@adcp/sdk 5.23.0

package/dist/lib/auth/oauth/diagnose.js

@@ -0,0 +1,630 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_DIAGNOSIS_SCHEMA_VERSION = void 0;
+exports.runAuthDiagnosis = runAuthDiagnosis;
+/**
+ * `adcp diagnose-auth` — structured OAuth handshake diagnostics.
+ *
+ * Performs an end-to-end trace of the OAuth flow for a single MCP agent and
+ * emits a structured {@link AuthDiagnosisReport} with wire-level HTTP captures,
+ * decoded token claims, and ranked hypotheses about what might be wrong.
+ *
+ * Designed for incident diagnosis, not continuous monitoring — each run does
+ * a full round-trip including (optionally) a token refresh and a `tools/call`
+ * attempt, so don't call this in a tight loop.
+ *
+ * The runner is decoupled from the CLI so library consumers can invoke it
+ * programmatically (e.g. from a monitoring agent or a test-controller fixture)
+ * and render their own output.
+ */
+const net_1 = require("../../net");
+const diagnostics_1 = require("./diagnostics");
+/**
+ * Report schema version. Bumped when breaking changes to the shape of
+ * {@link AuthDiagnosisReport} land. Dashboards and downstream consumers should
+ * check this before relying on specific fields.
+ */
+exports.AUTH_DIAGNOSIS_SCHEMA_VERSION = 1;
+/**
+ * Run the full diagnosis. Pass an agent config with (optionally) saved
+ * `oauth_tokens` to exercise a realistic handshake. Returns a structured
+ * report — rendering is the caller's job (CLI renders a text summary;
+ * programmatic consumers typically serialize to JSON).
+ */
+async function runAuthDiagnosis(agent, options = {}) {
+    const steps = [];
+    const agentUrl = agent.agent_uri;
+    const allowPrivateIp = options.allowPrivateIp ?? false;
+    const includeTokens = options.includeTokens ?? false;
+    // Per-invocation RPC id counter so concurrent `runAuthDiagnosis` calls don't share state.
+    let rpcId = 0;
+    const nextRpcId = () => ++rpcId;
+    // Step 1: protected-resource metadata (RFC 9728)
+    const prmCapture = await probeProtectedResourceMetadata(agentUrl, allowPrivateIp, options.timeoutMs);
+    steps.push({ name: 'probe_protected_resource_metadata', http: prmCapture });
+    // Step 2: authorization-server metadata (RFC 8414) — derives issuer from PRM
+    const asCapture = await probeAuthorizationServerMetadata(prmCapture, allowPrivateIp, options.timeoutMs);
+    steps.push({ name: 'probe_authorization_server_metadata', http: asCapture });
+    // Step 3: decode the current access token (if saved)
+    const currentToken = agent.oauth_tokens?.access_token;
+    const currentDecoded = currentToken ? (0, diagnostics_1.decodeAccessTokenClaims)(currentToken) : null;
+    steps.push({
+        name: 'decode_current_token',
+        decodedToken: currentDecoded,
+        notes: currentToken
+            ? currentDecoded
+                ? [`Decoded JWT with claims: ${Object.keys(currentDecoded.claims).join(', ')}`]
+                : ['Saved access_token is opaque (not a JWT) — `aud` inspection is not possible']
+            : ['No saved access_token'],
+    });
+    // Step 4: token refresh (only if we have a refresh_token AND the user didn't skip)
+    let refreshedAccessToken;
+    let refreshedDecoded = null;
+    if (!options.skipRefresh && agent.oauth_tokens?.refresh_token) {
+        const tokenEndpoint = extractTokenEndpoint(asCapture);
+        const clientId = agent.oauth_client?.client_id;
+        // Always request the agent URL as the resource indicator, even if PRM
+        // advertises something different — a well-behaved client sends what it
+        // actually wants to talk to, and using PRM.resource here would cause H2
+        // to fire spuriously when the real problem is H1.
+        const resource = agentUrl;
+        if (!tokenEndpoint) {
+            steps.push({
+                name: 'token_refresh_attempt',
+                error: 'No token_endpoint available from authorization-server metadata — cannot attempt refresh',
+            });
+        }
+        else if (!clientId) {
+            steps.push({
+                name: 'token_refresh_attempt',
+                error: 'No saved oauth_client.client_id — cannot attempt refresh without it',
+            });
+        }
+        else {
+            const refreshCapture = await attemptTokenRefresh({
+                tokenEndpoint,
+                clientId,
+                clientSecret: agent.oauth_client?.client_secret,
+                refreshToken: agent.oauth_tokens.refresh_token,
+                resource,
+                allowPrivateIp,
+                timeoutMs: options.timeoutMs,
+            });
+            // Capture the raw access_token string BEFORE redaction so we can still
+            // decode claims for H2 analysis. The report body itself uses the
+            // redacted capture unless includeTokens is set.
+            if (refreshCapture.status === 200 && refreshCapture.body && typeof refreshCapture.body === 'object') {
+                const body = refreshCapture.body;
+                if (typeof body.access_token === 'string') {
+                    refreshedAccessToken = body.access_token;
+                    refreshedDecoded = (0, diagnostics_1.decodeAccessTokenClaims)(refreshedAccessToken);
+                }
+            }
+            steps.push({
+                name: 'token_refresh_attempt',
+                http: includeTokens ? refreshCapture : redactTokenMaterial(refreshCapture),
+            });
+            if (refreshedAccessToken) {
+                steps.push({
+                    name: 'decode_refreshed_token',
+                    decodedToken: refreshedDecoded,
+                    notes: refreshedDecoded
+                        ? [`Decoded refreshed JWT with claims: ${Object.keys(refreshedDecoded.claims).join(', ')}`]
+                        : ['Refreshed access_token is opaque (not a JWT)'],
+                });
+            }
+        }
+    }
+    // Step 5: unauthenticated list_tools to surface 401 + WWW-Authenticate
+    const listToolsCapture = await probeListTools(agentUrl, undefined, allowPrivateIp, options.timeoutMs, nextRpcId);
+    steps.push({ name: 'list_tools_probe', http: listToolsCapture });
+    // Step 6: authenticated tool_call (skip if no token or if caller opts out)
+    const tokenForCall = refreshedAccessToken ?? currentToken;
+    if (!options.skipToolCall && tokenForCall) {
+        const toolName = options.probeToolName ?? 'get_products';
+        const args = options.probeToolArgs ?? { brief: 'diagnose-auth probe' };
+        const toolCapture = await probeToolCall(agentUrl, tokenForCall, toolName, args, allowPrivateIp, options.timeoutMs, nextRpcId);
+        steps.push({ name: 'tool_call_probe', http: toolCapture });
+    }
+    else if (!tokenForCall) {
+        steps.push({
+            name: 'tool_call_probe',
+            error: 'No access_token available — skipping authenticated tool call probe',
+        });
+    }
+    const hypotheses = rankHypotheses({
+        agentUrl,
+        steps,
+        currentDecoded,
+        refreshedDecoded,
+    });
+    return {
+        schemaVersion: exports.AUTH_DIAGNOSIS_SCHEMA_VERSION,
+        agentUrl,
+        aliasId: agent.id,
+        steps,
+        hypotheses,
+        generatedAt: new Date().toISOString(),
+    };
+}
+// ---------------------------------------------------------------------------
+// Probes
+// ---------------------------------------------------------------------------
+async function probeProtectedResourceMetadata(agentUrl, allowPrivateIp, timeoutMs) {
+    const u = new URL(agentUrl);
+    const url = `${u.origin}/.well-known/oauth-protected-resource${u.pathname}`;
+    return httpGet(url, allowPrivateIp, timeoutMs);
+}
+async function probeAuthorizationServerMetadata(prm, allowPrivateIp, timeoutMs) {
+    const issuer = extractIssuer(prm);
+    if (!issuer) {
+        return {
+            url: '',
+            method: 'GET',
+            status: 0,
+            headers: {},
+            body: null,
+            error: 'protected-resource metadata did not yield an authorization_servers[0] entry',
+        };
+    }
+    const url = `${issuer.replace(/\/$/, '')}/.well-known/oauth-authorization-server`;
+    return httpGet(url, allowPrivateIp, timeoutMs);
+}
+async function probeListTools(agentUrl, bearerToken, allowPrivateIp, timeoutMs, nextRpcId) {
+    return httpJsonRpc(agentUrl, { method: 'tools/list' }, bearerToken, allowPrivateIp, timeoutMs, nextRpcId);
+}
+async function probeToolCall(agentUrl, bearerToken, toolName, args, allowPrivateIp, timeoutMs, nextRpcId) {
+    return httpJsonRpc(agentUrl, { method: 'tools/call', params: { name: toolName, arguments: args } }, bearerToken, allowPrivateIp, timeoutMs, nextRpcId);
+}
+async function attemptTokenRefresh(options) {
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: options.refreshToken,
+        client_id: options.clientId,
+        // RFC 8707: explicitly request a token for this resource. If the AS
+        // ignores this (H2), the refreshed token's aud claim will still be wrong.
+        resource: options.resource,
+    });
+    if (options.clientSecret)
+        body.set('client_secret', options.clientSecret);
+    return httpFormPost(options.tokenEndpoint, body, options.allowPrivateIp, options.timeoutMs);
+}
+async function httpGet(url, allowPrivateIp, timeoutMs) {
+    try {
+        const res = await (0, net_1.ssrfSafeFetch)(url, {
+            method: 'GET',
+            headers: { accept: 'application/json' },
+            allowPrivateIp,
+            ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        });
+        return {
+            url,
+            method: 'GET',
+            status: res.status,
+            headers: res.headers,
+            body: (0, net_1.decodeBodyAsJsonOrText)(res.body, res.headers['content-type']),
+        };
+    }
+    catch (err) {
+        return { url, method: 'GET', status: 0, headers: {}, body: null, error: formatError(err) };
+    }
+}
+async function httpJsonRpc(url, rpc, bearerToken, allowPrivateIp, timeoutMs, nextRpcId) {
+    const body = JSON.stringify({ jsonrpc: '2.0', id: nextRpcId(), ...rpc });
+    const headers = {
+        'content-type': 'application/json',
+        accept: 'application/json',
+    };
+    if (bearerToken)
+        headers.authorization = `Bearer ${bearerToken}`;
+    try {
+        const res = await (0, net_1.ssrfSafeFetch)(url, {
+            method: 'POST',
+            headers,
+            body,
+            allowPrivateIp,
+            ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        });
+        return {
+            url,
+            method: 'POST',
+            status: res.status,
+            headers: res.headers,
+            body: (0, net_1.decodeBodyAsJsonOrText)(res.body, res.headers['content-type']),
+        };
+    }
+    catch (err) {
+        return { url, method: 'POST', status: 0, headers: {}, body: null, error: formatError(err) };
+    }
+}
+async function httpFormPost(url, body, allowPrivateIp, timeoutMs) {
+    try {
+        const res = await (0, net_1.ssrfSafeFetch)(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+            },
+            body: body.toString(),
+            allowPrivateIp,
+            ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        });
+        return {
+            url,
+            method: 'POST',
+            status: res.status,
+            headers: res.headers,
+            body: (0, net_1.decodeBodyAsJsonOrText)(res.body, res.headers['content-type']),
+        };
+    }
+    catch (err) {
+        return { url, method: 'POST', status: 0, headers: {}, body: null, error: formatError(err) };
+    }
+}
+function rankHypotheses(input) {
+    const out = [];
+    const prmStep = input.steps.find(s => s.name === 'probe_protected_resource_metadata');
+    const listStep = input.steps.find(s => s.name === 'list_tools_probe');
+    const toolStep = input.steps.find(s => s.name === 'tool_call_probe');
+    const refreshStep = input.steps.find(s => s.name === 'token_refresh_attempt');
+    // H1: Resource URL mismatch between well-known and agent host
+    out.push(rankH1(input.agentUrl, prmStep));
+    // H2: Refresh grant missing `resource` parameter (RFC 8707)
+    out.push(rankH2(input.agentUrl, refreshStep, input.refreshedDecoded));
+    // H4: Agent endpoint returns 401 with no WWW-Authenticate (RFC 6750 violation)
+    out.push(rankH4(listStep, toolStep));
+    // H5: Token `aud` claim missing or doesn't match agent URL
+    out.push(rankH5(input.agentUrl, input.currentDecoded, prmStep));
+    // H6: Agent endpoint doesn't validate audience (accepts token but ignores it)
+    out.push(rankH6(input.agentUrl, input.currentDecoded, toolStep));
+    // H7: Authorization server supports Dynamic Client Registration (RFC 7591)
+    // for client_credentials — informational, helps operators decide whether
+    // a throwaway M2M client is viable for compliance runs.
+    const asStep = input.steps.find(s => s.name === 'probe_authorization_server_metadata');
+    out.push(rankH7(asStep));
+    // Order: likely > possible > ruled_out > not_observed
+    const order = {
+        likely: 0,
+        possible: 1,
+        ruled_out: 2,
+        not_observed: 3,
+    };
+    return out.sort((a, b) => order[a.verdict] - order[b.verdict]);
+}
+function rankH1(agentUrl, prmStep) {
+    const base = {
+        id: 'H1',
+        title: 'Resource URL mismatch between well-known and agent host',
+        summary: '',
+        verdict: 'not_observed',
+        evidence: [],
+    };
+    if (!prmStep?.http ||
+        prmStep.http.status !== 200 ||
+        typeof prmStep.http.body !== 'object' ||
+        prmStep.http.body === null) {
+        base.verdict = 'not_observed';
+        base.summary = 'No protected-resource metadata was retrieved — cannot compare `resource` to agent URL';
+        return base;
+    }
+    const advertised = prmStep.http.body.resource;
+    if (typeof advertised !== 'string') {
+        base.verdict = 'not_observed';
+        base.summary = 'protected-resource metadata has no `resource` field';
+        return base;
+    }
+    const normAdvertised = normalizeForCompare(advertised);
+    const normAgent = normalizeForCompare(agentUrl);
+    if (normAdvertised === normAgent) {
+        base.verdict = 'ruled_out';
+        base.summary = `Advertised resource matches agent URL (${advertised})`;
+    }
+    else {
+        base.verdict = 'likely';
+        base.summary = `Advertised resource "${advertised}" does not match agent URL "${agentUrl}"`;
+        base.evidence = [
+            `PRM resource: ${advertised}`,
+            `Agent URL: ${agentUrl}`,
+            'Fix: align the agent server config so `.well-known/oauth-protected-resource` advertises the same origin+path as the agent endpoint itself.',
+        ];
+    }
+    return base;
+}
+function rankH2(agentUrl, refreshStep, refreshedDecoded) {
+    const base = {
+        id: 'H2',
+        title: 'Refresh grant missing `resource` parameter (RFC 8707)',
+        summary: '',
+        verdict: 'not_observed',
+        evidence: [],
+    };
+    if (!refreshStep) {
+        base.summary = 'No token refresh was attempted (skipped, missing refresh_token, or missing client registration)';
+        return base;
+    }
+    if (refreshStep.error) {
+        base.summary = `Token refresh could not run: ${refreshStep.error}`;
+        return base;
+    }
+    if (!refreshStep.http || refreshStep.http.status !== 200) {
+        base.summary = `Token refresh returned HTTP ${refreshStep.http?.status ?? 0}; cannot evaluate aud handling`;
+        base.evidence = refreshStep.http ? [`Body: ${safeStringify(refreshStep.http.body)}`] : [];
+        return base;
+    }
+    if (!refreshedDecoded) {
+        base.verdict = 'possible';
+        base.summary = 'Refreshed token is opaque — audience cannot be inspected from the wire';
+        base.evidence = [
+            'If this agent is a public resource server, an opaque token should still carry `aud` when inspected via introspection.',
+        ];
+        return base;
+    }
+    const result = (0, diagnostics_1.validateTokenAudience)(jwtFromDecoded(refreshedDecoded), agentUrl);
+    if (result.ok) {
+        base.verdict = 'ruled_out';
+        base.summary = 'Refreshed token `aud` claim matches the expected resource — AS honors RFC 8707 `resource`';
+        return base;
+    }
+    base.verdict = 'likely';
+    base.summary = 'We asked the AS to refresh with `resource=<agent-url>` but the new token `aud` still does not match';
+    base.evidence = [
+        `Expected aud: ${agentUrl}`,
+        `Actual aud: ${safeStringify(result.actualAudience)}`,
+        'Fix: update the AS to honor RFC 8707 `resource` and emit the corresponding `aud` claim on refresh_token grants.',
+    ];
+    return base;
+}
+function rankH4(listStep, toolStep) {
+    const base = {
+        id: 'H4',
+        title: 'Agent endpoint returns 401 with no `WWW-Authenticate` (RFC 6750 violation)',
+        summary: '',
+        verdict: 'not_observed',
+        evidence: [],
+    };
+    const unauthed = listStep?.http;
+    const authed = toolStep?.http;
+    const rfc6750Offender = (cap) => cap && cap.status === 401 && !cap.headers['www-authenticate'];
+    if (rfc6750Offender(unauthed) || rfc6750Offender(authed)) {
+        base.verdict = 'likely';
+        base.summary = 'Agent returned 401 without a `WWW-Authenticate` header — breaks RFC 6750 §3 and RFC 9728 discovery';
+        base.evidence = [];
+        if (rfc6750Offender(unauthed))
+            base.evidence.push(`unauthenticated tools/list: ${unauthed.status} (no WWW-Authenticate)`);
+        if (rfc6750Offender(authed))
+            base.evidence.push(`authenticated tools/call: ${authed.status} (no WWW-Authenticate)`);
+        base.evidence.push('Fix: emit `WWW-Authenticate: Bearer error="…", resource_metadata="…"` on 401 responses.');
+        return base;
+    }
+    if ((unauthed?.status === 401 && unauthed.headers['www-authenticate']) ||
+        (authed?.status === 401 && authed.headers['www-authenticate'])) {
+        base.verdict = 'ruled_out';
+        base.summary = 'Agent correctly emits a WWW-Authenticate challenge on 401';
+        const challenge = (0, diagnostics_1.parseWWWAuthenticate)(unauthed?.headers['www-authenticate'] ?? authed?.headers['www-authenticate']);
+        if (challenge) {
+            base.evidence = [
+                `Scheme: ${challenge.scheme}`,
+                ...(challenge.error ? [`error: ${challenge.error}`] : []),
+                ...(challenge.resource_metadata ? [`resource_metadata: ${challenge.resource_metadata}`] : []),
+            ];
+        }
+        return base;
+    }
+    base.summary = 'No 401 was observed on either probe — cannot evaluate challenge format';
+    return base;
+}
+function rankH5(agentUrl, currentDecoded, prmStep) {
+    const base = {
+        id: 'H5',
+        title: 'Token `aud` claim missing or does not match agent URL',
+        summary: '',
+        verdict: 'not_observed',
+        evidence: [],
+    };
+    if (!currentDecoded) {
+        base.summary = 'No saved access token was decodable — cannot inspect `aud`';
+        return base;
+    }
+    // Prefer the advertised resource (PRM) when available, fall back to agent URL.
+    const prmResource = prmStep?.http?.body && typeof prmStep.http.body.resource === 'string'
+        ? prmStep.http.body.resource
+        : undefined;
+    const expected = prmResource ?? agentUrl;
+    const prmDiffersFromAgent = prmResource !== undefined && normalizeForCompare(prmResource) !== normalizeForCompare(agentUrl);
+    const result = (0, diagnostics_1.validateTokenAudience)(jwtFromDecoded(currentDecoded), expected);
+    if (result.ok) {
+        base.verdict = 'ruled_out';
+        base.summary = `Saved token \`aud\` matches expected resource (${expected})`;
+        if (prmDiffersFromAgent) {
+            base.evidence = [
+                `Compared against advertised PRM resource; agent URL differs (see H1). Token is valid for the resource the AS thinks it's protecting, not for the agent URL you configured.`,
+            ];
+        }
+        return base;
+    }
+    base.verdict = 'likely';
+    base.summary = result.reason ?? 'Saved token audience does not match expected resource';
+    base.evidence = [
+        `Expected: ${expected}${prmDiffersFromAgent ? ' (from PRM; see H1 — agent URL differs)' : ''}`,
+        `Actual aud: ${safeStringify(result.actualAudience ?? '(missing)')}`,
+        'Fix: ensure the AS sets `aud` to the resource URL on token issuance (RFC 9068 §2.2 / RFC 8707).',
+    ];
+    return base;
+}
+function rankH6(agentUrl, currentDecoded, toolStep) {
+    const base = {
+        id: 'H6',
+        title: 'Agent accepts token but does not validate audience',
+        summary: '',
+        verdict: 'not_observed',
+        evidence: [],
+    };
+    if (!toolStep?.http || !currentDecoded) {
+        base.summary = 'Need both a decoded token and a tool_call probe to evaluate';
+        return base;
+    }
+    if (toolStep.http.status !== 200) {
+        base.verdict = 'ruled_out';
+        base.summary = `tool_call returned HTTP ${toolStep.http.status} — agent did not accept the token blindly`;
+        return base;
+    }
+    const audResult = (0, diagnostics_1.validateTokenAudience)(jwtFromDecoded(currentDecoded), agentUrl);
+    if (audResult.ok) {
+        base.verdict = 'ruled_out';
+        base.summary = 'Token `aud` matches agent URL and tool_call succeeded — cannot distinguish from correct behavior';
+        return base;
+    }
+    base.verdict = 'likely';
+    base.summary =
+        'tool_call succeeded with a token whose `aud` does not match the agent URL — agent is not enforcing audience';
+    base.evidence = [
+        `tool_call status: ${toolStep.http.status}`,
+        `Token aud: ${safeStringify(audResult.actualAudience ?? '(missing)')}`,
+        `Agent URL: ${agentUrl}`,
+        'Fix: have the agent reject tokens whose `aud` does not include its own resource URL (RFC 9068).',
+    ];
+    return base;
+}
+/**
+ * H7 — DCR readiness for client_credentials. Pure capability probe; no
+ * attempt to actually register. Flagged `possible` when both a
+ * `registration_endpoint` and `client_credentials` in `grant_types_supported`
+ * are advertised, so an operator deciding whether to script a throwaway M2M
+ * client has a signal. `ruled_out` when one or both are missing.
+ */
+function rankH7(asStep) {
+    const base = {
+        id: 'H7',
+        title: 'Authorization server supports Dynamic Client Registration for client_credentials',
+        summary: '',
+        verdict: 'not_observed',
+        evidence: [],
+    };
+    if (!asStep?.http || asStep.http.status !== 200 || !asStep.http.body || typeof asStep.http.body !== 'object') {
+        base.summary = 'Authorization server metadata not observed';
+        return base;
+    }
+    const md = asStep.http.body;
+    const registrationEndpoint = typeof md.registration_endpoint === 'string' ? md.registration_endpoint : undefined;
+    const grants = Array.isArray(md.grant_types_supported)
+        ? md.grant_types_supported.filter((g) => typeof g === 'string')
+        : undefined;
+    const supportsCc = grants ? grants.includes('client_credentials') : undefined;
+    if (!registrationEndpoint) {
+        base.verdict = 'ruled_out';
+        base.summary = 'No registration_endpoint advertised — DCR not available';
+        base.evidence = ['AS metadata has no registration_endpoint field'];
+        return base;
+    }
+    if (supportsCc === false) {
+        base.verdict = 'ruled_out';
+        base.summary = 'registration_endpoint present but client_credentials not in grant_types_supported';
+        base.evidence = [
+            `registration_endpoint: ${registrationEndpoint}`,
+            `grant_types_supported: [${(grants ?? []).join(', ')}]`,
+        ];
+        return base;
+    }
+    base.verdict = 'possible';
+    base.summary =
+        supportsCc === true
+            ? 'AS advertises DCR and client_credentials — a throwaway M2M client may be creatable'
+            : 'AS advertises DCR (grant_types_supported absent, RFC 8414 default may not include client_credentials)';
+    base.evidence = [
+        `registration_endpoint: ${registrationEndpoint}`,
+        `grant_types_supported: [${(grants ?? []).join(', ') || '(absent)'}]`,
+        'Note: many production ASes gate DCR behind an initial-access token; success is not guaranteed.',
+    ];
+    return base;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function extractIssuer(prm) {
+    if (prm.status !== 200 || !prm.body || typeof prm.body !== 'object')
+        return undefined;
+    const servers = prm.body.authorization_servers;
+    if (!Array.isArray(servers) || typeof servers[0] !== 'string')
+        return undefined;
+    return servers[0];
+}
+function extractTokenEndpoint(as) {
+    if (as.status !== 200 || !as.body || typeof as.body !== 'object')
+        return undefined;
+    const endpoint = as.body.token_endpoint;
+    return typeof endpoint === 'string' ? endpoint : undefined;
+}
+/** Fields in an OAuth token-endpoint response that should never leak to disk/logs. */
+const TOKEN_MATERIAL_FIELDS = new Set(['access_token', 'refresh_token', 'id_token']);
+/**
+ * Redact token-bearing fields from a token-endpoint capture so that `--json`
+ * output can safely be pasted into bug reports. The redacted form preserves
+ * the original length (useful for "wrong length" diagnostics) without leaking
+ * the secret. Set `includeTokens: true` on {@link DiagnoseOptions} to skip.
+ */
+function redactTokenMaterial(capture) {
+    if (!capture.body || typeof capture.body !== 'object' || Array.isArray(capture.body))
+        return capture;
+    const body = capture.body;
+    const redacted = {};
+    for (const [k, v] of Object.entries(body)) {
+        if (TOKEN_MATERIAL_FIELDS.has(k) && typeof v === 'string') {
+            redacted[k] = `<redacted length=${v.length}>`;
+        }
+        else {
+            redacted[k] = v;
+        }
+    }
+    return { ...capture, body: redacted };
+}
+function normalizeForCompare(value) {
+    try {
+        const u = new URL(value);
+        const port = u.port && !isDefaultPort(u.protocol, u.port) ? `:${u.port}` : '';
+        const path = u.pathname.length > 1 && u.pathname.endsWith('/') ? u.pathname.slice(0, -1) : u.pathname;
+        return `${u.protocol.toLowerCase()}//${u.hostname.toLowerCase()}${port}${path}`;
+    }
+    catch {
+        return value;
+    }
+}
+function isDefaultPort(scheme, port) {
+    if (scheme === 'https:' && port === '443')
+        return true;
+    if (scheme === 'http:' && port === '80')
+        return true;
+    return false;
+}
+function jwtFromDecoded(_decoded) {
+    // validateTokenAudience re-decodes from a JWT string, so we round-trip.
+    // Since we already decoded this, we can't reconstruct the original signature,
+    // but the validator only cares about the claims segment — so we synthesize a
+    // three-segment token with the original claims and dummy header/signature.
+    const h = base64url(JSON.stringify(_decoded.header));
+    const c = base64url(JSON.stringify(_decoded.claims));
+    return `${h}.${c}.${_decoded.signature || 'sig'}`;
+}
+function base64url(input) {
+    // `base64` output has at most 2 trailing `=` characters; the bounded form
+    // `={0,2}$` avoids the polynomial-regex flag CodeQL raises on `=+$`.
+    return Buffer.from(input)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/={0,2}$/, '');
+}
+function formatError(err) {
+    if (err instanceof net_1.SsrfRefusedError) {
+        return `SSRF guard refused: ${err.code} (${err.message})`;
+    }
+    return err instanceof Error ? err.message : String(err);
+}
+function safeStringify(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=diagnose.js.map

package/dist/lib/auth/oauth/diagnose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnose.js","sourceRoot":"","sources":["../../../../src/lib/auth/oauth/diagnose.ts"],"names":[],"mappings":";;;AAmIA,4CAmIC;AAtQD;;;;;;;;;;;;;;GAcG;AACH,mCAAoF;AAEpF,+CAAqG;AAqFrG;;;;GAIG;AACU,QAAA,6BAA6B,GAAG,CAAU,CAAC;AAkBxD;;;;;GAKG;AACI,KAAK,UAAU,gBAAgB,CACpC,KAAkB,EAClB,UAA2B,EAAE;IAE7B,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC;IACjC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IACrD,0FAA0F;IAC1F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC;IAEhC,iDAAiD;IACjD,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAE5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,MAAM,gCAAgC,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACxG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAE7E,qDAAqD;IACrD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC;IACtD,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,IAAA,qCAAuB,EAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,cAAc;QAC5B,KAAK,EAAE,YAAY;YACjB,CAAC,CAAC,cAAc;gBACd,CAAC,CAAC,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,CAAC,CAAC,CAAC,6EAA6E,CAAC;YACnF,CAAC,CAAC,CAAC,uBAAuB,CAAC;KAC9B,CAAC,CAAC;IAEH,mFAAmF;IACnF,IAAI,oBAAwC,CAAC;IAC7C,IAAI,gBAAgB,GAA8B,IAAI,CAAC;IACvD,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,aAAa,EAAE,CAAC;QAC9D,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC;QAC/C,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,yFAAyF;aACjG,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,qEAAqE;aAC7E,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC;gBAC/C,aAAa;gBACb,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,aAAa;gBAC/C,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,aAAa;gBAC9C,QAAQ;gBACR,cAAc;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YACH,uEAAuE;YACvE,iEAAiE;YACjE,gDAAgD;YAChD,IAAI,cAAc,CAAC,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,IAAI,OAAO,cAAc,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpG,MAAM,IAAI,GAAG,cAAc,CAAC,IAA+B,CAAC;gBAC5D,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBAC1C,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC;oBACzC,gBAAgB,GAAG,IAAA,qCAAuB,EAAC,oBAAoB,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC;aAC3E,CAAC,CAAC;YACH,IAAI,oBAAoB,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,wBAAwB;oBAC9B,YAAY,EAAE,gBAAgB;oBAC9B,KAAK,EAAE,gBAAgB;wBACrB,CAAC,CAAC,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3F,CAAC,CAAC,CAAC,8CAA8C,CAAC;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,MAAM,YAAY,GAAG,oBAAoB,IAAI,YAAY,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACvE,MAAM,WAAW,GAAG,MAAM,aAAa,CACrC,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,IAAI,EACJ,cAAc,EACd,OAAO,CAAC,SAAS,EACjB,SAAS,CACV,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,oEAAoE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC;QAChC,QAAQ;QACR,KAAK;QACL,cAAc;QACd,gBAAgB;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,qCAA6B;QAC5C,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,KAAK;QACL,UAAU;QACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,KAAK,UAAU,8BAA8B,CAC3C,QAAgB,EAChB,cAAuB,EACvB,SAAkB;IAElB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,wCAAwC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5E,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,GAAgB,EAChB,cAAuB,EACvB,SAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,EAAE,EAAE;YACP,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,6EAA6E;SACrF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CAAC;IAClF,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,WAA+B,EAC/B,cAAuB,EACvB,SAA6B,EAC7B,SAAuB;IAEvB,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC5G,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,WAAmB,EACnB,QAAgB,EAChB,IAA6B,EAC7B,cAAuB,EACvB,SAA6B,EAC7B,SAAuB;IAEvB,OAAO,WAAW,CAChB,QAAQ,EACR,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EACrE,WAAW,EACX,cAAc,EACd,SAAS,EACT,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAQlC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,oEAAoE;QACpE,0EAA0E;QAC1E,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1E,OAAO,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,cAAuB,EAAE,SAAkB;IAC7E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAa,EAAC,GAAG,EAAE;YACnC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,cAAc;YACd,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,IAAA,4BAAsB,EAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,GAAyC,EACzC,WAA+B,EAC/B,cAAuB,EACvB,SAA6B,EAC7B,SAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAa,EAAC,GAAG,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,cAAc;YACd,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,IAAA,4BAAsB,EAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,IAAqB,EACrB,cAAuB,EACvB,SAAkB;IAElB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAa,EAAC,GAAG,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,cAAc;YACd,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,IAAA,4BAAsB,EAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9F,CAAC;AACH,CAAC;AAaD,SAAS,cAAc,CAAC,KAAgB;IACtC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mCAAmC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;IAE9E,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAE1C,4DAA4D;IAC5D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAEtE,+EAA+E;IAC/E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAErC,2DAA2D;IAC3D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAEhE,8EAA8E;IAC9E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjE,2EAA2E;IAC3E,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qCAAqC,CAAC,CAAC;IACvF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzB,sDAAsD;IACtD,MAAM,KAAK,GAAsC;QAC/C,MAAM,EAAE,CAAC;QACT,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,OAAuB;IACvD,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,yDAAyD;QAChE,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,IACE,CAAC,OAAO,EAAE,IAAI;QACd,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;QACrC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,EAC1B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,uFAAuF,CAAC;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAI,OAAO,CAAC,IAAI,CAAC,IAA+B,CAAC,QAAQ,CAAC;IAC1E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,qDAAqD,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,0CAA0C,UAAU,GAAG,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,wBAAwB,UAAU,+BAA+B,QAAQ,GAAG,CAAC;QAC5F,IAAI,CAAC,QAAQ,GAAG;YACd,iBAAiB,UAAU,EAAE;YAC7B,cAAc,QAAQ,EAAE;YACxB,4IAA4I;SAC7I,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CACb,QAAgB,EAChB,WAAsC,EACtC,gBAA2C;IAE3C,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,uDAAuD;QAC9D,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,iGAAiG,CAAC;QACjH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,gCAAgC,WAAW,CAAC,KAAK,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,+BAA+B,WAAW,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,gCAAgC,CAAC;QAC5G,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,wEAAwE,CAAC;QACxF,IAAI,CAAC,QAAQ,GAAG;YACd,uHAAuH;SACxH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,mCAAqB,EAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,2FAA2F,CAAC;QAC3G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC,OAAO,GAAG,qGAAqG,CAAC;IACrH,IAAI,CAAC,QAAQ,GAAG;QACd,iBAAiB,QAAQ,EAAE;QAC3B,eAAe,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE;QACrD,iHAAiH;KAClH,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,QAAwB,EAAE,QAAwB;IAChE,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,4EAA4E;QACnF,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC9B,MAAM,eAAe,GAAG,CAAC,GAA4B,EAAE,EAAE,CACvD,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEhE,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,oGAAoG,CAAC;QACpH,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,eAAe,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,QAAS,CAAC,MAAM,wBAAwB,CAAC,CAAC;QAC9F,IAAI,eAAe,CAAC,MAAM,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,MAAO,CAAC,MAAM,wBAAwB,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;QAC9G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClE,CAAC,MAAM,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAC9D,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,2DAA2D,CAAC;QAC3E,MAAM,SAAS,GAAG,IAAA,kCAAoB,EACpC,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAC7E,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,GAAG;gBACd,WAAW,SAAS,CAAC,MAAM,EAAE;gBAC7B,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,sBAAsB,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,GAAG,wEAAwE,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CACb,QAAgB,EAChB,cAAyC,EACzC,OAAkC;IAElC,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,uDAAuD;QAC9D,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,4DAA4D,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,+EAA+E;IAC/E,MAAM,WAAW,GACf,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,OAAQ,OAAO,CAAC,IAAI,CAAC,IAA+B,CAAC,QAAQ,KAAK,QAAQ;QAC/F,CAAC,CAAE,OAAO,CAAC,IAAI,CAAC,IAA6B,CAAC,QAAQ;QACtD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAG,WAAW,IAAI,QAAQ,CAAC;IACzC,MAAM,mBAAmB,GACvB,WAAW,KAAK,SAAS,IAAI,mBAAmB,CAAC,WAAW,CAAC,KAAK,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,IAAA,mCAAqB,EAAC,cAAc,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,kDAAkD,QAAQ,GAAG,CAAC;QAC7E,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,GAAG;gBACd,4KAA4K;aAC7K,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,uDAAuD,CAAC;IACxF,IAAI,CAAC,QAAQ,GAAG;QACd,aAAa,QAAQ,GAAG,mBAAmB,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9F,eAAe,aAAa,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,EAAE;QACpE,iGAAiG;KAClG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,cAAyC,EAAE,QAAwB;IACnG,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,oDAAoD;QAC3D,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,6DAA6D,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,2BAA2B,QAAQ,CAAC,IAAI,CAAC,MAAM,2CAA2C,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,mCAAqB,EAAC,cAAc,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,kGAAkG,CAAC;QAClH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC,OAAO;QACV,6GAA6G,CAAC;IAChH,IAAI,CAAC,QAAQ,GAAG;QACd,qBAAqB,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE;QAC3C,cAAc,aAAa,CAAC,SAAS,CAAC,cAAc,IAAI,WAAW,CAAC,EAAE;QACtE,cAAc,QAAQ,EAAE;QACxB,iGAAiG;KAClG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,MAAsB;IACpC,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,kFAAkF;QACzF,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7G,IAAI,CAAC,OAAO,GAAG,4CAA4C,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAA4E,CAAC;IACpG,MAAM,oBAAoB,GAAG,OAAO,EAAE,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,qBAAqB,CAAC;QACpD,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,yDAAyD,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,CAAC,gDAAgD,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,mFAAmF,CAAC;QACnG,IAAI,CAAC,QAAQ,GAAG;YACd,0BAA0B,oBAAoB,EAAE;YAChD,2BAA2B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACxD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;IAC1B,IAAI,CAAC,OAAO;QACV,UAAU,KAAK,IAAI;YACjB,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,uGAAuG,CAAC;IAC9G,IAAI,CAAC,QAAQ,GAAG;QACd,0BAA0B,oBAAoB,EAAE;QAChD,2BAA2B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,GAAG;QACrE,gGAAgG;KACjG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,aAAa,CAAC,GAAgB;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,OAAO,GAAI,GAAG,CAAC,IAA4C,CAAC,qBAAqB,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,oBAAoB,CAAC,EAAe;IAC3C,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnF,MAAM,QAAQ,GAAI,EAAE,CAAC,IAAqC,CAAC,cAAc,CAAC;IAC1E,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,sFAAsF;AACtF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;AAErF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAoB;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACrG,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;IACrD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1D,QAAQ,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,MAAM,GAAG,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtG,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,IAAY;IACjD,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAA4B;IAClD,wEAAwE;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,0EAA0E;IAC1E,qEAAqE;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,sBAAgB,EAAE,CAAC;QACpC,OAAO,uBAAuB,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}