@arnaudjnn/billing-tools 0.15.0 → 0.17.0

package/dist/index.js

@@ -3,9 +3,15 @@ export { resolveConfig, internalDomainsFromEnv } from "./types.js";
 // Auth engine
 export { authContext, runWithAuth, runWithResolvedOrg, enforceAccess, enforceTokens, } from "./auth.js";
 // Billing engine (Stripe math)
-export { getStripe, stripeConfigured, ensureStripeCustomer, getBillingCustomerId, getTokenBalance, deductTokens, creditTokens, createTokenCheckoutSession, createBillingPortalSession, getAutoReloadSettings, setAutoReloadSettings, tryAutoReload, listInvoices, listSubscriptionPrices, resolveSubscriptionPrice, } from "./billing.js";
+export { getStripe, stripeConfigured, ensureStripeCustomer, getBillingCustomerId, getTokenBalance, deductTokens, creditTokens, usageSince, createTokenCheckoutSession, createBillingPortalSession, getAutoReloadSettings, setAutoReloadSettings, tryAutoReload, listInvoices, listSubscriptionPrices, resolveSubscriptionPrice, } from "./billing.js";
 // Declarative plans (auto-provision Stripe products/prices from config)
-export { ensurePlans, planPriceId, planForPriceId, seatLimit, includedTokens, lookupKeyFor, } from "./plans.js";
+export { ensurePlans, planPriceId, planForPriceId, seatTypeForPriceId, seatLimit, includedTokens, includedTokensByType, lookupKeyFor, DEFAULT_SEAT_TYPES, } from "./plans.js";
+// Per-execution metering engine (prepaid balance; per-seat packs or a global
+// pool; usage summed from Stripe balance-transaction metadata — no new backend).
+export { meterUsage, } from "./metering.js";
+// Top-up requests (user → owner approval) + admin-gated auto-top-up. Stored in
+// WorkOS org metadata via the adapter — no new backend.
+export { requestTopUp, listTopUpRequests, approveTopUp, denyTopUp, extraAllowance, setAutoTopUp, } from "./topup.js";
 // WorkOS magic-auth
 export { sendMagicAuth, verifyMagicAuth } from "./magic-auth.js";
 // WorkOS organization invitations (shared, hook-configurable)
@@ -27,6 +33,9 @@ export { createAgentAuth, CLAIM_GRANT_TYPE, } from "./agent-auth/index.js";
 export { inMemoryClaimStore, } from "./agent-auth/claim-store.js";
 // Machine payments — MPP (the 402 payment sibling of auth.md)
 export { createMachinePaymentHandler, createPaymentMd, } from "./machine-payment/index.js";
+// MCP OAuth 2.1 + Dynamic Client Registration proxy (opt-in via
+// createBilling({ oauthProxy }) or standalone).
+export { createOAuthProxy, } from "./oauth-proxy/index.js";
 // Next route factories
 export { createToolListHandler, createToolDispatchHandler } from "./routes/rest.js";
 export { createMcpTransport } from "./routes/mcp.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAYnE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEnE,cAAc;AACd,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,+BAA+B;AAC/B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,cAAc,CAAC;AAEtB,wEAAwE;AACxE,OAAO,EACL,WAAW,EACX,WAAW,EACX,cAAc,EACd,SAAS,EACT,cAAc,EACd,YAAY,GAKb,MAAM,YAAY,CAAC;AAEpB,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEjE,8DAA8D;AAC9D,OAAO,EACL,uBAAuB,GAMxB,MAAM,kBAAkB,CAAC;AAE1B,sEAAsE;AACtE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AAElF,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,eAAe,GAIhB,MAAM,WAAW,CAAC;AAEnB,4EAA4E;AAC5E,OAAO,EACL,YAAY,GAKb,MAAM,aAAa,CAAC;AAErB,oBAAoB;AACpB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,uBAAuB;AACvB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAC;AAEvF,oEAAoE;AACpE,OAAO,EAAE,aAAa,EAA6B,MAAM,qBAAqB,CAAC;AAE/E,2EAA2E;AAC3E,OAAO,EACL,eAAe,EACf,gBAAgB,GAMjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,GAInB,MAAM,6BAA6B,CAAC;AAErC,8DAA8D;AAC9D,OAAO,EACL,2BAA2B,EAC3B,eAAe,GAMhB,MAAM,4BAA4B,CAAC;AAEpC,uBAAuB;AACvB,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAmB,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAA4B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAuB,MAAM,qBAAqB,CAAC;AAEtF,cAAc;AACd,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,UAAU,EACV,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,QAAQ;AACR,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAYnE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEnE,cAAc;AACd,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,+BAA+B;AAC/B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,cAAc,CAAC;AAEtB,wEAAwE;AACxE,OAAO,EACL,WAAW,EACX,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,GAMnB,MAAM,YAAY,CAAC;AAEpB,6EAA6E;AAC7E,iFAAiF;AACjF,OAAO,EACL,UAAU,GAIX,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,wDAAwD;AACxD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,YAAY,GAEb,MAAM,YAAY,CAAC;AAEpB,oBAAoB;AACpB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEjE,8DAA8D;AAC9D,OAAO,EACL,uBAAuB,GAMxB,MAAM,kBAAkB,CAAC;AAE1B,sEAAsE;AACtE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAC;AAElF,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,eAAe,GAIhB,MAAM,WAAW,CAAC;AAEnB,4EAA4E;AAC5E,OAAO,EACL,YAAY,GAKb,MAAM,aAAa,CAAC;AAErB,oBAAoB;AACpB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B,uBAAuB;AACvB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAC;AAEvF,oEAAoE;AACpE,OAAO,EAAE,aAAa,EAA6B,MAAM,qBAAqB,CAAC;AAE/E,2EAA2E;AAC3E,OAAO,EACL,eAAe,EACf,gBAAgB,GAMjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,GAInB,MAAM,6BAA6B,CAAC;AAErC,8DAA8D;AAC9D,OAAO,EACL,2BAA2B,EAC3B,eAAe,GAMhB,MAAM,4BAA4B,CAAC;AAEpC,gEAAgE;AAChE,gDAAgD;AAChD,OAAO,EACL,gBAAgB,GAKjB,MAAM,wBAAwB,CAAC;AAEhC,uBAAuB;AACvB,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAmB,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAA4B,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAuB,MAAM,qBAAqB,CAAC;AAEtF,cAAc;AACd,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,UAAU,EACV,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,QAAQ;AACR,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/metering.d.ts

@@ -0,0 +1,38 @@
+import type { PlansConfig } from "./plans.js";
+import type { BillingAdapter, ResolvedConfig } from "./types.js";
+export interface MeterCaller {
+    /** `user` = a human via session/OAuth (their seat); `api` = an API key / agent
+     *  (the shared API seat). Decides which pack the execution draws — the surface
+     *  (ui/api/mcp/cli) is irrelevant. */
+    kind: "user" | "api";
+    /** WorkOS member id (user) or API key id (api) — for per-caller attribution. */
+    id?: string;
+    /** The caller's seat type, resolved by the consumer (e.g. `standard`,
+     *  `premium`, `api`). Used for the per-seat pack cap in `per_seat` plans. */
+    seatType?: string;
+}
+export interface MeterInput {
+    orgId: string;
+    action: string;
+    /** Token cost for this execution (rate card × units), resolved by the consumer. */
+    cost: number;
+    plans: PlansConfig;
+    /** The org's current plan key (consumer resolves + caches it). */
+    plan: string | null;
+    /** Start of the current billing cycle, unix seconds — the window for per-seat
+     *  usage. */
+    cycleStart: number;
+    /** Approved extra allowance for this caller this cycle (owner-granted top-up),
+     *  added on top of the seat pack. Consumer resolves it via `extraAllowance`. */
+    extraAllowance?: number;
+    caller?: MeterCaller;
+}
+export type MeterResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "no_billing" | "insufficient_balance" | "seat_allowance_reached";
+    message: string;
+};
+export declare function meterUsage(adapter: BillingAdapter, config: ResolvedConfig, input: MeterInput): Promise<MeterResult>;
+//# sourceMappingURL=metering.d.ts.map

package/dist/metering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metering.d.ts","sourceRoot":"","sources":["../src/metering.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B;;0CAEsC;IACtC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IACrB,gFAAgF;IAChF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;iFAC6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,kEAAkE;IAClE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;iBACa;IACb,UAAU,EAAE,MAAM,CAAC;IACnB;oFACgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,YAAY,GAAG,sBAAsB,GAAG,wBAAwB,CAAA;IACxE,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAUL,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,WAAW,CAAC,CA0DtB"}

package/dist/metering.js

@@ -0,0 +1,58 @@
+import { deductTokens, getBillingCustomerId, getTokenBalance, stripeConfigured, tryAutoReload, usageSince, } from "./billing.js";
+import { isInternalOrg } from "./auth.js";
+// The shared metering engine (used by every consumer). Pricing is per execution
+// at a uniform cost regardless of surface. The org's prepaid Stripe balance is
+// the shared reserve; in `per_seat` plans each caller's per-cycle pack caps how
+// much of it they may spend (usage summed from Stripe balance-transaction
+// metadata — no separate ledger), while `global` plans (e.g. an Enterprise token
+// commitment) impose no per-seat cap. The debit is tagged with the caller so
+// usage is attributable. Free (cost 0), Stripe-unset, and internal orgs pass
+// through untouched. Persistence is entirely Stripe + the adapter — no new DB.
+export async function meterUsage(adapter, config, input) {
+    const { orgId, action, cost, plans, plan, cycleStart, caller } = input;
+    const extra = input.extraAllowance ?? 0;
+    if (cost <= 0)
+        return { ok: true };
+    if (!stripeConfigured())
+        return { ok: true };
+    if (await isInternalOrg(adapter, orgId, config.internalDomains))
+        return { ok: true };
+    const customerId = await getBillingCustomerId(adapter, orgId);
+    if (!customerId) {
+        return { ok: false, reason: "no_billing", message: "No billing account found." };
+    }
+    // The shared reserve must cover the debit (it funds every pack + any API top-up).
+    const balance = await getTokenBalance(customerId);
+    if (balance < cost) {
+        return {
+            ok: false,
+            reason: "insufficient_balance",
+            message: `Insufficient tokens: this costs ${cost} but the workspace has ${balance}. Top up to continue.`,
+        };
+    }
+    // Per-seat allowance cap — only for `per_seat` plans with a seat context.
+    // `global` plans (Enterprise commitment) have no per-seat cap.
+    const planDef = plan ? plans[plan] : undefined;
+    const mode = planDef?.allowanceMode ?? "per_seat";
+    if (mode === "per_seat" && caller?.seatType) {
+        const pack = planDef?.seatTypes?.[caller.seatType]?.includedTokens;
+        if (pack != null) {
+            const used = await usageSince(customerId, cycleStart, caller.kind === "api"
+                ? { callerKind: "api" }
+                : { callerKind: "user", callerId: caller.id });
+            if (used + cost > pack + extra && caller.kind === "user") {
+                // Hard cap for a user seat. (API seat over its pack is allowed — it
+                // draws the shared reserve, which is the API pool's top-up.)
+                return {
+                    ok: false,
+                    reason: "seat_allowance_reached",
+                    message: "Seat token allowance reached for this cycle. Request extra from the workspace owner.",
+                };
+            }
+        }
+    }
+    await deductTokens(customerId, action, cost, config.currency, caller ? { kind: caller.kind, id: caller.id } : undefined);
+    tryAutoReload(customerId, config.currency).catch(() => { });
+    return { ok: true };
+}
+//# sourceMappingURL=metering.js.map

package/dist/metering.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metering.js","sourceRoot":"","sources":["../src/metering.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAyC1C,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,iFAAiF;AACjF,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAuB,EACvB,MAAsB,EACtB,KAAiB;IAEjB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,IAAI,CAAC,CAAA;IACvC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAC5C,IAAI,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAEpF,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAA;IAClF,CAAC;IAED,kFAAkF;IAClF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,OAAO,EAAE,mCAAmC,IAAI,0BAA0B,OAAO,uBAAuB;SACzG,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,EAAE,aAAa,IAAI,UAAU,CAAA;IACjD,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;QAClE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,UAAU,EACV,UAAU,EACV,MAAM,CAAC,IAAI,KAAK,KAAK;gBACnB,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAChD,CAAA;YACD,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzD,oEAAoE;gBACpE,6DAA6D;gBAC7D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,wBAAwB;oBAChC,OAAO,EACL,sFAAsF;iBACzF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,CAChB,UAAU,EACV,MAAM,EACN,IAAI,EACJ,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAA;IACD,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC"}

package/dist/oauth-proxy/index.d.ts

@@ -0,0 +1,51 @@
+export interface ClaimGrantChain {
+    type: string;
+    handle: (params: Record<string, string>) => Promise<Response> | Response;
+}
+export interface OAuthProxyPaths {
+    authorize?: string;
+    register?: string;
+    callback?: string;
+}
+export interface OAuthProxyOptions {
+    /** Absolute base URL for the AuthKit redirect_uri + advertised endpoints.
+     *  String, per-request resolver, or omitted to derive from forwarded headers. */
+    baseUrl?: string | ((request: Request) => string);
+    /** WorkOS client id. Defaults to process.env.WORKOS_CLIENT_ID. */
+    workosClientId?: string;
+    /** HS256 key for the proxy's refresh tokens. Defaults to
+     *  process.env.REFRESH_TOKEN_SECRET. No fallback — see the note above. */
+    refreshSecret?: string;
+    paths?: OAuthProxyPaths;
+    /** Seconds/ms overrides. accessTokenTtl is what we *advertise* for the WorkOS
+     *  access token; refreshTtl is how long our wrapper JWT stays valid. */
+    ttl?: {
+        clientMs?: number;
+        sessionMs?: number;
+        codeMs?: number;
+        accessTokenSeconds?: number;
+        refreshSeconds?: number;
+    };
+    /** Chain another grant type through the same /oauth/token route — e.g.
+     *  auth.md's claim grant, so one route serves both. Pass a function when the
+     *  handler isn't available yet at construction (createBilling builds the proxy
+     *  first, because agent-auth needs its endpoints for discovery). */
+    claimGrant?: ClaimGrantChain | (() => ClaimGrantChain | undefined);
+}
+export declare function createOAuthProxy(opts?: OAuthProxyOptions): {
+    register: (request: Request) => Promise<Response>;
+    authorize: (request: Request) => Promise<Response>;
+    callback: (request: Request) => Promise<Response>;
+    token: (request: Request) => Promise<Response>;
+    /** Grant types to advertise in AS metadata. */
+    grantTypes: readonly ["authorization_code", "refresh_token"];
+    /** AS-metadata fields this proxy adds — merge into the discovery document so
+     *  the endpoints are only advertised where they actually exist. */
+    asMetadata: (request: Request) => {
+        authorization_endpoint: string;
+        registration_endpoint: string;
+    };
+    paths: Required<OAuthProxyPaths>;
+};
+export type OAuthProxy = ReturnType<typeof createOAuthProxy>;
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth-proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth-proxy/index.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;qFACiF;IACjF,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;IAClD,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;8EAC0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;4EACwE;IACxE,GAAG,CAAC,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;wEAGoE;IACpE,UAAU,CAAC,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC;CACpE;AAsDD,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,iBAAsB;wBAwF1B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;yBAyC1B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;wBAwC5B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;qBA0I9B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;IAmBvD,+CAA+C;;IAE/C;uEACmE;0BAC7C,OAAO;;;;;EAMhC;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/oauth-proxy/index.js

@@ -0,0 +1,385 @@
+// MCP OAuth 2.1 proxy: lets a *dynamic* client (Claude Desktop, Claude.ai, any
+// MCP client that speaks RFC 7591 Dynamic Client Registration) connect to a
+// remote MCP server without a human pasting an API key.
+//
+// It is a proxy, not an authorization server: the user actually authenticates
+// with WorkOS AuthKit, and we translate that into the OAuth shape MCP clients
+// expect. Four endpoints, all framework-agnostic (Request → Response):
+//
+//   POST /oauth/register   RFC 7591 — client registers, gets a client_id
+//   GET  /oauth/authorize  parks the client's request, redirects to AuthKit
+//   GET  /oauth/callback   AuthKit returns; we mint OUR code, bounce to the client
+//   POST /oauth/token      code → {access_token, refresh_token}; also refreshes
+//
+// The access token handed back is the WorkOS access token (short-lived, ~10 min).
+// The refresh token is OUR HS256 JWT wrapping the WorkOS refresh token, so the
+// client never holds WorkOS credentials directly and we can bind the token to
+// the client_id that obtained it.
+//
+// Why this lives here and not in an app: it is pure protocol plumbing with one
+// product-specific input (the WorkOS project). Two consumers already needed it,
+// and the second one copying the first is how the fallback-secret bug below got
+// duplicated in the first place.
+//
+// SECURITY — the refresh secret is REQUIRED. An earlier app-local version fell
+// back to `WORKOS_CLIENT_ID`, which is a *public* OAuth identifier that appears
+// in authorize URLs and discovery documents, so anyone who knew it could forge a
+// 30-day refresh token. There is deliberately no fallback here: without
+// REFRESH_TOKEN_SECRET the token endpoint returns server_error rather than
+// signing with something guessable.
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { getWorkOS } from "../workos.js";
+const b64url = (b) => b.toString("base64url");
+function jsonError(error, description, status = 400) {
+    return Response.json({ error, error_description: description }, { status });
+}
+function baseUrlFromRequest(request) {
+    const h = request.headers;
+    const host = h.get("x-forwarded-host") ?? h.get("host");
+    const proto = h.get("x-forwarded-proto") ?? (host?.startsWith("localhost") ? "http" : "https");
+    if (host)
+        return `${proto}://${host}`;
+    return new URL(request.url).origin;
+}
+/** RFC 7636. `plain` is accepted because the MCP spec still allows it, but S256
+ *  is what every real client sends. */
+function verifyCodeChallenge(verifier, challenge, method) {
+    if (method === "plain")
+        return verifier === challenge;
+    if (method === "S256")
+        return createHash("sha256").update(verifier).digest("base64url") === challenge;
+    return false;
+}
+export function createOAuthProxy(opts = {}) {
+    const paths = {
+        authorize: opts.paths?.authorize ?? "/oauth/authorize",
+        register: opts.paths?.register ?? "/oauth/register",
+        callback: opts.paths?.callback ?? "/oauth/callback",
+    };
+    const CLIENT_TTL = opts.ttl?.clientMs ?? 24 * 60 * 60 * 1000;
+    const SESSION_TTL = opts.ttl?.sessionMs ?? 10 * 60 * 1000;
+    const CODE_TTL = opts.ttl?.codeMs ?? 5 * 60 * 1000;
+    const ACCESS_TTL = opts.ttl?.accessTokenSeconds ?? 600;
+    const REFRESH_TTL = opts.ttl?.refreshSeconds ?? 30 * 24 * 60 * 60;
+    // In-memory, single-process — same assumption as the default claim store.
+    // Pruned on access rather than on a timer, so there is no dangling interval in
+    // a serverless/edge build.
+    const clients = new Map();
+    const sessions = new Map();
+    const codes = new Map();
+    function prune() {
+        const now = Date.now();
+        for (const [k, v] of clients)
+            if (now - v.created_at > CLIENT_TTL)
+                clients.delete(k);
+        for (const [k, v] of sessions)
+            if (now - v.created_at > SESSION_TTL)
+                sessions.delete(k);
+        for (const [k, v] of codes)
+            if (now - v.created_at > CODE_TTL)
+                codes.delete(k);
+    }
+    const baseUrlOf = (request) => typeof opts.baseUrl === "function"
+        ? opts.baseUrl(request)
+        : (opts.baseUrl ?? baseUrlFromRequest(request));
+    const workosClientId = () => opts.workosClientId ?? process.env.WORKOS_CLIENT_ID;
+    /** Throws when unset — callers turn that into a 500 rather than signing with
+     *  a guessable key. Read lazily so app boot never depends on it. */
+    function refreshKey() {
+        const s = opts.refreshSecret ?? process.env.REFRESH_TOKEN_SECRET;
+        if (!s) {
+            throw new Error("REFRESH_TOKEN_SECRET is not configured — the OAuth proxy refuses to sign refresh tokens without it");
+        }
+        return Buffer.from(s, "utf8");
+    }
+    // HS256 JWT by hand: `jose` would be a dependency for ~15 lines, and the
+    // format is wire-compatible with it (same header, same claims), so tokens
+    // minted by an app's previous jose-based implementation still verify here.
+    function signRefresh(workosRefreshToken, clientId) {
+        const now = Math.floor(Date.now() / 1000);
+        const header = b64url(Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+        const payload = b64url(Buffer.from(JSON.stringify({ wrt: workosRefreshToken, cid: clientId, iat: now, exp: now + REFRESH_TTL })));
+        const sig = b64url(createHmac("sha256", refreshKey()).update(`${header}.${payload}`).digest());
+        return `${header}.${payload}.${sig}`;
+    }
+    /** Throws if the secret is missing (a 500 condition), returns null for a token
+     *  that is simply invalid (a 400 condition). Conflating the two sent
+     *  "invalid_grant" to a client whose token was fine while WE were misconfigured. */
+    function verifyRefresh(token) {
+        const expected = (() => {
+            const parts = token.split(".");
+            if (parts.length !== 3)
+                return null;
+            return createHmac("sha256", refreshKey()).update(`${parts[0]}.${parts[1]}`).digest();
+        })();
+        if (!expected)
+            return null;
+        const parts = token.split(".");
+        const [, payload, sig] = parts;
+        const given = Buffer.from(sig, "base64url");
+        if (given.length !== expected.length || !timingSafeEqual(given, expected))
+            return null;
+        try {
+            const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+            if (!claims.wrt || !claims.cid)
+                return null;
+            if (claims.exp && Math.floor(Date.now() / 1000) >= claims.exp)
+                return null;
+            return { workosRefreshToken: claims.wrt, clientId: claims.cid };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** RFC 7591 dynamic client registration. Public clients only
+     *  (token_endpoint_auth_method: none) — PKCE is what protects the exchange. */
+    async function register(request) {
+        prune();
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return jsonError("invalid_client_metadata", "Invalid JSON body");
+        }
+        const uris = body.redirect_uris;
+        if (!Array.isArray(uris) || uris.length === 0) {
+            return jsonError("invalid_client_metadata", "redirect_uris is required and must be a non-empty array");
+        }
+        if (!uris.every((u) => typeof u === "string")) {
+            return jsonError("invalid_client_metadata", "Each redirect_uri must be a string");
+        }
+        const client = {
+            client_id: randomUUID(),
+            client_name: typeof body.client_name === "string" ? body.client_name : undefined,
+            redirect_uris: uris,
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+            created_at: Date.now(),
+        };
+        clients.set(client.client_id, client);
+        return Response.json({
+            client_id: client.client_id,
+            client_name: client.client_name,
+            redirect_uris: client.redirect_uris,
+            grant_types: client.grant_types,
+            response_types: client.response_types,
+            token_endpoint_auth_method: client.token_endpoint_auth_method,
+        }, { status: 201 });
+    }
+    /** Parks the client's request under a session id, then hands the user to
+     *  AuthKit. The session id travels as WorkOS's `state`, so the callback can
+     *  match the returning user back to the waiting client. */
+    async function authorize(request) {
+        prune();
+        const q = new URL(request.url).searchParams;
+        const clientId = q.get("client_id");
+        const redirectUri = q.get("redirect_uri");
+        if (!clientId || !redirectUri || q.get("response_type") !== "code") {
+            return jsonError("invalid_request", "Missing or invalid required parameters (client_id, redirect_uri, response_type=code)");
+        }
+        const client = clients.get(clientId);
+        if (!client)
+            return jsonError("invalid_client", "Unknown client_id");
+        if (!client.redirect_uris.includes(redirectUri)) {
+            return jsonError("invalid_request", "redirect_uri does not match registered URIs");
+        }
+        const wosClientId = workosClientId();
+        if (!wosClientId)
+            return jsonError("server_error", "WORKOS_CLIENT_ID is not configured", 500);
+        const sessionId = randomUUID();
+        sessions.set(sessionId, {
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            state: q.get("state") ?? undefined,
+            code_challenge: q.get("code_challenge") ?? undefined,
+            code_challenge_method: q.get("code_challenge_method") ?? undefined,
+            created_at: Date.now(),
+        });
+        const url = new URL("https://api.workos.com/user_management/authorize");
+        url.searchParams.set("client_id", wosClientId);
+        url.searchParams.set("redirect_uri", `${baseUrlOf(request)}${paths.callback}`);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("provider", "authkit");
+        url.searchParams.set("state", sessionId);
+        return Response.redirect(url.toString(), 302);
+    }
+    /** AuthKit's redirect target. Exchanges WorkOS's code for tokens, mints OUR
+     *  single-use code, and bounces back to the client's redirect_uri. */
+    async function callback(request) {
+        prune();
+        const q = new URL(request.url).searchParams;
+        const workosCode = q.get("code");
+        const sessionId = q.get("state");
+        if (!workosCode || !sessionId)
+            return jsonError("invalid_request", "Missing code or state parameter");
+        const session = sessions.get(sessionId);
+        if (!session)
+            return jsonError("invalid_request", "Invalid or expired session");
+        sessions.delete(sessionId);
+        const wosClientId = workosClientId();
+        if (!wosClientId)
+            return jsonError("server_error", "WORKOS_CLIENT_ID is not configured", 500);
+        let accessToken;
+        let refreshToken;
+        try {
+            const auth = await getWorkOS().userManagement.authenticateWithCode({
+                clientId: wosClientId,
+                code: workosCode,
+            });
+            accessToken = auth.accessToken;
+            refreshToken = auth.refreshToken;
+        }
+        catch (e) {
+            console.error("[oauth-proxy] WorkOS code exchange failed:", e);
+            return jsonError("server_error", "Failed to exchange authorization code with WorkOS", 500);
+        }
+        const code = randomUUID();
+        codes.set(code, {
+            client_id: session.client_id,
+            redirect_uri: session.redirect_uri,
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            code_challenge: session.code_challenge,
+            code_challenge_method: session.code_challenge_method,
+            used: false,
+            created_at: Date.now(),
+        });
+        const back = new URL(session.redirect_uri);
+        back.searchParams.set("code", code);
+        if (session.state)
+            back.searchParams.set("state", session.state);
+        return Response.redirect(back.toString(), 302);
+    }
+    async function handleAuthorizationCode(params) {
+        const { code, client_id, redirect_uri, code_verifier } = params;
+        if (!code || !client_id) {
+            return jsonError("invalid_request", "Missing required parameters (code, client_id)");
+        }
+        const entry = codes.get(code);
+        if (!entry)
+            return jsonError("invalid_grant", "Invalid or expired authorization code");
+        if (entry.used) {
+            // Replay: burn it. RFC 6749 §4.1.2 — a reused code must invalidate.
+            codes.delete(code);
+            return jsonError("invalid_grant", "Authorization code has already been used");
+        }
+        if (entry.client_id !== client_id)
+            return jsonError("invalid_grant", "client_id does not match");
+        if (redirect_uri && entry.redirect_uri !== redirect_uri) {
+            return jsonError("invalid_grant", "redirect_uri does not match");
+        }
+        if (entry.code_challenge && entry.code_challenge_method) {
+            if (!code_verifier)
+                return jsonError("invalid_request", "code_verifier is required for PKCE");
+            if (!verifyCodeChallenge(code_verifier, entry.code_challenge, entry.code_challenge_method)) {
+                return jsonError("invalid_grant", "PKCE code_verifier verification failed");
+            }
+        }
+        entry.used = true;
+        let refresh;
+        try {
+            refresh = signRefresh(entry.refresh_token, entry.client_id);
+        }
+        catch (e) {
+            console.error("[oauth-proxy]", e);
+            return jsonError("server_error", "Refresh-token signing is not configured", 500);
+        }
+        return Response.json({
+            access_token: entry.access_token,
+            token_type: "bearer",
+            expires_in: ACCESS_TTL,
+            refresh_token: refresh,
+        });
+    }
+    async function handleRefreshToken(params) {
+        const { refresh_token, client_id } = params;
+        if (!refresh_token || !client_id) {
+            return jsonError("invalid_request", "Missing required parameters (refresh_token, client_id)");
+        }
+        let decoded;
+        try {
+            decoded = verifyRefresh(refresh_token);
+        }
+        catch (e) {
+            console.error("[oauth-proxy]", e);
+            return jsonError("server_error", "Refresh-token verification is not configured", 500);
+        }
+        if (!decoded)
+            return jsonError("invalid_grant", "Invalid or expired refresh token");
+        if (decoded.clientId !== client_id)
+            return jsonError("invalid_grant", "client_id does not match");
+        const wosClientId = workosClientId();
+        if (!wosClientId)
+            return jsonError("server_error", "WORKOS_CLIENT_ID is not configured", 500);
+        try {
+            const auth = await getWorkOS().userManagement.authenticateWithRefreshToken({
+                clientId: wosClientId,
+                refreshToken: decoded.workosRefreshToken,
+            });
+            return Response.json({
+                access_token: auth.accessToken,
+                token_type: "bearer",
+                expires_in: ACCESS_TTL,
+                refresh_token: signRefresh(auth.refreshToken, client_id),
+            });
+        }
+        catch (e) {
+            console.error("[oauth-proxy] refresh exchange failed:", e);
+            return jsonError("invalid_grant", "Refresh token is no longer valid. Please re-authenticate.");
+        }
+    }
+    async function readBody(request) {
+        const ct = request.headers.get("content-type") ?? "";
+        try {
+            if (ct.includes("application/x-www-form-urlencoded")) {
+                const form = await request.formData();
+                const out = {};
+                form.forEach((v, k) => {
+                    out[k] = String(v);
+                });
+                return out;
+            }
+            return (await request.json());
+        }
+        catch {
+            return null;
+        }
+    }
+    /** POST /oauth/token — authorization_code + refresh_token, plus whatever
+     *  `claimGrant` chains in (auth.md's claim grant, in practice). */
+    async function token(request) {
+        prune();
+        const params = await readBody(request);
+        if (!params)
+            return jsonError("invalid_request", "Invalid request body");
+        if (params.grant_type === "authorization_code")
+            return handleAuthorizationCode(params);
+        if (params.grant_type === "refresh_token")
+            return handleRefreshToken(params);
+        const chained = typeof opts.claimGrant === "function" ? opts.claimGrant() : opts.claimGrant;
+        if (chained && params.grant_type === chained.type)
+            return chained.handle(params);
+        const supported = ["authorization_code", "refresh_token", chained?.type]
+            .filter(Boolean)
+            .join(", ");
+        return jsonError("unsupported_grant_type", `Supported grant types: ${supported}`);
+    }
+    return {
+        register,
+        authorize,
+        callback,
+        token,
+        /** Grant types to advertise in AS metadata. */
+        grantTypes: ["authorization_code", "refresh_token"],
+        /** AS-metadata fields this proxy adds — merge into the discovery document so
+         *  the endpoints are only advertised where they actually exist. */
+        asMetadata: (request) => ({
+            authorization_endpoint: `${baseUrlOf(request)}${paths.authorize}`,
+            registration_endpoint: `${baseUrlOf(request)}${paths.register}`,
+        }),
+        paths,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/oauth-proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth-proxy/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,wDAAwD;AACxD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,mFAAmF;AACnF,gFAAgF;AAChF,EAAE;AACF,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAC9E,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,iCAAiC;AACjC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,wEAAwE;AACxE,2EAA2E;AAC3E,oCAAoC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAqEzC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEtD,SAAS,SAAS,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAM,GAAG,GAAG;IACjE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/F,IAAI,IAAI;QAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACtC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC;AAED;uCACuC;AACvC,SAAS,mBAAmB,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC9E,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IACtD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA0B,EAAE;IAC3D,MAAM,KAAK,GAA8B;QACvC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,kBAAkB;QACtD,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,iBAAiB;QACnD,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,iBAAiB;KACpD,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,GAAG,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAElE,0EAA0E;IAC1E,+EAA+E;IAC/E,2BAA2B;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE/C,SAAS,KAAK;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,UAAU;gBAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,WAAW;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK;YAAE,IAAI,GAAG,GAAG,CAAC,CAAC,UAAU,GAAG,QAAQ;gBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAU,EAAE,CAC7C,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU;QAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAEjF;wEACoE;IACpE,SAAS,UAAU;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjE,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,SAAS,WAAW,CAAC,kBAA0B,EAAE,QAAgB;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,CACpB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,WAAW,EAAE,CAAC,CAAC,CAC1G,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED;;wFAEoF;IACpF,SAAS,aAAa,CAAC,KAAa;QAClC,MAAM,QAAQ,GAAG,CAAC,GAAkB,EAAE;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvF,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAI3E,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;mFAC+E;IAC/E,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,KAAK,EAAE,CAAC;QACR,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,yBAAyB,EAAE,yDAAyD,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAqB;YAC/B,SAAS,EAAE,UAAU,EAAE;YACvB,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAChF,aAAa,EAAE,IAAgB;YAC/B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,IAAI,CAClB;YACE,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;SAC9D,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;+DAE2D;IAC3D,KAAK,UAAU,SAAS,CAAC,OAAgB;QACvC,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAC5C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YACnE,OAAO,SAAS,CACd,iBAAiB,EACjB,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC,cAAc,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAE9F,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;YACtB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAClC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS;YACpD,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS;YAClE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kDAAkD,CAAC,CAAC;QACxE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED;0EACsE;IACtE,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAEtG,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QAChF,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC,cAAc,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAE9F,IAAI,WAAmB,CAAC;QACxB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBACjE,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO,SAAS,CAAC,cAAc,EAAE,mDAAmD,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;YACpD,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,MAA8B;QACnE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;QAChE,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACvF,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,oEAAoE;YACpE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,SAAS,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QACjG,IAAI,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;YACxD,IAAI,CAAC,aAAa;gBAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;YAC9F,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAElB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC,cAAc,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,UAAU;YACtB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,MAA8B;QAC9D,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC5C,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,OAAgE,CAAC;QACrE,IAAI,CAAC;YACH,OAAO,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC,cAAc,EAAE,8CAA8C,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QAElG,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC,cAAc,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,cAAc,CAAC,4BAA4B,CAAC;gBACzE,QAAQ,EAAE,WAAW;gBACrB,YAAY,EAAE,OAAO,CAAC,kBAAkB;aACzC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,UAAU;gBACtB,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO,SAAS,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;gBACvC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACpB,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC;YACb,CAAC;YACD,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;uEACmE;IACnE,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,KAAK,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB;YAAE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5F,IAAI,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,CAAC,oBAAoB,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;aACrE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,SAAS,CAAC,wBAAwB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,KAAK;QACL,+CAA+C;QAC/C,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAU;QAC5D;2EACmE;QACnE,UAAU,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC;YACjC,sBAAsB,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE;YACjE,qBAAqB,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE;SAChE,CAAC;QACF,KAAK;KACN,CAAC;AACJ,CAAC"}