@withbuddi/buddi 0.1.0-pre.21 → 0.1.0-pre.23

package/packages/runtime/dist/oauth.js

@@ -0,0 +1,535 @@
+/**
+ * OAuth 2.1 pieces every sign-in in buddi shares: the Claude and ChatGPT
+ * subscription sign-ins today, remote MCP connections next
+ * (buddi-planning/specs/mcp-client.md §4).
+ *
+ * - The vault envelope (`OAuthTokens`) and its reader.
+ * - PKCE (S256), the authorize URL and the callback parser.
+ * - Discovery: the MCP authorization spec's protected-resource metadata
+ *   (RFC 9728), then the authorization server's metadata (RFC 8414 / OIDC).
+ * - Dynamic client registration (RFC 7591), public client, no secret.
+ * - `OAuthClient`: the code exchange and the refresh at a token endpoint.
+ * - `refreshDiscipline`: the ready / refreshing / reconnect dance, once.
+ *
+ * Nothing here puts a response body, a token or a code into an error message,
+ * and nothing retries a token request on its own: a refresh token may be
+ * single use, and a blind retry of one that reached the server burns it.
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { defaultHttpTransport } from './transport.js';
+const MAX_ENVELOPE_BYTES = 64 * 1024;
+export function validToken(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 16384 && !/[\s\x00-\x1f\x7f]/.test(value);
+}
+export function validOAuthId(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 200 && /^[A-Za-z0-9._:-]+$/.test(value);
+}
+function validScopes(value) {
+    return Array.isArray(value) && value.length <= 200 && value.every((s) => typeof s === 'string' && s.length <= 200);
+}
+/** Parse and check a stored envelope. Throws `invalidMessage`, never the value. */
+export function readOAuthTokens(raw, opts = {}) {
+    const invalid = opts.invalidMessage ?? 'Invalid sign-in credential. Reconnect this account.';
+    try {
+        if (typeof raw !== 'string' || Buffer.byteLength(raw) > MAX_ENVELOPE_BYTES)
+            throw new Error();
+        let data = JSON.parse(raw);
+        if (!data || typeof data !== 'object' || Array.isArray(data))
+            throw new Error();
+        if (data.version !== 1 && opts.adapt)
+            data = opts.adapt(data) ?? data;
+        const t = data;
+        if (t.version !== 1 || (t.state !== 'ready' && t.state !== 'refreshing') || !validToken(t.accessToken))
+            throw new Error();
+        if (t.refreshToken !== undefined ? !validToken(t.refreshToken) : opts.requireRefreshToken)
+            throw new Error();
+        if (typeof t.expiresAt !== 'number' || !Number.isFinite(t.expiresAt) || t.expiresAt < 0)
+            throw new Error();
+        if (opts.requirePositiveExpiry && t.expiresAt <= 0)
+            throw new Error();
+        if (t.scopes !== undefined ? !validScopes(t.scopes) : opts.requireScopes)
+            throw new Error();
+        if (t.clientId !== undefined && !validOAuthId(t.clientId) && !validToken(t.clientId))
+            throw new Error();
+        if (t.resource !== undefined && (typeof t.resource !== 'string' || t.resource.length > 2048))
+            throw new Error();
+        if (t.accountId !== undefined ? !validOAuthId(t.accountId) : opts.requireAccountId)
+            throw new Error();
+        const extra = {};
+        if (t.extra !== undefined) {
+            if (!t.extra || typeof t.extra !== 'object' || Array.isArray(t.extra))
+                throw new Error();
+            for (const [key, value] of Object.entries(t.extra)) {
+                if (typeof value !== 'string' || value.length > 16384 || key.length > 64)
+                    throw new Error();
+                extra[key] = value;
+            }
+        }
+        for (const key of opts.keep ?? []) {
+            if (t[key] === undefined)
+                continue;
+            if (!validToken(t[key]))
+                throw new Error();
+            extra[key] = t[key];
+        }
+        return {
+            version: 1, state: t.state, accessToken: t.accessToken,
+            ...(t.refreshToken !== undefined ? { refreshToken: t.refreshToken } : {}),
+            expiresAt: t.expiresAt,
+            ...(t.scopes !== undefined ? { scopes: [...t.scopes] } : {}),
+            ...(t.clientId !== undefined ? { clientId: t.clientId } : {}),
+            ...(t.resource !== undefined ? { resource: t.resource } : {}),
+            ...(t.accountId !== undefined ? { accountId: t.accountId } : {}),
+            ...(Object.keys(extra).length > 0 ? { extra } : {}),
+        };
+    }
+    catch {
+        throw new Error(invalid);
+    }
+}
+/** A fresh verifier and its S256 challenge. The verifier never enters a URL. */
+export function pkcePair() {
+    const verifier = randomBytes(32).toString('base64url');
+    return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url'), method: 'S256' };
+}
+/** A fresh, unguessable `state`. */
+export function oauthState() {
+    return randomBytes(32).toString('base64url');
+}
+export function authorizeUrl(p) {
+    const query = new URLSearchParams({
+        ...(p.extra ?? {}),
+        client_id: p.clientId, response_type: 'code', redirect_uri: p.redirectUri,
+        ...(p.scopes && p.scopes.length > 0 ? { scope: p.scopes.join(' ') } : {}),
+        code_challenge_method: 'S256', code_challenge: p.challenge, state: p.state,
+        ...(p.resource ? { resource: p.resource } : {}),
+    });
+    const url = new URL(p.authorizationEndpoint);
+    for (const [key, value] of url.searchParams)
+        if (!query.has(key))
+            query.append(key, value);
+    return `${url.origin}${url.pathname}?${query.toString().replaceAll('+', '%20')}`;
+}
+/** Why a callback was refused. `reason` lets a caller say it in its own words. */
+export class OAuthCallbackError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = 'OAuthCallbackError';
+    }
+}
+/**
+ * The code from a redirect URL, or a pasted `code#state`, checked against the
+ * state this sign-in sent in constant time. Throws `OAuthCallbackError`.
+ */
+export function parseCallback(input, expectedState, opts = {}) {
+    const text = typeof input === 'string' ? input.trim() : input.toString();
+    if (!text || text.length > 8192)
+        throw new OAuthCallbackError('malformed', 'The sign-in answer is missing or too long.');
+    let code;
+    let state;
+    if (typeof input !== 'string' || /^https?:\/\//.test(text)) {
+        let url;
+        try {
+            url = typeof input === 'string' ? new URL(text) : input;
+        }
+        catch {
+            throw new OAuthCallbackError('malformed', 'Invalid sign-in callback.');
+        }
+        if (opts.redirectUri !== undefined) {
+            const expected = new URL(opts.redirectUri);
+            if (url.origin + url.pathname !== expected.origin + expected.pathname)
+                throw new OAuthCallbackError('foreign', 'Unexpected sign-in callback.');
+        }
+        else if (url.protocol !== 'https:' && !isLoopback(url)) {
+            throw new OAuthCallbackError('foreign', 'Unexpected sign-in callback.');
+        }
+        state = url.searchParams.get('state');
+        if (url.searchParams.get('error')) {
+            if (!sameState(state, expectedState))
+                throw new OAuthCallbackError('state', 'Authorization state did not match.');
+            throw new OAuthCallbackError('denied', 'The sign-in was declined.');
+        }
+        code = url.searchParams.get('code');
+    }
+    else {
+        if (!opts.allowCodeHashState)
+            throw new OAuthCallbackError('malformed', 'Invalid sign-in callback.');
+        const parts = text.split('#');
+        if (parts.length !== 2)
+            throw new OAuthCallbackError('malformed', 'Paste the full code, including #state.');
+        [code, state] = parts.map((s) => s.trim());
+    }
+    if (!code || /\s/.test(code) || code.length > 4096)
+        throw new OAuthCallbackError('malformed', 'The sign-in answer has no code.');
+    if (!sameState(state, expectedState))
+        throw new OAuthCallbackError('state', 'Authorization state did not match.');
+    return { code, state: state };
+}
+function sameState(state, expected) {
+    if (!state || Buffer.byteLength(state) !== Buffer.byteLength(expected))
+        return false;
+    return timingSafeEqual(Buffer.from(state), Buffer.from(expected));
+}
+function isLoopback(url) {
+    return url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
+}
+/** A `WWW-Authenticate` header, read: scheme and its auth-params. */
+export function parseWwwAuthenticate(header) {
+    if (!header || header.length > 8192)
+        return undefined;
+    const match = /^\s*([A-Za-z][A-Za-z0-9!#$%&'*+.^_`|~-]*)\s*(.*)$/s.exec(header);
+    if (!match)
+        return undefined;
+    const params = {};
+    const re = /([A-Za-z0-9!#$%&'*+.^_`|~-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^\s,]*))\s*,?\s*/gy;
+    const rest = match[2] ?? '';
+    re.lastIndex = 0;
+    let m;
+    while (re.lastIndex < rest.length && (m = re.exec(rest)) !== null) {
+        params[m[1].toLowerCase()] = m[2] !== undefined ? m[2].replace(/\\(.)/g, '$1') : (m[3] ?? '');
+    }
+    return { scheme: match[1].toLowerCase(), params };
+}
+const DISCOVERY_MAX_BYTES = 256 * 1024;
+/**
+ * How to sign in to `resourceUrl` (an MCP server's address), per the MCP
+ * authorization spec: the resource metadata a 401 named, or the well-known
+ * one at the resource (path-aware, then root); then the named authorization
+ * server's metadata, RFC 8414 first, OpenID Connect discovery second. A server
+ * that publishes no resource metadata is taken to be its own authorization
+ * server (the MCP 2025-03-26 fallback). Every URL must be https; nothing
+ * follows a redirect.
+ */
+export async function discoverAuthorization(resourceUrl, opts = {}) {
+    const transport = opts.transport ?? defaultHttpTransport;
+    const loopback = opts.allowLoopbackHttp === true;
+    const resource = safeUrl(resourceUrl, loopback, 'The server address must be an https address.');
+    const challenge = parseWwwAuthenticate(opts.wwwAuthenticate);
+    const challengeScopes = challenge?.scheme === 'bearer' && challenge.params.scope ? splitScopes(challenge.params.scope) : undefined;
+    const candidates = [];
+    const named = challenge?.scheme === 'bearer' ? challenge.params.resource_metadata : undefined;
+    if (named)
+        candidates.push(safeUrl(named, loopback, 'The server named a metadata address that is not https.').toString());
+    const path = resource.pathname.replace(/\/$/, '');
+    if (path)
+        candidates.push(`${resource.origin}/.well-known/oauth-protected-resource${path}`);
+    candidates.push(`${resource.origin}/.well-known/oauth-protected-resource`);
+    let protectedResource;
+    for (const url of candidates) {
+        const data = await getJson(transport, url);
+        if (data === undefined)
+            continue;
+        protectedResource = readProtectedResource(data, resource, loopback);
+        break;
+    }
+    const issuer = protectedResource
+        ? safeUrl(protectedResource.authorizationServers[0], loopback, 'The authorization server address is not https.')
+        : new URL(resource.origin);
+    const authorizationServer = await discoverAuthorizationServer(issuer.toString(), { transport, allowLoopbackHttp: loopback });
+    return {
+        resource: protectedResource?.resource ?? canonicalResource(resource),
+        ...(protectedResource ? { protectedResource } : {}),
+        authorizationServer,
+        scopes: challengeScopes ?? protectedResource?.scopesSupported ?? [],
+    };
+}
+/** RFC 8414 metadata for an issuer, with the OIDC discovery fallbacks. */
+export async function discoverAuthorizationServer(issuerUrl, opts = {}) {
+    const transport = opts.transport ?? defaultHttpTransport;
+    const loopback = opts.allowLoopbackHttp === true;
+    const issuer = safeUrl(issuerUrl, loopback, 'The authorization server address is not https.');
+    const path = issuer.pathname.replace(/\/$/, '');
+    const candidates = path
+        ? [
+            `${issuer.origin}/.well-known/oauth-authorization-server${path}`,
+            `${issuer.origin}/.well-known/openid-configuration${path}`,
+            `${issuer.origin}${path}/.well-known/openid-configuration`,
+        ]
+        : [`${issuer.origin}/.well-known/oauth-authorization-server`, `${issuer.origin}/.well-known/openid-configuration`];
+    for (const url of candidates) {
+        const data = await getJson(transport, url);
+        if (data === undefined)
+            continue;
+        return readAuthorizationServer(data, issuer, loopback);
+    }
+    throw new Error('The server did not say how to sign in to it (no authorization server metadata).');
+}
+function readProtectedResource(data, resource, loopback) {
+    const servers = data.authorization_servers;
+    if (!Array.isArray(servers) || servers.length === 0 || !servers.every((s) => typeof s === 'string' && s.length <= 2048)) {
+        throw new Error('The server\'s sign-in metadata names no authorization server.');
+    }
+    let named = canonicalResource(resource);
+    if (data.resource !== undefined) {
+        if (typeof data.resource !== 'string')
+            throw new Error('The server\'s sign-in metadata is malformed.');
+        const declared = safeUrl(data.resource, loopback, 'The server\'s sign-in metadata is malformed.');
+        // RFC 9728 §3.3: the metadata must be about the resource that was asked.
+        if (declared.origin !== resource.origin)
+            throw new Error('The server\'s sign-in metadata is for another address.');
+        named = data.resource;
+    }
+    const scopes = strings(data.scopes_supported);
+    return { resource: named, authorizationServers: servers, ...(scopes ? { scopesSupported: scopes } : {}) };
+}
+function readAuthorizationServer(data, issuer, loopback) {
+    const bad = 'The authorization server\'s metadata is malformed.';
+    if (typeof data.issuer !== 'string' || stripSlash(data.issuer) !== stripSlash(issuer.toString())) {
+        throw new Error('The authorization server\'s metadata names another issuer.');
+    }
+    if (typeof data.authorization_endpoint !== 'string' || typeof data.token_endpoint !== 'string')
+        throw new Error(bad);
+    const methods = strings(data.code_challenge_methods_supported);
+    // MCP authorization: PKCE S256 is required, and a server that does not say
+    // it supports it is refused rather than tried.
+    if (!methods || !methods.includes('S256'))
+        throw new Error('The authorization server does not support PKCE (S256), which buddi requires.');
+    const registration = data.registration_endpoint;
+    const scopes = strings(data.scopes_supported);
+    const grants = strings(data.grant_types_supported);
+    const auths = strings(data.token_endpoint_auth_methods_supported);
+    return {
+        issuer: data.issuer,
+        authorizationEndpoint: safeUrl(data.authorization_endpoint, loopback, bad).toString(),
+        tokenEndpoint: safeUrl(data.token_endpoint, loopback, bad).toString(),
+        ...(typeof registration === 'string' ? { registrationEndpoint: safeUrl(registration, loopback, bad).toString() } : {}),
+        ...(scopes ? { scopesSupported: scopes } : {}),
+        codeChallengeMethods: methods,
+        ...(grants ? { grantTypesSupported: grants } : {}),
+        ...(auths ? { tokenEndpointAuthMethods: auths } : {}),
+    };
+}
+async function getJson(transport, url) {
+    let res;
+    try {
+        res = await transport(url, { method: 'GET', headers: { accept: 'application/json', 'mcp-protocol-version': '2025-06-18' },
+            signal: AbortSignal.timeout(15_000), maxBytes: DISCOVERY_MAX_BYTES });
+    }
+    catch {
+        throw new Error('Could not reach the server to read how it signs in. Check the address and the network.');
+    }
+    if (res.status === 404 || res.status === 405 || res.status === 400 || res.status === 401 || res.status === 403)
+        return undefined;
+    if (!res.ok)
+        throw new Error(`The server answered ${res.status} while buddi read how it signs in.`);
+    try {
+        const data = await res.json();
+        if (!data || typeof data !== 'object' || Array.isArray(data))
+            throw new Error();
+        return data;
+    }
+    catch {
+        throw new Error('The server\'s sign-in metadata is not JSON.');
+    }
+}
+function safeUrl(text, loopback, message) {
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        throw new Error(message);
+    }
+    if (url.username || url.password || url.hash)
+        throw new Error(message);
+    if (url.protocol === 'https:')
+        return url;
+    if (url.protocol === 'http:' && loopback && isLoopback(url))
+        return url;
+    throw new Error(message);
+}
+/** RFC 8707 / MCP: scheme and host lower-case, no fragment, no trailing slash on a bare origin. */
+export function canonicalResource(url) {
+    const u = new URL(url.toString());
+    u.hash = '';
+    return u.pathname === '/' && !u.search ? u.origin : u.toString();
+}
+function stripSlash(text) { return text.replace(/\/$/, ''); }
+function strings(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === 'string' && v.length <= 200) && value.length <= 500 ? value : undefined;
+}
+function splitScopes(text) {
+    return text.split(/\s+/).filter(Boolean).slice(0, 200);
+}
+/**
+ * Register buddi as a public client (no secret, PKCE) with an authorization
+ * server that allows it. One call, never retried; the answer's `client_id` is
+ * what the vault keeps beside the tokens.
+ */
+export async function registerClient(registrationEndpoint, request, opts = {}) {
+    const transport = opts.transport ?? defaultHttpTransport;
+    const endpoint = safeUrl(registrationEndpoint, opts.allowLoopbackHttp === true, 'The registration address is not https.');
+    const body = {
+        client_name: 'buddi',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+        ...request,
+    };
+    let res;
+    try {
+        res = await transport(endpoint.toString(), { method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(body), signal: AbortSignal.timeout(20_000), maxBytes: 65536 });
+    }
+    catch {
+        throw new Error('Could not reach the server to register buddi. Check the network and try again.');
+    }
+    if (!res.ok)
+        throw new Error(`The server refused to register buddi (${res.status}). It may need a client id entered by hand.`);
+    try {
+        const data = await res.json();
+        if (!validToken(data.client_id))
+            throw new Error();
+        const secret = data.client_secret;
+        if (secret !== undefined && secret !== null && !validToken(secret))
+            throw new Error();
+        const expires = data.client_secret_expires_at;
+        return {
+            clientId: data.client_id,
+            ...(typeof secret === 'string' ? { clientSecret: secret } : {}),
+            ...(typeof expires === 'number' && Number.isFinite(expires) && expires > 0 ? { clientSecretExpiresAt: expires * 1000 } : {}),
+        };
+    }
+    catch {
+        throw new Error('The server answered the registration with something buddi cannot read.');
+    }
+}
+const MAX_LIFETIME_S = 366 * 86400;
+/** Code exchange and refresh at one token endpoint, for one client. */
+export class OAuthClient {
+    options;
+    transport;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.transport = options.transport ?? defaultHttpTransport;
+        this.now = options.now ?? Date.now;
+    }
+    async #token(body, requested, previous) {
+        const o = this.options;
+        try {
+            const params = {
+                client_id: o.clientId,
+                ...(o.clientSecret ? { client_secret: o.clientSecret } : {}),
+                ...(o.extraParams ?? {}),
+                ...body,
+                ...(o.resource ? { resource: o.resource } : {}),
+            };
+            const res = await this.transport(o.tokenEndpoint, {
+                method: 'POST',
+                headers: { 'content-type': o.format === 'json' ? 'application/json' : 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: o.format === 'json' ? JSON.stringify(params) : new URLSearchParams(params).toString(),
+                signal: AbortSignal.timeout(20_000), maxBytes: 65536,
+            });
+            if (!res.ok)
+                throw new Error();
+            const data = await res.json();
+            if (!data || typeof data !== 'object' || !validToken(data.access_token))
+                throw new Error();
+            if (data.token_type !== undefined && (typeof data.token_type !== 'string' || data.token_type.toLowerCase() !== 'bearer'))
+                throw new Error();
+            const fresh = data.refresh_token === undefined || data.refresh_token === null || data.refresh_token === '' ? undefined : data.refresh_token;
+            if (fresh !== undefined && !validToken(fresh))
+                throw new Error();
+            // A server that does not rotate keeps the old one working.
+            const refreshToken = fresh ?? previous?.refreshToken;
+            if (o.requireRefreshToken && refreshToken === undefined)
+                throw new Error();
+            const expiresIn = typeof data.expires_in === 'string' && /^\d+$/.test(data.expires_in) ? Number(data.expires_in) : data.expires_in;
+            let expiresAt;
+            if (typeof expiresIn === 'number' && Number.isFinite(expiresIn) && expiresIn > 0 && expiresIn <= MAX_LIFETIME_S) {
+                expiresAt = this.now() + expiresIn * 1000;
+            }
+            else if (expiresIn !== undefined && o.requireExpiry) {
+                throw new Error();
+            }
+            else if (o.expiryFallback) {
+                expiresAt = o.expiryFallback(data);
+                if (!expiresAt)
+                    throw new Error();
+            }
+            else if (o.requireExpiry) {
+                throw new Error();
+            }
+            else {
+                expiresAt = this.now() + (o.assumedLifetimeMs ?? (refreshToken ? 3600_000 : 365 * 86400_000));
+            }
+            const scopes = data.scope === undefined ? (requested ? [...requested] : undefined)
+                : typeof data.scope === 'string' && data.scope.length < 4096 ? splitScopes(data.scope) : [];
+            for (const scope of o.requiredScopes ?? [])
+                if (!scopes?.includes(scope))
+                    throw new Error();
+            const tokens = {
+                version: 1, state: 'ready', accessToken: data.access_token,
+                ...(refreshToken ? { refreshToken } : {}),
+                expiresAt,
+                ...(scopes ? { scopes } : {}),
+                clientId: o.clientId,
+                ...(o.resource ? { resource: o.resource } : {}),
+            };
+            return o.finish ? o.finish(tokens, data, previous) : tokens;
+        }
+        catch {
+            throw new Error(previous
+                ? (o.messages?.refresh ?? 'Token refresh failed. Reconnect this account.')
+                : (o.messages?.exchange ?? 'Sign-in could not complete. Start a fresh sign-in.'));
+        }
+    }
+    /** The authorization code for tokens. One request, never retried. */
+    exchangeCode(input) {
+        return this.#token({
+            grant_type: 'authorization_code', code: input.code,
+            ...(input.state !== undefined ? { state: input.state } : {}),
+            code_verifier: input.verifier, redirect_uri: input.redirectUri,
+        }, input.scopes);
+    }
+    /** Spend the refresh token for a new pair. The caller persists the answer. */
+    refresh(tokens, extra = {}) {
+        if (!tokens.refreshToken) {
+            return Promise.reject(new Error(this.options.messages?.refresh ?? 'This sign-in has no refresh token. Reconnect this account.'));
+        }
+        return this.#token({ grant_type: 'refresh_token', refresh_token: tokens.refreshToken, ...extra }, tokens.scopes, tokens);
+    }
+}
+/**
+ * The account's tokens, refreshed when they expire within `skewMs`.
+ *
+ * Order is the whole point. A durable `refreshing` marker is written *before*
+ * the refresh token is spent, so a crash, a timeout or a failed save leaves an
+ * entry that says "reconnect" rather than one another process would replay.
+ * The rotated pair is saved before it is returned; a rotation that could not
+ * be saved is never used. If the marker itself cannot be written, nothing is
+ * spent. The caller holds the cross-process lock for this account.
+ */
+export async function refreshDiscipline(vault, ref, protocol, now = Date.now, opts = {}) {
+    const m = opts.messages ?? {};
+    const raw = await vault.get(ref);
+    if (!raw)
+        throw new Error(m.missing ?? 'Connect this account first.');
+    const tokens = protocol.read(raw);
+    if (tokens.state !== 'ready')
+        throw new Error(m.interrupted ?? 'The token refresh was interrupted or failed. Reconnect this account.');
+    if (tokens.expiresAt > now() + (opts.skewMs ?? 5 * 60_000))
+        return tokens;
+    await opts.beforeRefresh?.();
+    await vault.set(ref, JSON.stringify({ ...tokens, state: 'refreshing' }));
+    let rotated;
+    try {
+        rotated = await protocol.refresh(tokens);
+    }
+    catch (error) {
+        if (m.refreshFailed !== undefined)
+            throw new Error(m.refreshFailed);
+        throw error;
+    }
+    try {
+        await vault.set(ref, JSON.stringify({ ...rotated, state: 'ready' }));
+    }
+    catch {
+        throw new Error(m.unsaved ?? 'The credentials rotated but could not be saved. Reconnect this account.');
+    }
+    return { ...rotated, state: 'ready' };
+}
+//# sourceMappingURL=oauth.js.map

package/packages/runtime/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,oBAAoB,EAA8C,MAAM,gBAAgB,CAAC;AAgDlG,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpH,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClH,CAAC;AACD,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;AACrH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,OAA+B,EAAE;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,IAAI,qDAAqD,CAAC;IAC7F,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9F,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACtD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAChF,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACtE,MAAM,CAAC,GAAG,IAAsD,CAAC;QACjE,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1H,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC7G,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3G,IAAI,IAAI,CAAC,qBAAqB,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC5F,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACxG,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAChH,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtG,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC5F,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACrB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YACnC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAW,CAAC;QAChC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;YACtD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AACvC,CAAC;AAQD,gFAAgF;AAChF,MAAM,UAAU,QAAQ;IACtB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5G,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,UAAU;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAeD,MAAM,UAAU,YAAY,CAAC,CAAqB;IAChD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW;QACzE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;QAC1E,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3F,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;AACnF,CAAC;AAID,kFAAkF;AAClF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAArB,YAAqB,MAA4B,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAhE,WAAM,GAAN,MAAM,CAAsB;QAAqC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAAC,CAAC;CAC1H;AASD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,aAAqB,EAAE,OAA6B,EAAE;IACvG,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;IACzH,IAAI,IAA+B,CAAC;IACpC,IAAI,KAAgC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QAAC,CAAC;QAClJ,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ;gBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACjJ,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;YAClH,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;QAC5G,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;IACjI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAClH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAe,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAgC,EAAE,QAAgB;IACnE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAClG,CAAC;AAiCD,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,MAAiC;IACpE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,KAAK,GAAG,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAG,iFAAiF,CAAC;IAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACjB,IAAI,CAAyB,CAAC;IAC9B,OAAO,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAUD,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB,EAAE,OAAwB,EAAE;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,SAAS,EAAE,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnI,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,SAAS,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,wDAAwD,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC5F,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,uCAAuC,CAAC,CAAC;IAE3E,IAAI,iBAAwD,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,iBAAiB,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB;QAC9B,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,gDAAgD,CAAC;QACjH,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,mBAAmB,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7H,OAAO;QACL,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QACpE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,mBAAmB;QACnB,MAAM,EAAE,eAAe,IAAI,iBAAiB,EAAE,eAAe,IAAI,EAAE;KACpE,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAiB,EAAE,OAAiD,EAAE;IACtH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,gDAAgD,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI;QACrB,CAAC,CAAC;YACE,GAAG,MAAM,CAAC,MAAM,0CAA0C,IAAI,EAAE;YAChE,GAAG,MAAM,CAAC,MAAM,oCAAoC,IAAI,EAAE;YAC1D,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,mCAAmC;SAC3D;QACH,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,yCAAyC,EAAE,GAAG,MAAM,CAAC,MAAM,mCAAmC,CAAC,CAAC;IACrH,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,OAAO,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA6B,EAAE,QAAa,EAAE,QAAiB;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,8CAA8C,CAAC,CAAC;QAClG,yEAAyE;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACnH,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAA6B,EAAE,MAAW,EAAE,QAAiB;IAC5F,MAAM,GAAG,GAAG,oDAAoD,CAAC;IACjE,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACrH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/D,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC3I,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAClE,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,qBAAqB,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;QACrF,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;QACrE,GAAG,CAAC,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,oBAAoB,EAAE,OAAO;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,SAAwB,EAAE,GAAW;IAC1D,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,YAAY,EAAE;YACvH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAAC,CAAC;IACtH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACjI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,oCAAoC,CAAC,CAAC;IACpG,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAChF,OAAO,IAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAAC,CAAC;AAC7E,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,QAAiB,EAAE,OAAe;IAC/D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACxE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,GAAiB;IACjD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7E,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;AACrJ,CAAC;AACD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAuBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,OAAkC,EAClC,OAAmE,EAAE;IAErE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG;QACX,WAAW,EAAE,OAAO;QACpB,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,MAAM;QAClC,GAAG,OAAO;KACX,CAAC;IACF,IAAI,GAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACtI,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAAC,CAAC;IAC9G,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,CAAC,MAAM,6CAA6C,CAAC,CAAC;IAC/H,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6B,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC;QAC9C,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7H,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAAC,CAAC;AACxG,CAAC;AAsCD,MAAM,cAAc,GAAG,GAAG,GAAG,KAAK,CAAC;AAEnC,uEAAuE;AACvE,MAAM,OAAO,WAAW;IAGD;IAFZ,SAAS,CAAgB;IACzB,GAAG,CAAe;IAC3B,YAAqB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QAC9C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;QAC3D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAA4B,EAAE,SAAwC,EAAE,QAAsB;QACzG,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAA2B;gBACrC,SAAS,EAAE,CAAC,CAAC,QAAQ;gBACrB,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBACxB,GAAG,IAAI;gBACP,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvI,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBAC3F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6B,CAAC;YACzD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3F,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC5I,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YAC5I,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACjE,2DAA2D;YAC3D,MAAM,YAAY,GAAG,KAAK,IAAI,QAAQ,EAAE,YAAY,CAAC;YACrD,IAAI,CAAC,CAAC,mBAAmB,IAAI,YAAY,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YACnI,IAAI,SAAiB,CAAC;YACtB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;gBAChH,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;YAC5C,CAAC;iBAAM,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;gBAC5B,SAAS,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACpC,CAAC;iBAAM,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChF,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,cAAc,IAAI,EAAE;gBAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC5F,MAAM,MAAM,GAAgB;gBAC1B,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC1D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC;YACF,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,QAAQ;gBACtB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,IAAI,+CAA+C,CAAC;gBAC1E,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,oDAAoD,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,YAAY,CAAC,KAA0G;QACrH,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;YAClD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW;SAC/D,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,MAAmB,EAAE,QAAgC,EAAE;QAC7D,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,4DAA4D,CAAC,CAAC,CAAC;QACnI,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,KAAK,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3H,CAAC;CACF;AA6BD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAY,EACZ,GAAW,EACX,QAA4B,EAC5B,MAAoB,IAAI,CAAC,GAAG,EAC5B,OAAiC,EAAE;IAEnC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,sEAAsE,CAAC,CAAC;IACvI,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1E,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,OAAU,CAAC;IACf,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IACjD,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,yEAAyE,CAAC,CAAC;IAAC,CAAC;IAClH,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC"}