@boopkit/cap-oauth-server 0.1.0

package/dist/client-registry-service.js

@@ -0,0 +1,450 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_REGISTERED_CLIENTS = exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = exports.DEFAULT_METADATA_MAX_AGE_MS = exports.DEFAULT_RESPONSE_TYPES = exports.DEFAULT_GRANT_TYPES = void 0;
+exports.validateRedirectUris = validateRedirectUris;
+exports.createClientRegistryService = createClientRegistryService;
+const errors_js_1 = require("./errors.js");
+const metadata_document_js_1 = require("./metadata-document.js");
+const public_id_js_1 = require("./public-id.js");
+const redirect_uri_js_1 = require("./redirect-uri.js");
+/**
+ * The client registry — who is asking, and what they are allowed to ask for.
+ *
+ * One table, one lookup path, three registration modes. A mode says where a
+ * client's *authoritative* metadata lives, and almost nothing else:
+ *
+ *   `dynamic`            open RFC 7591 registration; we own the metadata
+ *   `metadata_document`  the `client_id` is an https URL; the client owns it
+ *   `static`             an operator wrote the row; only an operator changes it
+ *
+ * ## What is not here
+ *
+ * Nothing user- or account-shaped. A client is software; the record tying a
+ * client to a *person* is the grant, which lives in cap-users' user properties
+ * and belongs to Slice 2. The registry never learns who consented.
+ *
+ * ## The abuse controls, and why they are fresh work
+ *
+ * Neither donor has an unauthenticated registration endpoint. Paywalls'
+ * `/oauth/register` requires a caller of user type `service-user` and creates a
+ * row owned by that caller's account; open registration has no caller and no
+ * account, so the gate that made paywalls' endpoint safe has nothing to map
+ * onto. What replaces it is here and in `createRegistrationRateLimiter`:
+ * `redirect_uris` required and validated at registration, a ceiling on total
+ * rows, per-IP rate limiting at the transport, and a prune for rows that never
+ * went anywhere.
+ */
+/** Sensible RFC 7591 defaults for a client that asked for nothing specific. */
+exports.DEFAULT_GRANT_TYPES = ['authorization_code', 'refresh_token'];
+exports.DEFAULT_RESPONSE_TYPES = ['code'];
+/** 24 hours. A cached metadata document older than this is re-fetched lazily. */
+exports.DEFAULT_METADATA_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+/** 30 days, per the plan: a dynamic row that never went anywhere is garbage. */
+exports.DEFAULT_ABANDONED_CLIENT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** How many rows open registration may create before it starts refusing. */
+exports.DEFAULT_MAX_REGISTERED_CLIENTS = 1000;
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+const invalidMetadata = (message) => new errors_js_1.ClientRegistryError('invalid_client_metadata', message);
+const invalidRedirect = (message) => new errors_js_1.ClientRegistryError('invalid_redirect_uri', message);
+/**
+ * The redirect-URI rule at *registration*, which is the other half of
+ * `matchRedirectUri`. The matcher decides whether a presented URI satisfies a
+ * stored one; this decides whether a URI may be stored at all.
+ *
+ * Both halves read `classifyRedirectUri`, and that is the point: a URI this
+ * function stores is by construction a URI the matcher will compare. The three
+ * shapes it admits — claimed https, loopback http, and an application's own
+ * private-use scheme — and the grounds each is admitted or refused on live in
+ * `redirect-uri.ts` next to the matching rule they have to agree with.
+ *
+ * This is the umbrella spec's "declared-but-unenforced redirect URI lists"
+ * defect closed at the point of entry: a list that was never validated going in
+ * cannot be enforced coming out, whatever the matcher does.
+ */
+function validateRedirectUris(value) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw invalidRedirect('redirect_uris is required and must be a non-empty array');
+    }
+    if (value.length > 20) {
+        throw invalidRedirect('redirect_uris holds more entries than any real client needs');
+    }
+    const uris = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string' || entry === '') {
+            throw invalidRedirect('every redirect_uris entry must be a non-empty string');
+        }
+        const verdict = (0, redirect_uri_js_1.classifyRedirectUri)(entry);
+        if (!verdict.accepted) {
+            throw invalidRedirect(`redirect_uris entry ${verdict.reason}: ${entry}`);
+        }
+        // The raw entry, not the parsed URL's serialization: matching is by exact
+        // string, so storing a normalized spelling would silently refuse the value
+        // the client will actually present.
+        uris.push(entry);
+    }
+    return uris;
+}
+function optionalString(value, field, maxLength = 2048) {
+    if (value === undefined || value === null || value === '')
+        return null;
+    if (typeof value !== 'string')
+        throw invalidMetadata(`${field} must be a string`);
+    if (value.length > maxLength)
+        throw invalidMetadata(`${field} is longer than ${maxLength}`);
+    return value;
+}
+function optionalStringArray(value, field) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value))
+        throw invalidMetadata(`${field} must be an array of strings`);
+    return value.map((entry) => {
+        if (typeof entry !== 'string')
+            throw invalidMetadata(`${field} must be an array of strings`);
+        return entry;
+    });
+}
+/** RFC 6749 §3.3: `scope` on the wire is one space-delimited string. */
+function parseScope(value, fallback) {
+    if (value === undefined || value === null || value === '')
+        return [...fallback];
+    if (typeof value !== 'string')
+        throw invalidMetadata('scope must be a space-delimited string');
+    const scopes = value.split(/\s+/).filter(Boolean);
+    return scopes.length > 0 ? scopes : [...fallback];
+}
+/**
+ * Only public clients, v1.
+ *
+ * Every client in the Claude ecosystem is public — a desktop app or a hosted
+ * connector that cannot keep a secret — and accepting a value we do not
+ * implement would advertise an authentication method the token endpoint will
+ * later refuse.
+ */
+function parseAuthMethod(value) {
+    if (value === undefined || value === null || value === '')
+        return 'none';
+    if (value !== 'none') {
+        throw invalidMetadata(`token_endpoint_auth_method must be "none"; this server issues only public clients`);
+    }
+    return 'none';
+}
+// ---------------------------------------------------------------------------
+// Row mapping
+// ---------------------------------------------------------------------------
+const asStringArray = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+const asDate = (value) => value instanceof Date ? value : new Date(value);
+function toClient(row) {
+    return {
+        id: row.id,
+        publicId: row.publicId,
+        clientId: row.clientId,
+        mode: row.mode,
+        status: row.status === 'suspended' ? 'suspended' : 'enabled',
+        name: row.name ?? null,
+        description: row.description ?? null,
+        logoUri: row.logoUri ?? null,
+        clientUri: row.clientUri ?? null,
+        contacts: asStringArray(row.contacts),
+        softwareId: row.softwareId ?? null,
+        softwareVersion: row.softwareVersion ?? null,
+        policyUri: row.policyUri ?? null,
+        tosUri: row.tosUri ?? null,
+        redirectUris: asStringArray(row.redirectUris),
+        grantTypes: asStringArray(row.grantTypes),
+        responseTypes: asStringArray(row.responseTypes),
+        scopes: asStringArray(row.scopes),
+        tokenEndpointAuthMethod: row.tokenEndpointAuthMethod ?? 'none',
+        metadataUri: row.metadataUri ?? null,
+        metadataFetchedAt: row.metadataFetchedAt == null ? null : asDate(row.metadataFetchedAt),
+        createdAt: asDate(row.createdAt),
+        updatedAt: asDate(row.updatedAt),
+    };
+}
+// ---------------------------------------------------------------------------
+// The service
+// ---------------------------------------------------------------------------
+function createClientRegistryService(model, options = {}) {
+    const now = options.now ?? (() => new Date());
+    const defaultScopes = options.defaultScopes ?? [];
+    const maxRegisteredClients = options.maxRegisteredClients ?? exports.DEFAULT_MAX_REGISTERED_CLIENTS;
+    const metadataMaxAgeMs = options.metadataMaxAgeMs ?? exports.DEFAULT_METADATA_MAX_AGE_MS;
+    const fetchLimits = {
+        timeoutMs: options.metadataTimeoutMs ?? metadata_document_js_1.DEFAULT_METADATA_TIMEOUT_MS,
+        maxBytes: options.metadataMaxBytes ?? metadata_document_js_1.DEFAULT_METADATA_MAX_BYTES,
+        maxRedirects: options.metadataMaxRedirects ?? metadata_document_js_1.DEFAULT_METADATA_MAX_REDIRECTS,
+    };
+    const service = {
+        async registerDynamic(input) {
+            const redirectUris = validateRedirectUris(input.redirect_uris);
+            if (Number.isFinite(maxRegisteredClients)) {
+                const registered = await model.count({ where: { mode: 'dynamic' } });
+                if (registered >= maxRegisteredClients) {
+                    throw new errors_js_1.ClientRegistryError('boop_registration_capacity', 'the client registry has reached its configured ceiling');
+                }
+            }
+            const publicId = (0, public_id_js_1.generateClientPublicId)();
+            const row = await model.create({
+                data: {
+                    publicId,
+                    // For a dynamic client the `client_id` *is* the `publicId`. That is
+                    // what makes `<client_id>.<token>` and `<publicId>.<token>` the same
+                    // string for two of the three modes, and why only CIMD needs the
+                    // indirection at all.
+                    clientId: publicId,
+                    mode: 'dynamic',
+                    status: 'enabled',
+                    name: optionalString(input.client_name, 'client_name', 255),
+                    description: null,
+                    logoUri: optionalString(input.logo_uri, 'logo_uri'),
+                    clientUri: optionalString(input.client_uri, 'client_uri'),
+                    contacts: optionalStringArray(input.contacts, 'contacts'),
+                    softwareId: optionalString(input.software_id, 'software_id', 255),
+                    softwareVersion: optionalString(input.software_version, 'software_version', 255),
+                    policyUri: optionalString(input.policy_uri, 'policy_uri'),
+                    tosUri: optionalString(input.tos_uri, 'tos_uri'),
+                    redirectUris,
+                    grantTypes: normaliseGrantTypes(input.grant_types),
+                    responseTypes: normaliseResponseTypes(input.response_types),
+                    scopes: parseScope(input.scope, defaultScopes),
+                    tokenEndpointAuthMethod: parseAuthMethod(input.token_endpoint_auth_method),
+                },
+            });
+            return toClient(row);
+        },
+        async resolveMetadataDocument(clientId) {
+            if (!(0, metadata_document_js_1.isValidMetadataUri)(clientId)) {
+                throw new errors_js_1.ClientRegistryError('boop_metadata_document_unusable', `client_id is not a usable https metadata document URL: ${clientId}`);
+            }
+            const fetchImpl = options.fetch;
+            if (!fetchImpl) {
+                throw new errors_js_1.ClientRegistryError('boop_metadata_document_unusable', 'this registry was built without an HTTP boundary, so it cannot fetch a metadata document');
+            }
+            const existing = await model.findUnique({ where: { clientId } });
+            // No cached copy: a first fetch that fails *does* fail the request,
+            // because there is nothing to fall back to and consent would otherwise
+            // show a nameless client.
+            if (!existing) {
+                const doc = await (0, metadata_document_js_1.fetchMetadataDocument)(clientId, fetchImpl, fetchLimits);
+                const fields = readMetadataDocument(doc, defaultScopes);
+                const row = await model.create({
+                    data: {
+                        publicId: (0, public_id_js_1.generateClientPublicId)(),
+                        clientId,
+                        mode: 'metadata_document',
+                        status: 'enabled',
+                        metadataUri: clientId,
+                        metadataFetchedAt: now(),
+                        description: null,
+                        ...fields,
+                    },
+                });
+                return toClient(row);
+            }
+            const cached = toClient(existing);
+            if (cached.mode !== 'metadata_document') {
+                // A `static` or `dynamic` row already owns this `client_id`. Refetching
+                // over it would let whoever controls the URL rewrite a row an operator
+                // wrote.
+                return cached;
+            }
+            const fetchedAt = cached.metadataFetchedAt;
+            const age = fetchedAt ? now().getTime() - fetchedAt.getTime() : Number.POSITIVE_INFINITY;
+            if (age < metadataMaxAgeMs)
+                return cached;
+            // Stale. Re-fetch lazily — and **fall back to the cached copy when the
+            // re-fetch fails**. A client whose document is briefly unreachable should
+            // not break consent for users who already trust it, and the cached copy
+            // is metadata we validated ourselves the last time it was reachable.
+            try {
+                const doc = await (0, metadata_document_js_1.fetchMetadataDocument)(cached.metadataUri ?? clientId, fetchImpl, fetchLimits);
+                const fields = readMetadataDocument(doc, defaultScopes);
+                const row = await model.update({
+                    where: { clientId },
+                    data: { ...fields, metadataFetchedAt: now() },
+                });
+                return toClient(row);
+            }
+            catch (err) {
+                options.onMetadataRefreshFailed?.(clientId, err);
+                return cached;
+            }
+        },
+        async registerStaticClient(input) {
+            const redirectUris = validateRedirectUris(input.redirectUris);
+            if (!input.clientId)
+                throw invalidMetadata('a static client needs a clientId');
+            if (!input.name)
+                throw invalidMetadata('a static client needs a name for the consent screen');
+            const data = {
+                mode: 'static',
+                status: 'enabled',
+                name: input.name,
+                description: optionalString(input.description, 'description'),
+                logoUri: optionalString(input.logoUri, 'logoUri'),
+                clientUri: optionalString(input.clientUri, 'clientUri'),
+                contacts: input.contacts ?? [],
+                softwareId: optionalString(input.softwareId, 'softwareId', 255),
+                softwareVersion: optionalString(input.softwareVersion, 'softwareVersion', 255),
+                policyUri: optionalString(input.policyUri, 'policyUri'),
+                tosUri: optionalString(input.tosUri, 'tosUri'),
+                redirectUris,
+                grantTypes: input.grantTypes ?? [...exports.DEFAULT_GRANT_TYPES],
+                responseTypes: input.responseTypes ?? [...exports.DEFAULT_RESPONSE_TYPES],
+                scopes: input.scopes ?? [...defaultScopes],
+                tokenEndpointAuthMethod: 'none',
+            };
+            // Idempotent, because a seed script must be safe to run twice
+            // (boop-database-prisma, "Seed Scripts"). The `publicId` is minted only
+            // on the first write: re-seeding must not change the token prefix that
+            // every live token for this client already carries.
+            const existing = await model.findUnique({ where: { clientId: input.clientId } });
+            if (existing) {
+                const row = await model.update({ where: { clientId: input.clientId }, data });
+                return toClient(row);
+            }
+            const row = await model.create({
+                data: { publicId: (0, public_id_js_1.generateClientPublicId)(), clientId: input.clientId, ...data },
+            });
+            return toClient(row);
+        },
+        async findByClientId(clientId) {
+            if (typeof clientId !== 'string' || clientId === '')
+                return null;
+            const row = await model.findUnique({ where: { clientId } });
+            return row ? toClient(row) : null;
+        },
+        async findByPublicId(publicId) {
+            if (typeof publicId !== 'string' || publicId === '')
+                return null;
+            const row = await model.findUnique({ where: { publicId } });
+            return row ? toClient(row) : null;
+        },
+        async suspend(clientId) {
+            await requireClient(model, clientId);
+            const row = await model.update({ where: { clientId }, data: { status: 'suspended' } });
+            return toClient(row);
+        },
+        async unsuspend(clientId) {
+            await requireClient(model, clientId);
+            const row = await model.update({ where: { clientId }, data: { status: 'enabled' } });
+            return toClient(row);
+        },
+        async updateRegistration(clientId, input) {
+            const client = await requireClient(model, clientId);
+            refuseStatic(client, 'modified');
+            const data = {};
+            if (input.redirect_uris !== undefined) {
+                data.redirectUris = validateRedirectUris(input.redirect_uris);
+            }
+            if (input.client_name !== undefined) {
+                data.name = optionalString(input.client_name, 'client_name', 255);
+            }
+            if (input.client_uri !== undefined)
+                data.clientUri = optionalString(input.client_uri, 'client_uri');
+            if (input.logo_uri !== undefined)
+                data.logoUri = optionalString(input.logo_uri, 'logo_uri');
+            if (input.contacts !== undefined)
+                data.contacts = optionalStringArray(input.contacts, 'contacts');
+            if (input.policy_uri !== undefined)
+                data.policyUri = optionalString(input.policy_uri, 'policy_uri');
+            if (input.tos_uri !== undefined)
+                data.tosUri = optionalString(input.tos_uri, 'tos_uri');
+            if (input.scope !== undefined)
+                data.scopes = parseScope(input.scope, defaultScopes);
+            const row = await model.update({ where: { clientId }, data });
+            return toClient(row);
+        },
+        async deleteRegistration(clientId) {
+            const client = await requireClient(model, clientId);
+            refuseStatic(client, 'deleted');
+            await model.delete({ where: { clientId } });
+        },
+        async countRegistered() {
+            return model.count({ where: { mode: 'dynamic' } });
+        },
+        async pruneAbandonedClients(pruneOptions = {}) {
+            const before = pruneOptions.before ?? new Date(now().getTime() - exports.DEFAULT_ABANDONED_CLIENT_TTL_MS);
+            const isInUse = pruneOptions.isInUse ?? (async () => false);
+            const rows = await model.findMany({
+                where: { mode: 'dynamic', createdAt: { lt: before } },
+            });
+            const removed = [];
+            for (const row of rows) {
+                const client = toClient(row);
+                if (await isInUse(client))
+                    continue;
+                await model.delete({ where: { clientId: client.clientId } });
+                removed.push(client.clientId);
+            }
+            return removed;
+        },
+    };
+    return service;
+}
+async function requireClient(model, clientId) {
+    const row = await model.findUnique({ where: { clientId } });
+    if (!row)
+        throw new errors_js_1.ClientRegistryError('invalid_client', `no such client: ${clientId}`);
+    return toClient(row);
+}
+/**
+ * A `static` row belongs to the operator who wrote it.
+ *
+ * This is a check in the service rather than a convention anyone remembers,
+ * because the thing it prevents — an unauthenticated registration surface
+ * rewriting the redirect URIs of a client the operator vouched for — is exactly
+ * the kind of hole a convention leaves open the first time someone adds a
+ * route.
+ */
+function refuseStatic(client, verb) {
+    if (client.mode === 'static') {
+        throw new errors_js_1.ClientRegistryError('boop_static_client_immutable', `${client.clientId} is a static client and cannot be ${verb} through the registration surface`);
+    }
+}
+/** Grant types this server implements, filtered to what the client asked for. */
+function normaliseGrantTypes(value) {
+    const requested = optionalStringArray(value, 'grant_types');
+    if (requested.length === 0)
+        return [...exports.DEFAULT_GRANT_TYPES];
+    const unsupported = requested.filter((g) => !exports.DEFAULT_GRANT_TYPES.includes(g));
+    if (unsupported.length > 0) {
+        throw invalidMetadata(`unsupported grant_types: ${unsupported.join(', ')}`);
+    }
+    return requested;
+}
+function normaliseResponseTypes(value) {
+    const requested = optionalStringArray(value, 'response_types');
+    if (requested.length === 0)
+        return [...exports.DEFAULT_RESPONSE_TYPES];
+    const unsupported = requested.filter((r) => !exports.DEFAULT_RESPONSE_TYPES.includes(r));
+    if (unsupported.length > 0) {
+        throw invalidMetadata(`unsupported response_types: ${unsupported.join(', ')}`);
+    }
+    return requested;
+}
+/**
+ * Read a fetched document into row fields.
+ *
+ * Everything on the document is a claim by whoever owns the URL, so the same
+ * validation the registration endpoint applies runs here too — in particular
+ * `redirect_uris`, which is the field an attacker would want to control.
+ */
+function readMetadataDocument(doc, defaultScopes) {
+    return {
+        name: optionalString(doc.client_name, 'client_name', 255),
+        logoUri: optionalString(doc.logo_uri, 'logo_uri'),
+        clientUri: optionalString(doc.client_uri, 'client_uri'),
+        contacts: optionalStringArray(doc.contacts, 'contacts'),
+        policyUri: optionalString(doc.policy_uri, 'policy_uri'),
+        tosUri: optionalString(doc.tos_uri, 'tos_uri'),
+        redirectUris: validateRedirectUris(doc.redirect_uris),
+        grantTypes: normaliseGrantTypes(doc.grant_types),
+        responseTypes: normaliseResponseTypes(doc.response_types),
+        scopes: parseScope(doc.scope, defaultScopes),
+        tokenEndpointAuthMethod: parseAuthMethod(doc.token_endpoint_auth_method),
+    };
+}
+//# sourceMappingURL=client-registry-service.js.map

package/dist/client-registry-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registry-service.js","sourceRoot":"","sources":["../src/client-registry-service.ts"],"names":[],"mappings":";;;AAyJA,oDA0BC;AAsFD,kEAoPC;AA7fD,2CAAkD;AAClD,iEAOgC;AAChC,iDAAwD;AACxD,uDAAwD;AAUxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,+EAA+E;AAClE,QAAA,mBAAmB,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAC9D,QAAA,sBAAsB,GAAG,CAAC,MAAM,CAAC,CAAC;AAE/C,iFAAiF;AACpE,QAAA,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,gFAAgF;AACnE,QAAA,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExE,4EAA4E;AAC/D,QAAA,8BAA8B,GAAG,IAAK,CAAC;AAqEpD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,+BAAmB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AAE9D,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,+BAAmB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,yDAAyD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,eAAe,CAAC,6DAA6D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,eAAe,CAAC,sDAAsD,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,qCAAmB,EAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,eAAe,CAAC,uBAAuB,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,EAAE,SAAS,GAAG,IAAI;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,mBAAmB,SAAS,EAAE,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,eAAe,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,KAAc,EAAE,QAAkB;IACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,eAAe,CAAC,wCAAwC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IACzE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,eAAe,CACnB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAc,EAAY,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAElG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAQ,EAAE,CACtC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAe,CAAC,CAAC;AAE5D,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,IAAI,EAAE,GAAG,CAAC,IAAkB;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC5D,IAAI,EAAG,GAAG,CAAC,IAAsB,IAAI,IAAI;QACzC,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,OAAO,EAAG,GAAG,CAAC,OAAyB,IAAI,IAAI;QAC/C,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QACnD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACrD,eAAe,EAAG,GAAG,CAAC,eAAiC,IAAI,IAAI;QAC/D,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QACnD,MAAM,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC7C,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7C,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QAC/C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,uBAAuB,EAAG,GAAG,CAAC,uBAAkC,IAAI,MAAM;QAC1E,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACvF,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAgB,2BAA2B,CACzC,KAA0B,EAC1B,UAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,sCAA8B,CAAC;IAC5F,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mCAA2B,CAAC;IACjF,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,OAAO,CAAC,iBAAiB,IAAI,kDAA2B;QACnE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,IAAI,iDAA0B;QAChE,YAAY,EAAE,OAAO,CAAC,oBAAoB,IAAI,qDAA8B;KAC7E,CAAC;IAEF,MAAM,OAAO,GAA0B;QACrC,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAE/D,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBACrE,IAAI,UAAU,IAAI,oBAAoB,EAAE,CAAC;oBACvC,MAAM,IAAI,+BAAmB,CAC3B,4BAA4B,EAC5B,wDAAwD,CACzD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,qCAAsB,GAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE;oBACJ,QAAQ;oBACR,oEAAoE;oBACpE,qEAAqE;oBACrE,iEAAiE;oBACjE,sBAAsB;oBACtB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,SAAS;oBACjB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;oBAC3D,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACnD,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;oBACzD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;oBACzD,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;oBACjE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,CAAC;oBAChF,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;oBACzD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;oBAChD,YAAY;oBACZ,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC;oBAClD,aAAa,EAAE,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC;oBAC3D,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC;oBAC9C,uBAAuB,EAAE,eAAe,CAAC,KAAK,CAAC,0BAA0B,CAAC;iBAC3E;aACF,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,QAAQ;YACpC,IAAI,CAAC,IAAA,yCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAmB,CAC3B,iCAAiC,EACjC,0DAA0D,QAAQ,EAAE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,+BAAmB,CAC3B,iCAAiC,EACjC,0FAA0F,CAC3F,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEjE,oEAAoE;YACpE,uEAAuE;YACvE,0BAA0B;YAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,IAAA,4CAAqB,EAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,IAAI,EAAE;wBACJ,QAAQ,EAAE,IAAA,qCAAsB,GAAE;wBAClC,QAAQ;wBACR,IAAI,EAAE,mBAAmB;wBACzB,MAAM,EAAE,SAAS;wBACjB,WAAW,EAAE,QAAQ;wBACrB,iBAAiB,EAAE,GAAG,EAAE;wBACxB,WAAW,EAAE,IAAI;wBACjB,GAAG,MAAM;qBACV;iBACF,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACxC,wEAAwE;gBACxE,uEAAuE;gBACvE,SAAS;gBACT,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzF,IAAI,GAAG,GAAG,gBAAgB;gBAAE,OAAO,MAAM,CAAC;YAE1C,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAA,4CAAqB,EAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAChG,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAC7B,KAAK,EAAE,EAAE,QAAQ,EAAE;oBACnB,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,uBAAuB,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAK;YAC9B,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,MAAM,eAAe,CAAC,kCAAkC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,IAAI;gBAAE,MAAM,eAAe,CAAC,qDAAqD,CAAC,CAAC;YAE9F,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;gBAC7D,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;gBACjD,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;gBACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;gBAC9B,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC;gBAC/D,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC;gBAC9E,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;gBACvD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAC9C,YAAY;gBACZ,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,GAAG,2BAAmB,CAAC;gBACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,GAAG,8BAAsB,CAAC;gBACjE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,aAAa,CAAC;gBAC1C,uBAAuB,EAAE,MAAM;aAChC,CAAC;YAEF,8DAA8D;YAC9D,wEAAwE;YACxE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAA,qCAAsB,GAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;aAChF,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK;YACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAEjC,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAClG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAEpF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ;YAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,eAAe;YACnB,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,YAAY,GAAG,EAAE;YAC3C,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,uCAA+B,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;aACtD,CAAC,CAAC;YAEH,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACpC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC7D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAA0B,EAC1B,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,+BAAmB,CAAC,gBAAgB,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,MAAmB,EAAE,IAAY;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,+BAAmB,CAC3B,8BAA8B,EAC9B,GAAG,MAAM,CAAC,QAAQ,qCAAqC,IAAI,mCAAmC,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,2BAAmB,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,2BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,4BAA4B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,8BAAsB,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8BAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,eAAe,CAAC,+BAA+B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,GAA6B,EAC7B,aAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC;QACzD,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACvD,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACvD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACvD,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QAC9C,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;QACrD,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC;QAChD,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC;QACzD,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5C,uBAAuB,EAAE,eAAe,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,82 @@
+import { type DiscoveryConfig } from './discovery.js';
+/**
+ * Reading the capability's configuration out of the environment.
+ *
+ * ## Why the environment, and why here
+ *
+ * boop has no feature-flag system — the findings grepped every capability's
+ * `src/` and `scaffold/src/` for one and came back empty — so the `env` array in
+ * `capability.json` is the mechanism boop actually ships: it appends the
+ * declared variables to `.env` and records them in `.boop/config.json`.
+ *
+ * The parsing lives in the package rather than in the scaffold binding file for
+ * one reason: a value that is clamped, defaulted or warned about is behaviour,
+ * and behaviour in a scaffold file is behaviour that cannot be tested here and
+ * is copied into an application once and then never updated.
+ *
+ * ## Read once, at construction
+ *
+ * Every value here is read at boot, not per request, so a running process has
+ * one answer and a clamp warning fires once rather than on every token.
+ */
+/** RFC 6749 has no opinion; these are Decision 1's numbers. */
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 900;
+export declare const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 7776000;
+/**
+ * Clamps, not rejections.
+ *
+ * Above an hour the blast-radius argument for a short access token evaporates
+ * and we would be shipping a footgun as configuration; below a minute nothing
+ * works. But an application should not fail to boot over a token lifetime, so
+ * an out-of-range value is clamped and named in a warning.
+ */
+export declare const ACCESS_TOKEN_TTL_BOUNDS: {
+    readonly min: 60;
+    readonly max: 3600;
+};
+export declare const REFRESH_TOKEN_TTL_BOUNDS: {
+    readonly min: 3600;
+    readonly max: 31536000;
+};
+export interface ServerConfig extends DiscoveryConfig {
+    accessTokenTtlSeconds: number;
+    refreshTokenTtlSeconds: number;
+    maxRegisteredClients: number;
+    registrationRateLimit: number;
+    registrationRateWindowMs: number;
+}
+export interface ReadConfigOptions {
+    /** Where a clamp or a fallback is announced. Defaults to `console.warn`. */
+    warn?(message: string): void;
+}
+type Env = Record<string, string | undefined>;
+export declare class OauthServerConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Bring a lifetime inside its documented bounds, naming the value and the bound
+ * if it was out of range.
+ *
+ * Exported because the *number* is clamped in two places for one reason: this
+ * module clamps what the environment said, and the token service clamps what it
+ * was constructed with. Those are not the same event — an application that
+ * builds the token service from a literal rather than from `readServerConfig`
+ * bypasses the first entirely — and a clamp that only one of them applies is a
+ * clamp a caller can walk around. One function, called twice, cannot disagree
+ * with itself about where the bounds are.
+ */
+export declare function clampTtlSeconds(value: number, bounds: {
+    min: number;
+    max: number;
+}, name: string, warn: (message: string) => void): number;
+/**
+ * Build the whole capability's configuration from an environment.
+ *
+ * Throws only for `OAUTH_ISSUER_URL`, which is `required: "boot"` in the
+ * manifest: every endpoint this capability serves is an absolute URL built from
+ * it, and a wrong issuer produces discovery documents that send clients
+ * somewhere else. That is worth refusing to boot over; a token lifetime is not.
+ */
+export declare function readServerConfig(env: Env, options?: ReadConfigOptions): ServerConfig;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMhF;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,gCAAgC,MAAM,CAAC;AACpD,eAAO,MAAM,iCAAiC,UAAY,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;CAAmC,CAAC;AACxE,eAAO,MAAM,wBAAwB;;;CAA2C,CAAC;AAEjF,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,MAAM,CAcR;AAuCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE,iBAAsB,GAAG,YAAY,CAgFxF"}