aimeat 2.5.0 → 2.6.0

package/dist/src/services/connections/instance.js

@@ -0,0 +1,144 @@
+/**
+ * @file instance.ts
+ * @description Instance-scoped provider support (TARGET-057): normalising a user-supplied instance
+ *   address, and registering this node as an application at that instance on first contact.
+ *
+ *   THE ADDRESS COMES FROM A USER. That single fact drives this whole file. `mastodon.social` is
+ *   typed into a box by whoever is connecting, and the node then makes an HTTP request to it. That
+ *   is an SSRF vector, and the answer is two layers rather than one: normalise and reject
+ *   syntactically here, then let safeFetch apply the network-level rules (private ranges, redirect
+ *   re-validation) on every request that follows.
+ *
+ *   LAZY REGISTRATION. There is no way to know which instance the next user arrives from, and there
+ *   are thousands, so the client credentials cannot be configuration. The node registers itself the
+ *   first time someone connects from an instance and remembers the result, so the second user
+ *   reuses the first user's registration rather than minting a parallel one.
+ * @structure normalizeInstance · registerAtInstance
+ * @usage import { normalizeInstance, registerAtInstance } from './instance.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import { randomUUID } from 'node:crypto';
+import { safeFetch } from '../../utils/url-validator.js';
+import { logger } from '../../utils/logger.js';
+import { sealCredential, openCredential } from './credential.js';
+/**
+ * Normalise `mastodon.social`, `https://mastodon.social/`, `HTTPS://Mastodon.Social` and friends to
+ * one canonical origin, or refuse.
+ *
+ * Canonicalising matters beyond tidiness: the origin is the storage key for the node's registration
+ * at that instance, so two spellings of one instance would register twice and hold two client
+ * secrets for the same place.
+ *
+ * HTTPS is forced rather than accepted-if-offered. An instance reached over http would carry the
+ * user's authorization code in the clear, and accepting `http://` from a text box is also the
+ * easiest way to reach something that is not on the internet at all.
+ */
+export function normalizeInstance(raw) {
+    const trimmed = (raw ?? '').trim();
+    if (!trimmed)
+        return { ok: false, reason: 'instance address is empty' };
+    if (trimmed.length > 253)
+        return { ok: false, reason: 'instance address is too long' };
+    let url;
+    try {
+        url = new URL(trimmed.includes('://') ? trimmed : `https://${trimmed}`);
+    }
+    catch {
+        return { ok: false, reason: 'instance address is not a valid host' };
+    }
+    if (url.protocol !== 'https:')
+        return { ok: false, reason: 'instance must be reachable over https' };
+    // Credentials in the URL would be silently carried into every later request to that instance.
+    if (url.username || url.password)
+        return { ok: false, reason: 'instance address must not carry credentials' };
+    // A path would make two spellings of one instance look like two instances.
+    if (url.pathname !== '/' || url.search || url.hash) {
+        return { ok: false, reason: 'instance address must be a bare host, with no path or query' };
+    }
+    // Hostnames only. An IP literal here is either a mistake or an attempt to reach something
+    // internal; safeFetch would refuse the private ranges anyway, and refusing earlier is clearer.
+    if (/^\[|^\d+\.\d+\.\d+\.\d+$/.test(url.hostname)) {
+        return { ok: false, reason: 'instance address must be a hostname, not an IP address' };
+    }
+    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(url.hostname)) {
+        return { ok: false, reason: 'instance address is not a valid hostname' };
+    }
+    return { ok: true, origin: `https://${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ''}` };
+}
+/**
+ * The node's application registration at `origin`, registering it if this is the first contact.
+ *
+ * Concurrency is handled by the store rather than here: `upsertProviderClient` is insert-if-new and
+ * returns whatever is now there, so two users arriving from one instance at the same moment
+ * converge on a single registration. The loser of that race has registered an application at the
+ * instance that nothing will ever point at, which is untidy at the instance and harmless to us —
+ * the alternative, a lock held across a network call to a stranger's server, is worse.
+ */
+export async function registerAtInstance(storage, key, provider, origin, app) {
+    const existing = await storage.getProviderClient(provider, origin);
+    if (existing) {
+        const opened = openCredential(existing.clientSecret, key);
+        // A registration whose secret cannot be read is worse than none: every authorization against it
+        // would fail at the token exchange with a message from the instance, far from the cause.
+        if (!opened)
+            return { error: 'stored registration for this instance cannot be read' };
+        return { clientId: existing.clientId, clientSecret: opened.accessToken };
+    }
+    const body = new URLSearchParams({
+        client_name: app.name,
+        redirect_uris: app.redirectUri,
+        scopes: app.scopes.join(' '),
+        website: app.website,
+    });
+    let res;
+    try {
+        res = await safeFetch(`${origin}/api/v1/apps`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch (err) {
+        // safeFetch throws "Fetch blocked: <reason>" for a refused address. That is the SSRF gate
+        // reporting, and it is worth surfacing verbatim: it tells the user their instance is unreachable
+        // rather than leaving them at a spinner.
+        return { error: `could not reach the instance: ${err.message}` };
+    }
+    if (!res.ok)
+        return { error: `instance refused the registration (HTTP ${res.status})` };
+    const json = await res.json().catch((err) => {
+        // Logged rather than swallowed: an instance answering 200 with something that is not JSON is a
+        // different problem from one answering with JSON that lacks the fields, and the message below
+        // is the same for both. Without this line the two are indistinguishable in production.
+        logger.warn('connections: instance registration returned unparseable JSON', {
+            provider, origin, error: String(err),
+        });
+        return null;
+    });
+    const clientId = typeof json?.client_id === 'string' ? json.client_id : '';
+    const clientSecret = typeof json?.client_secret === 'string' ? json.client_secret : '';
+    if (!clientId || !clientSecret)
+        return { error: 'instance returned no usable client credentials' };
+    // Sealed through the same path as a user token. It is not personal data, but a table that holds
+    // one secret in the clear teaches the next one to do the same.
+    const stored = await storage.upsertProviderClient({
+        id: randomUUID(),
+        provider,
+        instance: origin,
+        clientId,
+        clientSecret: sealCredential({ shape: 'static', accessToken: clientSecret }, key),
+        registeredAt: new Date().toISOString(),
+    });
+    // Read back what the store actually kept: on a race that is the OTHER registration, and using our
+    // own local values would authorize against credentials the store does not have.
+    if (stored.clientId !== clientId) {
+        const opened = openCredential(stored.clientSecret, key);
+        if (!opened)
+            return { error: 'stored registration for this instance cannot be read' };
+        return { clientId: stored.clientId, clientSecret: opened.accessToken };
+    }
+    return { clientId, clientSecret };
+}
+//# sourceMappingURL=instance.js.map

package/dist/src/services/connections/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../../src/services/connections/instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAQjE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAEvF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACrG,8FAA8F;IAC9F,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAC9G,2EAA2E;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;IAC9F,CAAC;IACD,0FAA0F;IAC1F,+FAA+F;IAC/F,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,oEAAoE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACxG,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,GAAW,EACX,QAAgB,EAChB,MAAc,EACd,GAA6E;IAE7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC1D,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,aAAa,EAAE,GAAG,CAAC,WAAW;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC,CAAC;IAEH,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,cAAc,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0FAA0F;QAC1F,iGAAiG;QACjG,yCAAyC;QACzC,OAAO,EAAE,KAAK,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,2CAA2C,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAExF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACnD,+FAA+F;QAC/F,8FAA8F;QAC9F,uFAAuF;QACvF,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE;YAC1E,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAA4D,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IAEnG,gGAAgG;IAChG,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;QAChD,EAAE,EAAE,UAAU,EAAE;QAChB,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,QAAQ;QACR,YAAY,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC;QACjF,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IAEH,kGAAkG;IAClG,gFAAgF;IAChF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/dist/src/services/connections/oauth.d.ts

@@ -0,0 +1,77 @@
+/**
+ * @file oauth.ts
+ * @description The authorization round for an outbound connection (TARGET-057): start it, and
+ *   complete it when the provider redirects back.
+ *
+ *   WHAT THE URL MUST NOT CARRY. Everything the callback needs to make a decision — which provider,
+ *   which instance, which mode, who asked — is stored server-side against a single-use `state` and
+ *   never put in the redirect URL. Carrying it in the URL would let whoever reaches the callback
+ *   choose which provider their code is redeemed against and whose connection it becomes.
+ *
+ *   WHY THE STATE IS CONSUMED FIRST. `completeAuthorization` deletes the nonce BEFORE it exchanges
+ *   the code. A replayed callback then finds nothing and stops, rather than racing the original and
+ *   producing two connections from one authorization.
+ *
+ *   THE GOOGLE PARAMETERS ARE NOT OPTIONAL. `access_type=offline` and `prompt=consent` are why a
+ *   refresh token arrives at all. Without them a repeat authorization returns an access token and no
+ *   refresh token, and the connection silently becomes a one-hour connection that dies and cannot
+ *   renew — with nothing in the response to say so.
+ * @structure startAuthorization · completeAuthorization · resolveClient · fetchAccountIdentity
+ * @usage import { startAuthorization, completeAuthorization } from './oauth.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import { type OutboundProvider } from './providers.js';
+import type { AimeatConfig } from '../../config.js';
+import type { Storage } from '../../storage/interface.js';
+import type { ConnectionMode, ConnectionRecord } from '../../models/connection-schemas.js';
+export interface ConnectContext {
+    config: AimeatConfig;
+    storage: Storage;
+    providers: OutboundProvider[];
+    key: Buffer;
+}
+export type StartResult = {
+    ok: true;
+    authorizeUrl: string;
+    state: string;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+};
+export type CompleteResult = {
+    ok: true;
+    connection: ConnectionRecord;
+    returnUrl: string;
+    created: boolean;
+} | {
+    ok: false;
+    code: string;
+    reason: string;
+};
+/** The node's own callback address. One per node, and it must match the provider registration byte for byte. */
+export declare function callbackUrl(config: AimeatConfig): string;
+/**
+ * Begin an authorization. Returns the URL to send the user's browser to; the user grants consent at
+ * the PROVIDER, never here.
+ */
+export declare function startAuthorization(ctx: ConnectContext, input: {
+    principal: string;
+    provider: string;
+    instance?: string;
+    mode: ConnectionMode;
+    returnUrl: string;
+}): Promise<StartResult>;
+/**
+ * Complete an authorization: consume the state, exchange the code, learn who the account is, and
+ * store the connection.
+ *
+ * Re-authorising an account already connected UPDATES that row rather than adding a second one —
+ * which is what makes "reconnect" a repair rather than a way to accumulate duplicates.
+ */
+export declare function completeAuthorization(ctx: ConnectContext, input: {
+    state: string;
+    code: string;
+}): Promise<CompleteResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/src/services/connections/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/services/connections/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAK3F,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AASD,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhD,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC/E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAOhD,gHAAgH;AAChH,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAExD;AAsBD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzG,OAAO,CAAC,WAAW,CAAC,CA8DtB;AAiFD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,cAAc,CAAC,CAqGzB"}

package/dist/src/services/connections/oauth.js

@@ -0,0 +1,290 @@
+/**
+ * @file oauth.ts
+ * @description The authorization round for an outbound connection (TARGET-057): start it, and
+ *   complete it when the provider redirects back.
+ *
+ *   WHAT THE URL MUST NOT CARRY. Everything the callback needs to make a decision — which provider,
+ *   which instance, which mode, who asked — is stored server-side against a single-use `state` and
+ *   never put in the redirect URL. Carrying it in the URL would let whoever reaches the callback
+ *   choose which provider their code is redeemed against and whose connection it becomes.
+ *
+ *   WHY THE STATE IS CONSUMED FIRST. `completeAuthorization` deletes the nonce BEFORE it exchanges
+ *   the code. A replayed callback then finds nothing and stops, rather than racing the original and
+ *   producing two connections from one authorization.
+ *
+ *   THE GOOGLE PARAMETERS ARE NOT OPTIONAL. `access_type=offline` and `prompt=consent` are why a
+ *   refresh token arrives at all. Without them a repeat authorization returns an access token and no
+ *   refresh token, and the connection silently becomes a one-hour connection that dies and cannot
+ *   renew — with nothing in the response to say so.
+ * @structure startAuthorization · completeAuthorization · resolveClient · fetchAccountIdentity
+ * @usage import { startAuthorization, completeAuthorization } from './oauth.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-02 — TARGET-057 Phase 1c.
+ */
+import { randomUUID, randomBytes, createHash } from 'node:crypto';
+import { safeFetch } from '../../utils/url-validator.js';
+import { sealCredential } from './credential.js';
+import { normalizeInstance, registerAtInstance } from './instance.js';
+import { findProvider } from './providers.js';
+/** How long an unfinished authorization stays valid. Long enough to read a consent screen. */
+const STATE_TTL_MS = 10 * 60 * 1000;
+/** base64url without padding — what PKCE and OAuth2 expect. */
+function b64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** The node's own callback address. One per node, and it must match the provider registration byte for byte. */
+export function callbackUrl(config) {
+    return config.connectRedirectUri || `${config.baseUrl.replace(/\/$/, '')}/v1/connections/callback`;
+}
+/**
+ * Client credentials for this provider: from config for a fixed endpoint, from the node's
+ * registration at the instance for a federated one (registering on first contact).
+ */
+async function resolveClient(ctx, provider, instance) {
+    if (!provider.instanceScoped) {
+        if (!provider.client)
+            return { error: provider.disabledReason ?? 'provider is not configured' };
+        return { clientId: provider.client.id, clientSecret: provider.client.secret };
+    }
+    if (!instance)
+        return { error: 'this provider needs an instance address' };
+    return registerAtInstance(ctx.storage, ctx.key, provider.id, instance, {
+        name: 'AIMEAT',
+        redirectUri: callbackUrl(ctx.config),
+        scopes: provider.scopes,
+        website: ctx.config.baseUrl,
+    });
+}
+/**
+ * Begin an authorization. Returns the URL to send the user's browser to; the user grants consent at
+ * the PROVIDER, never here.
+ */
+export async function startAuthorization(ctx, input) {
+    const provider = findProvider(ctx.providers, input.provider);
+    if (!provider)
+        return { ok: false, code: 'UNKNOWN_PROVIDER', reason: `no provider '${input.provider}'` };
+    if (!provider.enabled) {
+        // The reason travels with the refusal: an operator staring at "disabled" has nothing to act on.
+        return { ok: false, code: 'PROVIDER_DISABLED', reason: provider.disabledReason ?? 'provider is disabled' };
+    }
+    if (provider.credentialShape !== 'oauth2') {
+        return { ok: false, code: 'NOT_AN_OAUTH_PROVIDER', reason: `${provider.id} does not use an authorization round` };
+    }
+    let instance = null;
+    if (provider.instanceScoped) {
+        const norm = normalizeInstance(input.instance ?? '');
+        if (!norm.ok)
+            return { ok: false, code: 'BAD_INSTANCE', reason: norm.reason };
+        instance = norm.origin;
+    }
+    const client = await resolveClient(ctx, provider, instance);
+    if ('error' in client)
+        return { ok: false, code: 'CLIENT_UNAVAILABLE', reason: client.error };
+    const endpoints = provider.endpoints(instance);
+    if (!endpoints)
+        return { ok: false, code: 'NO_ENDPOINTS', reason: 'provider has no authorization endpoint' };
+    const state = b64url(randomBytes(24));
+    const verifier = b64url(randomBytes(32));
+    const payload = { provider: provider.id, instance, mode: input.mode };
+    await ctx.storage.createVerificationNonce({
+        id: randomUUID(),
+        // Binding the state to the principal is the CSRF gate: a code redeemed by anyone else lands on
+        // a nonce whose owner is not them, and the callback refuses.
+        owner: input.principal,
+        type: 'connect',
+        state,
+        // The PKCE verifier stays HERE. It is the half of the exchange that never travels.
+        nonce: verifier,
+        redirectUri: input.returnUrl,
+        payload: JSON.stringify(payload),
+        createdAt: new Date().toISOString(),
+        expiresAt: new Date(Date.now() + STATE_TTL_MS).toISOString(),
+    });
+    const q = new URLSearchParams({
+        response_type: 'code',
+        client_id: client.clientId,
+        redirect_uri: callbackUrl(ctx.config),
+        scope: provider.scopes.join(' '),
+        state,
+    });
+    if (provider.pkce) {
+        q.set('code_challenge', b64url(createHash('sha256').update(verifier).digest()));
+        q.set('code_challenge_method', 'S256');
+    }
+    if (provider.id === 'youtube') {
+        // Not optional, and the failure is silent: without these Google returns no refresh token on a
+        // repeat authorization and the connection quietly becomes a one-hour connection.
+        q.set('access_type', 'offline');
+        q.set('prompt', 'consent');
+    }
+    return { ok: true, authorizeUrl: `${endpoints.authorize}?${q.toString()}`, state };
+}
+/**
+ * Ask the provider who the token belongs to.
+ *
+ * This lives in the node rather than in a publishing recipe because it is part of the CONNECTION's
+ * lifecycle, not of publishing: `externalId` is the dedupe key that stops one account becoming two
+ * rows, and `accountLabel` is what the owner reads in the panel. A label the app supplied would be
+ * a label the app chose.
+ */
+async function fetchAccountIdentity(provider, instance, accessToken) {
+    const auth = { Authorization: `Bearer ${accessToken}` };
+    try {
+        if (provider.id === 'mastodon') {
+            const r = await safeFetch(`${instance}/api/v1/accounts/verify_credentials`, {
+                headers: auth, signal: AbortSignal.timeout(15_000),
+            });
+            if (!r.ok)
+                return { error: `instance rejected the token (HTTP ${r.status})` };
+            const j = await r.json();
+            const id = typeof j.id === 'string' ? j.id : '';
+            const acct = typeof j.acct === 'string' ? j.acct : '';
+            if (!id)
+                return { error: 'instance returned no account id' };
+            const host = instance ? new URL(instance).hostname : '';
+            return { externalId: id, accountLabel: acct ? `@${acct}@${host}` : host };
+        }
+        if (provider.id === 'youtube') {
+            const r = await safeFetch('https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true', { headers: auth, signal: AbortSignal.timeout(15_000) });
+            if (!r.ok) {
+                // 403 here means the token is valid but not scoped for the read, which is a DIFFERENT
+                // problem from a bad token and has a different fix. Naming it saves the next person the
+                // hour it cost to find that youtube.upload alone cannot list your own channel.
+                return { error: r.status === 403
+                        ? 'Google accepted the sign-in but would not say which channel it is for. The connection was authorised before youtube.readonly was requested; disconnect and connect again.'
+                        : `Google rejected the token (HTTP ${r.status})` };
+            }
+            const j = await r.json();
+            const item = Array.isArray(j.items) ? j.items[0] : undefined;
+            const id = typeof item?.id === 'string' ? item.id : '';
+            // A Google account with no YouTube channel authorizes fine and then has nothing to publish to.
+            // Saying so here is far kinder than an upload failing later for a reason nobody can read.
+            if (!id)
+                return { error: 'this Google account has no YouTube channel' };
+            const title = typeof item?.snippet?.title === 'string' ? item.snippet.title : id;
+            return { externalId: id, accountLabel: title };
+        }
+        if (provider.id === 'fake') {
+            // Test-only, and reached only when a base URL is configured. It goes through the same
+            // safeFetch + shape-checking path as the real ones so the tests exercise that code rather
+            // than a shortcut around it.
+            const base = provider.endpoints(null)?.token.replace(/\/token$/, '') ?? '';
+            const r = await safeFetch(`${base}/me`, { headers: auth, signal: AbortSignal.timeout(15_000) });
+            if (!r.ok)
+                return { error: `test provider rejected the token (HTTP ${r.status})` };
+            const j = await r.json();
+            const id = typeof j.id === 'string' ? j.id : '';
+            if (!id)
+                return { error: 'test provider returned no account id' };
+            return { externalId: id, accountLabel: typeof j.label === 'string' ? j.label : id };
+        }
+        return { error: `no identity lookup for ${provider.id}` };
+    }
+    catch (err) {
+        return { error: `could not reach the provider: ${err.message}` };
+    }
+}
+/**
+ * Complete an authorization: consume the state, exchange the code, learn who the account is, and
+ * store the connection.
+ *
+ * Re-authorising an account already connected UPDATES that row rather than adding a second one —
+ * which is what makes "reconnect" a repair rather than a way to accumulate duplicates.
+ */
+export async function completeAuthorization(ctx, input) {
+    const nonce = await ctx.storage.getVerificationNonce(input.state);
+    if (!nonce || nonce.type !== 'connect') {
+        return { ok: false, code: 'UNKNOWN_STATE', reason: 'this authorization is not one we started' };
+    }
+    // Consumed BEFORE the exchange: a replayed callback then finds nothing, rather than racing the
+    // original and producing two connections from one authorization.
+    await ctx.storage.deleteVerificationNonce(input.state);
+    if (new Date(nonce.expiresAt).getTime() < Date.now()) {
+        return { ok: false, code: 'STATE_EXPIRED', reason: 'the authorization took too long; start again' };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(nonce.payload ?? '');
+    }
+    catch {
+        return { ok: false, code: 'BAD_STATE', reason: 'the stored authorization is unreadable' };
+    }
+    const provider = findProvider(ctx.providers, payload.provider);
+    if (!provider?.enabled) {
+        return { ok: false, code: 'PROVIDER_DISABLED', reason: 'that provider is no longer available' };
+    }
+    const client = await resolveClient(ctx, provider, payload.instance);
+    if ('error' in client)
+        return { ok: false, code: 'CLIENT_UNAVAILABLE', reason: client.error };
+    const endpoints = provider.endpoints(payload.instance);
+    if (!endpoints)
+        return { ok: false, code: 'NO_ENDPOINTS', reason: 'provider has no token endpoint' };
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: input.code,
+        redirect_uri: callbackUrl(ctx.config),
+        client_id: client.clientId,
+        client_secret: client.clientSecret,
+    });
+    if (provider.pkce)
+        body.set('code_verifier', nonce.nonce);
+    let token;
+    try {
+        const r = await safeFetch(endpoints.token, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(20_000),
+        });
+        if (!r.ok)
+            return { ok: false, code: 'EXCHANGE_FAILED', reason: `the provider refused the code (HTTP ${r.status})` };
+        token = await r.json();
+    }
+    catch (err) {
+        return { ok: false, code: 'EXCHANGE_FAILED', reason: `could not reach the provider: ${err.message}` };
+    }
+    const accessToken = typeof token.access_token === 'string' ? token.access_token : '';
+    if (!accessToken)
+        return { ok: false, code: 'EXCHANGE_FAILED', reason: 'the provider returned no access token' };
+    const refreshToken = typeof token.refresh_token === 'string' ? token.refresh_token : undefined;
+    const expiresAt = typeof token.expires_in === 'number'
+        ? new Date(Date.now() + token.expires_in * 1000).toISOString()
+        // NOT an error and NOT zero: some providers issue tokens that never expire, and treating the
+        // absence as "expired" would park a working connection on its first refresh check.
+        : null;
+    const scopes = typeof token.scope === 'string' ? token.scope.split(/[\s,]+/).filter(Boolean) : provider.scopes;
+    const identity = await fetchAccountIdentity(provider, payload.instance, accessToken);
+    if ('error' in identity)
+        return { ok: false, code: 'IDENTITY_FAILED', reason: identity.error };
+    const credential = sealCredential({ shape: provider.credentialShape, accessToken, ...(refreshToken ? { refreshToken } : {}) }, ctx.key);
+    const now = new Date().toISOString();
+    const existing = await ctx.storage.findConnection(nonce.owner, provider.id, identity.externalId, payload.instance);
+    if (existing) {
+        // Re-authorising repairs the row it already has. updateConnectionCredential also clears the
+        // error state, because a successful exchange IS the evidence that whatever was wrong is not.
+        await ctx.storage.updateConnectionCredential(existing.id, credential, expiresAt, scopes);
+        const refreshed = await ctx.storage.getConnection(existing.id);
+        return { ok: true, connection: refreshed ?? existing, returnUrl: nonce.redirectUri, created: false };
+    }
+    const connection = {
+        id: randomUUID(),
+        principal: nonce.owner,
+        mode: payload.mode,
+        provider: provider.id,
+        instance: payload.instance,
+        accountLabel: identity.accountLabel,
+        externalId: identity.externalId,
+        credential,
+        credentialShape: provider.credentialShape,
+        scopes,
+        expiresAt,
+        status: 'active',
+        lastOkAt: now,
+        lastError: null,
+        createdAt: now,
+        updatedAt: now,
+    };
+    await ctx.storage.createConnection(connection);
+    return { ok: true, connection, returnUrl: nonce.redirectUri, created: true };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/src/services/connections/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../src/services/connections/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAuB,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAyB,MAAM,gBAAgB,CAAC;AAKrE,8FAA8F;AAC9F,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwBpC,+DAA+D;AAC/D,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,WAAW,CAAC,MAAoB;IAC9C,OAAO,MAAM,CAAC,kBAAkB,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;AACrG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAmB,EAAE,QAA0B,EAAE,QAAuB;IAExE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,IAAI,4BAA4B,EAAE,CAAC;QAChG,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IAC3E,OAAO,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE;QACrE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAmB,EACnB,KAA0G;IAE1G,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,gGAAgG;QAChG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,IAAI,sBAAsB,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,sCAAsC,EAAE,CAAC;IACpH,CAAC;IAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9E,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAE9F,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAE7G,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,OAAO,GAAiB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAEpF,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACxC,EAAE,EAAE,UAAU,EAAE;QAChB,+FAA+F;QAC/F,6DAA6D;QAC7D,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,IAAI,EAAE,SAAS;QACf,KAAK;QACL,mFAAmF;QACnF,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,KAAK,CAAC,SAAS;QAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE;KAC7D,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,KAAK;KACN,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,iFAAiF;QACjF,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACrF,CAAC;AAgBD;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,QAA0B,EAAE,QAAuB,EAAE,WAAmB;IAExE,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,qCAAqC,EAAE;gBAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,qCAAqC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAsC,CAAC;YAC7D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,MAAM,SAAS,CACvB,uEAAuE,EACvE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACvD,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,sFAAsF;gBACtF,wFAAwF;gBACxF,+EAA+E;gBAC/E,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG;wBAC9B,CAAC,CAAC,2KAA2K;wBAC7K,CAAC,CAAC,mCAAmC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YACvD,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAmE,CAAC;YAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,+FAA+F;YAC/F,0FAA0F;YAC1F,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YACxE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YAC3B,sFAAsF;YACtF,0FAA0F;YAC1F,6BAA6B;YAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,0CAA0C,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YACnF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAuC,CAAC;YAC9D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YAClE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAmB,EAAE,KAAsC;IAE3D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAClG,CAAC;IACD,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IACtG,CAAC;IAED,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAiB,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9F,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAErG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAE1D,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,uCAAuC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;QACrH,KAAK,GAAG,MAAM,CAAC,CAAC,IAAI,EAAmB,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IACnH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACjH,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpD,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC9D,6FAA6F;QAC7F,mFAAmF;QACnF,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAE/G,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE/F,MAAM,UAAU,GAAG,cAAc,CAC/B,EAAE,KAAK,EAAE,QAAQ,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC3F,GAAG,CAAC,GAAG,CACR,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAC/C,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAChE,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,IAAI,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,UAAU;QACV,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,MAAM;QACN,SAAS;QACT,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC/E,CAAC"}