_attempt', attempt.id);\n    url.searchParams.set('xpod_provider', this.provider);\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'pending',\n      provider: this.provider,\n      deployment: this.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: expiresAt.toISOString(),\n      authorizationUrl: url.toString(),\n    };\n  }\n\n  public async completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    if (!input.apiKey.trim()) {\n      throw new Error('API key is required');\n    }\n    const attempt = await this.loadConsumableAttempt(input, 'browserAssistedApiKey');\n    const consumed = await this.attempts.consume(input.attemptId, this.now());\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: this.provider,\n    });\n    const secretPayload = encodePlaintextCredential({ type: 'apiKey', apiKey: input.apiKey });\n    const record = await this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),\n      credentialIri,\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      authMode: 'apiKey',\n      storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n      secretPayload,\n      status: 'active',\n      accountLabel: input.accountLabel,\n      expectedVersion: consumed.expectedCredentialVersion,\n    }, { auth: input.auth });\n\n    return {\n      mode: 'browserAssistedApiKey',\n      status: 'completed',\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      credentialId: record.id,\n    };\n  }\n\n  public async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'browserAssistedApiKey');\n    return {\n      mode: attempt.mode,\n      status: this.statusForAttempt(attempt),\n      provider: this.provider,\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n    };\n  }\n\n  public async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: this.provider,\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  protected async createAttempt(input: ConnectBeginInput, expiresAt: Date, extra: Partial<ConnectAttempt> = {}): Promise<ConnectAttempt> {\n    const attemptWithoutSignature: Omit<ConnectAttempt, 'signature'> = {\n      id: token(this.randomBytes),\n      provider: this.provider,\n      deployment: input.deployment,\n      webId: input.webId,\n      mode: input.requestedMode,\n      state: token(this.randomBytes),\n      expiresAt,\n      expectedCredentialVersion: input.expectedCredentialVersion,\n      ...extra,\n    };\n    const signature = signAttempt(attemptWithoutSignature, this.signingSecret);\n    return this.attempts.create({ ...attemptWithoutSignature, signature });\n  }\n\n  protected async loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.attempts.get(input.attemptId, this.now());\n    if (!attempt) {\n      throw new Error('Connect attempt not found');\n    }\n    if (attempt.webId !== input.webId) {\n      throw new Error('Connect attempt is bound to a different WebID');\n    }\n    if (attempt.deployment !== input.deployment) {\n      throw new Error('Connect attempt is bound to a different deployment');\n    }\n    if (attempt.provider !== normalizeProvider(input.provider)) {\n      throw new Error('Connect attempt is bound to a different provider');\n    }\n    if (attempt.mode !== mode) {\n      throw new Error('Connect attempt mode mismatch');\n    }\n    if (attempt.state !== input.state) {\n      throw new Error('Invalid Connect attempt state');\n    }\n    if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {\n      throw new Error('Invalid Connect attempt signature');\n    }\n    return attempt;\n  }\n\n  protected async loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt> {\n    const attempt = await this.loadAttemptForStatus(input, mode);\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      throw new Error('Connect attempt expired');\n    }\n    if (attempt.consumedAt) {\n      throw new Error('Connect attempt already consumed');\n    }\n    return attempt;\n  }\n\n  protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus {\n    if (attempt.expiresAt.getTime() <= this.now().getTime()) {\n      return 'expired';\n    }\n    return attempt.consumedAt ? 'completed' : 'pending';\n  }\n\n  protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    if (input.deployment !== this.deployment) {\n      throw new Error('Connect deployment mismatch');\n    }\n    if (input.requestedMode !== mode) {\n      throw new Error('Unsupported Connect mode');\n    }\n    if (!input.webId) {\n      throw new Error('Connect WebID is required');\n    }\n  }\n}\n\nexport interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {\n  fetch?: typeof fetch;\n  clientId: string;\n  deviceAuthorizationEndpoint?: string;\n  tokenEndpoint?: string;\n}\n\nexport class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {\n  private readonly fetchImpl: typeof fetch;\n  private readonly clientId: string;\n  private readonly deviceAuthorizationEndpoint: string;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: KimiDeviceCodeConnectAdapterOptions) {\n    super({\n      ...options,\n      provider: 'kimi',\n      consoleUrl: 'https://kimi.moonshot.cn/device',\n    });\n    this.fetchImpl = options.fetch ?? fetch;\n    this.clientId = options.clientId;\n    this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';\n    this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';\n    assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');\n    assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');\n  }\n\n  public override async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    this.assertInput(input, 'deviceCodeOAuth');\n    const now = this.now();\n    const verifier = token(this.randomBytes);\n    const challenge = codeChallenge(verifier);\n    const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: this.clientId,\n        code_challenge: challenge,\n        code_challenge_method: 'S256',\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);\n    }\n    requireStringField(body, 'device_code');\n    requireStringField(body, 'user_code');\n    requireStringField(body, 'verification_uri_complete');\n    const expiresIn = numberFrom(body.expires_in, 300);\n    const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {\n      mode: 'deviceCodeOAuth',\n      codeVerifier: verifier,\n      deviceCode: stringFrom(body.device_code),\n      intervalSeconds: numberFrom(body.interval, 5),\n      currentPollIntervalSeconds: numberFrom(body.interval, 5),\n      nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),\n    });\n    return {\n      mode: 'deviceCodeOAuth',\n      status: 'pending',\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      state: attempt.state,\n      signature: attempt.signature,\n      expiresAt: attempt.expiresAt.toISOString(),\n      pkceChallenge: challenge,\n      deviceCode: attempt.deviceCode,\n      userCode: stringFrom(body.user_code),\n      verificationUri: stringFrom(body.verification_uri),\n      verificationUriComplete: stringFrom(body.verification_uri_complete),\n      intervalSeconds: attempt.intervalSeconds,\n    };\n  }\n\n  public async pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');\n    const now = this.nowForConsume();\n    const claim = await this.attempts.claimPoll(input.attemptId, now);\n    if (!claim.claimed) {\n      return pendingResult(\n        input,\n        claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending',\n        claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds,\n      );\n    }\n    try {\n      const response = await this.fetchImpl(this.tokenEndpoint, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n          device_code: attempt.deviceCode ?? '',\n          client_id: this.clientId,\n          code_verifier: attempt.codeVerifier ?? '',\n        }),\n      });\n      const body = await safeJson(response);\n      if (!response.ok) {\n        if (body.error === 'authorization_pending' || body.error === 'slow_down') {\n          const status = body.error;\n          const intervalSeconds = status === 'slow_down'\n            ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5\n            : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);\n          await this.attempts.updatePollSchedule(input.attemptId, {\n            intervalSeconds,\n            nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),\n            lastPollStatus: status,\n          });\n          return pendingResult(input, status, intervalSeconds);\n        }\n        if (body.error === 'expired_token') {\n          await this.attempts.consume(input.attemptId, this.nowForConsume());\n          return pendingResult(input, 'expired');\n        }\n        throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);\n      }\n      await this.attempts.consume(input.attemptId, this.nowForConsume());\n      requireStringField(body, 'access_token');\n      requireStringField(body, 'refresh_token');\n      const record = await this.storeOAuthCredential(input, body, attempt.expectedCredentialVersion);\n      return {\n        mode: 'deviceCodeOAuth',\n        status: 'completed',\n        provider: 'kimi',\n        deployment: input.deployment,\n        attemptId: input.attemptId,\n        credentialId: record.id,\n      };\n    } catch (error) {\n      await this.attempts.releasePollClaim(input.attemptId);\n      throw error;\n    }\n  }\n\n  public override async status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');\n    return {\n      mode: 'deviceCodeOAuth',\n      status: this.statusForAttempt(attempt),\n      provider: 'kimi',\n      deployment: input.deployment,\n      attemptId: attempt.id,\n      expiresAt: attempt.expiresAt.toISOString(),\n      deviceCode: attempt.deviceCode,\n      intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,\n    };\n  }\n\n  public async refresh(\n    input: RefreshInput,\n    current: ConnectCredentialRecord,\n    secret: ProviderSecret,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const refreshToken = stringFrom(secret.refreshToken);\n    if (!refreshToken) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: 'missing_refresh_token',\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    const response = await this.fetchImpl(this.tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n        client_id: this.clientId,\n      }),\n    });\n    const body = await safeJson(response);\n    if (!response.ok) {\n      return this.credentialRepository.markReauthRequired({\n        webId: input.webId,\n        provider: 'kimi',\n        deployment: input.deployment,\n        reason: safeProviderError(body),\n        expectedVersion: current.version,\n        auth: input.auth,\n      });\n    }\n    requireStringField(body, 'access_token');\n    requireStringField(body, 'refresh_token');\n    return this.storeOAuthCredential(input, body, current.version);\n  }\n\n  public override async disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.credentialRepository.disconnect({\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      auth: input.auth,\n    });\n  }\n\n  private nowForConsume(): Date {\n    return this.now();\n  }\n\n  private async storeOAuthCredential(\n    input: { webId: string; deployment: GatewayDeployment; auth?: AuthContext },\n    body: Record<string, unknown>,\n    expectedVersion?: number,\n  ): Promise<ConnectCredentialRecord> {\n    const credentialIri = aiRuntimeRepository.credentialIri(input.webId, {\n      deployment: input.deployment,\n      provider: 'kimi',\n    });\n    const expiresAt = expiresAtFrom(body.expires_in, this.now());\n    const secret: ProviderSecret = {\n      type: 'deviceCodeOAuth',\n      accessToken: stringFrom(body.access_token),\n      refreshToken: stringFrom(body.refresh_token),\n      expiresAt: expiresAt?.toISOString(),\n      scope: stringFrom(body.scope),\n      idToken: stringFrom(body.id_token),\n    };\n    return this.credentialRepository.upsertConnectedCredential({\n      id: aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),\n      credentialIri,\n      webId: input.webId,\n      provider: 'kimi',\n      deployment: input.deployment,\n      authMode: 'deviceCodeOAuth',\n      storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n      secretPayload: encodePlaintextCredential(secret),\n      status: 'active',\n      expiresAt,\n      expectedVersion,\n      metadata: {\n        authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),\n      },\n    }, { auth: input.auth });\n  }\n}\n\nexport class DeepSeekConnectAdapter implements ProviderConnectAdapter {\n  public readonly provider = 'deepseek';\n\n  public async begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    if (normalizeProvider(input.provider) !== this.provider) {\n      throw new Error('Connect provider mismatch');\n    }\n    return {\n      mode: 'connectUnsupported',\n      status: 'unsupported',\n      provider: 'deepseek',\n      deployment: input.deployment,\n      apiKeyManagementSupported: true,\n      message: 'DeepSeek does not expose a supported third-party browser Connect flow; use authenticated API key management.',\n    };\n  }\n}\n\nexport interface ProviderConnectServiceOptions {\n  registry: ProviderRegistry;\n  adapters: ProviderConnectAdapter[];\n  credentialRepository?: PodCredentialRepository;\n}\n\nexport interface ProviderConnectionSummary {\n  provider: string;\n  status: 'connected' | 'disconnected' | 'reauthRequired';\n  authMode?: 'apiKey' | 'deviceCodeOAuth';\n  accountLabel?: string;\n  expiresAt?: string;\n  reauthRequired?: boolean;\n  credentialIri?: string;\n  version?: number;\n  connect: {\n    modes: string[];\n    configured: boolean;\n    message?: string;\n  };\n}\n\nexport class ProviderConnectService {\n  private readonly registry: ProviderRegistry;\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly adapters = new Map<string, ProviderConnectAdapter>();\n\n  public constructor(options: ProviderConnectServiceOptions) {\n    this.registry = options.registry;\n    this.credentialRepository = options.credentialRepository;\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public begin(input: ConnectBeginInput): Promise<ConnectBeginResult> {\n    const descriptor = this.registry.requireProvider(input.provider);\n    if (descriptor.connect?.mode !== input.requestedMode) {\n      throw new Error('Requested Connect mode does not match provider capability');\n    }\n    if (descriptor.connect?.configured === false) {\n      return Promise.resolve({\n        mode: descriptor.connect.mode,\n        status: 'unsupported',\n        provider: normalizeProvider(input.provider),\n        deployment: input.deployment,\n        apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,\n        message: descriptor.connect.notes?.join(' '),\n      });\n    }\n    return this.requireAdapter(input.provider).begin(input);\n  }\n\n  public async listProviders(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    auth?: AuthContext;\n  }): Promise<ProviderConnectionSummary[]> {\n    return Promise.all(this.registry.listProviders().map(async (descriptor) => {\n      let credential: ConnectCredentialRecord | undefined;\n      try {\n        credential = this.credentialRepository?.getCredential\n          ? await this.credentialRepository.getCredential({\n            ...input,\n            provider: descriptor.id,\n          })\n          : await this.credentialRepository?.getActiveCredential({\n            ...input,\n            provider: descriptor.id,\n          });\n      } catch (error) {\n        if (!(error instanceof UnsupportedCredentialStorageModeError)) {\n          throw error;\n        }\n      }\n      const activeCredential = credential?.status === 'active' ? credential : undefined;\n      const reauthRequired = activeCredential?.reauthRequired === true;\n      const modes = Array.from(new Set([\n        ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),\n        ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),\n      ]));\n      return {\n        provider: descriptor.id,\n        status: reauthRequired\n          ? 'reauthRequired' as const\n          : activeCredential\n            ? 'connected' as const\n            : 'disconnected' as const,\n        authMode: activeCredential?.authMode,\n        accountLabel: activeCredential?.accountLabel,\n        expiresAt: activeCredential?.expiresAt?.toISOString(),\n        reauthRequired: reauthRequired || undefined,\n        credentialIri: activeCredential?.credentialIri,\n        version: activeCredential?.version,\n        connect: {\n          modes,\n          configured: descriptor.connect?.configured !== false,\n          message: descriptor.connect?.notes?.join(' ') || undefined,\n        },\n      };\n    }));\n  }\n\n  public completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.completeApiKey) {\n      throw new Error('Provider does not support API key Connect completion');\n    }\n    return adapter.completeApiKey(input);\n  }\n\n  public pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.pollDevice) {\n      throw new Error('Provider does not support device-code polling');\n    }\n    return adapter.pollDevice(input);\n  }\n\n  public status(input: PollDeviceInput): Promise<ConnectBeginResult> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.status) {\n      throw new Error('Provider does not support Connect status');\n    }\n    return adapter.status(input);\n  }\n\n  public refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined> {\n    return this.refreshWithRetry(input, 2);\n  }\n\n  private async refreshWithRetry(\n    input: RefreshInput,\n    remainingAttempts: number,\n  ): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.refresh) {\n      throw new Error('Provider does not support refresh');\n    }\n    if (!this.credentialRepository) {\n      throw new Error('PodCredentialRepository is required for provider refresh');\n    }\n    const current = await this.credentialRepository.getActiveCredential(input);\n    if (!current) {\n      throw new Error('Active provider credential not found');\n    }\n    const secret = decodePlaintextCredential(current);\n    try {\n      return await adapter.refresh(input, current, secret);\n    } catch (error) {\n      if (remainingAttempts > 0 && isVersionConflict(error)) {\n        const latest = await this.credentialRepository.getActiveCredential(input);\n        if (latest && latest.version !== current.version && !latest.reauthRequired) {\n          return latest;\n        }\n        return this.refreshWithRetry(input, remainingAttempts - 1);\n      }\n      throw error;\n    }\n  }\n\n  public disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined> {\n    const adapter = this.requireAdapter(input.provider);\n    if (!adapter.disconnect) {\n      throw new Error('Provider does not support disconnect');\n    }\n    return adapter.disconnect(input);\n  }\n\n  private requireAdapter(provider: string): ProviderConnectAdapter {\n    const adapter = this.adapters.get(normalizeProvider(provider));\n    if (!adapter) {\n      throw new Error(`No Connect adapter registered for ${provider}`);\n    }\n    return adapter;\n  }\n}\n\nfunction token(randomBytes: (bytes: number) => Buffer): string {\n  return randomBytes(32).toString('base64url');\n}\n\nfunction createDefaultConnectedCredentialDb(input: {\n  owner: string;\n  podUrl: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n  credential?: typeof credentialResource;\n  aiProvider?: typeof aiProviderResource;\n}): Promise<ConnectedCredentialDb> {\n  const credential = input.credential ?? credentialResource;\n  const aiProvider = input.aiProvider ?? aiProviderResource;\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, podUrl: input.podUrl, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        credential,\n        aiProvider,\n      },\n      podUrl: input.podUrl,\n    },\n  ) as unknown as ConnectedCredentialDb);\n}\n\nfunction podUrlFromHostedWebId(webId: string): string {\n  const ownerUrl = new URL(webId);\n  if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {\n    throw new Error('hosted_pod_owner_url_invalid');\n  }\n  const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);\n  if (!podPath || !podPath.endsWith('/')) {\n    throw new Error('hosted_pod_owner_url_invalid');\n  }\n  return new URL(podPath, ownerUrl.origin).href;\n}\n\nfunction credentialRowFromRecord(record: ConnectCredentialRecord): Record<string, unknown> {\n  return {\n    id: record.id,\n    provider: aiProviderResource.buildId({ id: normalizeProvider(record.provider) }),\n    service: 'ai',\n    authMode: record.authMode,\n    status: record.status,\n    storageMode: record.storageMode,\n    secretPayload: record.secretPayload,\n    keyVersion: String(record.version ?? 1),\n    scopes: record.scopes ?? [],\n    expiresAt: record.expiresAt,\n    accountLabel: record.accountLabel,\n    label: record.accountLabel,\n    reauthRequired: record.reauthRequired ?? false,\n    lastRefreshAt: new Date(),\n  };\n}\n\nfunction recordFromCredentialRow(row: Record<string, unknown>, owner: string): ConnectCredentialRecord {\n  const storageMode = stringFrom(row.storageMode) === PLAINTEXT_CREDENTIAL_STORAGE_MODE\n    ? PLAINTEXT_CREDENTIAL_STORAGE_MODE\n    : stringFrom(row.storageMode);\n  const secretPayload = typeof row.secretPayload === 'string' ? row.secretPayload : '';\n  decodePlaintextCredential({\n    storageMode,\n    secretPayload,\n    encryptedSecret: row.encryptedSecret,\n    wrappedDataKey: row.wrappedDataKey,\n    encryptionAlgorithm: row.encryptionAlgorithm,\n  });\n  const id = stringFrom(row.id);\n  const provider = providerFromRelation(stringFrom(row.provider))\n    || providerFromCredentialId(id);\n  const deployment = deploymentFromCredentialId(id);\n  const credentialIri = stringFrom(row.credentialIri)\n    || aiRuntimeRepository.credentialIri(owner, { deployment, provider });\n  return {\n    id,\n    credentialIri,\n    webId: owner,\n    provider,\n    deployment,\n    authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',\n    storageMode: PLAINTEXT_CREDENTIAL_STORAGE_MODE,\n    secretPayload,\n    status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',\n    accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,\n    expiresAt: dateFrom(row.expiresAt),\n    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,\n    version: versionFromRow(row),\n    reauthRequired: row.reauthRequired === true || row.reauthRequired === 'true',\n    metadata: metadataFromRow(row),\n  };\n}\n\nfunction providerFromRelation(value: string): string | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const withoutFragment = value.split('#', 1)[0] ?? value;\n  const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;\n  const provider = fileName.replace(/\\.ttl$/u, '');\n  return provider ? normalizeProvider(provider) : undefined;\n}\n\nfunction credentialPersistenceError(stage: string, cause: unknown): Error {\n  return new Error(`credential_persistence_failed:${stage}`, { cause });\n}\n\nfunction isPodResourceNotFound(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  return /\\b404\\b|not found/i.test(error.message);\n}\n\nfunction metadataFromRow(row: Record<string, unknown>): Record<string, unknown> | undefined {\n  const value = row.metadata;\n  if (!value) {\n    return undefined;\n  }\n  if (typeof value === 'object' && !Array.isArray(value)) {\n    return value as Record<string, unknown>;\n  }\n  if (typeof value === 'string') {\n    try {\n      const parsed = JSON.parse(value);\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? parsed as Record<string, unknown>\n        : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n  return undefined;\n}\n\nfunction modelsFromMetadata(metadata: Record<string, unknown> | undefined): string[] | undefined {\n  const value = metadata?.models;\n  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : undefined;\n}\n\nfunction defaultModelFromMetadata(metadata: Record<string, unknown> | undefined): string | undefined {\n  const value = metadata?.defaultModel;\n  return typeof value === 'string' ? value : undefined;\n}\n\nfunction priorityFromMetadata(metadata: Record<string, unknown> | undefined): number | undefined {\n  const value = metadata?.priority;\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction runtimeCredentialFromMetadata(metadata: Record<string, unknown> | undefined): Record<string, unknown> | undefined {\n  const value = metadata?.runtimeCredential;\n  return value && typeof value === 'object' && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : undefined;\n}\n\nfunction versionFromRow(row: Record<string, unknown>): number {\n  const value = row.keyVersion;\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : 0;\n  }\n  return 0;\n}\n\nfunction providerFromCredentialId(id: string): string {\n  const match = /\\/([^/#]+)\\.ttl#/u.exec(id);\n  return match?.[1] ?? '';\n}\n\nfunction deploymentFromCredentialId(id: string): GatewayDeployment {\n  return id.includes('#cloud-') ? 'cloud' : 'local';\n}\n\nfunction dateFrom(value: unknown): Date | undefined {\n  if (value instanceof Date) {\n    return value;\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n  }\n  return undefined;\n}\n\nfunction signAttempt(\n  attempt: Pick<ConnectAttempt, 'id' | 'provider' | 'deployment' | 'webId' | 'mode' | 'state' | 'expiresAt'>,\n  secret: string,\n): string {\n  return createHmac('sha256', secret)\n    .update(JSON.stringify({\n      id: attempt.id,\n      provider: attempt.provider,\n      deployment: attempt.deployment,\n      webId: attempt.webId,\n      mode: attempt.mode,\n      state: attempt.state,\n      expiresAt: attempt.expiresAt.toISOString(),\n    }))\n    .digest('base64url');\n}\n\nfunction signatureMatches(actual: string, expected: string): boolean {\n  const actualBuffer = Buffer.from(actual, 'utf8');\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction codeChallenge(verifier: string): string {\n  return createHash('sha256').update(verifier).digest('base64url');\n}\n\n\nfunction cloneAttempt(attempt: ConnectAttempt): ConnectAttempt {\n  return {\n    ...attempt,\n    expiresAt: new Date(attempt.expiresAt),\n    consumedAt: attempt.consumedAt ? new Date(attempt.consumedAt) : undefined,\n    nextPollAt: attempt.nextPollAt ? new Date(attempt.nextPollAt) : undefined,\n    pollClaimedAt: attempt.pollClaimedAt ? new Date(attempt.pollClaimedAt) : undefined,\n  };\n}\n\nfunction normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nasync function safeJson(response: Response): Promise<Record<string, unknown>> {\n  const text = await response.text();\n  if (!text) {\n    if (response.ok) {\n      throw new Error('Provider returned an empty JSON response');\n    }\n    return {};\n  }\n  try {\n    const parsed = JSON.parse(text);\n    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n      if (response.ok) {\n        throw new Error('Provider returned a non-object JSON response');\n      }\n      return {};\n    }\n    return parsed as Record<string, unknown>;\n  } catch {\n    if (response.ok) {\n      throw new Error('Provider returned invalid JSON');\n    }\n    return {};\n  }\n}\n\nfunction stringFrom(value: unknown): string {\n  return typeof value === 'string' ? value : '';\n}\n\nfunction numberFrom(value: unknown, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) ? value : fallback;\n}\n\nfunction expiresAtFrom(expiresIn: unknown, now: Date): Date | undefined {\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {\n    return undefined;\n  }\n  return new Date(now.getTime() + expiresIn * 1000);\n}\n\nfunction safeProviderError(body: Record<string, unknown>): string {\n  const code = stringFrom(body.error);\n  if (SAFE_PROVIDER_ERROR_CODES.has(code)) {\n    return code;\n  }\n  if (!code) {\n    return 'provider_error';\n  }\n  if (code.endsWith('_error')) {\n    return 'provider_error';\n  }\n  return 'provider_error';\n}\n\nconst SAFE_PROVIDER_ERROR_CODES = new Set([\n  'authorization_pending',\n  'slow_down',\n  'expired_token',\n  'access_denied',\n  'invalid_grant',\n  'invalid_client',\n]);\n\nfunction pendingResult(\n  input: PollDeviceInput,\n  status: ConnectAttemptStatus,\n  intervalSeconds?: number,\n): ConnectBeginResult {\n  return {\n    mode: 'deviceCodeOAuth',\n    status,\n    provider: 'kimi',\n    deployment: input.deployment,\n    attemptId: input.attemptId,\n    intervalSeconds,\n  };\n}\n\nfunction assertKimiEndpoint(endpoint: string, pathname: string): void {\n  const url = new URL(endpoint);\n  if (\n    url.origin !== 'https://auth.kimi.com'\n    || url.pathname !== pathname\n    || url.search\n    || url.hash\n    || url.username\n    || url.password\n  ) {\n    throw new Error('Kimi Connect endpoint is not allowlisted');\n  }\n}\n\nfunction requireStringField(body: Record<string, unknown>, field: string): void {\n  if (typeof body[field] !== 'string' || !(body[field] as string).trim()) {\n    throw new Error(`Provider response missing required field: ${field}`);\n  }\n}\n\nfunction isVersionConflict(error: unknown): boolean {\n  return error instanceof Error && /version_conflict|credential_version_conflict/u.test(error.message);\n}\n\nfunction decodeJwtSubject(idToken: string): string | undefined {\n  const payload = idToken.split('.')[1];\n  if (!payload) {\n    return undefined;\n  }\n  try {\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));\n    return typeof decoded.sub === 'string' ? decoded.sub : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/dist/api/ai-gateway/pod/HostedPodDataAccess.js

@@ -34,7 +34,7 @@ class HostedPodDataAccess {
                 method,
                 resourceUrl,
                 principalKind: authorization.principalKind,
-                scopes: [method === 'GET' ? 'ai:credentials:read' : 'ai:credentials:write'],
+                scopes: [method === 'GET' || method === 'HEAD' ? 'ai:credentials:read' : 'ai:credentials:write'],
             });
             return this.fetch(loopbackUrl, {
                 method,
@@ -110,7 +110,7 @@ class HostedPodDataAccess {
 exports.HostedPodDataAccess = HostedPodDataAccess;
 function normalizeMethod(method) {
     const upper = (method ?? 'GET').toUpperCase();
-    if (upper === 'GET' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {
+    if (upper === 'GET' || upper === 'HEAD' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {
         return upper;
     }
     throw new Error('hosted_pod_method_not_allowed');

package/dist/api/ai-gateway/pod/HostedPodDataAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"HostedPodDataAccess.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/pod/HostedPodDataAccess.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,uCAAgC;AAChC,2FAA8F;AAE9F,kFAIgD;AAkBhD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AACrD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,eAAe;IACf,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAa,mBAAmB;IAO9B,YAAmB,OAAmC;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QAC3H,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,wBAAU,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,IAAmC;QAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE;gBACvD,UAAU,EAAE,KAAK;gBACjB,MAAM;gBACN,WAAW;gBACX,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,MAAM,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;aAC5E,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC7B,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;gBACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7B,CAAC,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,KAKjB;QACC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAEjE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC;IAEO,2BAA2B,CAAC,KAAa,EAAE,WAAmB;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,2DAA+B,EAAC;YAC9C,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,OAAgB,EAAE,MAA+B;QAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACrC,IACE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;mBACpC,mDAA2B,CAAC,QAAQ,CAAC,UAAwD,CAAC;mBAC9F,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAC/C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,sDAA8B,EAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,2BAA2B;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,sBAAsB;YAC3B,sBAAsB,EAAE,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,MAAM;SACP,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AApHD,kDAoHC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,SAAiB;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAa;IAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAA,eAAI,EAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,UAAU,KAAK,KAAK,CAAC;AAC9B,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { isIP } from 'node:net';\nimport { createAiConnectionServiceAccess } from '../service-access/AiConnectionServiceAccess';\nimport type { AuthContext, SolidAuthContext } from '../../auth/AuthContext';\nimport {\n  createGatewayAdminProxyHeaders,\n  GATEWAY_ADMIN_PROXY_HEADERS,\n  type GatewayAdminProxyIntent,\n} from '../../../runtime/GatewayAdminProxyAuth';\n\nexport interface InternalPodAccessTokenProvider {\n  getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined>;\n}\n\nexport type InternalPodAccessAuthContext = AuthContext | undefined;\n\nexport interface HostedPodDataAccessOptions {\n  cssBaseUrl: string;\n  gatewayAdminProxyAuthSecret?: string;\n  fetch?: typeof fetch;\n  now?: () => number;\n  nonce?: () => string;\n}\n\ntype InternalPodDataMethod = 'GET' | 'PUT' | 'PATCH' | 'DELETE';\n\nconst INTERNAL_POD_DATA_PATH = '/.internal/pod-data';\nconst STRIPPED_CALLER_HEADERS = new Set([\n  'authorization',\n  'dpop',\n  'cookie',\n]);\n\nexport class HostedPodDataAccess implements InternalPodAccessTokenProvider {\n  private readonly cssBaseUrl: URL;\n  private readonly gatewayAdminProxyAuthSecret?: string;\n  private readonly fetch: typeof fetch;\n  private readonly now: () => number;\n  private readonly nonce: () => string;\n\n  public constructor(options: HostedPodDataAccessOptions) {\n    this.cssBaseUrl = new URL(options.cssBaseUrl);\n    if (!isLoopbackHostname(this.cssBaseUrl.hostname)) {\n      throw new Error('hosted_pod_css_loopback_required');\n    }\n    this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;\n    this.fetch = options.fetch ?? fetch;\n    this.now = options.now ?? Date.now;\n    this.nonce = options.nonce ?? randomUUID;\n  }\n\n  public async getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined> {\n    return async (input, init) => {\n      const request = new Request(input, init);\n      const method = normalizeMethod(request.method);\n      const resourceUrl = normalizeResourceUrl(request.url);\n      const authorization = this.authorize({ owner, auth, method, resourceUrl });\n      const loopbackUrl = new URL(INTERNAL_POD_DATA_PATH, this.cssBaseUrl);\n      const headers = this.headersForLoopback(request.headers, {\n        ownerWebId: owner,\n        method,\n        resourceUrl,\n        principalKind: authorization.principalKind,\n        scopes: [method === 'GET' ? 'ai:credentials:read' : 'ai:credentials:write'],\n      });\n\n      return this.fetch(loopbackUrl, {\n        method,\n        headers,\n        body: request.body,\n        signal: init?.signal ?? request.signal,\n        ...(request.body ? { duplex: 'half' } : {}),\n      } as RequestInit);\n    };\n  }\n\n  private authorize(input: {\n    owner: string;\n    auth?: InternalPodAccessAuthContext;\n    method: InternalPodDataMethod;\n    resourceUrl: string;\n  }): { principalKind: GatewayAdminProxyIntent['principalKind'] } {\n    this.assertHostedAllowedResource(input.owner, input.resourceUrl);\n\n    if (!input.auth) {\n      throw new Error('hosted_pod_auth_required');\n    }\n    if (input.auth.type !== 'solid') {\n      throw new Error('hosted_pod_solid_principal_required');\n    }\n    if (input.auth.webId !== input.owner) {\n      throw new Error('hosted_pod_owner_mismatch');\n    }\n    return { principalKind: 'solid-user' };\n  }\n\n  private assertHostedAllowedResource(owner: string, resourceUrl: string): void {\n    const resource = parseUrl(resourceUrl, 'hosted_pod_resource_url_invalid');\n    const ownerUrl = parseUrl(owner, 'hosted_pod_owner_url_invalid');\n    const podRoot = hostedPodRootFromOwner(ownerUrl);\n    if (!podRoot || resource.origin !== podRoot.origin || !resource.pathname.startsWith(podRoot.pathname)) {\n      throw new Error('hosted_pod_remote_resource');\n    }\n    if (resource.hash || resource.search) {\n      throw new Error('hosted_pod_resource_not_allowed');\n    }\n\n    const allowed = createAiConnectionServiceAccess({\n      ownerWebId: owner,\n      serviceWebId: owner,\n    }).resources.map((entry) => entry.url);\n    if (!allowed.includes(resource.href)) {\n      throw new Error('hosted_pod_resource_not_allowed');\n    }\n  }\n\n  private headersForLoopback(headers: Headers, intent: GatewayAdminProxyIntent): Headers {\n    const next = new Headers();\n    headers.forEach((value, key) => {\n      const normalized = key.toLowerCase();\n      if (\n        STRIPPED_CALLER_HEADERS.has(normalized)\n        || GATEWAY_ADMIN_PROXY_HEADERS.includes(normalized as typeof GATEWAY_ADMIN_PROXY_HEADERS[number])\n        || normalized.startsWith('x-xpod-admin-proxy-')\n      ) {\n        return;\n      }\n      next.set(key, value);\n    });\n\n    if (!this.gatewayAdminProxyAuthSecret) {\n      throw new Error('XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET is required for hosted Pod data access');\n    }\n    const marker = createGatewayAdminProxyHeaders({\n      secret: this.gatewayAdminProxyAuthSecret,\n      method: intent.method,\n      url: INTERNAL_POD_DATA_PATH,\n      originalClientLoopback: true,\n      issuedAt: this.now(),\n      nonce: this.nonce(),\n      intent,\n    });\n    for (const [key, value] of Object.entries(marker)) {\n      if (value !== undefined) {\n        next.set(key, Array.isArray(value) ? value.join(', ') : String(value));\n      }\n    }\n    return next;\n  }\n}\n\nfunction normalizeMethod(method: string | undefined): InternalPodDataMethod {\n  const upper = (method ?? 'GET').toUpperCase();\n  if (upper === 'GET' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {\n    return upper;\n  }\n  throw new Error('hosted_pod_method_not_allowed');\n}\n\nfunction normalizeResourceUrl(value: string): string {\n  return new URL(value).href;\n}\n\nfunction parseUrl(value: string, errorCode: string): URL {\n  try {\n    return new URL(value);\n  } catch {\n    throw new Error(errorCode);\n  }\n}\n\nfunction hostedPodRootFromOwner(ownerUrl: URL): URL | undefined {\n  if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {\n    return undefined;\n  }\n  const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);\n  if (!podPath || !podPath.endsWith('/')) {\n    return undefined;\n  }\n  return new URL(podPath, ownerUrl.origin);\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = hostname.replace(/^\\[|\\]$/gu, '').toLowerCase();\n  if (normalized === 'localhost') {\n    return true;\n  }\n  if (isIP(normalized) === 4) {\n    return normalized.startsWith('127.');\n  }\n  return normalized === '::1';\n}\n"]}
+{"version":3,"file":"HostedPodDataAccess.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/pod/HostedPodDataAccess.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,uCAAgC;AAChC,2FAA8F;AAE9F,kFAIgD;AAkBhD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AACrD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,eAAe;IACf,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAa,mBAAmB;IAO9B,YAAmB,OAAmC;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QAC3H,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,wBAAU,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,IAAmC;QAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE;gBACvD,UAAU,EAAE,KAAK;gBACjB,MAAM;gBACN,WAAW;gBACX,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,MAAM,EAAE,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;aACjG,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC7B,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;gBACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7B,CAAC,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,KAKjB;QACC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAEjE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC;IAEO,2BAA2B,CAAC,KAAa,EAAE,WAAmB;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,2DAA+B,EAAC;YAC9C,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,OAAgB,EAAE,MAA+B;QAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACrC,IACE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;mBACpC,mDAA2B,CAAC,QAAQ,CAAC,UAAwD,CAAC;mBAC9F,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAC/C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,sDAA8B,EAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,2BAA2B;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,sBAAsB;YAC3B,sBAAsB,EAAE,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,MAAM;SACP,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AApHD,kDAoHC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,SAAiB;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAa;IAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAA,eAAI,EAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,UAAU,KAAK,KAAK,CAAC;AAC9B,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { isIP } from 'node:net';\nimport { createAiConnectionServiceAccess } from '../service-access/AiConnectionServiceAccess';\nimport type { AuthContext, SolidAuthContext } from '../../auth/AuthContext';\nimport {\n  createGatewayAdminProxyHeaders,\n  GATEWAY_ADMIN_PROXY_HEADERS,\n  type GatewayAdminProxyIntent,\n} from '../../../runtime/GatewayAdminProxyAuth';\n\nexport interface InternalPodAccessTokenProvider {\n  getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined>;\n}\n\nexport type InternalPodAccessAuthContext = AuthContext | undefined;\n\nexport interface HostedPodDataAccessOptions {\n  cssBaseUrl: string;\n  gatewayAdminProxyAuthSecret?: string;\n  fetch?: typeof fetch;\n  now?: () => number;\n  nonce?: () => string;\n}\n\ntype InternalPodDataMethod = 'GET' | 'HEAD' | 'PUT' | 'PATCH' | 'DELETE';\n\nconst INTERNAL_POD_DATA_PATH = '/.internal/pod-data';\nconst STRIPPED_CALLER_HEADERS = new Set([\n  'authorization',\n  'dpop',\n  'cookie',\n]);\n\nexport class HostedPodDataAccess implements InternalPodAccessTokenProvider {\n  private readonly cssBaseUrl: URL;\n  private readonly gatewayAdminProxyAuthSecret?: string;\n  private readonly fetch: typeof fetch;\n  private readonly now: () => number;\n  private readonly nonce: () => string;\n\n  public constructor(options: HostedPodDataAccessOptions) {\n    this.cssBaseUrl = new URL(options.cssBaseUrl);\n    if (!isLoopbackHostname(this.cssBaseUrl.hostname)) {\n      throw new Error('hosted_pod_css_loopback_required');\n    }\n    this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;\n    this.fetch = options.fetch ?? fetch;\n    this.now = options.now ?? Date.now;\n    this.nonce = options.nonce ?? randomUUID;\n  }\n\n  public async getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined> {\n    return async (input, init) => {\n      const request = new Request(input, init);\n      const method = normalizeMethod(request.method);\n      const resourceUrl = normalizeResourceUrl(request.url);\n      const authorization = this.authorize({ owner, auth, method, resourceUrl });\n      const loopbackUrl = new URL(INTERNAL_POD_DATA_PATH, this.cssBaseUrl);\n      const headers = this.headersForLoopback(request.headers, {\n        ownerWebId: owner,\n        method,\n        resourceUrl,\n        principalKind: authorization.principalKind,\n        scopes: [method === 'GET' || method === 'HEAD' ? 'ai:credentials:read' : 'ai:credentials:write'],\n      });\n\n      return this.fetch(loopbackUrl, {\n        method,\n        headers,\n        body: request.body,\n        signal: init?.signal ?? request.signal,\n        ...(request.body ? { duplex: 'half' } : {}),\n      } as RequestInit);\n    };\n  }\n\n  private authorize(input: {\n    owner: string;\n    auth?: InternalPodAccessAuthContext;\n    method: InternalPodDataMethod;\n    resourceUrl: string;\n  }): { principalKind: GatewayAdminProxyIntent['principalKind'] } {\n    this.assertHostedAllowedResource(input.owner, input.resourceUrl);\n\n    if (!input.auth) {\n      throw new Error('hosted_pod_auth_required');\n    }\n    if (input.auth.type !== 'solid') {\n      throw new Error('hosted_pod_solid_principal_required');\n    }\n    if (input.auth.webId !== input.owner) {\n      throw new Error('hosted_pod_owner_mismatch');\n    }\n    return { principalKind: 'solid-user' };\n  }\n\n  private assertHostedAllowedResource(owner: string, resourceUrl: string): void {\n    const resource = parseUrl(resourceUrl, 'hosted_pod_resource_url_invalid');\n    const ownerUrl = parseUrl(owner, 'hosted_pod_owner_url_invalid');\n    const podRoot = hostedPodRootFromOwner(ownerUrl);\n    if (!podRoot || resource.origin !== podRoot.origin || !resource.pathname.startsWith(podRoot.pathname)) {\n      throw new Error('hosted_pod_remote_resource');\n    }\n    if (resource.hash || resource.search) {\n      throw new Error('hosted_pod_resource_not_allowed');\n    }\n\n    const allowed = createAiConnectionServiceAccess({\n      ownerWebId: owner,\n      serviceWebId: owner,\n    }).resources.map((entry) => entry.url);\n    if (!allowed.includes(resource.href)) {\n      throw new Error('hosted_pod_resource_not_allowed');\n    }\n  }\n\n  private headersForLoopback(headers: Headers, intent: GatewayAdminProxyIntent): Headers {\n    const next = new Headers();\n    headers.forEach((value, key) => {\n      const normalized = key.toLowerCase();\n      if (\n        STRIPPED_CALLER_HEADERS.has(normalized)\n        || GATEWAY_ADMIN_PROXY_HEADERS.includes(normalized as typeof GATEWAY_ADMIN_PROXY_HEADERS[number])\n        || normalized.startsWith('x-xpod-admin-proxy-')\n      ) {\n        return;\n      }\n      next.set(key, value);\n    });\n\n    if (!this.gatewayAdminProxyAuthSecret) {\n      throw new Error('XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET is required for hosted Pod data access');\n    }\n    const marker = createGatewayAdminProxyHeaders({\n      secret: this.gatewayAdminProxyAuthSecret,\n      method: intent.method,\n      url: INTERNAL_POD_DATA_PATH,\n      originalClientLoopback: true,\n      issuedAt: this.now(),\n      nonce: this.nonce(),\n      intent,\n    });\n    for (const [key, value] of Object.entries(marker)) {\n      if (value !== undefined) {\n        next.set(key, Array.isArray(value) ? value.join(', ') : String(value));\n      }\n    }\n    return next;\n  }\n}\n\nfunction normalizeMethod(method: string | undefined): InternalPodDataMethod {\n  const upper = (method ?? 'GET').toUpperCase();\n  if (upper === 'GET' || upper === 'HEAD' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {\n    return upper;\n  }\n  throw new Error('hosted_pod_method_not_allowed');\n}\n\nfunction normalizeResourceUrl(value: string): string {\n  return new URL(value).href;\n}\n\nfunction parseUrl(value: string, errorCode: string): URL {\n  try {\n    return new URL(value);\n  } catch {\n    throw new Error(errorCode);\n  }\n}\n\nfunction hostedPodRootFromOwner(ownerUrl: URL): URL | undefined {\n  if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {\n    return undefined;\n  }\n  const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);\n  if (!podPath || !podPath.endsWith('/')) {\n    return undefined;\n  }\n  return new URL(podPath, ownerUrl.origin);\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = hostname.replace(/^\\[|\\]$/gu, '').toLowerCase();\n  if (normalized === 'localhost') {\n    return true;\n  }\n  if (isIP(normalized) === 4) {\n    return normalized.startsWith('127.');\n  }\n  return normalized === '::1';\n}\n"]}

package/dist/api/container/common.js

@@ -55,7 +55,7 @@ function resolveCssServiceBaseUrl() {
     return 'http://localhost:3000/';
 }
 function resolveHostedPodCssBaseUrl() {
-    return process.env.CSS_INTERNAL_URL ?? 'http://localhost:3000/';
+    return `http://127.0.0.1:${process.env.XPOD_MAIN_PORT ?? '3000'}/`;
 }
 function resolveAiConnectionBaseUrl(config) {
     const origin = config.publicUrl