@boopkit/cap-oauth-server 0.1.0

package/dist/consent-controller.js

@@ -0,0 +1,532 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCOPE_DESCRIPTIONS_LOCAL = void 0;
+exports.toScopeViews = toScopeViews;
+exports.scopeDescriptionsFrom = scopeDescriptionsFrom;
+exports.warnUndescribedScopes = warnUndescribedScopes;
+exports.provenanceFor = provenanceFor;
+exports.safeLogoUri = safeLogoUri;
+exports.monogramFor = monogramFor;
+exports.createConsentHandlers = createConsentHandlers;
+exports.createConsentRouter = createConsentRouter;
+const express_1 = require("express");
+const pkce_js_1 = require("./pkce.js");
+const redirect_uri_js_1 = require("./redirect-uri.js");
+require("./express.js");
+/**
+ * `GET` and `POST /oauth/authorize` — the consent screen.
+ *
+ * This is the product of the capability. Everything else is plumbing that makes
+ * this page's answer enforceable, and the page belongs to the application it is
+ * rendered in: it is one of the app's own pages, met at the moment somebody is
+ * deciding whether to trust a third party. It is not a protocol console.
+ *
+ * ## One page, three variants
+ *
+ * Authenticated, inline login, inline signup — following both donors, because
+ * an authorization request is a long query string and round-tripping it through
+ * cap-users' `?next=` would mean URL-encoding a URL into a redirect target,
+ * which is fragile and is the classic open-redirect shape. The request stays on
+ * the page in hidden fields and posts back here.
+ *
+ * **Signing in is the application's decision, not ours.** Both faces resolve
+ * credentials through injected `signIn` and `register` ports rather than
+ * through cap-users' `authService`, so an application whose own login admits
+ * somebody this page would refuse cannot end up with two doors that disagree
+ * about the same password. See `ConsentSignIn` for the failure that produced
+ * the ports.
+ *
+ * **Inline signup does not approve.** Both donors continue straight from a
+ * successful inline registration into the approval path, so one button press
+ * creates an account *and* grants a third party access to it. Those are two
+ * decisions with different consequences, and the second one is the entire point
+ * of the page. After signup the consent card is re-rendered in its
+ * authenticated variant and a second, explicit Approve is required. The cost is
+ * one extra click on the rarest path.
+ *
+ * ## Two hostile inputs the page is built against
+ *
+ * **`logo_uri` belongs to a stranger.** Under open dynamic registration the
+ * name, description and icon are supplied by an unauthenticated registrant, and
+ * they are the entire evidence base for the only decision on the page. So the
+ * icon renders inside a **fixed box** whose size is set in CSS and never by the
+ * image, an unusable or absent `logo_uri` falls back to a monogram, and the
+ * provenance line says in words where the client's claims came from — an
+ * operator-configured client can say so, a metadata-document client names the
+ * origin its document was fetched from, and a self-registered one says that
+ * nothing about it has been verified.
+ *
+ * **Raw scope strings are not consent.** What `workflows:advance` means is the
+ * application's domain knowledge, which the umbrella spec makes explicit — so
+ * this capability has no map to ship and no way to invent one. Descriptions
+ * come from `app.locals.oauthScopeDescriptions`, published the way
+ * cap-oauth-client publishes its provider buttons, and any advertised scope the
+ * application did not describe produces a **boot warning naming it**. Asking
+ * somebody to approve a string they cannot evaluate is asking a question they
+ * are not prepared to answer.
+ *
+ * ## And the coverage statement
+ *
+ * The settled data model keys the grant on the *user*, so a client reaches
+ * every account that user reaches, present and future. No donor page says
+ * anything of the kind, because neither donor had a multi-account model. It
+ * goes **before** the Approve button: a person cannot discover afterwards that
+ * they approved a connector for accounts they did not have in mind.
+ */
+/** The session cookie cap-users sets. Matched so inline login logs in here. */
+const SESSION_COOKIE = 'auth_id';
+const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+exports.SCOPE_DESCRIPTIONS_LOCAL = 'oauthScopeDescriptions';
+/**
+ * Turn a scope list into what a page shows, given the application's vocabulary.
+ *
+ * Exported because the consent screen and the connected-clients screen must
+ * describe the same scope with the same words. A user who approved "See your
+ * name and email address" and later reads "profile" on the management screen
+ * cannot tell they are looking at the same thing.
+ */
+function toScopeViews(scopes, descriptions) {
+    return scopes.map((value) => {
+        const description = descriptions?.[value];
+        const described = typeof description === 'string' && description.trim() !== '';
+        return { value, description: described ? description.trim() : value, described };
+    });
+}
+/**
+ * The application's scope vocabulary, wherever it was published.
+ *
+ * `app.locals` wins over anything passed at construction, because it is written
+ * later and by the application itself. Merging rather than choosing means the
+ * two cannot silently disagree: a factory argument that the page ignored used to
+ * be enough to silence the boot warning while the page still showed raw strings.
+ */
+function scopeDescriptionsFrom(req, defaults) {
+    const published = req.app?.locals?.[exports.SCOPE_DESCRIPTIONS_LOCAL];
+    if (!published)
+        return defaults;
+    if (!defaults)
+        return published;
+    return { ...defaults, ...published };
+}
+/**
+ * Warn, once at boot, about every advertised scope the application has not
+ * described.
+ *
+ * Called from the router factory rather than left to the developer to remember,
+ * because the failure it prevents is silent: the page renders, the raw string
+ * appears where a sentence should be, and nothing anywhere says that a consent
+ * screen is asking an unanswerable question.
+ */
+function warnUndescribedScopes(scopesSupported, descriptions, warn = (message) => console.warn(`[cap-oauth-server] ${message}`)) {
+    const undescribed = scopesSupported.filter((scope) => typeof descriptions?.[scope] !== 'string' || descriptions[scope].trim() === '');
+    if (undescribed.length > 0) {
+        warn(`no consent-screen description for ${undescribed.join(', ')} — the consent page will show ` +
+            `the raw scope string, which asks the user to approve something they cannot evaluate. ` +
+            `Set app.locals.${exports.SCOPE_DESCRIPTIONS_LOCAL}.`);
+    }
+    return undescribed;
+}
+/** What the page says about where this client's claims came from. */
+function provenanceFor(client) {
+    const mode = client.mode;
+    if (mode === 'static') {
+        return 'This application was configured by the people who run this site.';
+    }
+    if (mode === 'metadata_document') {
+        let origin = client.metadataUri ?? client.clientId;
+        try {
+            origin = new URL(origin).origin;
+        }
+        catch {
+            // Left as the raw string; it is escaped by the template either way.
+        }
+        return `Its details were published at ${origin}.`;
+    }
+    return 'This application registered itself. Nothing about it has been verified.';
+}
+/**
+ * An icon URL we are willing to put in an `<img src>`, or nothing.
+ *
+ * `https` only. `http` would break the page's padlock, and `data:` and
+ * `javascript:` are a stranger's payload rendered inside our own origin's page.
+ * The box's size is fixed in CSS regardless, so this decides only whether there
+ * is an image at all — never how much room it gets.
+ */
+function safeLogoUri(value) {
+    if (typeof value !== 'string' || value.trim() === '')
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The letter in the icon box when there is no usable image. */
+function monogramFor(client) {
+    // The name first, then the `client_id`, then a question mark. Falling through
+    // matters because a registrant supplies the name: `"   "` and `"!!!"` are
+    // both names a stranger can register, and an empty icon box reads as a broken
+    // page rather than as a client with a strange name.
+    for (const source of [client.name, client.clientId]) {
+        if (typeof source !== 'string')
+            continue;
+        const first = [...source.trim()].find((ch) => /[\p{L}\p{N}]/u.test(ch));
+        if (first)
+            return first.toUpperCase();
+    }
+    return '?';
+}
+/** Errors that must be shown on our own page, because we cannot redirect yet. */
+class ConsentRequestError extends Error {
+    constructor(message, status = 400) {
+        super(message);
+        this.name = 'ConsentRequestError';
+        this.status = status;
+    }
+}
+/** Errors that RFC 6749 §4.1.2.1 says go back to the client as a redirect. */
+class RedirectableError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'RedirectableError';
+        this.code = code;
+    }
+}
+function first(value) {
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        return trimmed === '' ? undefined : trimmed;
+    }
+    // Express hands back an array for a repeated parameter. A repeated
+    // `redirect_uri` is not a request we should try to interpret.
+    return undefined;
+}
+function parseScopeList(raw) {
+    if (!raw)
+        return [];
+    return [...new Set(raw.split(/\s+/).filter(Boolean))];
+}
+function createConsentHandlers(deps) {
+    const { clientRegistry, authorizationCodeService, signIn, register, scopesSupported } = deps;
+    const viewName = deps.viewName ?? 'oauth-consent';
+    const layout = deps.layout ?? 'main';
+    const actionPath = deps.actionPath ?? '/oauth/authorize';
+    /**
+     * Resolve the client and the redirect URI *before* anything else is judged.
+     *
+     * The order is RFC 6749 §4.1.2.1's and it is not a style choice: until both
+     * are known good there is nowhere safe to send an error, so every other
+     * failure has to be reported on our own page. Once they are, every remaining
+     * failure goes back to the client as a redirect, because a client left with
+     * no answer hangs until its own timeout while the user believes they are done.
+     */
+    async function resolveTarget(source) {
+        const clientId = first(source.client_id);
+        if (!clientId)
+            throw new ConsentRequestError('client_id is required');
+        let client = await clientRegistry.findByClientId(clientId);
+        if (!client && /^https:\/\//i.test(clientId)) {
+            // A Client ID Metadata Document client is allowed to arrive unseen: the
+            // document at its own URL is its registration. A fetch failure here is a
+            // refusal rather than a 500, because the URL was supplied by the caller.
+            try {
+                client = await clientRegistry.resolveMetadataDocument(clientId);
+            }
+            catch {
+                client = null;
+            }
+        }
+        if (!client)
+            throw new ConsentRequestError('unknown client_id');
+        if (client.status !== 'enabled')
+            throw new ConsentRequestError('this client is suspended', 403);
+        const redirectUri = first(source.redirect_uri);
+        if (!redirectUri)
+            throw new ConsentRequestError('redirect_uri is required');
+        if (!(0, redirect_uri_js_1.matchesAnyRedirectUri)(client.redirectUris, redirectUri)) {
+            // Never redirect to an unregistered URI to report that it is
+            // unregistered. That is the open redirect.
+            throw new ConsentRequestError('redirect_uri is not registered for this client');
+        }
+        return { client, redirectUri };
+    }
+    /** Everything that can be answered with a redirect, once we may redirect. */
+    function parseRequest(source, client) {
+        const responseType = first(source.response_type);
+        if (responseType !== 'code') {
+            throw new RedirectableError('unsupported_response_type', 'this server issues authorization codes; response_type must be "code"');
+        }
+        const codeChallengeMethod = first(source.code_challenge_method) ?? pkce_js_1.CODE_CHALLENGE_METHOD;
+        if (codeChallengeMethod !== pkce_js_1.CODE_CHALLENGE_METHOD) {
+            throw new RedirectableError('invalid_request', `code_challenge_method must be ${pkce_js_1.CODE_CHALLENGE_METHOD}`);
+        }
+        const codeChallenge = first(source.code_challenge);
+        if (!(0, pkce_js_1.isValidCodeChallenge)(codeChallenge)) {
+            // Required, not optional. OAuth 2.1 requires PKCE for public clients and
+            // every client this server will ever see is public.
+            throw new RedirectableError('invalid_request', 'a valid S256 code_challenge is required');
+        }
+        const scopes = parseScopeList(first(source.scope));
+        const unknown = scopes.filter((scope) => !scopesSupported.includes(scope));
+        if (unknown.length > 0) {
+            throw new RedirectableError('invalid_scope', `not supported here: ${unknown.join(' ')}`);
+        }
+        const clientScopes = client.scopes;
+        const disallowed = clientScopes.length > 0 ? scopes.filter((scope) => !clientScopes.includes(scope)) : [];
+        if (disallowed.length > 0) {
+            throw new RedirectableError('invalid_scope', `this client is not registered for: ${disallowed.join(' ')}`);
+        }
+        return {
+            responseType,
+            clientId: client.clientId,
+            redirectUri: first(source.redirect_uri),
+            scopes: scopes.length > 0 ? scopes : [...clientScopes],
+            state: first(source.state),
+            codeChallenge,
+            codeChallengeMethod,
+            resource: first(source.resource),
+        };
+    }
+    /** Build the redirect back to the client, error or success. */
+    function redirectTo(res, redirectUri, params) {
+        const url = new URL(redirectUri);
+        for (const [key, value] of Object.entries(params)) {
+            if (value !== undefined)
+                url.searchParams.set(key, value);
+        }
+        res.redirect(302, url.toString());
+    }
+    function scopeViews(scopes, req) {
+        return toScopeViews(scopes, scopeDescriptionsFrom(req, deps.scopeDescriptions));
+    }
+    /** The hidden fields that carry the request across a form post. */
+    function hiddenFields(request) {
+        const fields = [
+            ['response_type', request.responseType],
+            ['client_id', request.clientId],
+            ['redirect_uri', request.redirectUri],
+            ['scope', request.scopes.join(' ')],
+            ['state', request.state],
+            ['code_challenge', request.codeChallenge],
+            ['code_challenge_method', request.codeChallengeMethod],
+            ['resource', request.resource],
+        ];
+        return fields
+            .filter((entry) => entry[1] !== undefined && entry[1] !== '')
+            .map(([name, value]) => ({ name, value }));
+    }
+    function render(req, res, client, request, variant, extra = {}) {
+        res.render(viewName, {
+            layout,
+            action: actionPath,
+            variant,
+            isAuthenticated: variant === 'authenticated',
+            isLogin: variant === 'login',
+            isSignup: variant === 'signup',
+            client: {
+                name: client.name ?? client.clientId,
+                description: client.description ?? undefined,
+                clientUri: client.clientUri ?? undefined,
+                policyUri: client.policyUri ?? undefined,
+                tosUri: client.tosUri ?? undefined,
+                logoUri: safeLogoUri(client.logoUri),
+                monogram: monogramFor(client),
+                provenance: provenanceFor(client),
+                mode: client.mode,
+            },
+            scopes: scopeViews(request.scopes, req),
+            hiddenFields: hiddenFields(request),
+            ...extra,
+        });
+    }
+    /** Which face to show. `res.locals.auth` is cap-users' `addAuthContext`. */
+    function variantFor(req, res) {
+        const tier = res.locals?.auth?.trustTier;
+        return req.user && (tier === 'authenticated' || tier === 'verified')
+            ? 'authenticated'
+            : 'login';
+    }
+    function reportConsentError(res, err) {
+        // Our own page, because there is nowhere safe to send the caller. Rendered
+        // rather than JSON: whoever is looking at this is a person in a browser.
+        res.status(err.status).render('oauth-consent-error', {
+            layout,
+            errorMessage: err.message,
+        });
+    }
+    const showConsent = async (req, res, next) => {
+        let target;
+        try {
+            target = await resolveTarget(req.query);
+        }
+        catch (err) {
+            if (err instanceof ConsentRequestError)
+                return reportConsentError(res, err);
+            return next(err);
+        }
+        try {
+            const request = parseRequest(req.query, target.client);
+            render(req, res, target.client, request, variantFor(req, res));
+        }
+        catch (err) {
+            if (err instanceof RedirectableError) {
+                return redirectTo(res, target.redirectUri, {
+                    error: err.code,
+                    error_description: err.message,
+                    state: first(req.query.state),
+                });
+            }
+            next(err);
+        }
+    };
+    const submitConsent = async (req, res, next) => {
+        const body = (req.body ?? {});
+        let target;
+        try {
+            target = await resolveTarget(body);
+        }
+        catch (err) {
+            if (err instanceof ConsentRequestError)
+                return reportConsentError(res, err);
+            return next(err);
+        }
+        let request;
+        try {
+            request = parseRequest(body, target.client);
+        }
+        catch (err) {
+            if (err instanceof RedirectableError) {
+                return redirectTo(res, target.redirectUri, {
+                    error: err.code,
+                    error_description: err.message,
+                    state: first(body.state),
+                });
+            }
+            return next(err);
+        }
+        const action = first(body.action) ?? 'approve';
+        try {
+            if (action === 'deny') {
+                // A protocol response, not a navigation. If Cancel merely went home,
+                // the waiting client would hang until its own timeout while the user
+                // believed they had declined. The target is derived from the registry
+                // above and never taken from the form, or it is an open redirect.
+                return redirectTo(res, request.redirectUri, {
+                    error: 'access_denied',
+                    error_description: 'the user declined this request',
+                    state: request.state,
+                });
+            }
+            if (action === 'login' || action === 'signup') {
+                let user;
+                let sessionToken;
+                try {
+                    const result = action === 'login'
+                        ? await signIn({
+                            email: String(body.email ?? ''),
+                            password: String(body.password ?? ''),
+                            sessionToken: req.cookies?.[SESSION_COOKIE],
+                        })
+                        : await register({
+                            email: String(body.email ?? ''),
+                            password: String(body.password ?? ''),
+                            passwordConfirmation: String(body.passwordConfirmation ?? ''),
+                        });
+                    user = result.user;
+                    sessionToken = result.sessionToken;
+                }
+                catch (err) {
+                    return render(req, res, target.client, request, action, {
+                        email: typeof body.email === 'string' ? body.email : undefined,
+                        errorMessage: action === 'login'
+                            ? 'Invalid email or password'
+                            : err instanceof Error && err.message
+                                ? err.message
+                                : 'We could not create that account',
+                    });
+                }
+                res.cookie(SESSION_COOKIE, sessionToken, { httpOnly: true, maxAge: ONE_YEAR_MS });
+                req.user = user;
+                // Signing in is not consenting. Re-render the card and require a
+                // second, explicit Approve — see the header.
+                return render(req, res, target.client, request, 'authenticated', {
+                    justSignedIn: true,
+                });
+            }
+            if (action === 'showSignup' || action === 'showLogin') {
+                return render(req, res, target.client, request, action === 'showSignup' ? 'signup' : 'login');
+            }
+            // Approve.
+            const user = req.user;
+            if (!user) {
+                // Not signed in, so there is nobody to approve on behalf of. Show the
+                // login variant rather than redirecting: the request must stay on the
+                // page.
+                return render(req, res, target.client, request, 'login', {
+                    errorMessage: 'Please sign in to continue.',
+                });
+            }
+            const { code } = await authorizationCodeService.issue({
+                userId: user.id,
+                clientId: target.client.clientId,
+                clientPublicId: target.client.publicId,
+                redirectUri: request.redirectUri,
+                codeChallenge: request.codeChallenge,
+                codeChallengeMethod: request.codeChallengeMethod,
+                scopes: request.scopes,
+                resource: request.resource ?? null,
+            });
+            // `state` is echoed exactly as it arrived and is never interpreted. It is
+            // the client's CSRF token, not ours.
+            return redirectTo(res, request.redirectUri, { code, state: request.state });
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+    return { showConsent, submitConsent };
+}
+/**
+ * `GET` and `POST /oauth/authorize`.
+ *
+ * ## Why the undescribed-scope warning fires on the first request
+ *
+ * It used to fire here, at construction, on the argument that a warning a
+ * developer only sees when somebody reaches the consent screen is a warning they
+ * see in production. That reasoning is right and the placement was still wrong,
+ * because at construction there is nothing true to judge: the descriptions live
+ * on `app.locals`, an application publishes them after this router is built —
+ * boop injects every capability's mount above an application's own
+ * `app.locals` assignments — and the factory argument is one the shipped
+ * scaffold does not pass. So the check ran against `undefined` and named every
+ * advertised scope, on every boot, however carefully the application had
+ * described them. The wishfleet integration met exactly that: three scopes
+ * described, three scopes reported missing (boop-2vdy.8.5).
+ *
+ * A warning that always fires is worse than none, because it trains a developer
+ * to scroll past the line that would have told them their consent screen was
+ * asking an unanswerable question.
+ *
+ * So it fires on the first request this router serves, which is the earliest
+ * moment the value it must judge exists — and, since the router sits on the
+ * application's own mount, that is the first request to the site rather than the
+ * first one to reach the consent screen. Once per router, not once per request.
+ */
+function createConsentRouter(options) {
+    const handlers = createConsentHandlers(options);
+    const router = (0, express_1.Router)();
+    let warned = false;
+    router.use((req, _res, next) => {
+        if (!warned) {
+            warned = true;
+            warnUndescribedScopes(options.scopesSupported, scopeDescriptionsFrom(req, options.scopeDescriptions), options.warn);
+        }
+        next();
+    });
+    router.get('/oauth/authorize', handlers.showConsent);
+    router.post('/oauth/authorize', (0, express_1.urlencoded)({ extended: false, limit: options.bodyLimit ?? '16kb' }), handlers.submitConsent);
+    return router;
+}
+//# sourceMappingURL=consent-controller.js.map

package/dist/consent-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-controller.js","sourceRoot":"","sources":["../src/consent-controller.ts"],"names":[],"mappings":";;;AAqMA,oCASC;AAUD,sDAQC;AAmBD,sDAgBC;AAGD,sCAeC;AAUD,kCAQC;AAGD,kCAWC;AA0CD,sDAoUC;AAkCD,kDAyBC;AA9tBD,qCAA+F;AAK/F,uCAAwE;AACxE,uDAA0D;AAC1D,wBAAsB;AAGtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,+EAA+E;AAC/E,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,WAAW,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAkHjC,QAAA,wBAAwB,GAAG,wBAAwB,CAAC;AAEjE;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,MAAyB,EACzB,YAA2C;IAE3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,WAAW,GAAG,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/E,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CACnC,GAAY,EACZ,QAA4B;IAE5B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,gCAAwB,CAAkC,CAAC;IAC/F,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC;AACvC,CAAC;AAUD;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CACnC,eAAkC,EAClC,YAA2C,EAC3C,OAAkC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,CAAC;IAE5F,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CACxC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,YAAY,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAC1F,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CACF,qCAAqC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACzF,uFAAuF;YACvF,kBAAkB,gCAAwB,GAAG,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,qEAAqE;AACrE,SAAgB,aAAa,CAAC,MAAmB;IAC/C,MAAM,IAAI,GAAe,MAAM,CAAC,IAAI,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,IAAI,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,OAAO,iCAAiC,MAAM,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,yEAAyE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,KAAgC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAgB,WAAW,CAAC,MAAmB;IAC7C,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,oDAAoD;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACzC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,iFAAiF;AACjF,MAAM,mBAAoB,SAAQ,KAAK;IAErC,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,iBAAkB,SAAQ,KAAK;IAEnC,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9C,CAAC;IACD,mEAAmE;IACnE,8DAA8D;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAEzD;;;;;;;;OAQG;IACH,KAAK,UAAU,aAAa,CAC1B,MAA+B;QAE/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;QAEtE,IAAI,MAAM,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,cAAc,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAEhG,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAA,uCAAqB,EAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7D,6DAA6D;YAC7D,2CAA2C;YAC3C,MAAM,IAAI,mBAAmB,CAAC,gDAAgD,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,6EAA6E;IAC7E,SAAS,YAAY,CAAC,MAA+B,EAAE,MAAmB;QACxE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,2BAA2B,EAC3B,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,+BAAqB,CAAC;QACzF,IAAI,mBAAmB,KAAK,+BAAqB,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,iBAAiB,EACjB,iCAAiC,+BAAqB,EAAE,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,IAAA,8BAAoB,EAAC,aAAa,CAAC,EAAE,CAAC;YACzC,yEAAyE;YACzE,oDAAoD;YACpD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;QACnC,MAAM,UAAU,GACd,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,iBAAiB,CACzB,eAAe,EACf,sCAAsC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAW;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YACtD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1B,aAAa;YACb,mBAAmB;YACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,SAAS,UAAU,CACjB,GAAa,EACb,WAAmB,EACnB,MAA0C;QAE1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,UAAU,CAAC,MAAgB,EAAE,GAAY;QAChD,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,mEAAmE;IACnE,SAAS,YAAY,CAAC,OAA6B;QACjD,MAAM,MAAM,GAAwC;YAClD,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC;YACvC,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC/B,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC;YACrC,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;YACxB,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC;YACzC,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC;YACtD,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;SAC/B,CAAC;QACF,OAAO,MAAM;aACV,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;aACvF,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS,MAAM,CACb,GAAY,EACZ,GAAa,EACb,MAAmB,EACnB,OAA6B,EAC7B,OAAuB,EACvB,QAAiC,EAAE;QAEnC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;YACnB,MAAM;YACN,MAAM,EAAE,UAAU;YAClB,OAAO;YACP,eAAe,EAAE,OAAO,KAAK,eAAe;YAC5C,OAAO,EAAE,OAAO,KAAK,OAAO;YAC5B,QAAQ,EAAE,OAAO,KAAK,QAAQ;YAC9B,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ;gBACpC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,SAAS;gBAC5C,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACxC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBAClC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;gBACpC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC;gBAC7B,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC;gBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;YACD,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YACvC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC;YACnC,GAAG,KAAK;SACT,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,SAAS,UAAU,CAAC,GAAY,EAAE,GAAa;QAC7C,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,EAAE,IAA2C,EAAE,SAAS,CAAC;QACjF,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,UAAU,CAAC;YAClE,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IAED,SAAS,kBAAkB,CAAC,GAAa,EAAE,GAAwB;QACjE,2EAA2E;QAC3E,yEAAyE;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE;YACnD,MAAM;YACN,YAAY,EAAE,GAAG,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3D,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,KAAgC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB;gBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;oBACzC,KAAK,EAAE,GAAG,CAAC,IAAI;oBACf,iBAAiB,EAAE,GAAG,CAAC,OAAO;oBAC9B,KAAK,EAAE,KAAK,CAAE,GAAG,CAAC,KAAiC,CAAC,KAAK,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,aAAa,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB;gBAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE;oBACzC,KAAK,EAAE,GAAG,CAAC,IAAI;oBACf,iBAAiB,EAAE,GAAG,CAAC,OAAO;oBAC9B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAE/C,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,kEAAkE;gBAClE,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE;oBAC1C,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,gCAAgC;oBACnD,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,IAAwB,CAAC;gBAC7B,IAAI,YAAoB,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,MAAM,GACV,MAAM,KAAK,OAAO;wBAChB,CAAC,CAAC,MAAM,MAAM,CAAC;4BACX,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;4BAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;4BACrC,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAuB;yBAClE,CAAC;wBACJ,CAAC,CAAC,MAAM,QAAQ,CAAC;4BACb,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;4BAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;4BACrC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC;yBAC9D,CAAC,CAAC;oBACT,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;oBACnB,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;gBACrC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;wBACtD,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;wBAC9D,YAAY,EACV,MAAM,KAAK,OAAO;4BAChB,CAAC,CAAC,2BAA2B;4BAC7B,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;gCACnC,CAAC,CAAC,GAAG,CAAC,OAAO;gCACb,CAAC,CAAC,kCAAkC;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBAED,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBAClF,GAAG,CAAC,IAAI,GAAG,IAA+B,CAAC;gBAC3C,iEAAiE;gBACjE,6CAA6C;gBAC7C,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE;oBAC/D,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBACtD,OAAO,MAAM,CACX,GAAG,EACH,GAAG,EACH,MAAM,CAAC,MAAM,EACb,OAAO,EACP,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC7C,CAAC;YACJ,CAAC;YAED,WAAW;YACX,MAAM,IAAI,GAAG,GAAG,CAAC,IAAiD,CAAC;YACnE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,sEAAsE;gBACtE,sEAAsE;gBACtE,QAAQ;gBACR,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;oBACvD,YAAY,EAAE,6BAA6B;iBAC5C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC;gBACpD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;gBAChC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;gBACtC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;aACnC,CAAC,CAAC;YAEH,0EAA0E;YAC1E,qCAAqC;YACrC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,CAAC;YACd,qBAAqB,CACnB,OAAO,CAAC,eAAe,EACvB,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,EACrD,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,EACnE,QAAQ,CAAC,aAAa,CACvB,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/discovery-controller.d.ts

@@ -0,0 +1,16 @@
+import { Router, type RequestHandler } from 'express';
+import { type DiscoveryConfig } from './discovery.js';
+export interface DiscoveryHandlers {
+    authorizationServerMetadata: RequestHandler;
+    protectedResourceMetadata: RequestHandler;
+}
+export declare function createDiscoveryHandlers(config: DiscoveryConfig): DiscoveryHandlers;
+/**
+ * A router carrying both documents at their specified paths.
+ *
+ * Mounted at the application root — `app.use(oauthDiscoveryRoutes)` — because
+ * RFC 8414 and RFC 9728 fix these paths at the origin, and a client will not
+ * look for them anywhere else.
+ */
+export declare function createDiscoveryRouter(config: DiscoveryConfig): Router;
+//# sourceMappingURL=discovery-controller.d.ts.map

package/dist/discovery-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-controller.d.ts","sourceRoot":"","sources":["../src/discovery-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,cAAc,EAAiB,MAAM,SAAS,CAAC;AAErE,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAwBxB,MAAM,WAAW,iBAAiB;IAChC,2BAA2B,EAAE,cAAc,CAAC;IAC5C,yBAAyB,EAAE,cAAc,CAAC;CAC3C;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,iBAAiB,CAWlF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAQrE"}

package/dist/discovery-controller.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDiscoveryHandlers = createDiscoveryHandlers;
+exports.createDiscoveryRouter = createDiscoveryRouter;
+const express_1 = require("express");
+const discovery_js_1 = require("./discovery.js");
+/**
+ * The `.well-known` routes.
+ *
+ * Both mount **outside `/api`** and are reachable with no authentication —
+ * they are what a client reads *before* it has any credential at all, and a 401
+ * here is a connect failure the client cannot recover from.
+ *
+ * There is no `:resource` parameter and no filesystem read. Two fixed paths,
+ * two computed bodies. See the header of `discovery.ts` for why.
+ */
+/** One place the two handlers agree on headers, so they cannot drift. */
+function sendDocument(res, body) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    // Public, because the documents carry no secret and every client fetches
+    // them on every connect. An hour is the donor's number and the ecosystem's
+    // habit; it is short enough that a scope or endpoint change propagates the
+    // same working day.
+    res.setHeader('Cache-Control', `public, max-age=${discovery_js_1.DISCOVERY_MAX_AGE_SECONDS}`);
+    res.status(200).json(body);
+}
+function createDiscoveryHandlers(config) {
+    // Built once at construction rather than per request: the configuration is
+    // read at boot, so a running process has one answer and cannot serve two
+    // different documents to two clients.
+    const authorizationServer = (0, discovery_js_1.buildAuthorizationServerMetadata)(config);
+    const protectedResource = (0, discovery_js_1.buildProtectedResourceMetadata)(config);
+    return {
+        authorizationServerMetadata: (_req, res) => sendDocument(res, authorizationServer),
+        protectedResourceMetadata: (_req, res) => sendDocument(res, protectedResource),
+    };
+}
+/**
+ * A router carrying both documents at their specified paths.
+ *
+ * Mounted at the application root — `app.use(oauthDiscoveryRoutes)` — because
+ * RFC 8414 and RFC 9728 fix these paths at the origin, and a client will not
+ * look for them anywhere else.
+ */
+function createDiscoveryRouter(config) {
+    const handlers = createDiscoveryHandlers(config);
+    const router = (0, express_1.Router)();
+    router.get('/.well-known/oauth-authorization-server', handlers.authorizationServerMetadata);
+    router.get('/.well-known/oauth-protected-resource', handlers.protectedResourceMetadata);
+    return router;
+}
+//# sourceMappingURL=discovery-controller.js.map

package/dist/discovery-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-controller.js","sourceRoot":"","sources":["../src/discovery-controller.ts"],"names":[],"mappings":";;AAoCA,0DAWC;AASD,sDAQC;AAhED,qCAAqE;AAErE,iDAKwB;AAExB;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,SAAS,YAAY,CAAC,GAAa,EAAE,IAAa;IAChD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,oBAAoB;IACpB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,wCAAyB,EAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAOD,SAAgB,uBAAuB,CAAC,MAAuB;IAC7D,2EAA2E;IAC3E,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,mBAAmB,GAAG,IAAA,+CAAgC,EAAC,MAAM,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,IAAA,6CAA8B,EAAC,MAAM,CAAC,CAAC;IAEjE,OAAO;QACL,2BAA2B,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAClF,yBAAyB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,iBAAiB,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAC5F,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAExF,OAAO,MAAM,CAAC;AAChB,CAAC"}