@1claw/mcp 0.60.0 → 0.63.0

package/dist/core/server.js

@@ -0,0 +1,594 @@
+/**
+ * Server bootstrap shared by the umbrella package (`index.ts`, every
+ * toolset) and the split packages (`packages/vault`, `packages/guard`).
+ * Which toolset modules and which client class a server gets are the
+ * entrypoint's decision; nothing here imports a domain.
+ */
+import { createHash } from "node:crypto";
+import { FastMCP, UserError } from "fastmcp";
+import { z } from "zod";
+import { OneClawApiError } from "../client/error.js";
+import { inspectContentTool } from "../tools/inspect_content.js";
+import { inspectInput, inspectOutput, isSecurityEnabled, registerSecret, isSecretRedactionEnabled } from "../security/index.js";
+import { isLocalDaemonMode, createLocalClient } from "../local-client.js";
+import { proxyRequestTool } from "../tools/proxy_request.js";
+import { clientForSession, installClientFactory, resolveEntitlements, attachEntitlements, refreshEntitlementsIfStale, describeSession, } from "./session.js";
+import { installToolsets, toolsetOf, toolVisible, resolveToolsets, unknownEntitlements, TOOLSET_IDS, } from "../toolsets.js";
+/** Build, configure and start the server. Resolves once it is listening. */
+export async function startServer(cfg) {
+    installToolsets(cfg.modules);
+    installClientFactory(cfg.createClient);
+    const baseUrl = process.env.ONECLAW_BASE_URL ?? "https://api.1claw.co";
+    const transport = process.env.MCP_TRANSPORT ?? "stdio";
+    const port = parseInt(process.env.PORT ?? "8080", 10);
+    // When true, only security-inspection tools are registered (no vault credentials needed).
+    const localOnly = cfg.localOnly === true ||
+        process.env.ONECLAW_LOCAL_ONLY === "true" ||
+        process.env.ONECLAW_LOCAL_ONLY === "1";
+    /**
+     * Credential for the stdio process, read from process.env. Re-read each
+     * invocation so vault ID is not frozen at startup (C-MPC-VAULT); the client
+     * built from it is cached per distinct credential so the ocv_ exchange
+     * happens once per process, not once per call.
+     */
+    function stdioCredentialFromEnv() {
+        const vaultId = process.env.ONECLAW_VAULT_ID;
+        const agentId = process.env.ONECLAW_AGENT_ID;
+        const agentApiKey = process.env.ONECLAW_AGENT_API_KEY;
+        const token = process.env.ONECLAW_AGENT_TOKEN;
+        if (agentApiKey) {
+            return {
+                agentApiKey,
+                agentId: agentId || undefined,
+                vaultId: vaultId || undefined,
+                runtimeId: process.env.ONECLAW_RUNTIME_ID || undefined,
+            };
+        }
+        if (token) {
+            if (!vaultId) {
+                throw new UserError("ONECLAW_VAULT_ID is required when using ONECLAW_AGENT_TOKEN (static JWT).");
+            }
+            return { token, vaultId, runtimeId: process.env.ONECLAW_RUNTIME_ID || undefined };
+        }
+        throw new UserError("Authentication required. Set ONECLAW_AGENT_API_KEY or ONECLAW_AGENT_TOKEN + ONECLAW_VAULT_ID.");
+    }
+    let stdioSession;
+    /** The stdio process's session — one per distinct env credential. */
+    function stdioSessionFromEnv() {
+        const cred = stdioCredentialFromEnv();
+        const key = JSON.stringify(cred);
+        if (stdioSession && stdioSession.key === key)
+            return stdioSession.session;
+        // A changed env means a new identity; entitlements are re-resolved lazily
+        // by the TTL path. Start from the startup snapshot when there is one.
+        const ent = stdioSession?.session.entitlements ?? unknownEntitlements("failed");
+        const session = attachEntitlements(cred, ent, process.env.ONECLAW_MCP_TOOLSETS, stdioSession ? 0 : Date.now());
+        stdioSession = { key, session };
+        return session;
+    }
+    if (transport === "stdio" && !localOnly && !isLocalDaemonMode()) {
+        const agentApiKey = process.env.ONECLAW_AGENT_API_KEY;
+        const token = process.env.ONECLAW_AGENT_TOKEN;
+        if (!agentApiKey && !token) {
+            console.error("Authentication required. Set one of:\n" +
+                "  ONECLAW_AGENT_API_KEY                      (simplest, auto-discovers agent ID and vault)\n" +
+                "  ONECLAW_AGENT_ID + ONECLAW_AGENT_API_KEY   (explicit agent ID)\n" +
+                "  ONECLAW_AGENT_TOKEN + ONECLAW_VAULT_ID     (static JWT, expires)\n" +
+                "  ONECLAW_LOCAL_ONLY=true                    (security tools only, no vault needed)\n" +
+                "  ONECLAW_LOCAL_VAULT=true                   (local daemon mode, no cloud auth needed)");
+            process.exit(1);
+        }
+        if (!agentApiKey && token && !process.env.ONECLAW_VAULT_ID) {
+            console.error("ONECLAW_VAULT_ID is required when using ONECLAW_AGENT_TOKEN (static JWT).");
+            process.exit(1);
+        }
+    }
+    /** The session a tool call runs under: the hosted one, or the stdio process's. */
+    function resolveSession(session) {
+        if (session)
+            return session;
+        if (transport === "stdio" && !localOnly) {
+            return stdioSessionFromEnv();
+        }
+        throw new UserError("Not authenticated. Provide Authorization header (Bearer <ocv_api_key> or Bearer <jwt>).");
+    }
+    function resolveClient(session) {
+        return clientForSession(resolveSession(session), baseUrl);
+    }
+    const serverOpts = {
+        name: cfg.name,
+        version: cfg.version,
+        health: { enabled: true, path: "/health" },
+        instructions: cfg.instructions ??
+            "Tools are grouped into toolsets and only the toolsets this session is entitled to are listed " +
+                `(${TOOLSET_IDS.filter((t) => t !== "local" && t !== "platform").join(", ")}). ` +
+                "The vault, approvals and inspect toolsets are always on for an agent; intents, execute, cards, " +
+                "memory, channels and directory appear when the agent's flags enable them; treasury, delegation, chat, " +
+                "automations, runtimes and notification are opt-in via the X-1Claw-Toolsets header " +
+                "(or ONECLAW_MCP_TOOLSETS over stdio). Entitlements are re-checked periodically and after a 403, and " +
+                "the list is refreshed via notifications/tools/list_changed. If a tool you expect is missing, the " +
+                "agent is not entitled to it — check the agent's settings in the 1Claw dashboard.",
+    };
+    if (transport === "httpStream") {
+        // The HTTP layer (mcp-proxy) calls `authenticate` on EVERY POST, not once
+        // per MCP session, and swaps the result into the session via
+        // `updateAuth`. Without memoisation that is a key exchange + vault probe
+        // + profile GET per tool call, and a fresh SessionAuth object each time
+        // (so nothing keyed on it could ever be reused). Admissions are cached by
+        // credential for ADMISSION_TTL_MS and the *same* SessionAuth object is
+        // handed back, which is what makes the per-session client cache and the
+        // entitlement snapshot actually per session.
+        const ADMISSION_TTL_MS = 10 * 60 * 1000;
+        const ADMISSION_IDLE_MS = 60 * 60 * 1000;
+        const admissions = new Map();
+        const admissionSweep = setInterval(() => {
+            const now = Date.now();
+            for (const [k, a] of admissions)
+                if (now - a.lastSeen > ADMISSION_IDLE_MS)
+                    admissions.delete(k);
+        }, 5 * 60 * 1000);
+        if (typeof admissionSweep === "object" && "unref" in admissionSweep)
+            admissionSweep.unref();
+        const admissionKey = (...parts) => createHash("sha256").update(parts.join("\u0000")).digest("hex");
+        const authenticateUncached = async (request, existing) => {
+            const auth = (request.headers["authorization"] ?? "");
+            const credential = auth.replace(/^Bearer\s+/i, "").trim();
+            const vaultIdHeader = (request.headers["x-vault-id"] ?? "");
+            const agentIdHeader = (request.headers["x-agent-id"] ?? "");
+            const runtimeIdHeader = (request.headers["x-1claw-runtime-id"] ??
+                request.headers["X-1Claw-Runtime-Id"] ??
+                "");
+            const toolsetHeader = (request.headers["x-1claw-toolsets"] ?? "");
+            // Resolve entitlements once, at admission. `canAccess` on every tool
+            // reads the snapshot synchronously; the TTL/403 paths refresh it.
+            // A re-validation of a cached admission keeps the existing object.
+            const admit = async (cred) => {
+                if (existing)
+                    return existing;
+                const client = clientForSession(cred, baseUrl);
+                const ent = await resolveEntitlements(client, {
+                    warn: (m) => console.warn(`[1claw-mcp] ${m}`),
+                });
+                const session = attachEntitlements(cred, ent, toolsetHeader || undefined);
+                console.log(`[1claw-mcp] session admitted: ${describeSession(session)}`);
+                return session;
+            };
+            const runtimeIdFromJwtPayload = (token) => {
+                try {
+                    const parts = token.split(".");
+                    if (parts.length !== 3)
+                        return undefined;
+                    const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString());
+                    return typeof payload.runtime_id === "string" &&
+                        payload.runtime_id.length > 0
+                        ? payload.runtime_id
+                        : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            };
+            const vaultAuthHeaders = (token, runtimeId) => {
+                const headers = {
+                    Authorization: `Bearer ${token}`,
+                };
+                if (runtimeId) {
+                    headers["X-1Claw-Runtime-Id"] = runtimeId;
+                }
+                return headers;
+            };
+            if (!credential)
+                throw new Error("Missing Authorization header (Bearer <ocv_api_key> or Bearer <jwt>)");
+            // SEC-005: Only accept agent API keys (ocv_). Reject human and platform keys.
+            if (credential.startsWith("1ck_")) {
+                throw new Error("MCP server only accepts agent API keys (ocv_). Human API keys (1ck_) should use the SDK or dashboard.");
+            }
+            if (credential.startsWith("plt_")) {
+                throw new Error("MCP server only accepts agent API keys (ocv_). Platform API keys (plt_) should use the SDK.");
+            }
+            // ── API key path: exchange for JWT, auto-discover vault ──
+            if (credential.startsWith("ocv_")) {
+                const body = { api_key: credential };
+                if (agentIdHeader)
+                    body.agent_id = agentIdHeader;
+                const tokenRes = await fetch(`${baseUrl}/v1/auth/agent-token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify(body),
+                });
+                if (!tokenRes.ok) {
+                    const status = tokenRes.status;
+                    let detail = `HTTP ${status}`;
+                    try {
+                        const errBody = await tokenRes.json();
+                        if (errBody.detail)
+                            detail = errBody.detail;
+                    }
+                    catch { /* use default */ }
+                    throw new Error(`Agent API key auth failed: ${detail}`);
+                }
+                const data = await tokenRes.json();
+                const resolvedVaultId = vaultIdHeader ||
+                    (data.vault_ids && data.vault_ids.length === 1
+                        ? data.vault_ids[0]
+                        : "");
+                if (resolvedVaultId && data.access_token) {
+                    const checkRes = await fetch(`${baseUrl}/v1/vaults/${resolvedVaultId}`, {
+                        headers: vaultAuthHeaders(data.access_token, runtimeIdHeader || undefined),
+                    });
+                    if (!checkRes.ok && checkRes.status === 404) {
+                        throw new Error(`Vault ${resolvedVaultId} not found`);
+                    }
+                }
+                return admit({
+                    agentApiKey: credential,
+                    agentId: data.agent_id || agentIdHeader || undefined,
+                    vaultId: resolvedVaultId || undefined,
+                    runtimeId: runtimeIdHeader || undefined,
+                });
+            }
+            // ── JWT path (legacy): static token, requires X-Vault-ID ──
+            if (!vaultIdHeader)
+                throw new Error("Missing X-Vault-ID header (required when using a JWT; use an ocv_ API key instead for auto-discovery)");
+            // SEC-005: Verify the JWT belongs to an agent (sub starts with "agent:")
+            try {
+                const parts = credential.split(".");
+                if (parts.length === 3) {
+                    const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString());
+                    if (payload.sub && typeof payload.sub === "string" && !payload.sub.startsWith("agent:")) {
+                        throw new Error("MCP server only accepts agent JWTs. This token belongs to a non-agent principal.");
+                    }
+                }
+            }
+            catch (e) {
+                if (e instanceof Error && e.message.includes("MCP server only accepts"))
+                    throw e;
+            }
+            // H-9: Validate token against the vault API (not just pass-through).
+            const runtimeId = runtimeIdHeader || runtimeIdFromJwtPayload(credential) || undefined;
+            const validationRes = await fetch(`${baseUrl}/v1/vaults/${vaultIdHeader}`, {
+                headers: vaultAuthHeaders(credential, runtimeId),
+            });
+            if (!validationRes.ok) {
+                const status = validationRes.status;
+                if (status === 401) {
+                    throw new Error("Invalid or expired Bearer token");
+                }
+                if (status === 403) {
+                    throw new Error("X-Vault-ID is not accessible with this token (vault binding mismatch)");
+                }
+                if (status === 404) {
+                    throw new Error(`Vault ${vaultIdHeader} not found`);
+                }
+                throw new Error(`Token validation failed (HTTP ${status})`);
+            }
+            return admit({ token: credential, vaultId: vaultIdHeader, runtimeId });
+        };
+        serverOpts.authenticate = async (request) => {
+            const h = (name) => (request.headers[name] ?? "");
+            const key = admissionKey(h("authorization"), h("x-vault-id"), h("x-agent-id"), h("x-1claw-runtime-id"), h("x-1claw-toolsets"));
+            const now = Date.now();
+            const hit = admissions.get(key);
+            if (hit && now - hit.validatedAt < ADMISSION_TTL_MS) {
+                hit.lastSeen = now;
+                return hit.session;
+            }
+            try {
+                // Past the TTL the credential is proven again (exchange + vault
+                // probe) but the session object — client, entitlements — survives.
+                const session = await authenticateUncached(request, hit?.session);
+                admissions.set(key, { session, validatedAt: now, lastSeen: now });
+                return session;
+            }
+            catch (err) {
+                admissions.delete(key);
+                throw err;
+            }
+        };
+    }
+    const server = new FastMCP(serverOpts);
+    // ── Session admission for stdio ─────────────────────
+    // Hosted sessions are filtered per session via `canAccess`; stdio has no
+    // auth object for FastMCP to filter on, so the toolset is decided once here
+    // and only the visible tools are registered. Restart to pick up flag changes.
+    let stdioVisible;
+    if (transport === "stdio" && !localOnly && !isLocalDaemonMode()) {
+        const session = stdioSessionFromEnv();
+        const ent = await resolveEntitlements(clientForSession(session, baseUrl), {
+            warn: (m) => console.error(`[1claw-mcp] ${m}`),
+        });
+        attachEntitlements(session, ent, process.env.ONECLAW_MCP_TOOLSETS);
+        console.error(`[1claw-mcp] ${describeSession(session)}`);
+        stdioVisible = (name) => toolVisible(name, session.toolsets, session.entitlements);
+    }
+    /** Every tool handed to `server.addTool`, in order — needed to re-filter a session. */
+    const registeredTools = [];
+    function addTool(tool) {
+        registeredTools.push(tool);
+        server.addTool(tool);
+    }
+    /** Toolset selection for a session that somehow reached a tool without one. */
+    function sessionToolsets(auth) {
+        if (auth.toolsets && auth.entitlements)
+            return { toolsets: auth.toolsets, entitlements: auth.entitlements };
+        const entitlements = unknownEntitlements("failed");
+        return { toolsets: resolveToolsets(entitlements), entitlements };
+    }
+    /**
+     * Tell one session its tool list changed. FastMCP re-applies `canAccess`
+     * against the session's (now mutated) auth and sends
+     * `notifications/tools/list_changed`. Falls back to a server-wide
+     * rebroadcast when the session can't be found.
+     */
+    function notifyToolsChanged(sessionId) {
+        const target = sessionId
+            ? server.sessions.find((s) => s.sessionId === sessionId)
+            : undefined;
+        if (target) {
+            target.toolsListChanged(registeredTools);
+        }
+        else {
+            // No-op removal: FastMCP re-filters every session and notifies each.
+            server.removeTool("__entitlements_refresh__");
+        }
+    }
+    /**
+     * Re-resolve a session's entitlements when stale (or forced after a 403).
+     * Returns true when the visible tool list changed, having already notified.
+     */
+    async function refreshSession(session, sessionId, force, log) {
+        const changed = await refreshEntitlementsIfStale(session, clientForSession(session, baseUrl), {
+            force,
+            warn: (m) => log(`[1claw-mcp] ${m}`),
+        });
+        if (changed) {
+            log(`[1claw-mcp] entitlements changed: ${describeSession(session)}`);
+            if (transport === "httpStream")
+                notifyToolsChanged(sessionId);
+        }
+        return changed;
+    }
+    function registerTool(factory) {
+        const proto = factory(cfg.createClient({ baseUrl, token: "", vaultId: "" }));
+        // Fails loudly for a tool nobody assigned to a toolset.
+        toolsetOf(proto.name);
+        if (stdioVisible && !stdioVisible(proto.name))
+            return;
+        addTool({
+            name: proto.name,
+            description: proto.description,
+            parameters: proto.parameters,
+            canAccess: (auth) => {
+                const { toolsets, entitlements } = sessionToolsets(auth);
+                return toolVisible(proto.name, toolsets, entitlements);
+            },
+            execute: async (args, context) => {
+                const session = resolveSession(context.session);
+                // Hosted sessions outlive the flags they were admitted with.
+                await refreshSession(session, context.sessionId, false, context.log.warn);
+                if (!toolVisible(proto.name, session.toolsets, session.entitlements)) {
+                    throw new UserError(`Tool '${proto.name}' is not available to this session (toolset ` +
+                        `'${toolsetOf(proto.name)}' not entitled). Refresh the tool list.`);
+                }
+                // SEC-004: secret matching is scoped per agent so two agents on one
+                // vault never share a redaction bucket. Vault-scoped is the
+                // degraded state, logged so it is visible.
+                const sessionScope = session.entitlements.agentId ??
+                    ("agentId" in session ? session.agentId : undefined) ??
+                    session.vaultId;
+                if (sessionScope && sessionScope === session.vaultId && !session.entitlements.agentId) {
+                    context.log.warn(`[1claw-mcp] secret scope degraded to vault ${session.vaultId}: agent id unknown`);
+                }
+                // Security inspection of input
+                if (isSecurityEnabled()) {
+                    const inputCheck = inspectInput(proto.name, args, sessionScope);
+                    if (!inputCheck.passed) {
+                        const threat = inputCheck.threats[0];
+                        context.log.info(`[SECURITY] Blocked ${proto.name}: ${threat?.type} (${threat?.pattern})`);
+                        throw new UserError(`Security check failed: ${threat?.type} detected`);
+                    }
+                    if (inputCheck.threats.length > 0) {
+                        context.log.info(`[SECURITY] Warnings for ${proto.name}: ${inputCheck.threats.map(t => t.pattern).join(", ")}`);
+                    }
+                }
+                const client = clientForSession(session, baseUrl);
+                const tool = factory(client);
+                let result;
+                try {
+                    result = await tool.execute(args, context);
+                }
+                catch (err) {
+                    // The vault said no to something we thought was entitled:
+                    // re-resolve now rather than waiting out the TTL.
+                    if (err instanceof OneClawApiError && err.status === 403) {
+                        await refreshSession(session, context.sessionId, true, context.log.warn).catch(() => false);
+                    }
+                    throw err;
+                }
+                // Track secret values for redaction and exfiltration protection
+                if (isSecretRedactionEnabled()) {
+                    if (proto.name === "get_secret") {
+                        try {
+                            const parsed = JSON.parse(result);
+                            if (parsed.value && parsed.path)
+                                registerSecret(parsed.path, parsed.value, sessionScope);
+                        }
+                        catch { /* not JSON — skip */ }
+                    }
+                    if (proto.name === "get_env_bundle") {
+                        try {
+                            const env = JSON.parse(result);
+                            for (const [key, val] of Object.entries(env)) {
+                                if (typeof val === "string")
+                                    registerSecret(`env:${key}`, val, sessionScope);
+                            }
+                        }
+                        catch { /* not JSON — skip */ }
+                    }
+                    if (proto.name === "resolve_env") {
+                        try {
+                            const parsed = JSON.parse(result);
+                            for (const [key, val] of Object.entries(parsed.vars ?? {})) {
+                                if (typeof val === "string")
+                                    registerSecret(`env:${key}`, val, sessionScope);
+                            }
+                        }
+                        catch { /* not JSON — skip */ }
+                    }
+                }
+                // Security inspection of output (redacts secrets, detects PII, logs threats)
+                if (isSecurityEnabled()) {
+                    const outputCheck = inspectOutput(proto.name, result, sessionScope);
+                    if (outputCheck.threats.length > 0) {
+                        context.log.info(`[SECURITY] Output warnings for ${proto.name}: ${outputCheck.threats.map(t => t.pattern).join(", ")}`);
+                    }
+                    if (outputCheck.redacted) {
+                        context.log.info(`[SECURITY] Redacted secret values from ${proto.name} output`);
+                        return outputCheck.redacted;
+                    }
+                }
+                return result;
+            },
+        });
+    }
+    // ── Security-only tools (always available, including local-only mode) ─
+    {
+        const tool = inspectContentTool();
+        toolsetOf(tool.name);
+        addTool({
+            name: tool.name,
+            description: tool.description,
+            parameters: tool.parameters,
+            execute: async (args, context) => {
+                return tool.execute(args, context);
+            },
+        });
+    }
+    // ── Local daemon tools (available when ONECLAW_LOCAL_VAULT=true) ──
+    if (isLocalDaemonMode()) {
+        const localClient = createLocalClient();
+        const proxyTool = proxyRequestTool(localClient);
+        server.addTool({
+            name: proxyTool.name,
+            description: proxyTool.description,
+            parameters: proxyTool.parameters,
+            execute: async (args, context) => {
+                return proxyTool.execute(args, context);
+            },
+        });
+        // In local mode, list_secrets uses the daemon (shows names only, no values)
+        server.addTool({
+            name: "list_secrets",
+            description: "List secret names in the local vault. Values are never exposed. " +
+                "Use proxy_request to make API calls with secrets injected.",
+            parameters: z.object({}),
+            execute: async (_args, { log }) => {
+                const result = await localClient.listSecrets();
+                log.info(`Listed ${result.secrets.length} local secrets`);
+                return JSON.stringify(result.secrets);
+            },
+        });
+    }
+    // ── Vault tools (require credentials — skipped in local-only mode) ─
+    // Each toolset module under src/toolsets/ owns its tool list; registration
+    // walks them in order. `canAccess` / the stdio filter decide visibility.
+    if (!localOnly && !isLocalDaemonMode()) {
+        for (const module of cfg.modules) {
+            for (const factory of module.tools)
+                registerTool(factory);
+        }
+    }
+    // ── Resource: browsable secret listing ───────────────
+    if (!localOnly) {
+        server.addResource({
+            uri: "vault://secrets",
+            name: "Vault secrets",
+            description: "Browsable listing of all secret paths in the configured vault (metadata only, no values).",
+            mimeType: "application/json",
+            async load(auth) {
+                // Same gate as list_secrets: resources are not filtered by canAccess.
+                const session = resolveSession(auth);
+                if (!toolVisible("list_secrets", session.toolsets, session.entitlements)) {
+                    throw new UserError("vault://secrets is not available to this session (vault toolset not entitled).");
+                }
+                const client = resolveClient(auth);
+                const data = await client.listSecrets();
+                return {
+                    text: JSON.stringify(data.secrets.map((s) => ({
+                        path: s.path,
+                        type: s.type,
+                        version: s.version,
+                        expires_at: s.expires_at,
+                    })), null, 2),
+                };
+            },
+        });
+    } // end if (!localOnly) — resource
+    // ── Rate limiting (httpStream only) ──────────────────
+    if (transport === "httpStream") {
+        const RATE_LIMIT_WINDOW_MS = 60_000;
+        const RATE_LIMIT_MAX = 60;
+        const hits = new Map();
+        // Periodic sweep to prevent unbounded growth
+        const sweepTimer = setInterval(() => {
+            const now = Date.now();
+            for (const [ip, bucket] of hits) {
+                if (now >= bucket.resetAt)
+                    hits.delete(ip);
+            }
+        }, RATE_LIMIT_WINDOW_MS);
+        if (typeof sweepTimer === "object" && "unref" in sweepTimer) {
+            sweepTimer.unref();
+        }
+        const app = server.getApp();
+        app.get("/.well-known/oauth-protected-resource", (c) => {
+            const resource = process.env.ONECLAW_MCP_RESOURCE_URL ??
+                `${process.env.ONECLAW_PUBLIC_MCP_URL ?? "https://mcp.1claw.co"}/mcp`;
+            return c.json({
+                resource,
+                authorization_servers: [
+                    process.env.ONECLAW_BASE_URL ?? "https://api.1claw.co",
+                ],
+                bearer_methods_supported: ["header"],
+                scopes_supported: ["openid", "profile", "email"],
+            });
+        });
+        app.use("*", async (c, next) => {
+            // L2: Use rightmost XFF entry (closest to the trusted edge proxy)
+            const xff = c.req.header("x-forwarded-for");
+            const ip = (xff ? xff.split(",").pop()?.trim() : undefined) ||
+                c.req.header("x-real-ip") ||
+                "unknown";
+            const now = Date.now();
+            let bucket = hits.get(ip);
+            if (!bucket || now >= bucket.resetAt) {
+                bucket = { count: 0, resetAt: now + RATE_LIMIT_WINDOW_MS };
+                hits.set(ip, bucket);
+            }
+            bucket.count++;
+            c.header("RateLimit-Limit", String(RATE_LIMIT_MAX));
+            c.header("RateLimit-Remaining", String(Math.max(0, RATE_LIMIT_MAX - bucket.count)));
+            c.header("RateLimit-Reset", String(Math.ceil(bucket.resetAt / 1000)));
+            if (bucket.count > RATE_LIMIT_MAX) {
+                return c.json({ error: "Too many requests, please try again later." }, 429);
+            }
+            await next();
+        });
+    }
+    // ── Start ────────────────────────────────────────────
+    if (transport === "httpStream") {
+        await server.start({
+            transportType: "httpStream",
+            httpStream: { port, host: process.env.ONECLAW_MCP_HOST ?? "0.0.0.0" },
+        });
+        console.log(`${cfg.name} MCP server listening on port ${port} (HTTP streaming)${localOnly ? " [local-only mode]" : ""}`);
+    }
+    else {
+        await server.start({ transportType: "stdio" });
+        if (localOnly) {
+            console.error(`${cfg.name} MCP server started in local-only mode (security tools only, no vault credentials required)`);
+        }
+    }
+    return { server };
+}
+//# sourceMappingURL=server.js.map

package/dist/core/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/core/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAkC,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChI,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAIH,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAIH,eAAe,EACf,SAAS,EACT,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,GACd,MAAM,gBAAgB,CAAC;AAgBxB,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAiB;IACnD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,sBAAsB,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;IAEtD,0FAA0F;IAC1F,MAAM,SAAS,GACX,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM;QACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;IAE3C;;;;;OAKG;IACH,SAAS,sBAAsB;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAE9C,IAAI,WAAW,EAAE,CAAC;YACd,OAAO;gBACH,WAAW;gBACX,OAAO,EAAE,OAAO,IAAI,SAAS;gBAC7B,OAAO,EAAE,OAAO,IAAI,SAAS;gBAC7B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS;aACzD,CAAC;QACN,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,MAAM,IAAI,SAAS,CACf,2EAA2E,CAC9E,CAAC;YACN,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,SAAS,CACf,+FAA+F,CAClG,CAAC;IACN,CAAC;IAED,IAAI,YAA+D,CAAC;IAEpE,qEAAqE;IACrE,SAAS,mBAAmB;QACxB,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,YAAY,CAAC,OAAO,CAAC;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,GAAG,GAAG,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/G,YAAY,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CACT,wCAAwC;gBACpC,8FAA8F;gBAC9F,oEAAoE;gBACpE,sEAAsE;gBACtE,uFAAuF;gBACvF,wFAAwF,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACT,2EAA2E,CAC9E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,SAAS,cAAc,CAAC,OAAqB;QACzC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,OAAO,mBAAmB,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,SAAS,CACf,yFAAyF,CAC5F,CAAC;IACN,CAAC;IAED,SAAS,aAAa,CAAC,OAAqB;QACxC,OAAO,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAMD,MAAM,UAAU,GAAe;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAA0C;QACvD,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1C,YAAY,EAAE,GAAG,CAAC,YAAY;YAC1B,+FAA+F;gBAC/F,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAChF,iGAAiG;gBACjG,wGAAwG;gBACxG,oFAAoF;gBACpF,sGAAsG;gBACtG,mGAAmG;gBACnG,kFAAkF;KACzF,CAAC;IAEF,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC7B,0EAA0E;QAC1E,6DAA6D;QAC7D,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAEzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;QAChD,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU;gBAAE,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,GAAG,iBAAiB;oBAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAClB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,OAAO,IAAI,cAAc;YAAE,cAAc,CAAC,KAAK,EAAE,CAAC;QAE5F,MAAM,YAAY,GAAG,CAAC,GAAG,KAAe,EAAU,EAAE,CAChD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpE,MAAM,oBAAoB,GAAG,KAAK,EAC9B,OAA6B,EAC7B,QAAsB,EACF,EAAE;YACtB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAW,CAAC;YAChE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAW,CAAC;YACtE,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAW,CAAC;YACtE,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBAC1D,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBACrC,EAAE,CAAW,CAAC;YAClB,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAW,CAAC;YAE5E,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAuB,EAAwB,EAAE;gBAClE,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE;oBAC1C,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;iBAChD,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,IAAI,SAAS,CAAC,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,iCAAiC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACzE,OAAO,OAAO,CAAC;YACnB,CAAC,CAAC;YAEF,MAAM,uBAAuB,GAAG,CAAC,KAAa,EAAsB,EAAE;gBAClE,IAAI,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,SAAS,CAAC;oBACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACtB,MAAM,CAAC,IAAI,CACP,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAC9C,QAAQ,CACX,CAAC,QAAQ,EAAE,CACY,CAAC;oBAC7B,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;wBACzC,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;wBAC7B,CAAC,CAAC,OAAO,CAAC,UAAU;wBACpB,CAAC,CAAC,SAAS,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACL,OAAO,SAAS,CAAC;gBACrB,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,gBAAgB,GAAG,CACrB,KAAa,EACb,SAAkB,EACI,EAAE;gBACxB,MAAM,OAAO,GAA2B;oBACpC,aAAa,EAAE,UAAU,KAAK,EAAE;iBACnC,CAAC;gBACF,IAAI,SAAS,EAAE,CAAC;oBACZ,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;gBAC9C,CAAC;gBACD,OAAO,OAAO,CAAC;YACnB,CAAC,CAAC;YAEF,IAAI,CAAC,UAAU;gBACX,MAAM,IAAI,KAAK,CACX,qEAAqE,CACxE,CAAC;YAEN,8EAA8E;YAC9E,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACX,uGAAuG,CAC1G,CAAC;YACN,CAAC;YACD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACX,6FAA6F,CAChG,CAAC;YACN,CAAC;YAED,4DAA4D;YAC5D,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,GAA2B,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;gBAC7D,IAAI,aAAa;oBAAE,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;gBAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,sBAAsB,EAAE;oBAC3D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC7B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAC/B,IAAI,MAAM,GAAG,QAAQ,MAAM,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;wBAC7D,IAAI,OAAO,CAAC,MAAM;4BAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBAChD,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAI/B,CAAC;gBAEF,MAAM,eAAe,GACjB,aAAa;oBACb,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;wBAC1C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;wBACnB,CAAC,CAAC,EAAE,CAAC,CAAC;gBAEd,IAAI,eAAe,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CACxB,GAAG,OAAO,cAAc,eAAe,EAAE,EACzC;wBACI,OAAO,EAAE,gBAAgB,CACrB,IAAI,CAAC,YAAY,EACjB,eAAe,IAAI,SAAS,CAC/B;qBACJ,CACJ,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CAAC,SAAS,eAAe,YAAY,CAAC,CAAC;oBAC1D,CAAC;gBACL,CAAC;gBAED,OAAO,KAAK,CAAC;oBACT,WAAW,EAAE,UAAU;oBACvB,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,aAAa,IAAI,SAAS;oBACpD,OAAO,EAAE,eAAe,IAAI,SAAS;oBACrC,SAAS,EAAE,eAAe,IAAI,SAAS;iBAC1C,CAAC,CAAC;YACP,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,aAAa;gBACd,MAAM,IAAI,KAAK,CACX,uGAAuG,CAC1G,CAAC;YAEN,yEAAyE;YACzE,IAAI,CAAC;gBACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACnF,CAAC;oBACF,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACtF,MAAM,IAAI,KAAK,CACX,kFAAkF,CACrF,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;oBAAE,MAAM,CAAC,CAAC;YACrF,CAAC;YAED,qEAAqE;YACrE,MAAM,SAAS,GACX,eAAe,IAAI,uBAAuB,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,aAAa,EAAE,EAAE;gBACvE,OAAO,EAAE,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;gBACpC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACX,uEAAuE,CAC1E,CAAC;gBACN,CAAC;gBACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,SAAS,aAAa,YAAY,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,IAAI,KAAK,CACX,iCAAiC,MAAM,GAAG,CAC7C,CAAC;YACN,CAAC;YAED,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;QAEF,UAAU,CAAC,YAAY,GAAG,KAAK,EAAE,OAA6B,EAAwB,EAAE;YACpF,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAY,CAAC;YACtE,MAAM,GAAG,GAAG,YAAY,CACpB,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,CACvG,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,WAAW,GAAG,gBAAgB,EAAE,CAAC;gBAClD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;gBACnB,OAAO,GAAG,CAAC,OAAO,CAAC;YACvB,CAAC;YACD,IAAI,CAAC;gBACD,gEAAgE;gBAChE,mEAAmE;gBACnE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAc,UAAU,CAAC,CAAC;IAEpD,uDAAuD;IACvD,yEAAyE;IACzE,4EAA4E;IAC5E,8EAA8E;IAE9E,IAAI,YAAqD,CAAC;IAC1D,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;YACtE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,eAAe,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,YAAY,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,CAAC;IAED,uFAAuF;IACvF,MAAM,eAAe,GAAwB,EAAE,CAAC;IAEhD,SAAS,OAAO,CAA2B,IAA0B;QACjE,eAAe,CAAC,IAAI,CAAC,IAAoC,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,+EAA+E;IAC/E,SAAS,eAAe,CAAC,IAAiB;QACtC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5G,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,SAAS,kBAAkB,CAAC,SAAkB;QAC1C,MAAM,MAAM,GAAG,SAAS;YACpB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACJ,qEAAqE;YACrE,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,cAAc,CACzB,OAAoB,EACpB,SAA6B,EAC7B,KAAc,EACd,GAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;YAC1F,KAAK;YACL,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACV,GAAG,CAAC,qCAAqC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,SAAS,KAAK,YAAY;gBAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAaD,SAAS,YAAY,CAAC,OAAuB;QACzC,MAAM,KAAK,GAAG,OAAO,CACjB,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CACxD,CAAC;QACF,wDAAwD;QACxD,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO;QAEtD,OAAO,CAAC;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,CAAC,IAAiB,EAAE,EAAE;gBAC7B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;gBACzD,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,EAAE,KAAK,EACV,IAA6B,EAC7B,OAIC,EACH,EAAE;gBACA,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAEhD,6DAA6D;gBAC7D,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1E,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,SAAS,CACf,SAAS,KAAK,CAAC,IAAI,8CAA8C;wBAC7D,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,yCAAyC,CACzE,CAAC;gBACN,CAAC;gBAED,oEAAoE;gBACpE,4DAA4D;gBAC5D,2CAA2C;gBAC3C,MAAM,YAAY,GACd,OAAO,CAAC,YAAY,CAAC,OAAO;oBAC5B,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;oBACpD,OAAO,CAAC,OAAO,CAAC;gBACpB,IAAI,YAAY,IAAI,YAAY,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBACpF,OAAO,CAAC,GAAG,CAAC,IAAI,CACZ,8CAA8C,OAAO,CAAC,OAAO,oBAAoB,CACpF,CAAC;gBACN,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,iBAAiB,EAAE,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;oBAChE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;wBACrB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;wBACrC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,IAAI,KAAK,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;wBAC3F,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,EAAE,IAAI,WAAW,CAAC,CAAC;oBAC3E,CAAC;oBACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACpH,CAAC;gBACL,CAAC;gBAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACD,MAAM,GAAG,MACL,IAAI,CAAC,OACR,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACrB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,0DAA0D;oBAC1D,kDAAkD;oBAClD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACvD,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;oBAChG,CAAC;oBACD,MAAM,GAAG,CAAC;gBACd,CAAC;gBAED,gEAAgE;gBAChE,IAAI,wBAAwB,EAAE,EAAE,CAAC;oBAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;4BAClC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI;gCAAE,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;wBAC7F,CAAC;wBAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;oBACrC,CAAC;oBACD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBAClC,IAAI,CAAC;4BACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;4BAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;oCAAE,cAAc,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;4BACjF,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;oBACrC,CAAC;oBACD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAC/B,IAAI,CAAC;4BACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAuC,CAAC;4BACxE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gCACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;oCAAE,cAAc,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;4BACjF,CAAC;wBACL,CAAC;wBAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;oBACrC,CAAC;gBACL,CAAC;gBAED,6EAA6E;gBAC7E,IAAI,iBAAiB,EAAE,EAAE,CAAC;oBACtB,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;oBACpE,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC5H,CAAC;oBACD,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC;wBAChF,OAAO,WAAW,CAAC,QAAQ,CAAC;oBAChC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,CAAC;YAClB,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAED,yEAAyE;IAEzE,CAAC;QACG,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,CAAC;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,KAAK,EACV,IAA6B,EAC7B,OAAwE,EAC1E,EAAE;gBACA,OAAQ,IAAI,CAAC,OAAuD,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxF,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAED,qEAAqE;IAErE,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,OAAO,EAAE,KAAK,EACV,IAA6B,EAC7B,OAAwE,EAC1E,EAAE;gBACA,OAAQ,SAAS,CAAC,OAAuD,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7F,CAAC;SACJ,CAAC,CAAC;QAEH,4EAA4E;QAC5E,MAAM,CAAC,OAAO,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,WAAW,EACP,kEAAkE;gBAClE,4DAA4D;YAChE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,EACV,KAA8B,EAC9B,EAAE,GAAG,EAA4C,EACnD,EAAE;gBACA,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC/C,GAAG,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC;gBAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IAEzE,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK;gBAAE,YAAY,CAAC,OAAyB,CAAC,CAAC;QAChF,CAAC;IACL,CAAC;IAGD,wDAAwD;IAExD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,CAAC,WAAW,CAAC;YACf,GAAG,EAAE,iBAAiB;YACtB,IAAI,EAAE,eAAe;YACrB,WAAW,EACP,2FAA2F;YAC/F,QAAQ,EAAE,kBAAkB;YAC5B,KAAK,CAAC,IAAI,CAAC,IAAkB;gBACzB,sEAAsE;gBACtE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBACvE,MAAM,IAAI,SAAS,CAAC,gFAAgF,CAAC,CAAC;gBAC1G,CAAC;gBACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO;oBACH,IAAI,EAAE,IAAI,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACrB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;qBAC3B,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACJ;iBACJ,CAAC;YACN,CAAC;SACJ,CAAC,CAAC;IACH,CAAC,CAAC,iCAAiC;IAEnC,wDAAwD;IAExD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,oBAAoB,GAAG,MAAM,CAAC;QACpC,MAAM,cAAc,GAAG,EAAE,CAAC;QAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;QAEnE,6CAA6C;QAC7C,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC9B,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,CAAC;QACL,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACzB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1D,UAAU,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAE5B,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE;YACnD,MAAM,QAAQ,GACV,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBACpC,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,sBAAsB,MAAM,CAAC;YAC1E,OAAO,CAAC,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,qBAAqB,EAAE;oBACnB,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,sBAAsB;iBACzD;gBACD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;gBACpC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;aACnD,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,kEAAkE;YAClE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,EAAE,GACJ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;gBACzB,SAAS,CAAC;YAEd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;gBAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,CAAC;YAEf,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpF,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEtE,IAAI,MAAM,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACP,CAAC;IAGD,wDAAwD;IAExD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,KAAK,CAAC;YACf,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS,EAAE;SACxE,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,iCAAiC,IAAI,oBAAoB,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACJ,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,6FAA6F,CAAC,CAAC;QAC5H,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,CAAC"}