synomem 0.8.0 → 0.9.1

package/dist/oauth.js

@@ -1,35 +1,152 @@
+/**
+ * The CLI's own OAuth 2.1 client (RFC 8252 native app).
+ *
+ * Authorization code + PKCE S256 through the system browser and a loopback
+ * redirect, against the pre-registered public client `synomem-cli`. The token
+ * is audienced to the Synomem API itself: discovery starts from the API's own
+ * protected-resource metadata (RFC 9728), never from the MCP gateway, and the
+ * discovered issuer and resource are validated before any browser opens.
+ *
+ * Which agent and workspace the resulting connection may act as is chosen on
+ * the consent screen and enforced by the API; nothing here names an actor.
+ */
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
-import { discoverOAuthServerInfo, startAuthorization, } from '@modelcontextprotocol/sdk/client/auth.js';
+import { createHash, randomBytes } from 'node:crypto';
 import { SynomemError } from './errors.js';
-import { readCredentialFile } from './configure.js';
-const defaultScope = 'synomem:read synomem:write offline_access';
-function secureEndpoint(value, label) {
-    const url = new URL(value);
-    if (url.protocol !== 'https:') {
+export const DEFAULT_CLI_CLIENT_ID = 'synomem-cli';
+export const DEFAULT_CALLBACK_PORT = 43_817;
+export const DEFAULT_CLI_SCOPE = 'openid offline_access synomem:read synomem:write';
+const maximumDocumentBytes = 64 * 1024;
+/** Access tokens are treated as expired this long before they actually are. */
+const expirySafetyMs = 30_000;
+function trimSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+/** HTTPS, or loopback HTTP (development against a local stack). */
+export function secureUrl(value, label) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new SynomemError('AUTH_REQUIRED', `${label} is not a valid URL.`);
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
         throw new SynomemError('AUTH_REQUIRED', `${label} must use HTTPS.`);
     }
+    if (url.username || url.password) {
+        throw new SynomemError('AUTH_REQUIRED', `${label} must not carry credentials.`);
+    }
     return url;
 }
-async function tokenRequest(endpoint, parameters, fetchImplementation, signal) {
+async function readJson(url, fetchImplementation, label) {
     let response;
     try {
-        response = await fetchImplementation(secureEndpoint(endpoint, 'OAuth token endpoint'), {
+        response = await fetchImplementation(url, {
+            redirect: 'error',
+            headers: { accept: 'application/json' },
+        });
+    }
+    catch {
+        throw new SynomemError('REMOTE_UNAVAILABLE', `${label} is unavailable.`);
+    }
+    const text = await response.text();
+    if (Buffer.byteLength(text) > maximumDocumentBytes) {
+        throw new SynomemError('REMOTE_PROTOCOL', `${label} exceeded the safe size limit.`);
+    }
+    if (!response.ok) {
+        throw new SynomemError('REMOTE_PROTOCOL', `${label} returned HTTP ${response.status}.`);
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            throw new Error();
+        return parsed;
+    }
+    catch {
+        throw new SynomemError('REMOTE_PROTOCOL', `${label} is not valid JSON.`);
+    }
+}
+/**
+ * Where to sign in for this API, validated.
+ *
+ * The protected-resource metadata must name THIS API as its resource and at
+ * least one authorization server; the authorization server's metadata must
+ * name itself as issuer, publish HTTPS endpoints and support S256. A mismatch
+ * anywhere stops the login before a browser opens.
+ */
+export async function discoverApiAuthorization(apiUrl, fetchImplementation = fetch) {
+    const api = secureUrl(apiUrl, 'Synomem API URL');
+    const resourceMetadata = await readJson(new URL('/.well-known/oauth-protected-resource', api.origin), fetchImplementation, 'API protected-resource metadata');
+    const resource = resourceMetadata.resource;
+    if (typeof resource !== 'string' || trimSlash(resource) !== trimSlash(api.origin)) {
+        throw new SynomemError('AUTH_REQUIRED', 'The API protected-resource metadata does not describe this API.');
+    }
+    const servers = resourceMetadata.authorization_servers;
+    const issuerValue = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof issuerValue !== 'string') {
+        throw new SynomemError('AUTH_REQUIRED', 'The API names no authorization server.');
+    }
+    const issuer = secureUrl(issuerValue, 'Authorization server');
+    const asMetadata = await readJson(new URL(`/.well-known/oauth-authorization-server${issuer.pathname === '/' ? '' : trimSlash(issuer.pathname)}`, issuer.origin), fetchImplementation, 'Authorization server metadata');
+    if (typeof asMetadata.issuer !== 'string' ||
+        trimSlash(asMetadata.issuer) !== trimSlash(issuer.href)) {
+        throw new SynomemError('AUTH_REQUIRED', 'The authorization server metadata issuer does not match.');
+    }
+    const authorizationEndpoint = asMetadata.authorization_endpoint;
+    const tokenEndpoint = asMetadata.token_endpoint;
+    if (typeof authorizationEndpoint !== 'string' || typeof tokenEndpoint !== 'string') {
+        throw new SynomemError('AUTH_REQUIRED', 'Authorization server discovery is incomplete.');
+    }
+    secureUrl(authorizationEndpoint, 'OAuth authorization endpoint');
+    secureUrl(tokenEndpoint, 'OAuth token endpoint');
+    const methods = asMetadata.code_challenge_methods_supported;
+    if (!Array.isArray(methods) || !methods.includes('S256')) {
+        throw new SynomemError('AUTH_REQUIRED', 'The authorization server must support PKCE S256.');
+    }
+    return {
+        resource: trimSlash(resource),
+        issuer: trimSlash(asMetadata.issuer),
+        authorizationEndpoint,
+        tokenEndpoint,
+    };
+}
+export const TOKEN_REQUEST_TIMEOUT_MS = 20_000;
+/*
+ * Failures that prove the request never reached the server. Anything else — a
+ * timeout, a reset mid-response — may have followed a committed rotation, so
+ * the refresh token it carried must be treated as spent (plan §6: never retry
+ * a possibly consumed token; reauthorize instead).
+ */
+const NOT_SENT = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN', 'ENETUNREACH', 'EHOSTUNREACH']);
+function neverDelivered(error) {
+    const cause = error?.cause;
+    return typeof cause?.code === 'string' && NOT_SENT.has(cause.code);
+}
+async function tokenRequest(endpoint, parameters, fetchImplementation) {
+    let response;
+    try {
+        response = await fetchImplementation(secureUrl(endpoint, 'OAuth token endpoint'), {
             method: 'POST',
             redirect: 'error',
             headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
             body: parameters,
-            ...(signal ? { signal } : {}),
+            // Well inside the credential lock's stale window, so a refresh can never
+            // outlive the lock that serializes it.
+            signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
         });
     }
     catch (error) {
         if (error instanceof SynomemError)
             throw error;
-        throw new SynomemError('REMOTE_UNAVAILABLE', 'The OAuth token endpoint is unavailable.');
+        throw new SynomemError('REMOTE_UNAVAILABLE', 'The OAuth token endpoint is unavailable.', {
+            delivery: neverDelivered(error) ? 'not_sent' : 'indeterminate',
+        });
     }
     const text = await response.text();
-    if (Buffer.byteLength(text) > 64 * 1024) {
+    if (Buffer.byteLength(text) > maximumDocumentBytes) {
         throw new SynomemError('REMOTE_PROTOCOL', 'OAuth token response exceeded the safe limit.');
     }
     let parsed;
@@ -44,11 +161,16 @@ async function tokenRequest(endpoint, parameters, fetchImplementation, signal) {
     }
     return parsed;
 }
+function expiresAt(expiresIn) {
+    // A token without a lifetime is still refreshed on the API's schedule: 10
+    // minutes is the contract's maximum access-token lifetime.
+    return Date.now() + Math.max(0, (expiresIn ?? 600) * 1_000 - expirySafetyMs);
+}
 function launchBrowser(url) {
-    const command = process.platform === 'darwin' ? 'open' : 'xdg-open';
     if (process.platform !== 'darwin' && process.platform !== 'linux') {
         throw new SynomemError('CONFIG_INVALID', `Open this URL in a browser: ${url.href}`);
     }
+    const command = process.platform === 'darwin' ? 'open' : 'xdg-open';
     const child = spawn(command, [url.href], { detached: true, stdio: 'ignore' });
     child.once('error', () => undefined);
     child.unref();
@@ -67,7 +189,9 @@ async function authorizationCode(authorizationUrl, state, callbackPort, openBrow
             if (oauthError || !code || returnedState !== state) {
                 response.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
                 response.end('Synomem authorization failed. Return to your terminal.');
-                finish(new SynomemError('AUTH_REQUIRED', 'OAuth callback validation failed.'));
+                finish(new SynomemError('AUTH_REQUIRED', oauthError === 'access_denied'
+                    ? 'Authorization was declined.'
+                    : 'OAuth callback validation failed.'));
                 return;
             }
             response.writeHead(200, {
@@ -97,132 +221,78 @@ async function authorizationCode(authorizationUrl, state, callbackPort, openBrow
         });
     });
 }
+/** Runs the browser flow and returns the credential for the caller to store. */
 export async function loginWithOAuth(options) {
     const fetchImplementation = options.fetch ?? fetch;
-    const mcpUrl = new URL('/mcp', options.baseUrl);
-    const discovered = await discoverOAuthServerInfo(mcpUrl, { fetchFn: fetchImplementation });
-    const metadata = discovered.authorizationServerMetadata;
-    if (!metadata?.authorization_endpoint || !metadata.token_endpoint) {
-        throw new SynomemError('AUTH_REQUIRED', 'OAuth server discovery is incomplete.');
-    }
-    secureEndpoint(metadata.authorization_endpoint, 'OAuth authorization endpoint');
-    secureEndpoint(metadata.token_endpoint, 'OAuth token endpoint');
-    if (!metadata.code_challenge_methods_supported?.includes('S256')) {
-        throw new SynomemError('AUTH_REQUIRED', 'The OAuth server must support PKCE S256.');
-    }
-    const callbackPort = options.callbackPort ?? 43_817;
-    const redirectUrl = new URL(`http://127.0.0.1:${callbackPort}/callback`);
+    const metadata = await discoverApiAuthorization(options.apiUrl, fetchImplementation);
+    const clientId = options.clientId ?? DEFAULT_CLI_CLIENT_ID;
+    const scope = options.scope ?? DEFAULT_CLI_SCOPE;
+    const callbackPort = options.callbackPort ?? DEFAULT_CALLBACK_PORT;
+    const redirectUri = `http://127.0.0.1:${callbackPort}/callback`;
     const state = randomBytes(32).toString('base64url');
-    const resource = new URL(discovered.resourceMetadata?.resource ?? mcpUrl.href);
-    const scope = options.scope ?? defaultScope;
-    const started = await startAuthorization(discovered.authorizationServerUrl, {
-        metadata,
-        clientInformation: { client_id: options.clientId },
-        redirectUrl,
-        scope,
-        state,
-        resource,
-    });
-    const code = await authorizationCode(started.authorizationUrl, state, callbackPort, options.openBrowser ?? launchBrowser, options.timeoutMs ?? 5 * 60_000);
-    const tokens = await tokenRequest(metadata.token_endpoint, new URLSearchParams({
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const authorizationUrl = new URL(metadata.authorizationEndpoint);
+    authorizationUrl.searchParams.set('response_type', 'code');
+    authorizationUrl.searchParams.set('client_id', clientId);
+    authorizationUrl.searchParams.set('redirect_uri', redirectUri);
+    authorizationUrl.searchParams.set('scope', scope);
+    authorizationUrl.searchParams.set('state', state);
+    authorizationUrl.searchParams.set('code_challenge', challenge);
+    authorizationUrl.searchParams.set('code_challenge_method', 'S256');
+    authorizationUrl.searchParams.set('resource', metadata.resource);
+    const code = await authorizationCode(authorizationUrl, state, callbackPort, options.openBrowser ?? launchBrowser, options.timeoutMs ?? 5 * 60_000);
+    const tokens = await tokenRequest(metadata.tokenEndpoint, new URLSearchParams({
         grant_type: 'authorization_code',
-        client_id: options.clientId,
+        client_id: clientId,
         code,
-        code_verifier: started.codeVerifier,
-        redirect_uri: redirectUrl.href,
-        resource: resource.href,
+        code_verifier: verifier,
+        redirect_uri: redirectUri,
+        resource: metadata.resource,
     }), fetchImplementation);
-    await options.credentialStore.set(options.credentialReference, {
+    return {
+        kind: 'oauth',
+        issuer: metadata.issuer,
+        resource: metadata.resource,
+        clientId,
+        tokenEndpoint: metadata.tokenEndpoint,
+        scope: tokens.scope ?? scope,
         accessToken: tokens.access_token,
         ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
-        ...(tokens.expires_in
-            ? { expiresAt: Date.now() + Math.max(0, tokens.expires_in - 30) * 1_000 }
-            : {}),
-        tokenEndpoint: metadata.token_endpoint,
-        clientId: options.clientId,
-        resource: resource.href,
-        scope: tokens.scope ?? scope,
-    });
+        expiresAt: expiresAt(tokens.expires_in),
+        generation: 0,
+    };
 }
-export class StoredCredentialProvider {
-    reference;
-    store;
-    env;
-    fetchImplementation;
-    home;
-    refresh;
-    credential;
-    /** Set when the stored credential is an access key rather than an OAuth grant. */
-    staticAccessToken;
-    loaded = false;
-    constructor(reference, store, env = process.env, fetchImplementation = fetch, 
-    /**
-     * Where `synomem config`'s restricted-file credential store, if chosen,
-     * would have written an access key. Optional because local-only and
-     * environment-only callers have no such file to fall back to.
-     */
-    home) {
-        this.reference = reference;
-        this.store = store;
-        this.env = env;
-        this.fetchImplementation = fetchImplementation;
-        this.home = home;
-    }
-    async getAccessToken(signal) {
-        if (this.env.SYNOMEM_ACCESS_TOKEN)
-            return this.env.SYNOMEM_ACCESS_TOKEN;
-        if (!this.loaded) {
-            const stored = await this.store.get(this.reference);
-            /*
-             * An access key is not an OAuth credential: it cannot be refreshed and
-             * has no client or token endpoint. It is used exactly as stored,
-             * whichever of the two places it was found.
-             */
-            if (stored && 'kind' in stored) {
-                this.staticAccessToken = stored.accessToken;
-            }
-            else if (stored) {
-                this.credential = stored;
-            }
-            else if (this.home) {
-                this.staticAccessToken = readCredentialFile(this.home);
-            }
-            this.loaded = true;
-        }
-        if (this.staticAccessToken)
-            return this.staticAccessToken;
-        const credential = this.credential;
-        if (!credential)
-            return undefined;
-        if (!credential.expiresAt || credential.expiresAt > Date.now())
-            return credential.accessToken;
-        if (!credential.refreshToken)
-            return undefined;
-        this.refresh ??= this.refreshCredential(credential, signal).finally(() => {
-            this.refresh = undefined;
-        });
-        return await this.refresh;
+/**
+ * Spends the refresh token once. Callers hold the credential lock and write the
+ * result before releasing it; a failure here is never retried with the same
+ * (possibly consumed) refresh token.
+ */
+export async function refreshOAuthCredential(credential, fetchImplementation = fetch) {
+    if (!credential.refreshToken) {
+        throw new SynomemError('REAUTHORIZATION_REQUIRED', 'The stored credential cannot be refreshed.');
     }
-    async refreshCredential(credential, signal) {
-        const tokens = await tokenRequest(credential.tokenEndpoint, new URLSearchParams({
+    let tokens;
+    try {
+        tokens = await tokenRequest(credential.tokenEndpoint, new URLSearchParams({
             grant_type: 'refresh_token',
             client_id: credential.clientId,
             refresh_token: credential.refreshToken,
             resource: credential.resource,
-            scope: credential.scope,
-        }), this.fetchImplementation, signal);
-        const updated = {
-            ...credential,
-            accessToken: tokens.access_token,
-            refreshToken: tokens.refresh_token ?? credential.refreshToken,
-            ...(tokens.expires_in
-                ? { expiresAt: Date.now() + Math.max(0, tokens.expires_in - 30) * 1_000 }
-                : { expiresAt: undefined }),
-            scope: tokens.scope ?? credential.scope,
-        };
-        await this.store.set(this.reference, updated);
-        this.credential = updated;
-        return updated.accessToken;
+        }), fetchImplementation);
     }
+    catch (error) {
+        if (error instanceof SynomemError && error.code === 'REMOTE_UNAVAILABLE')
+            throw error;
+        throw new SynomemError('REAUTHORIZATION_REQUIRED', 'The stored credential was refused when refreshing.');
+    }
+    return {
+        ...credential,
+        accessToken: tokens.access_token,
+        ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
+        scope: tokens.scope ?? credential.scope,
+        expiresAt: expiresAt(tokens.expires_in),
+        generation: credential.generation + 1,
+    };
 }
 //# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,YAAY,GAAG,2CAA2C,CAAC;AASjE,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,UAA2B,EAC3B,mBAAiC,EACjC,MAAoB;IAEpB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,gBAAqB,EACrB,KAAa,EACb,YAAoB,EACpB,WAA+B,EAC/B,SAAiB;IAEjB,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBACnD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACzE,QAAQ,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,cAAc,EAAE,2BAA2B;gBAC3C,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,EACzE,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAa,EAAE,EAAE;YAC9C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACpB,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5C,IAAI,CAAC;gBACH,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA0B;IAC7D,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,UAAU,CAAC,2BAA2B,CAAC;IACxD,IAAI,CAAC,QAAQ,EAAE,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,cAAc,CAAC,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC;IAChF,cAAc,CAAC,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,YAAY,WAAW,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,sBAAsB,EAAE;QAC1E,QAAQ;QACR,iBAAiB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;QAClD,WAAW;QACX,KAAK;QACL,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC,OAAO,CAAC,gBAAgB,EACxB,KAAK,EACL,YAAY,EACZ,OAAO,CAAC,WAAW,IAAI,aAAa,EACpC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,QAAQ,CAAC,cAAc,EACvB,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI;QACJ,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,YAAY,EAAE,WAAW,CAAC,IAAI;QAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC,EACF,mBAAmB,CACpB,CAAC;IACF,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE;QAC7D,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,QAAQ,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,wBAAwB;IAQhB;IACA;IACA;IACA;IAMA;IAhBX,OAAO,CAA+B;IACtC,UAAU,CAAyB;IAC3C,kFAAkF;IAC1E,iBAAiB,CAAU;IAC3B,MAAM,GAAG,KAAK,CAAC;IAEvB,YACmB,SAAiB,EACjB,KAAsB,EACtB,MAAyB,OAAO,CAAC,GAAG,EACpC,sBAAoC,KAAK;IAC1D;;;;OAIG;IACc,IAAa;QATb,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAiB;QACtB,QAAG,GAAH,GAAG,CAAiC;QACpC,wBAAmB,GAAnB,mBAAmB,CAAsB;QAMzC,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,MAAoB;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD;;;;eAIG;YACH,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBAC/B,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC;YAC9C,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;YAC3B,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,UAAU,CAAC,WAAW,CAAC;QAC9F,IAAI,CAAC,UAAU,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACvE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,UAAiC,EACjC,MAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,UAAU,CAAC,aAAa,EACxB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,UAAU,CAAC,QAAQ;YAC9B,aAAa,EAAE,UAAU,CAAC,YAAa;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,EACF,IAAI,CAAC,mBAAmB,EACxB,MAAM,CACP,CAAC;QACF,MAAM,OAAO,GAA0B;YACrC,GAAG,UAAU;YACb,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY;YAC7D,GAAG,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE;gBACzE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;SACxC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;QAC1B,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,kDAAkD,CAAC;AACpF,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,+EAA+E;AAC/E,MAAM,cAAc,GAAG,MAAM,CAAC;AAgB9B,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAQ,EACR,mBAAiC,EACjC,KAAa;IAEb,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;YACxC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,kBAAkB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,sBAAoC,KAAK;IAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CACrC,IAAI,GAAG,CAAC,uCAAuC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5D,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;IACF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,qBAAqB,CAAC;IACvD,MAAM,WAAW,GAAY,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,IAAI,GAAG,CACL,0CAA0C,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EACrG,MAAM,CAAC,MAAM,CACd,EACD,mBAAmB,EACnB,+BAA+B,CAChC,CAAC;IACF,IACE,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACrC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAG,UAAU,CAAC,sBAAsB,CAAC;IAChE,MAAM,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC;IAChD,IAAI,OAAO,qBAAqB,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,CAAC,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;IACjE,SAAS,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,gCAAgC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;QACpC,qBAAqB;QACrB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AACpG,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,KAAK,GAAI,KAAoD,EAAE,KAAK,CAAC;IAC3E,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,UAA2B,EAC3B,mBAAiC;IAEjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,UAAU;YAChB,yEAAyE;YACzE,uCAAuC;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,0CAA0C,EAAE;YACvF,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,SAA6B;IAC9C,0EAA0E;IAC1E,2DAA2D;IAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,gBAAqB,EACrB,KAAa,EACb,YAAoB,EACpB,WAA+B,EAC/B,SAAiB;IAEjB,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBACnD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACzE,QAAQ,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;gBACvE,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,UAAU,KAAK,eAAe;oBAC5B,CAAC,CAAC,6BAA6B;oBAC/B,CAAC,CAAC,mCAAmC,CACxC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,cAAc,EAAE,2BAA2B;gBAC3C,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,EACzE,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,IAAa,EAAE,EAAE;YAC9C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;iBACpB,IAAI,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5C,IAAI,CAAC;gBACH,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAYD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA0B;IAC7D,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,WAAW,GAAG,oBAAoB,YAAY,WAAW,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACjE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC/D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC/D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEjE,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAClC,gBAAgB,EAChB,KAAK,EACL,YAAY,EACZ,OAAO,CAAC,WAAW,IAAI,aAAa,EACpC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,QAAQ,CAAC,aAAa,EACtB,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC,EACF,mBAAmB,CACpB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;QAC5B,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,UAAU,EAAE,CAAC;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAiC,EACjC,sBAAoC,KAAK;IAEzC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,0BAA0B,EAC1B,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CACzB,UAAU,CAAC,aAAa,EACxB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,UAAU,CAAC,QAAQ;YAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,EACF,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;YAAE,MAAM,KAAK,CAAC;QACtF,MAAM,IAAI,YAAY,CACpB,0BAA0B,EAC1B,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;QACvC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,UAAU,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC;KACtC,CAAC;AACJ,CAAC"}