n8n 2.15.1 → 2.17.0

package/dist/modules/token-exchange/services/trusted-key.service.js

@@ -0,0 +1,465 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TrustedKeyService = void 0;
+const node_crypto_1 = require("node:crypto");
+const backend_common_1 = require("@n8n/backend-common");
+const constants_1 = require("@n8n/constants");
+const db_1 = require("@n8n/db");
+const decorators_1 = require("@n8n/decorators");
+const di_1 = require("@n8n/di");
+const typeorm_1 = require("@n8n/typeorm");
+const n8n_core_1 = require("n8n-core");
+const n8n_workflow_1 = require("n8n-workflow");
+const zod_1 = require("zod");
+const trusted_key_source_entity_1 = require("../database/entities/trusted-key-source.entity");
+const trusted_key_entity_1 = require("../database/entities/trusted-key.entity");
+const trusted_key_source_repository_1 = require("../database/repositories/trusted-key-source.repository");
+const trusted_key_repository_1 = require("../database/repositories/trusted-key.repository");
+const token_exchange_config_1 = require("../token-exchange.config");
+const token_exchange_schemas_1 = require("../token-exchange.schemas");
+const jwks_resolver_1 = require("./jwks-resolver");
+const ALGORITHM_FAMILY = {
+    RS256: 'RSA',
+    RS384: 'RSA',
+    RS512: 'RSA',
+    PS256: 'RSA',
+    PS384: 'RSA',
+    PS512: 'RSA',
+    ES256: 'EC',
+    ES384: 'EC',
+    ES512: 'EC',
+    EdDSA: 'EdDSA',
+};
+const STATIC_SOURCE_ID = 'static';
+const REFRESH_POLL_INTERVAL_MS = 30 * constants_1.Time.seconds.toMilliseconds;
+let TrustedKeyService = class TrustedKeyService {
+    constructor(logger, config, trustedKeySourceRepository, trustedKeyRepository, instanceSettings, dbLockService, jwksResolverService) {
+        this.config = config;
+        this.trustedKeySourceRepository = trustedKeySourceRepository;
+        this.trustedKeyRepository = trustedKeyRepository;
+        this.instanceSettings = instanceSettings;
+        this.dbLockService = dbLockService;
+        this.jwksResolverService = jwksResolverService;
+        this.isShuttingDown = false;
+        this.cryptoCache = new Map();
+        this.logger = logger.scoped('token-exchange');
+    }
+    async initialize() {
+        if (!this.instanceSettings.isLeader) {
+            this.logger.debug('Worker instance — skipping trusted key initialization');
+            return;
+        }
+        await this.initializeAsLeader();
+    }
+    async onLeaderTakeover() {
+        await this.initializeAsLeader();
+    }
+    async initializeAsLeader() {
+        const sources = this.parseConfigSources();
+        await this.syncSourcesToDb(sources);
+        await this.refreshAllSources();
+        this.startRefresh();
+    }
+    startRefresh() {
+        if (this.isShuttingDown || this.refreshInterval)
+            return;
+        this.refreshInterval = setInterval(async () => await this.refreshDueSources(), REFRESH_POLL_INTERVAL_MS);
+        this.logger.debug('Trusted key refresh poller started');
+    }
+    stopRefresh() {
+        clearInterval(this.refreshInterval);
+        this.refreshInterval = undefined;
+    }
+    shutdown() {
+        this.isShuttingDown = true;
+        this.stopRefresh();
+    }
+    async getByKidAndIss(kid, issuer) {
+        const entities = await this.trustedKeyRepository.findAllByKid(kid);
+        if (entities.length === 0)
+            return undefined;
+        for (const entity of entities) {
+            let data;
+            try {
+                const parsed = token_exchange_schemas_1.TrustedKeyDataSchema.safeParse(JSON.parse(entity.data));
+                if (!parsed.success) {
+                    this.logger.warn('Skipping corrupted trusted key entity', {
+                        kid,
+                        sourceId: entity.sourceId,
+                        error: parsed.error.message,
+                    });
+                    continue;
+                }
+                data = parsed.data;
+            }
+            catch {
+                this.logger.warn('Skipping corrupted trusted key entity', {
+                    kid,
+                    sourceId: entity.sourceId,
+                    error: 'invalid JSON',
+                });
+                continue;
+            }
+            if (data.issuer !== issuer)
+                continue;
+            const cryptoKey = this.resolveCryptoKey(`${entity.sourceId}:${kid}`, data.keyMaterial);
+            if (!cryptoKey)
+                continue;
+            return {
+                kid,
+                algorithms: data.algorithms,
+                key: cryptoKey,
+                issuer: data.issuer,
+                expectedAudience: data.expectedAudience,
+                allowedRoles: data.allowedRoles,
+            };
+        }
+        return undefined;
+    }
+    async refreshSource(sourceId) {
+        const source = await this.trustedKeySourceRepository.findOneBy({ id: sourceId });
+        if (!source) {
+            throw new n8n_workflow_1.UnexpectedError(`Trusted key source not found: ${sourceId}`);
+        }
+        await this.refreshSourceInternal(source);
+    }
+    async listAll() {
+        return await this.trustedKeyRepository.find();
+    }
+    async listSources() {
+        return await this.trustedKeySourceRepository.find();
+    }
+    parseConfigSources() {
+        const raw = this.config.trustedKeys;
+        if (!raw) {
+            this.logger.info('No trusted keys configured');
+            return [];
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            this.logger.error('Failed to parse trusted keys JSON', { error });
+            throw new n8n_workflow_1.UnexpectedError('Failed to parse trusted keys JSON');
+        }
+        const result = zod_1.z.array(token_exchange_schemas_1.TrustedKeySourceSchema).safeParse(parsed);
+        if (!result.success) {
+            this.logger.error('Trusted keys JSON has invalid format', { error: result.error });
+            throw new n8n_workflow_1.UnexpectedError('Trusted keys JSON has invalid format');
+        }
+        return result.data;
+    }
+    generateSourceId(source) {
+        if (source.type === 'static')
+            return STATIC_SOURCE_ID;
+        return (0, node_crypto_1.createHash)('sha256').update(source.url).digest('hex').slice(0, 36);
+    }
+    async syncSourcesToDb(sources) {
+        await this.dbLockService.withLock(1002, async (tx) => {
+            this.logger.debug('Syncing sources to the database', { sources });
+            const staticSources = sources.filter((s) => s.type === 'static');
+            const jwksSources = sources.filter((s) => s.type === 'jwks');
+            const expectedSourceIds = new Set();
+            if (staticSources.length > 0) {
+                const sourceId = STATIC_SOURCE_ID;
+                expectedSourceIds.add(sourceId);
+                await tx.save(trusted_key_source_entity_1.TrustedKeySourceEntity, {
+                    id: sourceId,
+                    type: 'static',
+                    config: JSON.stringify(staticSources),
+                    status: 'pending',
+                });
+            }
+            for (const jwks of jwksSources) {
+                const sourceId = this.generateSourceId(jwks);
+                expectedSourceIds.add(sourceId);
+                await tx.save(trusted_key_source_entity_1.TrustedKeySourceEntity, {
+                    id: sourceId,
+                    type: 'jwks',
+                    config: JSON.stringify(jwks),
+                    status: 'pending',
+                });
+            }
+            if (expectedSourceIds.size > 0) {
+                await tx.delete(trusted_key_source_entity_1.TrustedKeySourceEntity, {
+                    id: (0, typeorm_1.Not)((0, typeorm_1.In)([...expectedSourceIds])),
+                });
+            }
+            else {
+                await tx.delete(trusted_key_source_entity_1.TrustedKeySourceEntity, {});
+            }
+        });
+    }
+    async refreshAllSources() {
+        try {
+            const sources = await this.trustedKeySourceRepository.find();
+            for (const source of sources) {
+                await this.refreshSourceInternal(source);
+            }
+        }
+        catch (error) {
+            this.logger.error('Failed to run trusted key refresh cycle', { error });
+        }
+    }
+    async refreshDueSources() {
+        try {
+            this.logger.debug('Refreshing due sources');
+            const sources = await this.trustedKeySourceRepository.find();
+            const now = Date.now();
+            for (const source of sources) {
+                const intervalMs = this.getRefreshIntervalMs(source);
+                const lastRefresh = source.lastRefreshedAt?.getTime() ?? 0;
+                if (now - lastRefresh >= intervalMs) {
+                    await this.refreshSourceInternal(source);
+                }
+            }
+        }
+        catch (error) {
+            this.logger.error('Failed to run trusted key refresh cycle', { error });
+        }
+    }
+    getRefreshIntervalMs(source) {
+        if (source.type === 'jwks') {
+            try {
+                const config = (0, n8n_workflow_1.jsonParse)(source.config);
+                if (typeof config.cacheTtlSeconds === 'number' && config.cacheTtlSeconds > 0) {
+                    return config.cacheTtlSeconds * constants_1.Time.seconds.toMilliseconds;
+                }
+            }
+            catch (e) {
+                this.logger.warn('Failed to parse source configuration for jwks source', {
+                    id: source.id,
+                    error: e,
+                });
+            }
+        }
+        return this.config.keyRefreshIntervalSeconds * constants_1.Time.seconds.toMilliseconds;
+    }
+    async refreshSourceInternal(source) {
+        try {
+            await this.dbLockService.withLock(1002, async (tx) => {
+                const freshSource = await tx.findOneBy(trusted_key_source_entity_1.TrustedKeySourceEntity, { id: source.id });
+                if (!freshSource)
+                    return;
+                await this.refreshSourceWithinTransaction(freshSource, tx);
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.logger.error('Failed to refresh trusted key source', {
+                sourceId: source.id,
+                error: message,
+            });
+            await this.trustedKeySourceRepository.update(source.id, {
+                status: 'error',
+                lastError: message,
+                lastRefreshedAt: new Date(),
+            });
+        }
+    }
+    async refreshSourceWithinTransaction(source, tx) {
+        const result = await this.resolveKeysForSource(source);
+        if (!result) {
+            await tx.update(trusted_key_source_entity_1.TrustedKeySourceEntity, source.id, {
+                status: 'healthy',
+                lastRefreshedAt: new Date(),
+            });
+            return;
+        }
+        const keys = result.keys;
+        const cacheTtlSeconds = result.cacheTtlSeconds;
+        await tx.delete(trusted_key_entity_1.TrustedKeyEntity, { sourceId: source.id });
+        for (const key of keys) {
+            await tx.save(trusted_key_entity_1.TrustedKeyEntity, {
+                sourceId: source.id,
+                kid: key.kid,
+                data: JSON.stringify(key.data),
+                createdAt: new Date(),
+            });
+        }
+        const updatePayload = {
+            status: 'healthy',
+            lastError: null,
+            lastRefreshedAt: new Date(),
+        };
+        if (cacheTtlSeconds !== undefined) {
+            const config = (0, n8n_workflow_1.jsonParse)(source.config);
+            config.cacheTtlSeconds = cacheTtlSeconds;
+            updatePayload.config = JSON.stringify(config);
+        }
+        await tx.update(trusted_key_source_entity_1.TrustedKeySourceEntity, source.id, updatePayload);
+    }
+    async resolveKeysForSource(source) {
+        switch (source.type) {
+            case 'static':
+                return this.resolveKeysForStaticSource(source);
+            case 'jwks':
+                return await this.resolveKeysForJwksSource(source);
+            default:
+                this.logger.warn('Unknown key source type, skipping', {
+                    sourceId: source.id,
+                    type: source.type,
+                });
+                return undefined;
+        }
+    }
+    async resolveKeysForJwksSource(source) {
+        let jwksConfig;
+        try {
+            jwksConfig = (0, n8n_workflow_1.jsonParse)(source.config);
+        }
+        catch {
+            throw new n8n_workflow_1.UnexpectedError('Invalid JWKS source config: malformed JSON');
+        }
+        const result = await this.jwksResolverService.resolveKeys(jwksConfig);
+        if (result.skipped.length > 0) {
+            this.logger.debug(`JWKS "${jwksConfig.url}": skipped ${result.skipped.length} key(s)`, {
+                skipped: result.skipped,
+            });
+        }
+        return {
+            keys: result.keys.map((key) => ({
+                kid: key.kid,
+                data: {
+                    algorithms: key.algorithms,
+                    keyMaterial: key.keyMaterial,
+                    issuer: key.issuer,
+                    expectedAudience: key.expectedAudience,
+                    allowedRoles: key.allowedRoles,
+                    expiresAt: new Date(Date.now() + result.ttlSeconds * 1000).toISOString(),
+                },
+            })),
+            cacheTtlSeconds: result.ttlSeconds,
+        };
+    }
+    resolveKeysForStaticSource(source) {
+        let rawConfig;
+        try {
+            rawConfig = JSON.parse(source.config);
+        }
+        catch {
+            throw new n8n_workflow_1.UnexpectedError('Invalid static source config: malformed JSON');
+        }
+        const configResult = zod_1.z.array(token_exchange_schemas_1.TrustedKeySourceSchema).safeParse(rawConfig);
+        if (!configResult.success) {
+            throw new n8n_workflow_1.UnexpectedError(`Invalid static source config: ${configResult.error.message}`);
+        }
+        const staticConfigs = configResult.data.filter((s) => s.type === 'static');
+        return {
+            keys: this.resolveStaticKeys(staticConfigs),
+        };
+    }
+    resolveStaticKeys(configs) {
+        const result = [];
+        const seenKids = new Set();
+        for (const config of configs) {
+            const { kid, algorithms, key: pemString, issuer, expectedAudience, allowedRoles } = config;
+            if (seenKids.has(kid)) {
+                throw new n8n_workflow_1.UnexpectedError(`Trusted key "${kid}": duplicate kid`);
+            }
+            seenKids.add(kid);
+            this.validateKeyMaterial(kid, algorithms, pemString);
+            result.push({
+                kid,
+                data: {
+                    algorithms,
+                    keyMaterial: pemString,
+                    issuer,
+                    expectedAudience,
+                    allowedRoles,
+                },
+            });
+        }
+        return result;
+    }
+    validateKeyMaterial(kid, algorithms, pemString) {
+        const families = new Set();
+        for (const alg of algorithms) {
+            const family = ALGORITHM_FAMILY[alg];
+            if (!family) {
+                throw new n8n_workflow_1.UnexpectedError(`Trusted key "${kid}": unknown algorithm "${alg}"`);
+            }
+            families.add(family);
+        }
+        if (families.size > 1) {
+            throw new n8n_workflow_1.UnexpectedError(`Trusted key "${kid}": algorithms must belong to the same family, got ${[...families].join(', ')}`);
+        }
+        const family = [...families][0];
+        let keyObject;
+        try {
+            keyObject = (0, node_crypto_1.createPublicKey)(pemString);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'unknown error';
+            throw new n8n_workflow_1.UnexpectedError(`Trusted key "${kid}": failed to parse public key — ${message}`);
+        }
+        const keyType = keyObject.asymmetricKeyType;
+        const expectedTypes = {
+            RSA: ['rsa'],
+            EC: ['ec'],
+            EdDSA: ['ed25519', 'ed448'],
+        };
+        if (!expectedTypes[family].includes(keyType ?? '')) {
+            throw new n8n_workflow_1.UnexpectedError(`Trusted key "${kid}": key type "${keyType}" does not match algorithm family "${family}"`);
+        }
+    }
+    resolveCryptoKey(cacheKey, keyMaterial) {
+        const hash = (0, node_crypto_1.createHash)('sha256').update(keyMaterial).digest('hex');
+        const cached = this.cryptoCache.get(cacheKey);
+        if (cached && cached.keyMaterialHash === hash) {
+            return cached.cryptoKey;
+        }
+        try {
+            const cryptoKey = (0, node_crypto_1.createPublicKey)(keyMaterial);
+            this.cryptoCache.set(cacheKey, { keyMaterialHash: hash, cryptoKey });
+            return cryptoKey;
+        }
+        catch (error) {
+            this.logger.warn('Failed to parse key material from DB', {
+                cacheKey,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+};
+exports.TrustedKeyService = TrustedKeyService;
+__decorate([
+    (0, decorators_1.OnLeaderTakeover)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], TrustedKeyService.prototype, "onLeaderTakeover", null);
+__decorate([
+    (0, decorators_1.OnLeaderStepdown)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], TrustedKeyService.prototype, "stopRefresh", null);
+__decorate([
+    (0, decorators_1.OnShutdown)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], TrustedKeyService.prototype, "shutdown", null);
+exports.TrustedKeyService = TrustedKeyService = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [backend_common_1.Logger,
+        token_exchange_config_1.TokenExchangeConfig,
+        trusted_key_source_repository_1.TrustedKeySourceRepository,
+        trusted_key_repository_1.TrustedKeyRepository,
+        n8n_core_1.InstanceSettings,
+        db_1.DbLockService,
+        jwks_resolver_1.JwksResolverService])
+], TrustedKeyService);
+//# sourceMappingURL=trusted-key.service.js.map

package/dist/modules/token-exchange/services/trusted-key.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-key.service.js","sourceRoot":"","sources":["../../../../src/modules/token-exchange/services/trusted-key.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA0D;AAG1D,wDAA6C;AAC7C,8CAAsC;AACtC,gCAAgD;AAChD,gDAAiF;AACjF,gCAAkC;AAElC,0CAAuC;AACvC,uCAA4C;AAC5C,+CAA0D;AAC1D,6BAAwB;AAExB,8FAAwF;AACxF,gFAA2E;AAC3E,0GAAoG;AACpG,4FAAuF;AACvF,oEAA+D;AAS/D,sEAAyF;AACzF,mDAAsD;AAItD,MAAM,gBAAgB,GAAoC;IACzD,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,OAAO;CACd,CAAC;AAEF,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAGlC,MAAM,wBAAwB,GAAG,EAAE,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAc3D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAY7B,YACC,MAAc,EACG,MAA2B,EAC3B,0BAAsD,EACtD,oBAA0C,EAC1C,gBAAkC,EAClC,aAA4B,EAC5B,mBAAwC;QALxC,WAAM,GAAN,MAAM,CAAqB;QAC3B,+BAA0B,GAA1B,0BAA0B,CAA4B;QACtD,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,kBAAa,GAAb,aAAa,CAAe;QAC5B,wBAAmB,GAAnB,mBAAmB,CAAqB;QAdlD,mBAAc,GAAG,KAAK,CAAC;QAEd,gBAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;QAWH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAQD,KAAK,CAAC,UAAU;QACf,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,OAAO;QACR,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB;QACrB,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IAED,YAAY;QACX,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QAExD,IAAI,CAAC,eAAe,GAAG,WAAW,CACjC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,EAC1C,wBAAwB,CACxB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACzD,CAAC;IAGD,WAAW;QACV,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;IAClC,CAAC;IAGD,QAAQ;QACP,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC;IAWD,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,MAAc;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE5C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,IAAoB,CAAC;YACzB,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,6CAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;wBACzD,GAAG;wBACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;qBAC3B,CAAC,CAAC;oBACH,SAAS;gBACV,CAAC;gBACD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;oBACzD,GAAG;oBACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,cAAc;iBACrB,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YAErC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvF,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,OAAO;gBACN,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;aAC/B,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IAClB,CAAC;IAQD,KAAK,CAAC,aAAa,CAAC,QAAgB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,8BAAe,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAIO,kBAAkB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAEpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC;QACX,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,8BAAe,CAAC,mCAAmC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,OAAC,CAAC,KAAK,CAAC,+CAAsB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,8BAAe,CAAC,sCAAsC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAIO,gBAAgB,CAAC,MAAwB;QAChD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,gBAAgB,CAAC;QACtD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAMO,KAAK,CAAC,eAAe,CAAC,OAA2B;QACxD,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,OAA6B,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACvF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAE7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;YAG5C,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC;gBAClC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,EAAE,CAAC,IAAI,CAAC,kDAAsB,EAAE;oBACrC,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,QAAiB;oBACvB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;oBACrC,MAAM,EAAE,SAAkB;iBAC1B,CAAC,CAAC;YACJ,CAAC;YAGD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAC7C,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,EAAE,CAAC,IAAI,CAAC,kDAAsB,EAAE;oBACrC,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,MAAe;oBACrB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC5B,MAAM,EAAE,SAAkB;iBAC1B,CAAC,CAAC;YACJ,CAAC;YAGD,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,EAAE,CAAC,MAAM,CAAC,kDAAsB,EAAE;oBACvC,EAAE,EAAE,IAAA,aAAG,EAAC,IAAA,YAAE,EAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC;iBACnC,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,EAAE,CAAC,MAAM,CAAC,kDAAsB,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC;IAQO,KAAK,CAAC,iBAAiB;QAC9B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;IACF,CAAC;IAMO,KAAK,CAAC,iBAAiB;QAC9B,IAAI,CAAC;YACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC3D,IAAI,GAAG,GAAG,WAAW,IAAI,UAAU,EAAE,CAAC;oBACrC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBAC1C,CAAC;YACF,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;IACF,CAAC;IAEO,oBAAoB,CAAC,MAA8B;QAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,IAAA,wBAAS,EAA0B,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;oBAC9E,OAAO,MAAM,CAAC,eAAe,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC7D,CAAC;YACF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBACxE,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,KAAK,EAAE,CAAC;iBACR,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,yBAAyB,GAAG,gBAAI,CAAC,OAAO,CAAC,cAAc,CAAC;IAC5E,CAAC;IAWO,KAAK,CAAC,qBAAqB,CAAC,MAA8B;QACjE,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,OAA6B,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC1E,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,kDAAsB,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClF,IAAI,CAAC,WAAW;oBAAE,OAAO;gBACzB,MAAM,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACzD,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,KAAK,EAAE,OAAO;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gBACvD,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO;gBAClB,eAAe,EAAE,IAAI,IAAI,EAAE;aAC3B,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,8BAA8B,CAC3C,MAA8B,EAC9B,EAAiB;QAEjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YAGb,MAAM,EAAE,CAAC,MAAM,CAAC,kDAAsB,EAAE,MAAM,CAAC,EAAE,EAAE;gBAClD,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,IAAI,IAAI,EAAE;aAC3B,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAG/C,MAAM,EAAE,CAAC,MAAM,CAAC,qCAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAG3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,IAAI,CAAC,qCAAgB,EAAE;gBAC/B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE;aACrB,CAAC,CAAC;QACJ,CAAC;QAGD,MAAM,aAAa,GAAoC;YACtD,MAAM,EAAE,SAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,IAAI,IAAI,EAAE;SAC3B,CAAC;QACF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAA,wBAAS,EAA0B,MAAM,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;YACzC,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,kDAAsB,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACnE,CAAC;IASO,KAAK,CAAC,oBAAoB,CACjC,MAA8B;QAI9B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACZ,OAAO,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAChD,KAAK,MAAM;gBACV,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACpD;gBACC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBACrD,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;iBACjB,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACrC,MAA8B;QAE9B,IAAI,UAAyB,CAAC;QAC9B,IAAI,CAAC;YACJ,UAAU,GAAG,IAAA,wBAAS,EAAgB,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,8BAAe,CAAC,4CAA4C,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,UAAU,CAAC,GAAG,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,SAAS,EAAE;gBACtF,OAAO,EAAE,MAAM,CAAC,OAAO;aACvB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,IAAI,EAAE;oBACL,UAAU,EAAE,GAAG,CAAC,UAA4B;oBAC5C,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;iBACxE;aACD,CAAC,CAAC;YACH,eAAe,EAAE,MAAM,CAAC,UAAU;SAClC,CAAC;IACH,CAAC;IAEO,0BAA0B,CAAC,MAA8B;QAIhE,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,8BAAe,CAAC,8CAA8C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC,+CAAsB,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,8BAAe,CAAC,iCAAiC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAC7C,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAChD,CAAC;QACF,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;SAC3C,CAAC;IACH,CAAC;IAIO,iBAAiB,CACxB,OAA0B;QAE1B,MAAM,MAAM,GAAiD,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;YAE3F,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,8BAAe,CAAC,gBAAgB,GAAG,kBAAkB,CAAC,CAAC;YAClE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAElB,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAErD,MAAM,CAAC,IAAI,CAAC;gBACX,GAAG;gBACH,IAAI,EAAE;oBACL,UAAU;oBACV,WAAW,EAAE,SAAS;oBACtB,MAAM;oBACN,gBAAgB;oBAChB,YAAY;iBACZ;aACD,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,mBAAmB,CAAC,GAAW,EAAE,UAAoB,EAAE,SAAiB;QAE/E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,8BAAe,CAAC,gBAAgB,GAAG,yBAAyB,GAAG,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAGD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,8BAAe,CACxB,gBAAgB,GAAG,qDAAqD,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAGhC,IAAI,SAA6C,CAAC;QAClD,IAAI,CAAC;YACJ,SAAS,GAAG,IAAA,6BAAe,EAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM,IAAI,8BAAe,CAAC,gBAAgB,GAAG,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAGD,MAAM,OAAO,GAAG,SAAS,CAAC,iBAAiB,CAAC;QAC5C,MAAM,aAAa,GAAsC;YACxD,GAAG,EAAE,CAAC,KAAK,CAAC;YACZ,EAAE,EAAE,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAC3B,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,8BAAe,CACxB,gBAAgB,GAAG,gBAAgB,OAAO,sCAAsC,MAAM,GAAG,CACzF,CAAC;QACH,CAAC;IACF,CAAC;IAIO,gBAAgB,CAAC,QAAgB,EAAE,WAAmB;QAC7D,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE9C,IAAI,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,MAAM,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,IAAA,6BAAe,EAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACrE,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACxD,QAAQ;gBACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD,CAAA;AA9hBY,8CAAiB;AAwCvB;IADL,IAAA,6BAAgB,GAAE;;;;yDAGlB;AAqBD;IADC,IAAA,6BAAgB,GAAE;;;;oDAIlB;AAGD;IADC,IAAA,uBAAU,GAAE;;;;iDAIZ;4BAxEW,iBAAiB;IAD7B,IAAA,YAAO,GAAE;qCAcA,uBAAM;QACW,2CAAmB;QACC,0DAA0B;QAChC,6CAAoB;QACxB,2BAAgB;QACnB,kBAAa;QACP,mCAAmB;GAnB9C,iBAAiB,CA8hB7B"}

package/dist/modules/token-exchange/token-exchange.config.d.ts

@@ -0,0 +1,11 @@
+export declare class TokenExchangeConfig {
+    enabled: boolean;
+    embedEnabled: boolean;
+    maxTokenTtl: number;
+    trustedKeys: string;
+    keyRefreshIntervalSeconds: number;
+    jtiCleanupIntervalSeconds: number;
+    jtiCleanupBatchSize: number;
+    rateLimitEmbedLogin: number;
+    rateLimitTokenExchange: number;
+}

package/dist/modules/token-exchange/token-exchange.config.js

@@ -0,0 +1,67 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeConfig = void 0;
+const config_1 = require("@n8n/config");
+let TokenExchangeConfig = class TokenExchangeConfig {
+    constructor() {
+        this.enabled = false;
+        this.embedEnabled = false;
+        this.maxTokenTtl = 900;
+        this.trustedKeys = '';
+        this.keyRefreshIntervalSeconds = 300;
+        this.jtiCleanupIntervalSeconds = 60;
+        this.jtiCleanupBatchSize = 1000;
+        this.rateLimitEmbedLogin = 20;
+        this.rateLimitTokenExchange = 20;
+    }
+};
+exports.TokenExchangeConfig = TokenExchangeConfig;
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_ENABLED'),
+    __metadata("design:type", Boolean)
+], TokenExchangeConfig.prototype, "enabled", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_EMBED_LOGIN_ENABLED'),
+    __metadata("design:type", Boolean)
+], TokenExchangeConfig.prototype, "embedEnabled", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_MAX_TOKEN_TTL'),
+    __metadata("design:type", Number)
+], TokenExchangeConfig.prototype, "maxTokenTtl", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_TRUSTED_KEYS'),
+    __metadata("design:type", String)
+], TokenExchangeConfig.prototype, "trustedKeys", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_KEY_REFRESH_INTERVAL_SECONDS'),
+    __metadata("design:type", Number)
+], TokenExchangeConfig.prototype, "keyRefreshIntervalSeconds", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_JTI_CLEANUP_INTERVAL_SECONDS'),
+    __metadata("design:type", Number)
+], TokenExchangeConfig.prototype, "jtiCleanupIntervalSeconds", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_JTI_CLEANUP_BATCH_SIZE'),
+    __metadata("design:type", Number)
+], TokenExchangeConfig.prototype, "jtiCleanupBatchSize", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_EMBED_LOGIN_PER_MINUTE'),
+    __metadata("design:type", Number)
+], TokenExchangeConfig.prototype, "rateLimitEmbedLogin", void 0);
+__decorate([
+    (0, config_1.Env)('N8N_TOKEN_EXCHANGE_TOKEN_EXCHANGE_PER_MINUTE'),
+    __metadata("design:type", Number)
+], TokenExchangeConfig.prototype, "rateLimitTokenExchange", void 0);
+exports.TokenExchangeConfig = TokenExchangeConfig = __decorate([
+    config_1.Config
+], TokenExchangeConfig);
+//# sourceMappingURL=token-exchange.config.js.map

package/dist/modules/token-exchange/token-exchange.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.config.js","sourceRoot":"","sources":["../../../src/modules/token-exchange/token-exchange.config.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAA0C;AAGnC,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAAzB;QAGN,YAAO,GAAY,KAAK,CAAC;QAIzB,iBAAY,GAAY,KAAK,CAAC;QAI9B,gBAAW,GAAW,GAAG,CAAC;QAU1B,gBAAW,GAAW,EAAE,CAAC;QAIzB,8BAAyB,GAAW,GAAG,CAAC;QAIxC,8BAAyB,GAAW,EAAE,CAAC;QAIvC,wBAAmB,GAAW,IAAI,CAAC;QAInC,wBAAmB,GAAW,EAAE,CAAC;QAIjC,2BAAsB,GAAW,EAAE,CAAC;IACrC,CAAC;CAAA,CAAA;AA1CY,kDAAmB;AAG/B;IADC,IAAA,YAAG,EAAC,4BAA4B,CAAC;;oDACT;AAIzB;IADC,IAAA,YAAG,EAAC,yBAAyB,CAAC;;yDACD;AAI9B;IADC,IAAA,YAAG,EAAC,kCAAkC,CAAC;;wDACd;AAU1B;IADC,IAAA,YAAG,EAAC,iCAAiC,CAAC;;wDACd;AAIzB;IADC,IAAA,YAAG,EAAC,iDAAiD,CAAC;;sEACf;AAIxC;IADC,IAAA,YAAG,EAAC,iDAAiD,CAAC;;sEAChB;AAIvC;IADC,IAAA,YAAG,EAAC,2CAA2C,CAAC;;gEACd;AAInC;IADC,IAAA,YAAG,EAAC,2CAA2C,CAAC;;gEAChB;AAIjC;IADC,IAAA,YAAG,EAAC,8CAA8C,CAAC;;mEAChB;8BAzCxB,mBAAmB;IAD/B,eAAM;GACM,mBAAmB,CA0C/B"}

package/dist/modules/token-exchange/token-exchange.module.d.ts

@@ -0,0 +1,5 @@
+import type { ModuleInterface } from '@n8n/decorators';
+export declare class TokenExchangeModule implements ModuleInterface {
+    entities(): Promise<never>;
+    init(): Promise<void>;
+}

package/dist/modules/token-exchange/token-exchange.module.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenExchangeModule = void 0;
+const constants_1 = require("@n8n/constants");
+const decorators_1 = require("@n8n/decorators");
+const di_1 = require("@n8n/di");
+function isFeatureFlagEnabled() {
+    return process.env.N8N_ENV_FEAT_TOKEN_EXCHANGE === 'true';
+}
+let TokenExchangeModule = class TokenExchangeModule {
+    async entities() {
+        const { TokenExchangeJti } = await Promise.resolve().then(() => __importStar(require('./database/entities/token-exchange-jti.entity')));
+        const { TrustedKeySourceEntity } = await Promise.resolve().then(() => __importStar(require('./database/entities/trusted-key-source.entity')));
+        const { TrustedKeyEntity } = await Promise.resolve().then(() => __importStar(require('./database/entities/trusted-key.entity')));
+        return [TokenExchangeJti, TrustedKeySourceEntity, TrustedKeyEntity];
+    }
+    async init() {
+        if (!isFeatureFlagEnabled()) {
+            return;
+        }
+        const { TrustedKeyService } = await Promise.resolve().then(() => __importStar(require('./services/trusted-key.service')));
+        await di_1.Container.get(TrustedKeyService).initialize();
+        await Promise.resolve().then(() => __importStar(require('./controllers/token-exchange.controller')));
+        await Promise.resolve().then(() => __importStar(require('./controllers/embed-auth.controller')));
+        const { JtiCleanupService } = await Promise.resolve().then(() => __importStar(require('./services/jti-cleanup.service')));
+        di_1.Container.get(JtiCleanupService).init();
+        const { ScopedJwtStrategy } = await Promise.resolve().then(() => __importStar(require('./services/scoped-jwt.strategy')));
+        const { AuthStrategyRegistry } = await Promise.resolve().then(() => __importStar(require('../../services/auth-strategy.registry')));
+        di_1.Container.get(AuthStrategyRegistry).register(di_1.Container.get(ScopedJwtStrategy));
+    }
+};
+exports.TokenExchangeModule = TokenExchangeModule;
+exports.TokenExchangeModule = TokenExchangeModule = __decorate([
+    (0, decorators_1.BackendModule)({
+        name: 'token-exchange',
+        licenseFlag: constants_1.LICENSE_FEATURES.TOKEN_EXCHANGE,
+        instanceTypes: ['main'],
+    })
+], TokenExchangeModule);
+//# sourceMappingURL=token-exchange.module.js.map

package/dist/modules/token-exchange/token-exchange.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.module.js","sourceRoot":"","sources":["../../../src/modules/token-exchange/token-exchange.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAkD;AAElD,gDAAgD;AAChD,gCAAoC;AAEpC,SAAS,oBAAoB;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,MAAM,CAAC;AAC3D,CAAC;AAOM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC/B,KAAK,CAAC,QAAQ;QACb,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,+CAA+C,GAAC,CAAC;QAC3F,MAAM,EAAE,sBAAsB,EAAE,GAAG,wDAClC,+CAA+C,GAC/C,CAAC;QACF,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,wCAAwC,GAAC,CAAC;QACpF,OAAO,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,gBAAgB,CAAU,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC7B,OAAO;QACR,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,gCAAgC,GAAC,CAAC;QAC7E,MAAM,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,UAAU,EAAE,CAAC;QAEpD,wDAAa,yCAAyC,GAAC,CAAC;QACxD,wDAAa,qCAAqC,GAAC,CAAC;QAEpD,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,gCAAgC,GAAC,CAAC;QAC7E,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QAIxC,MAAM,EAAE,iBAAiB,EAAE,GAAG,wDAAa,gCAAgC,GAAC,CAAC;QAC7E,MAAM,EAAE,oBAAoB,EAAE,GAAG,wDAAa,mCAAmC,GAAC,CAAC;QACnF,cAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,cAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChF,CAAC;CACD,CAAA;AA9BY,kDAAmB;8BAAnB,mBAAmB;IAL/B,IAAA,0BAAa,EAAC;QACd,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,4BAAgB,CAAC,cAAc;QAC5C,aAAa,EAAE,CAAC,MAAM,CAAC;KACvB,CAAC;GACW,mBAAmB,CA8B/B"}