@cat-factory/server 0.222.2 → 0.224.0

package/dist/modules/auth/ssoRoutes.js

@@ -0,0 +1,294 @@
+import { SSO_ERROR_FRAGMENT_KEY, ssoCallbackContract, ssoLoginContract, } from '@cat-factory/contracts';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { deleteCookie, getCookie } from 'hono/cookie';
+import { UnavailableError, oidcIdentitySubject } from '@cat-factory/kernel';
+import { OidcClient, OidcFlowError, createPkcePair, ssoNotConfigured, } from '../../auth/oidc/OidcClient.js';
+import { OidcProviderDirectory } from '../../auth/oidc/discovery.js';
+import { judgeSsoAdmission, needsUserinfo, readSsoIdentity, userinfoMatchesSubject, } from '../../auth/oidc/claims.js';
+import { HmacSigner, TOKEN_AUDIENCE } from '../../auth/signing.js';
+import { requestLogger } from '../../http/requestLogging.js';
+import { OAUTH_STATE_TTL_MS, acceptInvite, authConfig, emailMatchesInvite, mintSession, peekInvite, pickPostLoginRedirect, resolveRedirect, sessionUser, setRoundTripCookie, withToken, } from './loginFlow.js';
+// ---------------------------------------------------------------------------
+// Enterprise SSO sign-in: `GET /auth/sso/login` → the IdP → `GET /auth/sso/callback`.
+//
+// ONE pair of routes serves every OpenID Connect provider, because the provider's own discovery
+// document supplies the endpoints (see `auth/oidc/discovery.ts`). What this module owns is the
+// round-trip's STATE and its refusals.
+//
+// The state differs from the GitHub/Google flow in one way that matters. Those carry a signed
+// state token in the URL and bind it to a cookie holding just its nonce. SSO cannot: PKCE's
+// `code_verifier` and OIDC's `nonce` are SECRETS that must not travel in a URL — a verifier
+// visible beside the code it protects protects nothing. So the whole round-trip rides in the
+// httpOnly cookie (signed, audience-pinned with the SAME `HmacSigner` the OAuth flow uses, so
+// CSRF protection stays one implementation) and only an opaque nonce goes in the `state`
+// parameter. That also means the post-login redirect target cannot be tampered with in the URL,
+// which is strictly stronger than the OAuth leg.
+//
+// Refusals REDIRECT rather than rendering an error envelope: a browser mid-redirect that lands on
+// raw JSON has no way back, and the reason is a closed vocabulary the SPA maps to translated copy
+// (`SSO_ERROR_REASONS`). The redirect target is only ever a TRUSTED one — the cookie's own
+// recorded target, or `pickPostLoginRedirect` with no requested value — never a query parameter,
+// because the failure path must not become the open redirect the success path is guarded against.
+// ---------------------------------------------------------------------------
+/** The httpOnly cookie carrying one SSO round-trip. Distinct from the OAuth flow's. */
+const SSO_STATE_COOKIE = 'cf_sso_state';
+function ssoConfig(c) {
+    const cfg = authConfig(c).sso;
+    if (!cfg)
+        ssoNotConfigured();
+    return cfg;
+}
+/**
+ * The redirect_uri, which must match what is registered with the IdP EXACTLY. Explicit
+ * configuration wins, because a deployment behind a proxy or a custom domain sees a request
+ * origin that is not its public one, and a derived value would then be rejected by the provider
+ * with the least helpful error it has (`invalid_grant`).
+ */
+function ssoCallbackUrl(c, cfg) {
+    if (cfg.redirectUrl)
+        return cfg.redirectUrl;
+    return `${new URL(c.req.url).origin}/auth/sso/callback`;
+}
+/**
+ * Build the OIDC client for this request. A fresh instance per request is deliberate: the
+ * expensive part (the discovery document) lives in the shared app cache, so the client itself
+ * holds no state worth reusing and none worth leaking between requests.
+ */
+function ssoClient(c, cfg) {
+    const logger = requestLogger(c);
+    return new OidcClient({
+        config: cfg,
+        directory: new OidcProviderDirectory({
+            cache: c.get('container').caches?.ssoDiscovery,
+            logger,
+        }),
+        logger,
+    });
+}
+/** Land the browser back on the SPA with a machine-readable reason instead of a session. */
+function refuse(target, reason) {
+    const url = new URL(target);
+    url.hash = `${SSO_ERROR_FRAGMENT_KEY}=${reason}`;
+    return url.toString();
+}
+export function registerSsoRoutes(app) {
+    buildHonoRoute(app, ssoLoginContract, async (c) => {
+        const cfg = authConfig(c);
+        const sso = ssoConfig(c);
+        const { verifier, challenge } = await createPkcePair();
+        const trip = {
+            aud: TOKEN_AUDIENCE.ssoState,
+            nonce: crypto.randomUUID(),
+            verifier,
+            idNonce: crypto.randomUUID(),
+            redirect: resolveRedirect(c, cfg),
+            ...(c.req.query('invite') ? { invite: c.req.query('invite') } : {}),
+            exp: Date.now() + OAUTH_STATE_TTL_MS,
+        };
+        setRoundTripCookie(c, SSO_STATE_COOKIE, await new HmacSigner(cfg.sessionSecret).sign(trip));
+        // Resolving the provider can fail (an unreachable IdP, a malformed discovery document). It
+        // throws an `UnavailableError` naming which, and the shared error handler renders it: this is
+        // the one leg where an envelope is right, because nothing has redirected yet and the operator
+        // is the audience.
+        const url = await ssoClient(c, sso).authorizeUrl({
+            redirectUri: ssoCallbackUrl(c, sso),
+            state: trip.nonce,
+            nonce: trip.idNonce,
+            codeChallenge: challenge,
+        });
+        return c.redirect(url);
+    });
+    buildHonoRoute(app, ssoCallbackContract, async (c) => {
+        const cfg = authConfig(c);
+        const sso = ssoConfig(c);
+        const trip = await consumeRoundTrip(c, cfg);
+        // With no verified round-trip there is no recorded landing URL, so fall back to the
+        // deployment's own configured target (or its origin) — never the request's `redirect` query,
+        // which is exactly the untrusted value the success path allow-lists.
+        const fallback = pickPostLoginRedirect(undefined, new URL(c.req.url).origin, cfg);
+        if (!trip)
+            return c.redirect(refuse(fallback, 'state_invalid'));
+        // The IdP's own refusal (`access_denied` when a user cancels or the app is not assigned to
+        // them) is reported as itself rather than as a token failure: there is nothing on this side
+        // to fix, and saying "invalid token" would send an operator hunting one.
+        if (c.req.query('error')) {
+            requestLogger(c).info('sso.provider_denied', { error: c.req.query('error') });
+            return c.redirect(refuse(trip.redirect, 'provider_denied'));
+        }
+        const code = c.req.query('code');
+        if (!code)
+            return c.redirect(refuse(trip.redirect, 'state_invalid'));
+        const client = ssoClient(c, sso);
+        let resolved;
+        try {
+            resolved = await resolveIdentity(client, sso, {
+                code,
+                redirectUri: ssoCallbackUrl(c, sso),
+                trip,
+                logger: requestLogger(c),
+            });
+        }
+        catch (err) {
+            // An IdP that stopped answering mid-round-trip is an OUTAGE, not a bad token and not this
+            // deployment's credentials, so it gets its own reason. It also has to REDIRECT: on the login
+            // leg an envelope is right (nothing has redirected yet, the operator is the audience), but
+            // here the browser is mid-flow and raw JSON leaves it with no way back.
+            if (err instanceof UnavailableError) {
+                requestLogger(c).warn('sso.provider_unreachable', { detail: err.message });
+                return c.redirect(refuse(trip.redirect, 'provider_unreachable'));
+            }
+            if (!(err instanceof OidcFlowError))
+                throw err;
+            // The message names the operator-actionable cause (a wrong secret, a redirect_uri the IdP
+            // does not hold, a clock skew); the user gets the reason code. Logged at WARN because a
+            // deployment whose SSO cannot complete is broken, not busy.
+            requestLogger(c).warn(`sso.${err.reason}`, { detail: err.message });
+            return c.redirect(refuse(trip.redirect, err.reason));
+        }
+        const { identity, issuer } = resolved;
+        if (!identity)
+            return c.redirect(refuse(trip.redirect, 'subject_missing'));
+        const admission = judgeSsoAdmission(identity, sso);
+        if (!admission.allowed) {
+            requestLogger(c).info('sso.refused', { reason: admission.reason, login: identity.login });
+            return c.redirect(refuse(trip.redirect, admission.reason));
+        }
+        const token = await establishSession(c, cfg, identity, issuer, trip);
+        return c.redirect(withToken(trip.redirect, token));
+    });
+}
+/**
+ * Exchange the code, verify the ID token, and merge in userinfo when — and only when — a claim
+ * admission depends on is missing from the token. `identity` is null when the verified token
+ * carries no `sub`, the one shape that leaves nothing to key an identity on.
+ *
+ * Returns the DISCOVERED issuer alongside it, so the caller keying the user's identity on it does
+ * not resolve the provider a second time: that second read is what put an IdP outage AFTER the
+ * admission decision, where nothing was left to report it with.
+ */
+async function resolveIdentity(client, sso, params) {
+    const tokens = await client.exchangeCode({
+        code: params.code,
+        redirectUri: params.redirectUri,
+        codeVerifier: params.trip.verifier,
+    });
+    const claims = (await client.verifyIdToken(tokens.idToken, {
+        nonce: params.trip.idNonce,
+    }));
+    let merged = claims;
+    if (tokens.accessToken && needsUserinfo(claims, sso)) {
+        const extra = await client.fetchUserInfo(tokens.accessToken);
+        // The ID token's claims WIN over userinfo's: the token is signed and the userinfo response is
+        // only bearer-authenticated, so on a disagreement the verified half is authoritative. `sub`
+        // in particular must never be taken from userinfo.
+        //
+        // And the response is only merged AT ALL when it describes the same subject the token did
+        // (OIDC Core 5.3.2): spreading `claims` last protects `sub` itself, but `email` and `groups`
+        // ride the same response and both decide admission, so another subject's response would
+        // satisfy a group gate with somebody else's membership. Dropped LOUDLY, because the visible
+        // consequence otherwise is a `group_required` refusal blamed on the operator's group names.
+        if (extra && userinfoMatchesSubject(extra, claims))
+            merged = { ...extra, ...claims };
+        else if (extra) {
+            params.logger.warn('sso.userinfo.subject_mismatch', {
+                // Separates a non-conformant provider OMITTING the required claim (an operator fixes which
+                // claims it releases) from a response genuinely describing somebody else (alarming, and a
+                // different conversation). Neither subject value is logged.
+                userinfoHasSub: typeof extra.sub === 'string' && extra.sub.trim() !== '',
+            });
+        }
+    }
+    const { metadata } = await client.provider();
+    return { identity: readSsoIdentity(merged, sso), issuer: metadata.issuer };
+}
+/**
+ * Resolve the canonical user for a verified SSO identity and mint its session.
+ *
+ * The subject is `<discovered issuer>#<sub>`, never the email: emails are reassigned inside orgs
+ * and some directories let a user change their own, so keying on one would hand a departed
+ * employee's account to whoever inherits their address.
+ */
+async function establishSession(c, cfg, identity, issuer, trip) {
+    const container = c.get('container');
+    const user = await container.userService.findOrCreateByIdentity('oidc', oidcIdentitySubject(issuer, identity.sub), {
+        name: identity.name,
+        email: identity.email,
+        emailVerified: identity.emailVerified,
+        avatarUrl: identity.avatarUrl,
+        metadata: { issuer, login: identity.login },
+    });
+    await container.accountService.ensurePersonalAccount({
+        id: user.id,
+        login: identity.login,
+        name: user.name,
+    });
+    // An SSO user reached here through the IdP's own app assignment, so an invite is not what
+    // ADMITTED them — it only decides which org they join. Honoured when present (a person invited
+    // by email who then signs in with SSO), and bound to the invited address exactly as every other
+    // provider binds it, so a leaked link cannot pull an arbitrary directory user into an org.
+    if (trip.invite) {
+        const invited = await peekInvite(c, trip.invite);
+        if (invited && emailMatchesInvite(identity.email, invited.email)) {
+            await acceptInvite(c, trip.invite, user.id, user.email);
+        }
+    }
+    const { token } = await mintSession(cfg, sessionUser(user, identity.login));
+    logSignIn(requestLogger(c), user.id, identity, issuer);
+    return token;
+}
+/**
+ * One line per successful SSO sign-in, at INFO.
+ *
+ * Deliberate: an org adopting SSO is doing it to answer "who has access", and a login that leaves
+ * no trace answers nothing. Group memberships are logged as a COUNT rather than a list — the list
+ * is directory data of unbounded size, and its presence or absence is what diagnoses a
+ * `group_required` refusal.
+ */
+function logSignIn(logger, userId, identity, issuer) {
+    logger.info('sso.signed_in', {
+        userId,
+        issuer,
+        login: identity.login,
+        emailVerified: identity.emailVerified,
+        groupCount: identity.groups.length,
+    });
+}
+/**
+ * Verify + single-use the round-trip cookie, and check it against the `state` parameter the IdP
+ * echoed back. Returns null on any mismatch, which the caller reports as `state_invalid`.
+ *
+ * The cookie is deleted whatever the outcome, so one round-trip can be completed exactly once —
+ * which is also what makes a captured callback URL useless on a second visit.
+ */
+async function consumeRoundTrip(c, cfg) {
+    const raw = getCookie(c, SSO_STATE_COOKIE);
+    deleteCookie(c, SSO_STATE_COOKIE, { path: '/auth' });
+    const trip = await new HmacSigner(cfg.sessionSecret).verify(raw, {
+        aud: TOKEN_AUDIENCE.ssoState,
+    });
+    if (!isCompleteRoundTrip(trip))
+        return null;
+    const state = c.req.query('state');
+    if (!state || state !== trip.nonce)
+        return null;
+    return trip;
+}
+/**
+ * Whether a verified cookie payload actually carries the round-trip this leg needs.
+ *
+ * `HmacSigner.verify` proves THIS deployment signed the value and pins its audience; neither
+ * proves its SHAPE, and the generic parameter is a cast rather than a check. Without this, a
+ * payload missing the two secrets would flow on as `undefined`: a PKCE `code_verifier` of
+ * `"undefined"` in the token form and a nonce compared against `undefined`, both of which a
+ * conformant provider refuses — which is exactly why the check belongs here instead of resting on
+ * one being conformant.
+ */
+function isCompleteRoundTrip(trip) {
+    const present = (value) => typeof value === 'string' && value !== '';
+    return (trip !== null &&
+        present(trip.nonce) &&
+        present(trip.verifier) &&
+        present(trip.idNonce) &&
+        present(trip.redirect));
+}
+//# sourceMappingURL=ssoRoutes.js.map

package/dist/modules/auth/ssoRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoRoutes.js","sourceRoot":"","sources":["../../../src/modules/auth/ssoRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGrD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE3E,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGlE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,8EAA8E;AAC9E,sFAAsF;AACtF,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,uCAAuC;AACvC,EAAE;AACF,8FAA8F;AAC9F,4FAA4F;AAC5F,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,yFAAyF;AACzF,gGAAgG;AAChG,iDAAiD;AACjD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,2FAA2F;AAC3F,iGAAiG;AACjG,kGAAkG;AAClG,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,cAAc,CAAA;AAsBvC,SAAS,SAAS,CAAmB,CAAa;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7B,IAAI,CAAC,GAAG;QAAE,gBAAgB,EAAE,CAAA;IAC5B,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAmB,CAAa,EAAE,GAAc;IACrE,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,CAAA;IAC3C,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,oBAAoB,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAmB,CAAa,EAAE,GAAc;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAC/B,OAAO,IAAI,UAAU,CAAC;QACpB,MAAM,EAAE,GAAG;QACX,SAAS,EAAE,IAAI,qBAAqB,CAAC;YACnC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,YAAY;YAC9C,MAAM;SACP,CAAC;QACF,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,MAAc,EAAE,MAAsB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,GAAG,CAAC,IAAI,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAA;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAiB;IACjD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,EAAE,CAAA;QACtD,MAAM,IAAI,GAAiB;YACzB,GAAG,EAAE,cAAc,CAAC,QAAQ;YAC5B,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;YAC1B,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,QAAQ,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;YACjC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;SACrC,CAAA;QACD,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3F,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,mBAAmB;QACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC;YAC/C,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa,EAAE,SAAS;SACzB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC3C,oFAAoF;QACpF,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;QAE/D,2FAA2F;QAC3F,4FAA4F;QAC5F,yEAAyE;QACzE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC7E,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;QAEpE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAChC,IAAI,QAA0D,CAAA;QAC9D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC5C,IAAI;gBACJ,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC;gBACnC,IAAI;gBACJ,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;aACzB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,wEAAwE;YACxE,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1E,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAA;YAClE,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC;gBAAE,MAAM,GAAG,CAAA;YAC9C,0FAA0F;YAC1F,wFAAwF;YACxF,4DAA4D;YAC5D,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAE1E,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;YACzF,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,GAAc,EACd,MAAiF;IAEjF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;KACnC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE;QACzD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;KAC3B,CAAC,CAA4B,CAAA;IAC9B,IAAI,MAAM,GAAG,MAAM,CAAA;IACnB,IAAI,MAAM,CAAC,WAAW,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC5D,8FAA8F;QAC9F,4FAA4F;QAC5F,mDAAmD;QACnD,EAAE;QACF,0FAA0F;QAC1F,6FAA6F;QAC7F,wFAAwF;QACxF,4FAA4F;QAC5F,4FAA4F;QAC5F,IAAI,KAAK,IAAI,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,EAAE,CAAA;aAC/E,IAAI,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAClD,2FAA2F;gBAC3F,0FAA0F;gBAC1F,4DAA4D;gBAC5D,cAAc,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;aACzE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5C,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,CAAa,EACb,GAAe,EACf,QAAqB,EACrB,MAAc,EACd,IAAkB;IAElB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAC7D,MAAM,EACN,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EACzC;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;KAC5C,CACF,CAAA;IACD,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACnD,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAA;IACF,0FAA0F;IAC1F,+FAA+F;IAC/F,gGAAgG;IAChG,2FAA2F;IAC3F,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,OAAO,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC3E,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACtD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,QAAqB,EAAE,MAAc;IACtF,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;QAC3B,MAAM;QACN,MAAM;QACN,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;KACnC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,CAAa,EACb,GAAe;IAEf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC1C,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAe,GAAG,EAAE;QAC7E,GAAG,EAAE,cAAc,CAAC,QAAQ;KAC7B,CAAC,CAAA;IACF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,IAAyB;IACpD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAA;IACtF,OAAO,CACL,IAAI,KAAK,IAAI;QACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CACvB,CAAA;AACH,CAAC"}

package/dist/modules/localSettings/MothershipConnectController.js

@@ -1,7 +1,7 @@
 import { connectMothershipContract } from '@cat-factory/contracts';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
-import { mintSession } from '../auth/AuthController.js';
+import { mintSession } from '../auth/loginFlow.js';
 import { UnavailableError } from '@cat-factory/kernel';
 /**
  * Local-mode mothership login: `POST /local/mothership/connect`.

package/dist/modules/localSettings/MothershipConnectController.js.map

@@ -1 +1 @@
-{"version":3,"file":"MothershipConnectController.js","sourceRoot":"","sources":["../../../src/modules/localSettings/MothershipConnectController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,CACvE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,6FAA6F;YAC7F,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAA;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAClF,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACnB,CAAA;QACH,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAChF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"MothershipConnectController.js","sourceRoot":"","sources":["../../../src/modules/localSettings/MothershipConnectController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAA;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,CACvE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,6FAA6F;YAC7F,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAA;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAClF,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACnB,CAAA;QACH,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACxE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAChF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/publicApi/PublicDebugController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicDebugController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDebugController.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA4F/C,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,MAAM,CAAC,CAoLpD"}
+{"version":3,"file":"PublicDebugController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDebugController.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA4F/C,wBAAgB,qBAAqB,IAAI,IAAI,CAAC,MAAM,CAAC,CAyLpD"}

package/dist/modules/publicApi/PublicDebugController.js

@@ -243,6 +243,11 @@ export function publicDebugController() {
             ...(cursor.cursor ? { cursor: cursor.cursor } : {}),
             ...(query.jobId ? { jobId: query.jobId } : {}),
             ...(query.order ? { order: query.order } : {}),
+            // `ok` is a string on the wire (a query param always is), so the enum is narrowed to the
+            // boolean the port takes here rather than carried as text down to the SQL. Keyed on
+            // PRESENCE, not truthiness: `'false'` is a truthy string, and reading it as one would send
+            // the filter down inverted the day the picklist gains a member.
+            ...(query.ok !== undefined ? { ok: query.ok === 'true' } : {}),
         });
         return c.json({ toolCalls: page.items, nextCursor: nextCursorOf(page) }, 200);
     });

package/dist/modules/publicApi/PublicDebugController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PublicDebugController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDebugController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAErE,+FAA+F;AAC/F,0FAA0F;AAC1F,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,0FAA0F;AAC1F,yBAAyB;AACzB,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,wFAAwF;AACxF,gFAAgF;AAChF,2FAA2F;AAC3F,mFAAmF;AACnF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,4CAA4C;AAC5C,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAE5F,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAC/B,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAEjC;;;;GAIG;AACH,MAAM,6BAA6B,GAAG,OAAO,CAAA;AAE7C,kGAAkG;AAClG,SAAS,YAAY,CAAmB,CAAa;IACnD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAA;AAC5C,CAAC;AAED,MAAM,WAAW,GAAG,CAAmB,CAAa,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE7F,MAAM,QAAQ,GAAG,CAAmB,CAAa,EAAE,IAAY,EAAE,EAAE,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE3E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1D,CAAC;AAED,MAAM,aAAa,GAAG,CAAmB,CAAa,EAAE,EAAE,CACxD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAmB,CAAa,EAAE,EAAE,CAC5D,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+EAA+E;KACzF;CACF,EACD,GAAG,CACJ,CAAA;AAEH,gGAAgG;AAChG,SAAS,YAAY,CAAI,IAAkB;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACvD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,gBAAgB;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,oFAAoF;IACpF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,0FAA0F;QAC1F,yFAAyF;QACzF,qEAAqE;QACrE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,yCAAyC;IACzC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YACtF,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,6BAA6B;YAC3D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK;SAC1B,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,oBAAoB;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,EAC/B,KAAK,CAAC,SAAS,IAAI,6BAA6B,EAChD,KAAK,CAAC,UAAU,IAAI,CAAC,CACtB,CAAA;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,uFAAuF;IACvF,gFAAgF;IAChF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,2FAA2F;IAC3F,oBAAoB;IACpB,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PublicDebugController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDebugController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAErE,+FAA+F;AAC/F,0FAA0F;AAC1F,6FAA6F;AAC7F,+FAA+F;AAC/F,6FAA6F;AAC7F,0FAA0F;AAC1F,yBAAyB;AACzB,EAAE;AACF,kDAAkD;AAClD,EAAE;AACF,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,wFAAwF;AACxF,gFAAgF;AAChF,2FAA2F;AAC3F,mFAAmF;AACnF,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,4CAA4C;AAC5C,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAE5F,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAC/B,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAEjC;;;;GAIG;AACH,MAAM,6BAA6B,GAAG,OAAO,CAAA;AAE7C,kGAAkG;AAClG,SAAS,YAAY,CAAmB,CAAa;IACnD,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAA;AAC5C,CAAC;AAED,MAAM,WAAW,GAAG,CAAmB,CAAa,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE7F,MAAM,QAAQ,GAAG,CAAmB,CAAa,EAAE,IAAY,EAAE,EAAE,CACjE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAE3E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1D,CAAC;AAED,MAAM,aAAa,GAAG,CAAmB,CAAa,EAAE,EAAE,CACxD,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAmB,CAAa,EAAE,EAAE,CAC5D,CAAC,CAAC,IAAI,CACJ;IACE,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,+EAA+E;KACzF;CACF,EACD,GAAG,CACJ,CAAA;AAEH,gGAAgG;AAChG,SAAS,YAAY,CAAI,IAAkB;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,yFAAyF;IACzF,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACvD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,gBAAgB;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,oFAAoF;IACpF,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,0FAA0F;QAC1F,yFAAyF;QACzF,qEAAqE;QACrE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,yCAAyC;IACzC,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YACtF,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,6BAA6B;YAC3D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK;SAC1B,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,oBAAoB;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,EAC/B,KAAK,CAAC,SAAS,IAAI,6BAA6B,EAChD,KAAK,CAAC,UAAU,IAAI,CAAC,CACtB,CAAA;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,uFAAuF;IACvF,gFAAgF;IAChF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE;YACzD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,yFAAyF;YACzF,oFAAoF;YACpF,2FAA2F;YAC3F,gEAAgE;YAChE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,4FAA4F;IAC5F,2FAA2F;IAC3F,oBAAoB;IACpB,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAA;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,SAAS,IAAI,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAA;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE;YAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,sBAAsB;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/toolServers/McpOAuthCompletionController.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+export declare function mcpOAuthCompletionController(): Hono<AppEnv>;
+//# sourceMappingURL=McpOAuthCompletionController.d.ts.map

package/dist/modules/toolServers/McpOAuthCompletionController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthCompletionController.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/McpOAuthCompletionController.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAmC/C,wBAAgB,4BAA4B,IAAI,IAAI,CAAC,MAAM,CAAC,CA4C3D"}

package/dist/modules/toolServers/McpOAuthCompletionController.js

@@ -0,0 +1,125 @@
+import { completeToolServerOAuthContract } from '@cat-factory/contracts';
+import { ForbiddenError, UnauthorizedError, ValidationError } from '@cat-factory/kernel';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+import { resolveOAuthClientSecret } from '../../agents/mcpOAuthClientSecret.js';
+import { requireCapability } from '../../http/guards.js';
+import { requestLogger } from '../../http/requestLogging.js';
+import { loadWorkspaceAccess } from '../../http/workspaceAccess.js';
+import { resolveDeclaredToolServers } from './declaredToolServers.js';
+// ---------------------------------------------------------------------------
+// Finishing an OAuth grant against a remote MCP tool server.
+//
+// The vendor's redirect does NOT land here. It lands on the SPA, which re-presents the `code` and
+// `state` over the authenticated API, and that indirection is the entire security design rather
+// than a convenience:
+//
+// A redirect URI is one fixed string a third party has on file, so a route receiving it directly
+// is reached by a top-level browser navigation the vendor triggers. Sessions in this product are
+// BEARER TOKENS, which such a navigation cannot carry, so that route sees no user on every request
+// — on an auth-enabled deployment exactly as in dev-open. Any "the caller is who started the flow"
+// or "the caller still holds secrets.manage" check written there is unreachable code that reads
+// like protection, and it would additionally have to be exempted from the default-deny session gate
+// to be reachable at all. Routing the two values back through the SPA is what turns both checks
+// into things that actually run.
+//
+// So this route is ordinary session-gated API, and it is mounted at the ROOT because the board is
+// sealed into the state rather than carried in the path — the same shape `/user-secrets` has. Three
+// things gate it, each of which now genuinely executes:
+//
+//   1. the SESSION, via the shared default-deny gate (`mountAuthGate`), so an absent user here
+//      means auth is not configured at all rather than a caller who simply has no token;
+//   2. the sealed `state`, which only this deployment can mint and open, carries the workspace, the
+//      server and the PKCE verifier, and expires;
+//   3. the workspace PERMISSION, re-resolved at the moment the token is stored. A grant takes
+//      minutes of human time and `secrets.manage` can be revoked inside that window, so the start
+//      route's gate is not evidence about now.
+// ---------------------------------------------------------------------------
+export function mcpOAuthCompletionController() {
+    const app = new Hono();
+    buildHonoRoute(app, completeToolServerOAuthContract, async (c) => {
+        const container = c.get('container');
+        const logger = requestLogger(c);
+        const oauthService = requireCapability(container.mcpOAuth, 'Tool-server OAuth is not configured');
+        const { code, state } = c.req.valid('json');
+        const request = await oauthService.readAuthorizationRequest(state);
+        if (!request) {
+            logger.warn('mcp oauth completion carried no usable state');
+            throw new UnauthorizedError('This authorization request is invalid or has expired');
+        }
+        await assertMayCompleteGrant(c, request);
+        // Re-resolved from the registry rather than sealed into the state: the CLIENT is deployment
+        // code, so a deployment that fixed a wrong client id between the redirect and the completion
+        // should exchange with the corrected one. What is pinned in the state is the endpoint and the
+        // verifier, which are properties of the request the operator actually consented to.
+        const declared = resolveDeclaredToolServers(container.agentKindRegistry).get(request.serverId);
+        const oauth = declared?.definition.oauth;
+        if (!oauth) {
+            throw new ValidationError(`Tool server '${request.serverId}' no longer declares OAuth, so this grant cannot be ` +
+                `completed.`, { reason: 'tool_server_without_oauth' });
+        }
+        const clientSecret = await resolveClientSecret(c, request.workspaceId, request.serverId, oauth);
+        await oauthService.completeAuthorization(request, {
+            code,
+            clientId: oauth.clientId,
+            ...(clientSecret ? { clientSecret } : {}),
+        });
+        return c.json({ serverId: request.serverId, workspaceId: request.workspaceId }, 200);
+    });
+    return app;
+}
+/**
+ * The two checks a completion is worth having a session for.
+ *
+ * A `null` user is dev-open and allows everything, the same reading `requirePermission` takes and
+ * not a second policy. It is SOUND here only because the route sits behind the default-deny gate:
+ * with auth enabled, a request with no valid session never reaches the handler, so an absent user
+ * means auth is genuinely unconfigured. (That is precisely what a public redirect target could not
+ * say, which is why this flow does not have one.)
+ */
+async function assertMayCompleteGrant(c, request) {
+    const user = c.get('user');
+    if (!user)
+        return;
+    // Without this binding, getting an admin to open an attacker's authorization link would plant the
+    // ATTACKER's vendor account as the board's connection: the classic OAuth login-CSRF turned inside
+    // out. The state is sealed, so only someone who could already start a flow on this board can mint
+    // one, and this closes the case where such a value is captured and replayed by someone else.
+    if (request.userId && request.userId !== user.id) {
+        requestLogger(c).warn('mcp oauth completion attempted by a different user than the one who started it', { workspaceId: request.workspaceId, toolServerId: request.serverId });
+        throw new UnauthorizedError('This authorization request was started by someone else');
+    }
+    // Resolved through the ONE shared resolution the workspace gate uses. It cannot be the gate
+    // itself: the board is sealed into the state rather than named in the path, so there is no
+    // `:workspaceId` segment to bind to.
+    const access = await loadWorkspaceAccess(c.get('container'), request.workspaceId, user.id);
+    if (!access?.allowed || !access.permissions.has('secrets.manage')) {
+        throw new ForbiddenError('This action requires the secrets.manage permission', {
+            permission: 'secrets.manage',
+        });
+    }
+}
+/**
+ * The OAuth client secret for the exchange, through the SAME shared resolution the dispatch path
+ * uses — including its reserved-key floor, which is exactly why this is not a local lookup: a
+ * floor enforced at one of two call sites is not a floor.
+ *
+ * A declared-but-unresolvable secret REFUSES the completion with a 422 rather than exchanging as a
+ * public client. The operator is standing in front of this: telling them the client secret is
+ * missing is a fix they can make, where a vendor's `invalid_client` a second later is not.
+ */
+async function resolveClientSecret(c, workspaceId, serverId, oauth) {
+    const container = c.get('container');
+    const resolved = await resolveOAuthClientSecret({
+        workspaceId,
+        serverId,
+        oauth,
+        ...(container.toolSecretResolver ? { resolveToolSecrets: container.toolSecretResolver } : {}),
+        logger: requestLogger(c),
+    });
+    if (!resolved.ok) {
+        throw new ValidationError(resolved.error, { reason: 'oauth_client_secret_unavailable' });
+    }
+    return resolved.value;
+}
+//# sourceMappingURL=McpOAuthCompletionController.js.map

package/dist/modules/toolServers/McpOAuthCompletionController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthCompletionController.js","sourceRoot":"","sources":["../../../src/modules/toolServers/McpOAuthCompletionController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAA;AAExE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AAErE,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,sBAAsB;AACtB,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,gGAAgG;AAChG,oGAAoG;AACpG,gGAAgG;AAChG,iCAAiC;AACjC,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,wDAAwD;AACxD,EAAE;AACF,+FAA+F;AAC/F,yFAAyF;AACzF,oGAAoG;AACpG,kDAAkD;AAClD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,YAAY,GAAG,iBAAiB,CACpC,SAAS,CAAC,QAAQ,EAClB,qCAAqC,CACtC,CAAA;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;YAC3D,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAExC,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,oFAAoF;QACpF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC9F,MAAM,KAAK,GAAG,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAA;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CACvB,gBAAgB,OAAO,CAAC,QAAQ,sDAAsD;gBACpF,YAAY,EACd,EAAE,MAAM,EAAE,2BAA2B,EAAE,CACxC,CAAA;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE/F,MAAM,YAAY,CAAC,qBAAqB,CAAC,OAAO,EAAE;YAChD,IAAI;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,CAAa,EACb,OAAyE;IAEzE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,6FAA6F;IAC7F,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACjD,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CACnB,gFAAgF,EAChF,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,CACrE,CAAA;QACD,MAAM,IAAI,iBAAiB,CAAC,wDAAwD,CAAC,CAAA;IACvF,CAAC;IAED,4FAA4F;IAC5F,2FAA2F;IAC3F,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,cAAc,CAAC,oDAAoD,EAAE;YAC7E,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAChC,CAAa,EACb,WAAmB,EACnB,QAAgB,EAChB,KAAqB;IAErB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW;QACX,QAAQ;QACR,KAAK;QACL,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;KACzB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAA;AACvB,CAAC"}

package/dist/modules/toolServers/ToolServerController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ToolServerController.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAO/C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAsCnD"}
+{"version":3,"file":"ToolServerController.d.ts","sourceRoot":"","sources":["../../../src/modules/toolServers/ToolServerController.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAS/C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAuGnD"}