@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/domain/client/authenticated-request.js

@@ -0,0 +1,440 @@
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { authenticatedRequestInputSchema } from "../../schemas/transport/authenticated-request.schema.js";
+import { OAuthAuthorizationCodeTokenResponseSchema } from "../../schemas/transport/credential-use.schema.js";
+import { readBoundedText } from "../../transport/bounded-body.js";
+import { resolveCredentialCandidates } from "./credential-use.js";
+import { isDevelopmentHost, parseSecureUrl } from "../../transport/secure-url.js";
+import { setHeaderValue } from "../../transport/header-value.js";
+function invalid(reason) {
+    return new CapabilityError('The authenticated request is invalid.', 'INVALID_INPUT', { reason, retryable: false });
+}
+function setCredentialHeader(headers, name, value) {
+    const result = setHeaderValue(headers, name, value);
+    if (!result.ok)
+        throw new CapabilityError('A credential header cannot be sent.', 'INVALID_INPUT', { reason: 'request-header-invalid', cause: result.problem === 'value-rejected' ? result.failure : undefined });
+}
+const JsonContainerSchema = z.union([z.record(z.string(), JsonValueSchema), z.array(JsonValueSchema)]);
+function isContainer(value) {
+    return JsonContainerSchema.safeParse(value).success;
+}
+function preserveResponseMetadata(wrapped, upstream, publicUrl) {
+    Object.defineProperties(wrapped, {
+        url: { value: publicUrl },
+        redirected: { value: upstream.redirected },
+        type: { value: upstream.type },
+        clone: { value: function () {
+                const cloned = Response.prototype.clone.call(this);
+                return this === wrapped ? preserveResponseMetadata(cloned, upstream, publicUrl) : cloned;
+            } }
+    });
+    return wrapped;
+}
+/** Demand-driven ownership lasts until body completion, cancellation, disposal or its deadline. */
+function ownResponseBody(runtime, response, publicUrl, timeoutMs, callerSignal, transportController, finishResource) {
+    if (!response.body) {
+        finishResource();
+        return preserveResponseMetadata(new Response(null, { status: response.status, statusText: response.statusText, headers: response.headers }), response, publicUrl);
+    }
+    const diagnostics = runtime.diagnostics;
+    const reader = response.body.getReader();
+    const completion = Promise.withResolvers();
+    let closed = false;
+    const body = new ReadableStream({
+        start(controller) {
+            const lifetime = runtime.lifecycle.wait(async (signal) => {
+                const abort = () => {
+                    if (closed)
+                        return;
+                    closed = true;
+                    const cause = CaughtFailureSchema.parse(signal.reason);
+                    const timedOut = cause instanceof CapabilityError && cause.code === 'TIMEOUT';
+                    const failure = new CapabilityError('Authenticated response body was interrupted.', timedOut ? 'TIMEOUT' : 'CANCELLED', { reason: timedOut ? 'request-body-timeout' : 'request-body-cancelled', cause: valueFreeFailure(cause) });
+                    controller.error(failure);
+                    const cancellation = reader.cancel();
+                    transportController.abort(failure);
+                    // The pre-admitted resource remains owned until cancellation settles, including after this wait's deadline.
+                    void cancellation.then(() => { reader.releaseLock(); completion.resolve(); finishResource(); }, error => {
+                        reader.releaseLock();
+                        diagnostics.error('Authenticated request cleanup failed', { scope: 'secrets', plugin: 'authenticated-request', error: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                        completion.resolve();
+                        finishResource();
+                    });
+                };
+                signal.addEventListener('abort', abort, { once: true });
+                if (signal.aborted)
+                    abort();
+                try {
+                    await completion.promise;
+                }
+                finally {
+                    signal.removeEventListener('abort', abort);
+                }
+            }, { timeoutMs, reason: 'authenticated-response-body', signal: callerSignal });
+            void lifetime.catch(error => {
+                controller.error(new CapabilityError('Authenticated response ownership failed.', 'UNAVAILABLE', { reason: 'request-body-owner-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) }));
+                // Controlled abort was already delivered; cleanup has its own retained resource and diagnostic.
+                if (closed)
+                    return;
+                closed = true;
+                const cancellation = reader.cancel();
+                transportController.abort();
+                void cancellation.then(() => { reader.releaseLock(); completion.resolve(); finishResource(); }, cause => {
+                    reader.releaseLock();
+                    diagnostics.error('Authenticated request cleanup failed', { scope: 'secrets', plugin: 'authenticated-request', error: valueFreeFailure(CaughtFailureSchema.parse(cause)) });
+                    completion.resolve();
+                    finishResource();
+                });
+            });
+        },
+        async pull(controller) {
+            if (closed)
+                return;
+            try {
+                const next = await reader.read();
+                if (closed)
+                    return;
+                if (next.done) {
+                    closed = true;
+                    controller.close();
+                    reader.releaseLock();
+                    completion.resolve();
+                    finishResource();
+                }
+                else
+                    controller.enqueue(next.value);
+            }
+            catch (error) {
+                const failure = new CapabilityError('Authenticated response body failed.', 'UNAVAILABLE', { reason: 'request-body-read-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                controller.error(failure);
+                if (closed) {
+                    diagnostics.error('Authenticated response read failed after closure', { scope: 'secrets', plugin: 'authenticated-request', error: failure });
+                    return;
+                }
+                closed = true;
+                transportController.abort();
+                try {
+                    await reader.cancel();
+                }
+                catch (cause) {
+                    controller.error(new CapabilityError('Authenticated response cancellation failed.', 'UNAVAILABLE', { reason: 'request-body-close-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(cause)) }));
+                    // A native errored stream rethrows its stored read error from cancel; that failure was delivered above.
+                    if (cause !== error)
+                        diagnostics.error('Authenticated request cleanup failed', { scope: 'secrets', plugin: 'authenticated-request', error: valueFreeFailure(CaughtFailureSchema.parse(cause)) });
+                }
+                finally {
+                    reader.releaseLock();
+                    completion.resolve();
+                    finishResource();
+                }
+            }
+        },
+        async cancel() {
+            if (closed)
+                return;
+            closed = true;
+            const cancellation = reader.cancel();
+            transportController.abort();
+            try {
+                await cancellation;
+            }
+            catch (error) {
+                const failure = new CapabilityError('Authenticated response cancellation failed.', 'UNAVAILABLE', { reason: 'request-body-close-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                diagnostics.error('Authenticated request cleanup failed', { scope: 'secrets', plugin: 'authenticated-request', error: failure });
+                throw failure;
+            }
+            finally {
+                reader.releaseLock();
+                completion.resolve();
+                finishResource();
+            }
+        }
+    }, { highWaterMark: 0 });
+    return preserveResponseMetadata(new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers }), response, publicUrl);
+}
+/** Paths address existing parents; setting a value never creates an array hole or prototype property. */
+function setJsonField(root, path, value) {
+    let current = root;
+    for (const [index, part] of path.entries()) {
+        if (!isContainer(current))
+            throw invalid('request-json-path-invalid');
+        const last = index === path.length - 1;
+        if (Array.isArray(current)) {
+            if (!/^(0|[1-9]\d*)$/.test(part) || Number(part) >= current.length)
+                throw invalid('request-json-path-invalid');
+            const key = Number(part);
+            if (last)
+                current[key] = value;
+            else
+                current = current[key];
+        }
+        else if (last)
+            current[part] = value;
+        else {
+            const next = current[part];
+            if (next === undefined)
+                throw invalid('request-json-path-invalid');
+            current = next;
+        }
+    }
+}
+const ClientCredentialsTokenResponseSchema = OAuthAuthorizationCodeTokenResponseSchema.extend({
+    token_type: z.string().toLowerCase().pipe(z.literal('bearer'))
+});
+/** Exchange and consume inside Secrets; neither client secret nor issued bearer crosses this owner. */
+async function clientCredentialsBearer(runtime, binding, request, signal) {
+    const form = new URLSearchParams({ grant_type: 'client_credentials' });
+    if (binding.scopes.length > 0)
+        form.set('scope', binding.scopes.join(' '));
+    const authentication = [
+        { kind: 'form-field', field: 'client_id', candidates: binding.clientId, required: true },
+        { kind: 'form-field', field: 'client_secret', candidates: binding.clientSecret, required: true }
+    ];
+    const response = await sendAuthenticatedRequest(runtime, {
+        url: binding.tokenEndpoint, signal, operation: request.operation,
+        options: {
+            method: 'POST', headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded' }, body: form,
+            credentialBindings: [...authentication, ...binding.tokenEndpointBindings],
+            store: request.options.store, maxRedirects: 0,
+            timeoutMs: request.options.timeoutMs, bodyTimeoutMs: request.options.timeoutMs
+        }
+    });
+    if (!response.ok) {
+        const closed = await settle(() => response.body?.cancel());
+        throw new CapabilityError('OAuth client credentials were refused.', response.status === 400 || response.status === 401 ? 'AUTH_REQUIRED' : 'UNAVAILABLE', {
+            reason: 'oauth-client-credentials-refused', retryable: response.status >= 500,
+            details: { status: response.status }, cause: closed.ok ? undefined : valueFreeFailure(closed.cause)
+        });
+    }
+    const received = await settle(() => readBoundedText(response, 1024 * 1024));
+    if (!received.ok) {
+        const failure = received.cause;
+        // Preserve this wait's own cancellation receipt across its nested body owner.
+        if (signal.aborted && failure instanceof CapabilityError && ((failure.code === 'CANCELLED' && failure.reason === 'request-body-cancelled') ||
+            (failure.code === 'TIMEOUT' && failure.reason === 'request-body-timeout')))
+            throw signal.reason;
+        throw failure;
+    }
+    const answer = received.value;
+    if (answer.truncated)
+        throw new CapabilityError('OAuth token response is invalid.', 'UNAVAILABLE', {
+            reason: 'oauth-token-response-invalid', retryable: false
+        });
+    const decoded = settleNow(() => JSON.parse(answer.text));
+    const token = decoded.ok ? ClientCredentialsTokenResponseSchema.safeParse(decoded.value) : undefined;
+    if (!token?.success)
+        throw new CapabilityError('OAuth token response is invalid.', 'UNAVAILABLE', {
+            reason: 'oauth-token-response-invalid', retryable: false
+        });
+    signal.throwIfAborted();
+    return token.data.access_token;
+}
+export async function sendAuthenticatedRequest(runtime, input) {
+    const parsed = authenticatedRequestInputSchema.safeParse(input);
+    if (!parsed.success)
+        throw invalid('request-input-invalid');
+    const request = parsed.data;
+    const options = request.options;
+    const policy = { allowLoopbackHttp: isDevelopmentHost(runtime) };
+    const destination = parseSecureUrl(request.url, policy);
+    if (!destination.ok)
+        throw invalid('request-url-invalid');
+    const environment = runtime.environment;
+    const transport = environment.httpFetch;
+    if (!transport)
+        throw new CapabilityError('The host has no HTTP transport.', 'UNAVAILABLE', { reason: 'http-fetch-unavailable', retryable: false });
+    const resource = Promise.withResolvers();
+    // Admission precedes the first asynchronous allocation; the release follows actual cleanup, never a timeout observer.
+    void runtime.lifecycle.own(() => resource.promise);
+    let started = false;
+    try {
+        return await runtime.lifecycle.wait(async (waitSignal) => {
+            started = true;
+            let transferred = false;
+            try {
+                const resolve = (candidates) => resolveCredentialCandidates(runtime, candidates.map(reference => {
+                    if (reference.source === 'oauth-account')
+                        return reference;
+                    return { ...reference, store: reference.store ?? options.store, operation: reference.operation ?? request.operation };
+                }));
+                const required = async (candidates, mustExist) => {
+                    const value = await resolve(candidates);
+                    if (value === undefined && mustExist)
+                        throw new CapabilityError('Secret is not set.', 'NOT_FOUND', { reason: 'credential-not-set', retryable: false });
+                    return value;
+                };
+                let headers;
+                try {
+                    headers = new Headers(options.headers);
+                }
+                catch (error) {
+                    throw new CapabilityError('Request headers cannot be sent.', 'INVALID_INPUT', { reason: 'request-header-invalid', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                }
+                const inputBody = options.body;
+                let body = ArrayBuffer.isView(inputBody)
+                    ? new Uint8Array(inputBody.buffer, inputBody.byteOffset, inputBody.byteLength)
+                    : inputBody;
+                let target = new URL(destination.url);
+                const privateSegments = [];
+                let jsonBody;
+                if (options.credential !== undefined) {
+                    const value = await required([options.credential], !options.allowMissingCredential);
+                    if (value !== undefined) {
+                        const name = options.credentialScheme === 'x-access-token' ? 'x-access-token' : 'authorization';
+                        const prefix = options.credentialTemplate === 'bearer' ? 'Bearer ' : '';
+                        setCredentialHeader(headers, name, `${prefix}${value}`);
+                    }
+                }
+                for (const binding of options.credentialBindings ?? []) {
+                    if (binding.kind === 'oauth-client-credentials') {
+                        const bearer = await clientCredentialsBearer(runtime, binding, request, waitSignal);
+                        setCredentialHeader(headers, 'authorization', `Bearer ${bearer}`);
+                        continue;
+                    }
+                    if (binding.kind === 'basic-auth') {
+                        const username = await required(binding.username, binding.required);
+                        const password = await required(binding.password, binding.required);
+                        if (username === undefined || password === undefined)
+                            continue;
+                        if (username.includes(':'))
+                            throw invalid('request-basic-username-invalid');
+                        let binary = '';
+                        for (const byte of new TextEncoder().encode(`${username}:${password}`))
+                            binary += String.fromCharCode(byte);
+                        setCredentialHeader(headers, 'authorization', `Basic ${btoa(binary)}`);
+                        continue;
+                    }
+                    const value = await required(binding.candidates, binding.required);
+                    if (value === undefined)
+                        continue;
+                    switch (binding.kind) {
+                        case 'header':
+                            setCredentialHeader(headers, binding.header, `${binding.prefix}${value}`);
+                            break;
+                        case 'form-field': {
+                            if (!(body instanceof URLSearchParams))
+                                throw invalid('request-form-body-invalid');
+                            body = new URLSearchParams(body);
+                            body.set(binding.field, value);
+                            break;
+                        }
+                        case 'json-field': {
+                            if (jsonBody === undefined) {
+                                const text = z.string().safeParse(body);
+                                if (!text.success)
+                                    throw invalid('request-json-body-invalid');
+                                try {
+                                    jsonBody = JsonValueSchema.parse(JSON.parse(text.data));
+                                }
+                                catch (error) {
+                                    throw new CapabilityError('The JSON request body is invalid.', 'INVALID_INPUT', { reason: 'request-json-body-invalid', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                                }
+                            }
+                            setJsonField(jsonBody, binding.path, value);
+                            body = JSON.stringify(jsonBody);
+                            break;
+                        }
+                        case 'path-segment': {
+                            let found = false;
+                            let encoded;
+                            try {
+                                encoded = encodeURIComponent(value);
+                            }
+                            catch (error) {
+                                throw new CapabilityError('A credential path segment cannot be encoded.', 'INVALID_INPUT', { reason: 'request-path-value-invalid', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                            }
+                            target.pathname = target.pathname.split('/').map((segment, index) => {
+                                if (segment !== `{${binding.name}}` && segment !== `%7B${binding.name}%7D`)
+                                    return segment;
+                                found = true;
+                                privateSegments.push({ index, encoded, placeholder: segment });
+                                return encoded;
+                            }).join('/');
+                            if (!found)
+                                throw invalid('request-path-placeholder-missing');
+                            break;
+                        }
+                    }
+                }
+                const transportController = new AbortController();
+                // Header cancellation belongs to the wait; after headers, the body owner cancels its reader before transport.
+                const signal = AbortSignal.any([waitSignal, transportController.signal]);
+                const firstOrigin = target.origin;
+                let method = options.method;
+                for (let hop = 0; hop <= options.maxRedirects; hop += 1) {
+                    const init = { method, headers, body, signal, redirect: 'manual' };
+                    if (body instanceof ReadableStream)
+                        init.duplex = 'half';
+                    let response;
+                    try {
+                        response = await transport.call(environment, target, init);
+                    }
+                    catch (error) {
+                        if (waitSignal.aborted && error === waitSignal.reason)
+                            throw error;
+                        if (waitSignal.aborted && error instanceof Error && error.name === 'AbortError')
+                            throw waitSignal.reason;
+                        throw new CapabilityError('Authenticated HTTP transport failed.', 'UNAVAILABLE', { reason: 'request-transport-failed', retryable: true, cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                    }
+                    const location = response.headers.get('location');
+                    if (waitSignal.aborted) {
+                        try {
+                            await response.body?.cancel();
+                        }
+                        catch (error) {
+                            const failure = new CapabilityError('Authenticated response cancellation failed.', 'UNAVAILABLE', { reason: 'request-body-close-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                            runtime.diagnostics.error('Authenticated request cleanup failed', { scope: 'secrets', plugin: 'authenticated-request', error: failure });
+                            throw failure;
+                        }
+                        throw waitSignal.reason;
+                    }
+                    if (options.redirect === 'manual' || response.status < 300 || response.status >= 400 || location === null) {
+                        let publicUrl = response.url;
+                        if (privateSegments.length > 0 && URL.canParse(publicUrl)) {
+                            const projected = new URL(publicUrl);
+                            const segments = projected.pathname.split('/');
+                            for (const placement of privateSegments) {
+                                if (segments[placement.index] === placement.encoded)
+                                    segments[placement.index] = placement.placeholder;
+                            }
+                            projected.pathname = segments.join('/');
+                            publicUrl = projected.href;
+                        }
+                        const owned = ownResponseBody(runtime, response, publicUrl, options.bodyTimeoutMs, request.signal, transportController, resource.resolve);
+                        transferred = true;
+                        return owned;
+                    }
+                    try {
+                        await response.body?.cancel();
+                    }
+                    catch (error) {
+                        throw new CapabilityError('The redirect response could not be closed.', 'UNAVAILABLE', { reason: 'request-body-close-failed', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                    }
+                    const next = URL.canParse(location, target.href) ? parseSecureUrl(new URL(location, target).href, policy) : undefined;
+                    if (!next?.ok || next.url.origin !== firstOrigin)
+                        throw new CapabilityError('Credential redirects must stay on the admitted origin.', 'PERMISSION_DENIED', { reason: 'request-redirect-cross-origin', retryable: false });
+                    if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === 'POST')) {
+                        method = 'GET';
+                        body = undefined;
+                        headers.delete('content-type');
+                    }
+                    else if (body instanceof ReadableStream) {
+                        throw new CapabilityError('A consumed stream cannot be replayed after a redirect.', 'UNAVAILABLE', { reason: 'request-redirect-body-not-replayable', retryable: false });
+                    }
+                    target = next.url;
+                }
+                throw new CapabilityError('The request exceeded its redirect budget.', 'UNAVAILABLE', { reason: 'request-redirect-limit', retryable: false });
+            }
+            finally {
+                if (!transferred)
+                    resource.resolve();
+            }
+        }, { timeoutMs: options.timeoutMs, reason: 'authenticated-request-headers', signal: request.signal });
+    }
+    finally {
+        if (!started)
+            resource.resolve();
+    }
+}
+//# sourceMappingURL=authenticated-request.js.map

package/dist/domain/client/authenticated-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-request.js","sourceRoot":"","sources":["../../../src/domain/client/authenticated-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAA6C,MAAM,qBAAqB,CAAC;AAC3J,OAAO,EAAE,eAAe,EAAkB,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAkG,MAAM,yDAAyD,CAAC;AAC1M,OAAO,EAAE,yCAAyC,EAA6B,MAAM,kDAAkD,CAAC;AACxI,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,SAAS,OAAO,CAAC,MAAc;IAC9B,OAAO,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,IAAY,EAAE,KAAa;IACzE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;AAClN,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACvG,SAAS,WAAW,CAAC,KAAgB;IACpC,OAAO,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAiB,EAAE,QAAkB,EAAE,SAAiB;IACzF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE;QAChC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QACzB,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,EAAE;QAC1C,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;QAC9B,KAAK,EAAE,EAAE,KAAK,EAAE;gBACf,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1F,CAAC,EAAE;KACH,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CAAC,OAAqB,EAAE,QAAkB,EAAE,SAAiB,EAAE,SAAiB,EAAE,YAAqC,EAAE,mBAAoC,EAAE,cAA0B;IAChN,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,cAAc,EAAE,CAAC;QACjB,OAAO,wBAAwB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnK,CAAC;IACD,MAAM,WAAW,GAAsB,OAAO,CAAC,WAAW,CAAC;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IACjD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,cAAc,CAAa;QAC3C,KAAK,CAAC,UAAU;YACf,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;gBACtD,MAAM,KAAK,GAAG,GAAG,EAAE;oBAClB,IAAI,MAAM;wBAAE,OAAO;oBACnB,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,MAAM,QAAQ,GAAG,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;oBAC9E,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,8CAA8C,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAClO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBACrC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACnC,4GAA4G;oBAC5G,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE;wBACvG,MAAM,CAAC,WAAW,EAAE,CAAC;wBACrB,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;wBAC5K,UAAU,CAAC,OAAO,EAAE,CAAC;wBACrB,cAAc,EAAE,CAAC;oBAClB,CAAC,CAAC,CAAC;gBACJ,CAAC,CAAC;gBACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,IAAI,MAAM,CAAC,OAAO;oBAAE,KAAK,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBAAC,MAAM,UAAU,CAAC,OAAO,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;YAC1F,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/E,KAAK,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBAC3B,UAAU,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,0CAA0C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrM,gGAAgG;gBAChG,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACrC,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBAC5B,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE;oBACvG,MAAM,CAAC,WAAW,EAAE,CAAC;oBAAC,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBAAC,cAAc,EAAE,CAAC;gBAC3O,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU;YACpB,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,MAAM;oBAAE,OAAO;gBACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,MAAM,GAAG,IAAI,CAAC;oBACd,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrB,UAAU,CAAC,OAAO,EAAE,CAAC;oBACrB,cAAc,EAAE,CAAC;gBAClB,CAAC;;oBAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,qCAAqC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7L,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1B,IAAI,MAAM,EAAE,CAAC;oBACZ,WAAW,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC7I,OAAO;gBACR,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC;gBACd,mBAAmB,CAAC,KAAK,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAC7C,UAAU,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBACxM,wGAAwG;oBACxG,IAAI,KAAK,KAAK,KAAK;wBAAE,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClM,CAAC;wBAAS,CAAC;oBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBAAC,cAAc,EAAE,CAAC;gBAAC,CAAC;YAC5E,CAAC;QACF,CAAC;QACD,KAAK,CAAC,MAAM;YACX,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACrC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC;gBAAC,MAAM,YAAY,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtM,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjI,MAAM,OAAO,CAAC;YACf,CAAC;oBAAS,CAAC;gBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAAC,cAAc,EAAE,CAAC;YAAC,CAAC;QAC5E,CAAC;KACD,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IAEzB,OAAO,wBAAwB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACnK,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAe,EAAE,IAAc,EAAE,KAAa;IACnE,IAAI,OAAO,GAAc,IAAI,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;YAC/G,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;;gBAC1B,OAAO,GAAG,OAAO,CAAC,GAAG,CAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;aAClC,CAAC;YACL,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;YACnE,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;IACF,CAAC;AACF,CAAC;AAGD,MAAM,oCAAoC,GAAG,yCAAyC,CAAC,MAAM,CAAC;IAC7F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9D,CAAC,CAAC;AAEH,uGAAuG;AACvG,KAAK,UAAU,uBAAuB,CACrC,OAAqB,EACrB,OAA4E,EAC5E,OAAkC,EAClC,MAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,MAAM,cAAc,GAA2B;QAC9C,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChG,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE;QACxD,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;QAChE,OAAO,EAAE;YACR,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,IAAI,EAAE,IAAI;YACxH,kBAAkB,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;YACzE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;SAC9E;KACD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE;YACzJ,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG;YAC7E,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;SACnG,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC/B,8EAA8E;QAC9E,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,YAAY,eAAe,IAAI,CAC3D,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,wBAAwB,CAAC;YAC7E,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,sBAAsB,CAAC,CACzE;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC;QACvB,MAAM,OAAO,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,aAAa,EAAE;YAClG,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK;SACxD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,aAAa,EAAE;YACjG,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK;SACxD,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqB,EAAE,KAAqC;IAC1G,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,MAAM,GAAG,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpJ,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC/C,sHAAsH;IACtH,KAAK,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;YACtD,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC;gBACL,MAAM,OAAO,GAAG,CAAC,UAAgC,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;oBACrH,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe;wBAAE,OAAO,SAAS,CAAC;oBAC3D,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvH,CAAC,CAAC,CAAC,CAAC;gBACJ,MAAM,QAAQ,GAAG,KAAK,EAAE,UAAgC,EAAE,SAAkB,EAAE,EAAE;oBAC/E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;oBACxC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS;wBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;oBACvJ,OAAO,KAAK,CAAC;gBACd,CAAC,CAAC;gBACF,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAC9D,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChL,CAAC;gBACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC/B,IAAI,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC;oBACvC,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;oBAC9E,CAAC,CAAC,SAAS,CAAC;gBACb,IAAI,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,MAAM,eAAe,GAAmE,EAAE,CAAC;gBAC5F,IAAI,QAA+B,CAAC;gBACpC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;oBACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC;wBAChG,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxE,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC;oBACzD,CAAC;gBACF,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;oBACxD,IAAI,OAAO,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;wBACjD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;wBACpF,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;wBAClE,SAAS;oBACV,CAAC;oBACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACnC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;wBACpE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;wBACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;4BAAE,SAAS;wBAC/D,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;4BAAE,MAAM,OAAO,CAAC,gCAAgC,CAAC,CAAC;wBAC5E,IAAI,MAAM,GAAG,EAAE,CAAC;wBAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;4BAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;wBAC5G,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;wBACvE,SAAS;oBACV,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACnE,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;wBACtB,KAAK,QAAQ;4BAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC;4BAAC,MAAM;wBAChG,KAAK,YAAY,CAAC,CAAC,CAAC;4BACnB,IAAI,CAAC,CAAC,IAAI,YAAY,eAAe,CAAC;gCAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;4BACnF,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;4BACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;4BAC/B,MAAM;wBACP,CAAC;wBACD,KAAK,YAAY,CAAC,CAAC,CAAC;4BACnB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gCAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gCACxC,IAAI,CAAC,IAAI,CAAC,OAAO;oCAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;gCAC9D,IAAI,CAAC;oCAAC,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gCAAC,CAAC;gCAAC,OAAO,KAAK,EAAE,CAAC;oCAC/E,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gCACrL,CAAC;4BACF,CAAC;4BACD,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;4BAC5C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;4BAChC,MAAM;wBACP,CAAC;wBACD,KAAK,cAAc,CAAC,CAAC,CAAC;4BACrB,IAAI,KAAK,GAAG,KAAK,CAAC;4BAClB,IAAI,OAAe,CAAC;4BACpB,IAAI,CAAC;gCAAC,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;4BAAC,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCAC3D,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;4BACjM,CAAC;4BACD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;gCACnE,IAAI,OAAO,KAAK,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,KAAK,MAAM,OAAO,CAAC,IAAI,KAAK;oCAAE,OAAO,OAAO,CAAC;gCAC3F,KAAK,GAAG,IAAI,CAAC;gCACb,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;gCAC/D,OAAO,OAAO,CAAC;4BAChB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACb,IAAI,CAAC,KAAK;gCAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;4BAC9D,MAAM;wBACP,CAAC;oBACF,CAAC;gBACF,CAAC;gBAED,MAAM,mBAAmB,GAAG,IAAI,eAAe,EAAE,CAAC;gBAClD,8GAA8G;gBAC9G,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACzE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;gBAClC,IAAI,MAAM,GAAW,OAAO,CAAC,MAAM,CAAC;gBACpC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,GAAsC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBACtG,IAAI,IAAI,YAAY,cAAc;wBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACzD,IAAI,QAAkB,CAAC;oBACvB,IAAI,CAAC;wBAAC,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAClF,IAAI,UAAU,CAAC,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,MAAM;4BAAE,MAAM,KAAK,CAAC;wBACnE,IAAI,UAAU,CAAC,OAAO,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;4BAAE,MAAM,UAAU,CAAC,MAAM,CAAC;wBACzG,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBACtM,CAAC;oBACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAClD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC;4BAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;wBAAC,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BAAC,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;4BAC9P,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;4BACzI,MAAM,OAAO,CAAC;wBAAC,CAAC;wBACf,MAAM,UAAU,CAAC,MAAM,CAAC;oBACzB,CAAC;oBACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC1G,IAAI,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC;wBAC7B,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;4BACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;4BAC/C,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;gCACzC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,OAAO;oCAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC;4BACxG,CAAC;4BACD,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BACxC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC;wBAC5B,CAAC;wBACD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;wBAC3I,WAAW,GAAG,IAAI,CAAC;wBACnB,OAAO,KAAK,CAAC;oBACd,CAAC;oBACD,IAAI,CAAC;wBAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACrD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5L,CAAC;oBACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACtH,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW;wBAAE,MAAM,IAAI,eAAe,CAAC,wDAAwD,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1N,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;wBAC5G,MAAM,GAAG,KAAK,CAAC;wBACf,IAAI,GAAG,SAAS,CAAC;wBACjB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;oBAChC,CAAC;yBAAM,IAAI,IAAI,YAAY,cAAc,EAAE,CAAC;wBAC3C,MAAM,IAAI,eAAe,CAAC,wDAAwD,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,sCAAsC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1K,CAAC;oBACD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnB,CAAC;gBACD,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9I,CAAC;oBAAS,CAAC;gBAAC,IAAI,CAAC,WAAW;oBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;QACpD,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAChD,CAAC"}

package/dist/domain/client/credential-use.d.ts

@@ -0,0 +1,27 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type CredentialCandidates, type CredentialPresenceInputInput, type CredentialPayloadSignatureInput, type OAuthAuthorizationCodeExchangeInputInput, type OAuthRefreshTokenExchangeInputInput, type OAuthAuthorizationUrlResolveInput } from '../../schemas/transport/credential-use.schema.ts';
+/** Only a confirmed absence advances the declared list; every other owner refusal survives. */
+export declare function resolveCredentialCandidates(runtime: VibesRuntime, candidates: CredentialCandidates): Promise<string | undefined>;
+export declare function checkCredentialPresence(runtime: VibesRuntime, input: CredentialPresenceInputInput): Promise<{
+    set: true;
+}>;
+/** Return only the HMAC receipt; key resolution and cryptographic use stay in Secrets. */
+export declare function signCredentialPayload(runtime: VibesRuntime, input: CredentialPayloadSignatureInput): Promise<string | undefined>;
+export declare function resolveOAuthAuthorizationUrl(runtime: VibesRuntime, input: OAuthAuthorizationUrlResolveInput): Promise<string>;
+export declare function exchangeOAuthAuthorizationCode(runtime: VibesRuntime, input: OAuthAuthorizationCodeExchangeInputInput): Promise<{
+    [x: string]: import("@vibesdotdev/kernel/bootstrap").JsonValue;
+    access_token: string;
+    refresh_token?: string | undefined;
+    expires_in?: number | undefined;
+    x_refresh_token_expires_in?: number | undefined;
+    refresh_token_expires_in?: number | undefined;
+}>;
+export declare function exchangeOAuthRefreshToken(runtime: VibesRuntime, input: OAuthRefreshTokenExchangeInputInput): Promise<{
+    [x: string]: import("@vibesdotdev/kernel/bootstrap").JsonValue;
+    access_token: string;
+    refresh_token?: string | undefined;
+    expires_in?: number | undefined;
+    x_refresh_token_expires_in?: number | undefined;
+    refresh_token_expires_in?: number | undefined;
+}>;
+//# sourceMappingURL=credential-use.d.ts.map

package/dist/domain/client/credential-use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-use.d.ts","sourceRoot":"","sources":["../../../src/domain/client/credential-use.ts"],"names":[],"mappings":"AACA,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAON,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,wCAAwC,EAC7C,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,EACtC,MAAM,kDAAkD,CAAC;AAU1D,+FAA+F;AAC/F,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CActI;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,CAAC,CAMhI;AAED,0FAA0F;AAC1F,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsCtI;AAQD,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnI;AAwFD,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,wCAAwC;;;;;;;GAG1H;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,mCAAmC;;;;;;;GAGhH"}