synomem 0.8.0 → 0.9.0

package/dist/oauth.js

@@ -1,26 +1,126 @@
+/**
+ * The CLI's own OAuth 2.1 client (RFC 8252 native app).
+ *
+ * Authorization code + PKCE S256 through the system browser and a loopback
+ * redirect, against the pre-registered public client `synomem-cli`. The token
+ * is audienced to the Synomem API itself: discovery starts from the API's own
+ * protected-resource metadata (RFC 9728), never from the MCP gateway, and the
+ * discovered issuer and resource are validated before any browser opens.
+ *
+ * Which agent and workspace the resulting connection may act as is chosen on
+ * the consent screen and enforced by the API; nothing here names an actor.
+ */
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
-import { discoverOAuthServerInfo, startAuthorization, } from '@modelcontextprotocol/sdk/client/auth.js';
+import { createHash, randomBytes } from 'node:crypto';
 import { SynomemError } from './errors.js';
-import { readCredentialFile } from './configure.js';
-const defaultScope = 'synomem:read synomem:write offline_access';
-function secureEndpoint(value, label) {
-    const url = new URL(value);
-    if (url.protocol !== 'https:') {
+export const DEFAULT_CLI_CLIENT_ID = 'synomem-cli';
+export const DEFAULT_CALLBACK_PORT = 43_817;
+export const DEFAULT_CLI_SCOPE = 'openid offline_access synomem:read synomem:write';
+const maximumDocumentBytes = 64 * 1024;
+/** Access tokens are treated as expired this long before they actually are. */
+const expirySafetyMs = 30_000;
+function trimSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+/** HTTPS, or loopback HTTP (development against a local stack). */
+export function secureUrl(value, label) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new SynomemError('AUTH_REQUIRED', `${label} is not a valid URL.`);
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
         throw new SynomemError('AUTH_REQUIRED', `${label} must use HTTPS.`);
     }
+    if (url.username || url.password) {
+        throw new SynomemError('AUTH_REQUIRED', `${label} must not carry credentials.`);
+    }
     return url;
 }
-async function tokenRequest(endpoint, parameters, fetchImplementation, signal) {
+async function readJson(url, fetchImplementation, label) {
     let response;
     try {
-        response = await fetchImplementation(secureEndpoint(endpoint, 'OAuth token endpoint'), {
+        response = await fetchImplementation(url, {
+            redirect: 'error',
+            headers: { accept: 'application/json' },
+        });
+    }
+    catch {
+        throw new SynomemError('REMOTE_UNAVAILABLE', `${label} is unavailable.`);
+    }
+    const text = await response.text();
+    if (Buffer.byteLength(text) > maximumDocumentBytes) {
+        throw new SynomemError('REMOTE_PROTOCOL', `${label} exceeded the safe size limit.`);
+    }
+    if (!response.ok) {
+        throw new SynomemError('REMOTE_PROTOCOL', `${label} returned HTTP ${response.status}.`);
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error();
+        return parsed;
+    }
+    catch {
+        throw new SynomemError('REMOTE_PROTOCOL', `${label} is not valid JSON.`);
+    }
+}
+/**
+ * Where to sign in for this API, validated.
+ *
+ * The protected-resource metadata must name THIS API as its resource and at
+ * least one authorization server; the authorization server's metadata must
+ * name itself as issuer, publish HTTPS endpoints and support S256. A mismatch
+ * anywhere stops the login before a browser opens.
+ */
+export async function discoverApiAuthorization(apiUrl, fetchImplementation = fetch) {
+    const api = secureUrl(apiUrl, 'Synomem API URL');
+    const resourceMetadata = await readJson(new URL('/.well-known/oauth-protected-resource', api.origin), fetchImplementation, 'API protected-resource metadata');
+    const resource = resourceMetadata.resource;
+    if (typeof resource !== 'string' || trimSlash(resource) !== trimSlash(api.origin)) {
+        throw new SynomemError('AUTH_REQUIRED', 'The API protected-resource metadata does not describe this API.');
+    }
+    const servers = resourceMetadata.authorization_servers;
+    const issuerValue = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof issuerValue !== 'string') {
+        throw new SynomemError('AUTH_REQUIRED', 'The API names no authorization server.');
+    }
+    const issuer = secureUrl(issuerValue, 'Authorization server');
+    const asMetadata = await readJson(new URL(`/.well-known/oauth-authorization-server${issuer.pathname === '/' ? '' : trimSlash(issuer.pathname)}`, issuer.origin), fetchImplementation, 'Authorization server metadata');
+    if (typeof asMetadata.issuer !== 'string' ||
+        trimSlash(asMetadata.issuer) !== trimSlash(issuer.href)) {
+        throw new SynomemError('AUTH_REQUIRED', 'The authorization server metadata issuer does not match.');
+    }
+    const authorizationEndpoint = asMetadata.authorization_endpoint;
+    const tokenEndpoint = asMetadata.token_endpoint;
+    if (typeof authorizationEndpoint !== 'string' || typeof tokenEndpoint !== 'string') {
+        throw new SynomemError('AUTH_REQUIRED', 'Authorization server discovery is incomplete.');
+    }
+    secureUrl(authorizationEndpoint, 'OAuth authorization endpoint');
+    secureUrl(tokenEndpoint, 'OAuth token endpoint');
+    const methods = asMetadata.code_challenge_methods_supported;
+    if (!Array.isArray(methods) || !methods.includes('S256')) {
+        throw new SynomemError('AUTH_REQUIRED', 'The authorization server must support PKCE S256.');
+    }
+    return {
+        resource: trimSlash(resource),
+        issuer: trimSlash(asMetadata.issuer),
+        authorizationEndpoint,
+        tokenEndpoint,
+    };
+}
+async function tokenRequest(endpoint, parameters, fetchImplementation) {
+    let response;
+    try {
+        response = await fetchImplementation(secureUrl(endpoint, 'OAuth token endpoint'), {
             method: 'POST',
             redirect: 'error',
             headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
             body: parameters,
-            ...(signal ? { signal } : {}),
         });
     }
     catch (error) {
@@ -29,7 +129,7 @@ async function tokenRequest(endpoint, parameters, fetchImplementation, signal) {
         throw new SynomemError('REMOTE_UNAVAILABLE', 'The OAuth token endpoint is unavailable.');
     }
     const text = await response.text();
-    if (Buffer.byteLength(text) > 64 * 1024) {
+    if (Buffer.byteLength(text) > maximumDocumentBytes) {
         throw new SynomemError('REMOTE_PROTOCOL', 'OAuth token response exceeded the safe limit.');
     }
     let parsed;
@@ -44,11 +144,16 @@ async function tokenRequest(endpoint, parameters, fetchImplementation, signal) {
     }
     return parsed;
 }
+function expiresAt(expiresIn) {
+    // A token without a lifetime is still refreshed on the API's schedule: 10
+    // minutes is the contract's maximum access-token lifetime.
+    return Date.now() + Math.max(0, (expiresIn ?? 600) * 1_000 - expirySafetyMs);
+}
 function launchBrowser(url) {
-    const command = process.platform === 'darwin' ? 'open' : 'xdg-open';
     if (process.platform !== 'darwin' && process.platform !== 'linux') {
         throw new SynomemError('CONFIG_INVALID', `Open this URL in a browser: ${url.href}`);
     }
+    const command = process.platform === 'darwin' ? 'open' : 'xdg-open';
     const child = spawn(command, [url.href], { detached: true, stdio: 'ignore' });
     child.once('error', () => undefined);
     child.unref();
@@ -67,7 +172,9 @@ async function authorizationCode(authorizationUrl, state, callbackPort, openBrow
             if (oauthError || !code || returnedState !== state) {
                 response.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
                 response.end('Synomem authorization failed. Return to your terminal.');
-                finish(new SynomemError('AUTH_REQUIRED', 'OAuth callback validation failed.'));
+                finish(new SynomemError('AUTH_REQUIRED', oauthError === 'access_denied'
+                    ? 'Authorization was declined.'
+                    : 'OAuth callback validation failed.'));
                 return;
             }
             response.writeHead(200, {
@@ -97,132 +204,78 @@ async function authorizationCode(authorizationUrl, state, callbackPort, openBrow
         });
     });
 }
+/** Runs the browser flow and returns the credential for the caller to store. */
 export async function loginWithOAuth(options) {
     const fetchImplementation = options.fetch ?? fetch;
-    const mcpUrl = new URL('/mcp', options.baseUrl);
-    const discovered = await discoverOAuthServerInfo(mcpUrl, { fetchFn: fetchImplementation });
-    const metadata = discovered.authorizationServerMetadata;
-    if (!metadata?.authorization_endpoint || !metadata.token_endpoint) {
-        throw new SynomemError('AUTH_REQUIRED', 'OAuth server discovery is incomplete.');
-    }
-    secureEndpoint(metadata.authorization_endpoint, 'OAuth authorization endpoint');
-    secureEndpoint(metadata.token_endpoint, 'OAuth token endpoint');
-    if (!metadata.code_challenge_methods_supported?.includes('S256')) {
-        throw new SynomemError('AUTH_REQUIRED', 'The OAuth server must support PKCE S256.');
-    }
-    const callbackPort = options.callbackPort ?? 43_817;
-    const redirectUrl = new URL(`http://127.0.0.1:${callbackPort}/callback`);
+    const metadata = await discoverApiAuthorization(options.apiUrl, fetchImplementation);
+    const clientId = options.clientId ?? DEFAULT_CLI_CLIENT_ID;
+    const scope = options.scope ?? DEFAULT_CLI_SCOPE;
+    const callbackPort = options.callbackPort ?? DEFAULT_CALLBACK_PORT;
+    const redirectUri = `http://127.0.0.1:${callbackPort}/callback`;
     const state = randomBytes(32).toString('base64url');
-    const resource = new URL(discovered.resourceMetadata?.resource ?? mcpUrl.href);
-    const scope = options.scope ?? defaultScope;
-    const started = await startAuthorization(discovered.authorizationServerUrl, {
-        metadata,
-        clientInformation: { client_id: options.clientId },
-        redirectUrl,
-        scope,
-        state,
-        resource,
-    });
-    const code = await authorizationCode(started.authorizationUrl, state, callbackPort, options.openBrowser ?? launchBrowser, options.timeoutMs ?? 5 * 60_000);
-    const tokens = await tokenRequest(metadata.token_endpoint, new URLSearchParams({
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const authorizationUrl = new URL(metadata.authorizationEndpoint);
+    authorizationUrl.searchParams.set('response_type', 'code');
+    authorizationUrl.searchParams.set('client_id', clientId);
+    authorizationUrl.searchParams.set('redirect_uri', redirectUri);
+    authorizationUrl.searchParams.set('scope', scope);
+    authorizationUrl.searchParams.set('state', state);
+    authorizationUrl.searchParams.set('code_challenge', challenge);
+    authorizationUrl.searchParams.set('code_challenge_method', 'S256');
+    authorizationUrl.searchParams.set('resource', metadata.resource);
+    const code = await authorizationCode(authorizationUrl, state, callbackPort, options.openBrowser ?? launchBrowser, options.timeoutMs ?? 5 * 60_000);
+    const tokens = await tokenRequest(metadata.tokenEndpoint, new URLSearchParams({
         grant_type: 'authorization_code',
-        client_id: options.clientId,
+        client_id: clientId,
         code,
-        code_verifier: started.codeVerifier,
-        redirect_uri: redirectUrl.href,
-        resource: resource.href,
+        code_verifier: verifier,
+        redirect_uri: redirectUri,
+        resource: metadata.resource,
     }), fetchImplementation);
-    await options.credentialStore.set(options.credentialReference, {
+    return {
+        kind: 'oauth',
+        issuer: metadata.issuer,
+        resource: metadata.resource,
+        clientId,
+        tokenEndpoint: metadata.tokenEndpoint,
+        scope: tokens.scope ?? scope,
         accessToken: tokens.access_token,
         ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
-        ...(tokens.expires_in
-            ? { expiresAt: Date.now() + Math.max(0, tokens.expires_in - 30) * 1_000 }
-            : {}),
-        tokenEndpoint: metadata.token_endpoint,
-        clientId: options.clientId,
-        resource: resource.href,
-        scope: tokens.scope ?? scope,
-    });
+        expiresAt: expiresAt(tokens.expires_in),
+        generation: 0,
+    };
 }
-export class StoredCredentialProvider {
-    reference;
-    store;
-    env;
-    fetchImplementation;
-    home;
-    refresh;
-    credential;
-    /** Set when the stored credential is an access key rather than an OAuth grant. */
-    staticAccessToken;
-    loaded = false;
-    constructor(reference, store, env = process.env, fetchImplementation = fetch, 
-    /**
-     * Where `synomem config`'s restricted-file credential store, if chosen,
-     * would have written an access key. Optional because local-only and
-     * environment-only callers have no such file to fall back to.
-     */
-    home) {
-        this.reference = reference;
-        this.store = store;
-        this.env = env;
-        this.fetchImplementation = fetchImplementation;
-        this.home = home;
-    }
-    async getAccessToken(signal) {
-        if (this.env.SYNOMEM_ACCESS_TOKEN)
-            return this.env.SYNOMEM_ACCESS_TOKEN;
-        if (!this.loaded) {
-            const stored = await this.store.get(this.reference);
-            /*
-             * An access key is not an OAuth credential: it cannot be refreshed and
-             * has no client or token endpoint. It is used exactly as stored,
-             * whichever of the two places it was found.
-             */
-            if (stored && 'kind' in stored) {
-                this.staticAccessToken = stored.accessToken;
-            }
-            else if (stored) {
-                this.credential = stored;
-            }
-            else if (this.home) {
-                this.staticAccessToken = readCredentialFile(this.home);
-            }
-            this.loaded = true;
-        }
-        if (this.staticAccessToken)
-            return this.staticAccessToken;
-        const credential = this.credential;
-        if (!credential)
-            return undefined;
-        if (!credential.expiresAt || credential.expiresAt > Date.now())
-            return credential.accessToken;
-        if (!credential.refreshToken)
-            return undefined;
-        this.refresh ??= this.refreshCredential(credential, signal).finally(() => {
-            this.refresh = undefined;
-        });
-        return await this.refresh;
+/**
+ * Spends the refresh token once. Callers hold the credential lock and write the
+ * result before releasing it; a failure here is never retried with the same
+ * (possibly consumed) refresh token.
+ */
+export async function refreshOAuthCredential(credential, fetchImplementation = fetch) {
+    if (!credential.refreshToken) {
+        throw new SynomemError('REAUTHORIZATION_REQUIRED', 'The stored credential cannot be refreshed.');
     }
-    async refreshCredential(credential, signal) {
-        const tokens = await tokenRequest(credential.tokenEndpoint, new URLSearchParams({
+    let tokens;
+    try {
+        tokens = await tokenRequest(credential.tokenEndpoint, new URLSearchParams({
             grant_type: 'refresh_token',
             client_id: credential.clientId,
             refresh_token: credential.refreshToken,
             resource: credential.resource,
-            scope: credential.scope,
-        }), this.fetchImplementation, signal);
-        const updated = {
-            ...credential,
-            accessToken: tokens.access_token,
-            refreshToken: tokens.refresh_token ?? credential.refreshToken,
-            ...(tokens.expires_in
-                ? { expiresAt: Date.now() + Math.max(0, tokens.expires_in - 30) * 1_000 }
-                : { expiresAt: undefined }),
-            scope: tokens.scope ?? credential.scope,
-        };
-        await this.store.set(this.reference, updated);
-        this.credential = updated;
-        return updated.accessToken;
+        }), fetchImplementation);
     }
+    catch (error) {
+        if (error instanceof SynomemError && error.code === 'REMOTE_UNAVAILABLE')
+            throw error;
+        throw new SynomemError('REAUTHORIZATION_REQUIRED', 'The stored credential was refused when refreshing.');
+    }
+    return {
+        ...credential,
+        accessToken: tokens.access_token,
+        ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
+        scope: tokens.scope ?? credential.scope,
+        expiresAt: expiresAt(tokens.expires_in),
+        generation: credential.generation + 1,
+    };
 }
 //# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,YAAY,GAAG,2CAA2C,CAAC;AASjE,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,UAA2B,EAC3B,mBAAiC,EACjC,MAAoB;IAEpB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,gBAAqB,EACrB,KAAa,EACb,YAAoB,EACpB,WAA+B,EAC/B,SAAiB;IAEjB,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBACnD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACzE,QAAQ,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,cAAc,EAAE,2BAA2B;gBAC3C,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,EACzE,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAa,EAAE,EAAE;YAC9C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACpB,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5C,IAAI,CAAC;gBACH,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA0B;IAC7D,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,UAAU,CAAC,2BAA2B,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,cAAc,CAAC,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC;IAChF,cAAc,CAAC,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,YAAY,WAAW,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,sBAAsB,EAAE;QAC1E,QAAQ;QACR,iBAAiB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;QAClD,WAAW;QACX,KAAK;QACL,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC,OAAO,CAAC,gBAAgB,EACxB,KAAK,EACL,YAAY,EACZ,OAAO,CAAC,WAAW,IAAI,aAAa,EACpC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,QAAQ,CAAC,cAAc,EACvB,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI;QACJ,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,YAAY,EAAE,WAAW,CAAC,IAAI;QAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC,EACF,mBAAmB,CACpB,CAAC;IACF,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE;QAC7D,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,QAAQ,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,wBAAwB;IAQhB;IACA;IACA;IACA;IAMA;IAhBX,OAAO,CAA+B;IACtC,UAAU,CAAyB;IAC3C,kFAAkF;IAC1E,iBAAiB,CAAU;IAC3B,MAAM,GAAG,KAAK,CAAC;IAEvB,YACmB,SAAiB,EACjB,KAAsB,EACtB,MAAyB,OAAO,CAAC,GAAG,EACpC,sBAAoC,KAAK;IAC1D;;;;OAIG;IACc,IAAa;QATb,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAiB;QACtB,QAAG,GAAH,GAAG,CAAiC;QACpC,wBAAmB,GAAnB,mBAAmB,CAAsB;QAMzC,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,MAAoB;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD;;;;eAIG;YACH,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBAC/B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC;YAC9C,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;YAC3B,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,UAAU,CAAC,WAAW,CAAC;QAC9F,IAAI,CAAC,UAAU,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACvE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,UAAiC,EACjC,MAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,UAAU,CAAC,aAAa,EACxB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,UAAU,CAAC,QAAQ;YAC9B,aAAa,EAAE,UAAU,CAAC,YAAa;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,EACF,IAAI,CAAC,mBAAmB,EACxB,MAAM,CACP,CAAC;QACF,MAAM,OAAO,GAA0B;YACrC,GAAG,UAAU;YACb,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY;YAC7D,GAAG,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE;gBACzE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;SACxC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;QAC1B,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,kDAAkD,CAAC;AACpF,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,+EAA+E;AAC/E,MAAM,cAAc,GAAG,MAAM,CAAC;AAgB9B,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAQ,EACR,mBAAiC,EACjC,KAAa;IAEb,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;YACxC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,kBAAkB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,sBAAoC,KAAK;IAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CACrC,IAAI,GAAG,CAAC,uCAAuC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5D,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;IACF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,qBAAqB,CAAC;IACvD,MAAM,WAAW,GAAY,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,IAAI,GAAG,CACL,0CAA0C,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EACrG,MAAM,CAAC,MAAM,CACd,EACD,mBAAmB,EACnB,+BAA+B,CAChC,CAAC;IACF,IACE,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACrC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAG,UAAU,CAAC,sBAAsB,CAAC;IAChE,MAAM,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC;IAChD,IAAI,OAAO,qBAAqB,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,CAAC,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;IACjE,SAAS,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,gCAAgC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QACpC,qBAAqB;QACrB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,UAA2B,EAC3B,mBAAiC;IAEjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,SAA6B;IAC9C,0EAA0E;IAC1E,2DAA2D;IAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,gBAAqB,EACrB,KAAa,EACb,YAAoB,EACpB,WAA+B,EAC/B,SAAiB;IAEjB,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBACnD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACzE,QAAQ,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACvE,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,UAAU,KAAK,eAAe;oBAC5B,CAAC,CAAC,6BAA6B;oBAC/B,CAAC,CAAC,mCAAmC,CACxC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,cAAc,EAAE,2BAA2B;gBAC3C,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,EACzE,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAa,EAAE,EAAE;YAC9C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACpB,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5C,IAAI,CAAC;gBACH,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA0B;IAC7D,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,WAAW,GAAG,oBAAoB,YAAY,WAAW,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACjE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC/D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC/D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEjE,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,OAAO,CAAC,WAAW,IAAI,aAAa,EACpC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,QAAQ,CAAC,aAAa,EACtB,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,EACF,mBAAmB,CACpB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;QAC5B,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,UAAU,EAAE,CAAC;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAiC,EACjC,sBAAoC,KAAK;IAEzC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,0BAA0B,EAC1B,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CACzB,UAAU,CAAC,aAAa,EACxB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,UAAU,CAAC,QAAQ;YAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,EACF,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;YAAE,MAAM,KAAK,CAAC;QACtF,MAAM,IAAI,YAAY,CACpB,0BAA0B,EAC1B,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;QACvC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,UAAU,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC;KACtC,CAAC;AACJ,CAAC"}

package/dist/profiles.d.ts

@@ -0,0 +1,243 @@
+import { z } from 'zod';
+import { type CredentialStore, type CredentialStores } from './credentials.js';
+import { SynomemError } from './errors.js';
+import { createLocalResolver, createRemoteResolver, type ContextResolver, type RemoteCredentialSource } from './resolvers.js';
+import type { ActorIdentity, ContextSummary } from './types.js';
+export declare const PROFILES_FILE = "profiles.json";
+declare const credentialEntrySchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        oauth: "oauth";
+        "access-key": "access-key";
+    }>;
+    apiUrl: z.ZodString;
+    store: z.ZodEnum<{
+        file: "file";
+        keychain: "keychain";
+        environment: "environment";
+    }>;
+    secretRef: z.ZodOptional<z.ZodString>;
+    issuer: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    connectionId: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strict>;
+declare const localProfileSchema: z.ZodObject<{
+    backend: z.ZodLiteral<"local">;
+    home: z.ZodOptional<z.ZodString>;
+    actorId: z.ZodString;
+    actorName: z.ZodOptional<z.ZodString>;
+    contextId: z.ZodString;
+}, z.core.$strict>;
+declare const remoteProfileSchema: z.ZodObject<{
+    backend: z.ZodOptional<z.ZodLiteral<"remote">>;
+    credentialRef: z.ZodString;
+    contextId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    workspaceName: z.ZodOptional<z.ZodString>;
+    actor: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+            system: "system";
+        }>;
+        id: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const profileSchema: z.ZodUnion<readonly [z.ZodObject<{
+    backend: z.ZodLiteral<"local">;
+    home: z.ZodOptional<z.ZodString>;
+    actorId: z.ZodString;
+    actorName: z.ZodOptional<z.ZodString>;
+    contextId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    backend: z.ZodOptional<z.ZodLiteral<"remote">>;
+    credentialRef: z.ZodString;
+    contextId: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    workspaceName: z.ZodOptional<z.ZodString>;
+    actor: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+            system: "system";
+        }>;
+        id: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+export declare const profilesConfigSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    credentials: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        kind: z.ZodEnum<{
+            oauth: "oauth";
+            "access-key": "access-key";
+        }>;
+        apiUrl: z.ZodString;
+        store: z.ZodEnum<{
+            file: "file";
+            keychain: "keychain";
+            environment: "environment";
+        }>;
+        secretRef: z.ZodOptional<z.ZodString>;
+        issuer: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodOptional<z.ZodString>;
+        connectionId: z.ZodOptional<z.ZodString>;
+        label: z.ZodOptional<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strict>>>;
+    profiles: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        backend: z.ZodLiteral<"local">;
+        home: z.ZodOptional<z.ZodString>;
+        actorId: z.ZodString;
+        actorName: z.ZodOptional<z.ZodString>;
+        contextId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        backend: z.ZodOptional<z.ZodLiteral<"remote">>;
+        credentialRef: z.ZodString;
+        contextId: z.ZodString;
+        workspaceId: z.ZodOptional<z.ZodString>;
+        workspaceName: z.ZodOptional<z.ZodString>;
+        actor: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                human: "human";
+                agent: "agent";
+                system: "system";
+            }>;
+            id: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>>;
+    harnessPresets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    defaultProfile: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type CredentialEntry = z.infer<typeof credentialEntrySchema>;
+export type LocalProfile = z.infer<typeof localProfileSchema>;
+export type RemoteProfile = z.infer<typeof remoteProfileSchema>;
+export type Profile = z.infer<typeof profileSchema>;
+export type ProfilesConfig = z.infer<typeof profilesConfigSchema>;
+export declare function isLocalProfile(profile: Profile): profile is LocalProfile;
+export declare function emptyProfilesConfig(): ProfilesConfig;
+export declare function assertName(name: string, what: string): string;
+/** Reads and writes `<home>/profiles.json`. Injected in tests. */
+export declare class ProfileStore {
+    readonly home: string;
+    constructor(explicitHome?: string);
+    get path(): string;
+    read(): ProfilesConfig;
+    write(config: ProfilesConfig): void;
+}
+export type Selection = {
+    kind: 'profile';
+    name: string;
+    source: string;
+} | {
+    kind: 'preset';
+    name: string;
+    source: string;
+};
+export interface SelectionInput {
+    profile?: string;
+    preset?: string;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    /** The Synomem home, so it is never mistaken for a project directory. */
+    home?: string;
+}
+/**
+ * Which profile or preset a process acts through. One implementation, used by
+ * the CLI and both stdio entrypoints:
+ *
+ *   1. `--profile` / `--preset` on this invocation
+ *   2. `SYNOMEM_PROFILE` / `SYNOMEM_PRESET` for this process
+ *   3. the nearest project `.synomem/project.json` (names a profile/preset only)
+ *   4. `defaultProfile` in profiles.json
+ *
+ * Returns undefined when nothing selects anything. Naming something that does
+ * not exist is an error, never a fall-through to the next source.
+ */
+export declare function resolveSelection(config: ProfilesConfig, input: SelectionInput): Selection | undefined;
+export declare function noSelectionError(): SynomemError;
+export interface CredentialSourceOptions {
+    home: string;
+    name: string;
+    entry: CredentialEntry;
+    stores: CredentialStores;
+    env?: NodeJS.ProcessEnv;
+    fetch?: typeof fetch;
+}
+export declare function storeFor(stores: CredentialStores, entry: CredentialEntry): CredentialStore;
+/**
+ * A connection's current bearer: an access key as stored, or an OAuth access
+ * token, refreshed under the cross-process lock when it has expired.
+ *
+ * After taking the lock the stored credential is re-read: if another process
+ * already refreshed it (a newer generation), that token is used and the
+ * refresh token is not spent again. A refused refresh is never retried — the
+ * connection must be logged in again.
+ */
+export declare class ConnectionCredentialSource implements RemoteCredentialSource {
+    private readonly options;
+    private cached?;
+    private cachedExpiry;
+    private pending?;
+    constructor(options: CredentialSourceOptions);
+    bearer(): Promise<string>;
+    private reauthorize;
+    private load;
+    private remember;
+}
+export interface ResolverDependencies {
+    stores: CredentialStores;
+    env?: NodeJS.ProcessEnv;
+    fetch?: typeof fetch;
+    createRemoteResolver?: typeof createRemoteResolver;
+    createLocalResolver?: typeof createLocalResolver;
+}
+export declare function credentialSourceFor(home: string, config: ProfilesConfig, name: string, deps: ResolverDependencies): ConnectionCredentialSource;
+/** The canonical local actor for a local profile, after checking its store. */
+export declare function localProfileTarget(rootHome: string, profile: LocalProfile): {
+    home: string;
+    actor: ActorIdentity;
+};
+/** A fixed-mode resolver for one profile. */
+export declare function profileResolver(rootHome: string, config: ProfilesConfig, name: string, deps: ResolverDependencies): ContextResolver;
+interface Route {
+    profile: string;
+    contextId: string;
+    resolver: ContextResolver;
+}
+/**
+ * An explicit-context resolver over a preset's profiles.
+ *
+ * Remote profiles sharing a connection share one remote resolver, restricted
+ * to exactly the contexts the preset names (the server still authorizes each).
+ * Every operation must name its context; there is no default and no switch.
+ */
+export declare class PresetResolver implements ContextResolver {
+    private readonly name;
+    private readonly routes;
+    constructor(name: string, routes: Route[]);
+    mode(): 'explicit';
+    resolve(contextId?: string): Promise<import("./resolvers.js").ResolvedContext>;
+    list(): Promise<{
+        mode: "explicit";
+        fixedContextId: null;
+        contexts: ContextSummary[];
+    }>;
+    close(): Promise<void>;
+}
+export declare function presetResolver(rootHome: string, config: ProfilesConfig, name: string, deps: ResolverDependencies): PresetResolver;
+/**
+ * The single entry point for the CLI and both stdio servers: selection flags
+ * and environment in, one resolver out.
+ */
+export declare function resolverForSelection(rootHome: string, config: ProfilesConfig, selection: Selection, deps: ResolverDependencies): ContextResolver;
+export declare function describeContext(context: ContextSummary): string;
+/** One line describing a profile, for list/show. Never a secret. */
+export declare function describeProfile(name: string, profile: Profile): string;
+export {};
+//# sourceMappingURL=profiles.d.ts.map

package/dist/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EAEpB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhE,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAS7C,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;kBAsBvB,CAAC;AAUL,QAAA,MAAM,kBAAkB;;;;;;kBASb,CAAC;AAEZ,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;kBAUd,CAAC;AAEZ,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;oBAAqD,CAAC;AAEhF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQtB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,YAAY,CAExE;AAED,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS7D;AAED,kEAAkE;AAClE,qBAAa,YAAY;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,YAAY,CAAC,EAAE,MAAM;IAIjC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,IAAI,cAAc;IA0BtB,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;CAIpC;AAID,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,cAAc,GACpB,SAAS,GAAG,SAAS,CAqCvB;AAiBD,wBAAgB,gBAAgB,IAAI,YAAY,CAK/C;AAID,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,GAAG,eAAe,CAK1F;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,YAAW,sBAAsB;IAK3D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,OAAO,CAAC,CAAkB;gBAEL,OAAO,EAAE,uBAAuB;IAEvD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ/B,OAAO,CAAC,WAAW;YAOL,IAAI;IAwDlB,OAAO,CAAC,QAAQ;CAKjB;AAID,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,gBAAgB,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;CAClD;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,oBAAoB,GACzB,0BAA0B,CAgB5B;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAexC;AAED,6CAA6C;AAC7C,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,oBAAoB,GACzB,eAAe,CAoBjB;AAED,UAAU,KAAK;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,cAAe,YAAW,eAAe;IAElD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,KAAK,EAAE;IAGlC,IAAI,IAAI,UAAU;IAIZ,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM;IAgB1B,IAAI;;;;;IAgBJ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAO7B;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,oBAAoB,GACzB,cAAc,CA8DhB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,oBAAoB,GACzB,eAAe,CAIjB;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAI/D;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAMtE"}