@coffeerunhobby/mcp-ha-connect 1.5.0 → 1.5.2

package/dist/server/http.d.ts

@@ -37,6 +37,22 @@ export declare function applySecurityHeaders(res: ServerResponse): void;
  * need that detail can query the authenticated MCP tools (e.g. `getVersion`).
  */
 export declare function handleHealthCheck(res: ServerResponse): void;
+/**
+ * Add CORS headers for REST API endpoints (always enabled for Open WebUI compatibility)
+ */
+export declare function addRestApiCors(req: IncomingMessage, res: ServerResponse): void;
+/**
+ * Whether a request path is served by the browser-facing REST surface
+ * (`/openapi.json`, the `/api/*` bridge, or the SSE events stream) and therefore
+ * must always carry CORS headers — INCLUDING on responses produced before the
+ * route handler runs (rate-limit 429, auth 401). If those rejections go back
+ * without `Access-Control-Allow-Origin`, the browser discards the response and
+ * surfaces it as an opaque "NetworkError when attempting to fetch resource",
+ * masking the real status (this is why an Open WebUI 401 looked like a network
+ * failure). `url` is the raw request URL (query string included); `urlPath` is
+ * the path-only form used to match the configurable SSE events path.
+ */
+export declare function isRestApiCorsPath(url: string, urlPath: string, sseEventsPath: string): boolean;
 /**
  * Resolve the permission a REST `/api/*` route requires.
  *
@@ -52,6 +68,18 @@ export declare function requiredRestPermission(method: string, pathname: string)
  * These endpoints translate REST calls to Home Assistant API calls
  */
 export declare function handleRestApi(req: IncomingMessage, res: ServerResponse, url: string, client: HaClient): Promise<void>;
+/**
+ * Resolve the public URL scheme, honoring `X-Forwarded-Proto` (set by Cloudflare /
+ * reverse proxies that TLS-terminate upstream). The header is validated against an
+ * allowlist so a spoofed value can't inject an arbitrary scheme; anything other than
+ * a literal `https` falls back to `http`. Comma-separated values (proxy chains) take
+ * the first hop.
+ */
+export declare function resolveForwardedProto(headerValue: string | string[] | undefined): 'http' | 'https';
+/**
+ * Generate OpenAPI spec for Open WebUI compatibility
+ */
+export declare function getOpenApiSpec(baseUrl: string): object;
 /**
  * Start HTTP server
  */

package/dist/server/http.js

@@ -131,13 +131,27 @@ export function handleHealthCheck(res) {
 /**
  * Add CORS headers for REST API endpoints (always enabled for Open WebUI compatibility)
  */
-function addRestApiCors(req, res) {
+export function addRestApiCors(req, res) {
     const origin = req.headers.origin;
     res.setHeader('Access-Control-Allow-Origin', origin ?? '*');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
     res.setHeader('Access-Control-Max-Age', '86400');
 }
+/**
+ * Whether a request path is served by the browser-facing REST surface
+ * (`/openapi.json`, the `/api/*` bridge, or the SSE events stream) and therefore
+ * must always carry CORS headers — INCLUDING on responses produced before the
+ * route handler runs (rate-limit 429, auth 401). If those rejections go back
+ * without `Access-Control-Allow-Origin`, the browser discards the response and
+ * surfaces it as an opaque "NetworkError when attempting to fetch resource",
+ * masking the real status (this is why an Open WebUI 401 looked like a network
+ * failure). `url` is the raw request URL (query string included); `urlPath` is
+ * the path-only form used to match the configurable SSE events path.
+ */
+export function isRestApiCorsPath(url, urlPath, sseEventsPath) {
+    return url === '/openapi.json' || url.startsWith('/api/') || urlPath === sseEventsPath;
+}
 /**
  * Resolve the permission a REST `/api/*` route requires.
  *
@@ -290,10 +304,25 @@ export async function handleRestApi(req, res, url, client) {
         });
     }
 }
+/**
+ * Resolve the public URL scheme, honoring `X-Forwarded-Proto` (set by Cloudflare /
+ * reverse proxies that TLS-terminate upstream). The header is validated against an
+ * allowlist so a spoofed value can't inject an arbitrary scheme; anything other than
+ * a literal `https` falls back to `http`. Comma-separated values (proxy chains) take
+ * the first hop.
+ */
+export function resolveForwardedProto(headerValue) {
+    const first = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+    const proto = String(first ?? '')
+        .split(',')[0]
+        ?.trim()
+        .toLowerCase();
+    return proto === 'https' ? 'https' : 'http';
+}
 /**
  * Generate OpenAPI spec for Open WebUI compatibility
  */
-function getOpenApiSpec(baseUrl) {
+export function getOpenApiSpec(baseUrl) {
     return {
         openapi: '3.1.0',
         info: {
@@ -529,7 +558,7 @@ export async function startHttpServer(options) {
         const urlPath = url.split('?')[0];
         // Handle OPTIONS (CORS preflight) - add CORS headers for REST API endpoints
         if (req.method === 'OPTIONS') {
-            if (url === '/openapi.json' || url.startsWith('/api/') || urlPath === sseEventsPath) {
+            if (isRestApiCorsPath(url, urlPath, sseEventsPath)) {
                 addRestApiCors(req, res);
             }
             else {
@@ -539,6 +568,13 @@ export async function startHttpServer(options) {
             res.end();
             return;
         }
+        // Apply CORS headers for the browser-facing REST surface BEFORE rate limiting
+        // and auth, so a 429 or 401 rejection still carries `Access-Control-Allow-Origin`.
+        // Otherwise the browser masks the real status as an opaque "NetworkError when
+        // attempting to fetch resource" (Open WebUI auth failures looked like this).
+        if (isRestApiCorsPath(url, urlPath, sseEventsPath)) {
+            addRestApiCors(req, res);
+        }
         // Apply rate limiting (skip health checks and certain paths)
         if (rateLimiter) {
             const allowed = rateLimiter.middleware()(req, res);
@@ -571,7 +607,12 @@ export async function startHttpServer(options) {
             // OpenAPI spec endpoint for Open WebUI compatibility
             if (req.method === 'GET' && url === '/openapi.json') {
                 addRestApiCors(req, res);
-                const baseUrl = `http://${req.headers.host ?? `${bindAddr}:${port}`}`;
+                // Honor X-Forwarded-Proto (set by Cloudflare / reverse proxies) so the advertised
+                // server URL is https when the public endpoint is TLS-terminated upstream. Without
+                // this, an https Open WebUI page is handed an http:// server URL and the browser
+                // blocks tool calls as mixed content ("NetworkError when attempting to fetch resource").
+                const scheme = resolveForwardedProto(req.headers['x-forwarded-proto']);
+                const baseUrl = `${scheme}://${req.headers.host ?? `${bindAddr}:${port}`}`;
                 sendJson(res, 200, getOpenApiSpec(baseUrl));
                 return;
             }

package/dist/server/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAA6C,MAAM,WAAW,CAAC;AAGxG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAA0D,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAA6B,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,oCAAoC;AACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;AAEzD;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtC,uDAAuD;IACvD,GAAG,CAAC,GAAG,GAAG,UACR,KAAe,EACf,kBAAkD,EAClD,QAAqB;QAErB,wDAAwD;QACxD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC7C,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAmB,CAAC;IAEpB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAO1C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,WAAmB,cAAc;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;YACnB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,GAAc,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC3D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAkB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAI,KAA+B,EAAE,UAAU,CAAC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAmB,EAAE,UAAkB,EAAE,IAAa;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAoB,EAAE,GAAmB;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAgB;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAChB,IACE,QAAQ,KAAK,aAAa;YAC1B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,aAAa;YAC1B,QAAQ,KAAK,cAAc;YAC3B,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACxC,CAAC;YACD,OAAO,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO,UAAU,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,MAAgB;IAEhB,+BAA+B;IAC/B,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IAEpC,kEAAkE;IAClE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,8CAA8C;QAC9C,MAAM,eAAe,GAAK,GAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,WAAkC,IAAI,CAAC,CAAC;QAC5G,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC;gBACtC,GAAG,EAAE,kBAAkB,CAAC,eAAe,CAAC;aACzC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,sCAAsC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,0CAA0C;QAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,QAAQ,YAAY,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QAED,qCAAqC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,CAAwB,EAAE,EAAE,CAC3B,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAChF,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAwB,EAAE,EAAE,CAC1D,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrC,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,CAAC,CAAiE,EAAE,EAAE,CACpE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACzC,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,UAAU,EAAE,QAAQ,CAAC,OAAO;gBAC5B,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAuE,CAAC;YAC1G,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBACtC,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,YAAY,EAAE,IAAI,EAAE,IAAI;aACzB,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,YAAY;QACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,yEAAyE;YACtF,OAAO,EAAE,OAAO;SACjB;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC3B,KAAK,EAAE;YACL,aAAa,EAAE;gBACb,GAAG,EAAE;oBACH,WAAW,EAAE,WAAW;oBACxB,OAAO,EAAE,2CAA2C;oBACpD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,2BAA2B;4BACxC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,yBAAyB,EAAE;gBACzB,GAAG,EAAE;oBACH,WAAW,EAAE,UAAU;oBACvB,OAAO,EAAE,gCAAgC;oBACzC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;oBAC/I,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,cAAc;4BAC3B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE;yBAC1F;qBACF;iBACF;aACF;YACD,kCAAkC,EAAE;gBAClC,IAAI,EAAE;oBACJ,WAAW,EAAE,aAAa;oBAC1B,OAAO,EAAE,+BAA+B;oBACxC,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,sCAAsC,EAAE;wBAC/H,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE;qBACnI;oBACD,WAAW,EAAE;wBACX,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;wCAC9D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;qCACtD;iCACF;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE;iBAC7D;aACF;YACD,cAAc,EAAE;gBACd,GAAG,EAAE;oBACH,WAAW,EAAE,eAAe;oBAC5B,OAAO,EAAE,yCAAyC;oBAClD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,uBAAuB;4BACpC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,wBAAwB,EAAE;gBACxB,GAAG,EAAE;oBACH,WAAW,EAAE,qBAAqB;oBAClC,OAAO,EAAE,wCAAwC;oBACjD,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;oBAC1I,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,4BAA4B;4BACzC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,aAAa,EAAE;gBACb,GAAG,EAAE;oBACH,WAAW,EAAE,gBAAgB;oBAC7B,OAAO,EAAE,+BAA+B;oBACxC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;oBACjH,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,mBAAmB;4BAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,0BAA0B,EAAE;gBAC1B,GAAG,EAAE;oBACH,WAAW,EAAE,YAAY;oBACzB,OAAO,EAAE,mCAAmC;oBAC5C,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;wBACvG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBACzG;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,iBAAiB;4BAC9B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;yBAC/D;qBACF;iBACF;aACF;YACD,cAAc,EAAE;gBACd,GAAG,EAAE;oBACH,WAAW,EAAE,YAAY;oBACzB,OAAO,EAAE,wCAAwC;oBACjD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,qBAAqB;4BAClC,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE;wCACN,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE;4CACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE;4CACrE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;yCACnE;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBACjC;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAyB;IACtF,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAEvD,0DAA0D;IAC1D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B;IAC9D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,mBAAmB,CAAC;IAElE,qCAAqC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB;QACzC,CAAC,CAAC,IAAI,WAAW,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,WAAW,EAAE,MAAM,CAAC,oBAAoB;YACxC,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;YACxC,6DAA6D;YAC7D,cAAc,EAAE,MAAM,CAAC,uBAAuB;SAC/C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,6BAA6B;IAC7B,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,eAAe,GAAG,IAAI,eAAe,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;gBAChF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAClC,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,QAAQ;QACnB,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,aAAa,EAAE,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe;KAC5D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAoB,EAAE,WAA2B,EAAE,EAAE;QAC1F,4CAA4C;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAEpD,mDAAmD;QACnD,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpF,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,6DAA6D;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,wCAAwC;YAClD,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,2CAA2C;QACrD,CAAC;QAED,qCAAqC;QACrC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,wBAAwB;YACxB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvD,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,IAAI,MAAM,CAAC,gBAAgB,IAAI,eAAe,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACzB,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBACpD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC;gBACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAClG,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;gBAEtF,IAAI,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;oBAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,YAAY;YACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACrG,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACjC,KAAK;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,sEAAsE;gBACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,kCAAkC;IACpE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,sCAAsC;IACxE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAE,qCAAqC;IACvE,MAAM,CAAC,oBAAoB,GAAG,CAAC,CAAC,CAAE,4CAA4C;IAE9E,4BAA4B;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QAChD,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QAEtB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,yBAAyB;QACzB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7B,CAAC;gBACD,IAAI,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxE,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEjB,yBAAyB;QACzB,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QAED,oBAAoB;QACpB,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAED,oBAAoB;QACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,kBAAkB;IAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,IAAI;gBACJ,QAAQ;gBACR,GAAG,EAAE,UAAU,QAAQ,IAAI,IAAI,GAAG,OAAO,EAAE;gBAC3C,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC/F,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;aACpH,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAA6C,MAAM,WAAW,CAAC;AAGxG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAA0D,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAA6B,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,oCAAoC;AACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;AAEzD;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtC,uDAAuD;IACvD,GAAG,CAAC,GAAG,GAAG,UACR,KAAe,EACf,kBAAkD,EAClD,QAAqB;QAErB,wDAAwD;QACxD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC7C,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAmB,CAAC;IAEpB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAO1C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,WAAmB,cAAc;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;YACnB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,GAAc,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC3D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAkB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAI,KAA+B,EAAE,UAAU,CAAC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAmB,EAAE,UAAkB,EAAE,IAAa;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAmB;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IACnF,OAAO,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,aAAa,CAAC;AACzF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAgB;IACrE,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAE/B,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAChB,IACE,QAAQ,KAAK,aAAa;YAC1B,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,aAAa;YAC1B,QAAQ,KAAK,cAAc;YAC3B,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACxC,CAAC;YACD,OAAO,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,MAAM,IAAI,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO,UAAU,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,MAAgB;IAEhB,+BAA+B;IAC/B,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IAEpC,kEAAkE;IAClE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,8CAA8C;QAC9C,MAAM,eAAe,GAAK,GAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,WAAkC,IAAI,CAAC,CAAC;QAC5G,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC;gBACtC,GAAG,EAAE,kBAAkB,CAAC,eAAe,CAAC;aACzC,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,sCAAsC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,0CAA0C;QAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,QAAQ,YAAY,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QAED,qCAAqC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,CAAwB,EAAE,EAAE,CAC3B,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAChF,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAwB,EAAE,EAAE,CAC1D,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrC,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC5B,CAAC,CAAiE,EAAE,EAAE,CACpE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACzC,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,4CAA4C;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,UAAU,EAAE,QAAQ,CAAC,OAAO;gBAC5B,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,YAAY,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAuE,CAAC;YAC1G,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBACtC,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;gBACnE,YAAY,EAAE,IAAI,EAAE,IAAI;aACzB,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,YAAY;QACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,qEAAqE;QACrE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA0C;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,EAAE,IAAI,EAAE;SACP,WAAW,EAAE,CAAC;IACjB,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,yEAAyE;YACtF,OAAO,EAAE,OAAO;SACjB;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC3B,KAAK,EAAE;YACL,aAAa,EAAE;gBACb,GAAG,EAAE;oBACH,WAAW,EAAE,WAAW;oBACxB,OAAO,EAAE,2CAA2C;oBACpD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,2BAA2B;4BACxC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,yBAAyB,EAAE;gBACzB,GAAG,EAAE;oBACH,WAAW,EAAE,UAAU;oBACvB,OAAO,EAAE,gCAAgC;oBACzC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;oBAC/I,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,cAAc;4BAC3B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE;yBAC1F;qBACF;iBACF;aACF;YACD,kCAAkC,EAAE;gBAClC,IAAI,EAAE;oBACJ,WAAW,EAAE,aAAa;oBAC1B,OAAO,EAAE,+BAA+B;oBACxC,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,sCAAsC,EAAE;wBAC/H,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE;qBACnI;oBACD,WAAW,EAAE;wBACX,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;wCAC9D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;qCACtD;iCACF;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE;iBAC7D;aACF;YACD,cAAc,EAAE;gBACd,GAAG,EAAE;oBACH,WAAW,EAAE,eAAe;oBAC5B,OAAO,EAAE,yCAAyC;oBAClD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,uBAAuB;4BACpC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,wBAAwB,EAAE;gBACxB,GAAG,EAAE;oBACH,WAAW,EAAE,qBAAqB;oBAClC,OAAO,EAAE,wCAAwC;oBACjD,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;oBAC1I,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,4BAA4B;4BACzC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,aAAa,EAAE;gBACb,GAAG,EAAE;oBACH,WAAW,EAAE,gBAAgB;oBAC7B,OAAO,EAAE,+BAA+B;oBACxC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;oBACjH,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,mBAAmB;4BAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,EAAE,EAAE,EAAE;yBACpH;qBACF;iBACF;aACF;YACD,0BAA0B,EAAE;gBAC1B,GAAG,EAAE;oBACH,WAAW,EAAE,YAAY;oBACzB,OAAO,EAAE,mCAAmC;oBAC5C,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;wBACvG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBACzG;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,iBAAiB;4BAC9B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;yBAC/D;qBACF;iBACF;aACF;YACD,cAAc,EAAE;gBACd,GAAG,EAAE;oBACH,WAAW,EAAE,YAAY;oBACzB,OAAO,EAAE,wCAAwC;oBACjD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,qBAAqB;4BAClC,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE;wCACN,IAAI,EAAE,QAAQ;wCACd,UAAU,EAAE;4CACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE;4CACrE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;yCACnE;qCACF;iCACF;6BACF;yBACF;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBACjC;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAyB;IACtF,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAEvD,0DAA0D;IAC1D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B;IAC9D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,mBAAmB,CAAC;IAElE,qCAAqC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB;QACzC,CAAC,CAAC,IAAI,WAAW,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,WAAW,EAAE,MAAM,CAAC,oBAAoB;YACxC,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;YACxC,6DAA6D;YAC7D,cAAc,EAAE,MAAM,CAAC,uBAAuB;SAC/C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,6BAA6B;IAC7B,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,eAAe,GAAG,IAAI,eAAe,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;gBAChF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAClC,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,QAAQ;QACnB,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,aAAa,EAAE,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe;KAC5D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAoB,EAAE,WAA2B,EAAE,EAAE;QAC1F,4CAA4C;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAEpD,mDAAmD;QACnD,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBACnD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,mFAAmF;QACnF,8EAA8E;QAC9E,6EAA6E;QAC7E,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;YACnD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,6DAA6D;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,wCAAwC;YAClD,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,2CAA2C;QACrD,CAAC;QAED,qCAAqC;QACrC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,wBAAwB;YACxB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvD,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,IAAI,MAAM,CAAC,gBAAgB,IAAI,eAAe,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACzB,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBACpD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,kFAAkF;gBAClF,mFAAmF;gBACnF,iFAAiF;gBACjF,yFAAyF;gBACzF,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvE,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAClG,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;gBAEtF,IAAI,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;oBAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,YAAY;YACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACrG,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACjC,KAAK;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,sEAAsE;gBACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,kCAAkC;IACpE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,sCAAsC;IACxE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAE,qCAAqC;IACvE,MAAM,CAAC,oBAAoB,GAAG,CAAC,CAAC,CAAE,4CAA4C;IAE9E,4BAA4B;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QAChD,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QAEtB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,yBAAyB;QACzB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7B,CAAC;gBACD,IAAI,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxE,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEjB,yBAAyB;QACzB,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QAED,oBAAoB;QACpB,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAED,oBAAoB;QACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,kBAAkB;IAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,IAAI;gBACJ,QAAQ;gBACR,GAAG,EAAE,UAAU,QAAQ,IAAI,IAAI,GAAG,OAAO,EAAE;gBAC3C,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC/F,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;aACpH,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/version.d.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export declare const VERSION = "1.5.0";
+export declare const VERSION = "1.5.2";

package/dist/version.js

@@ -2,5 +2,5 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.5.0';
+export const VERSION = '1.5.2';
 //# sourceMappingURL=version.js.map

package/docs/CHANGELOG.md

@@ -1,3 +1,38 @@
+### 1.5.2
+**Fix — CORS headers on `/api/*` and `/openapi.json` rejections (401 / 429) so auth
+failures stop masquerading as "NetworkError".**
+The REST-bridge CORS headers were applied only *inside* the route handlers, which run
+**after** the auth and rate-limit middleware. So a `401 Unauthorized` (bad/missing token)
+or a `429` (rate limited) on a browser-facing endpoint went back with **no**
+`Access-Control-Allow-Origin` header. A browser that receives a cross-origin response
+without that header discards it and reports the generic *"NetworkError when attempting to
+fetch resource"* — completely hiding the real `401`. This made an Open WebUI auth
+misconfiguration look identical to a network/tunnel failure.
+
+CORS headers for the browser-facing REST surface (`/openapi.json`, `/api/*`, the SSE
+events path) are now applied **before** rate limiting and authentication, so every
+rejection carries `Access-Control-Allow-Origin` and the browser surfaces the true status.
+The path test is extracted into the `isRestApiCorsPath()` helper (shared by the preflight
+and the new early-CORS step); `addRestApiCors()` is unchanged. No behavior change for a
+successful (200) request — it already carried CORS.
+
+### 1.5.1
+**Fix — `/openapi.json` now advertises the correct scheme behind a TLS-terminating proxy.**
+The OpenAPI document's `servers[0].url` was built with a hardcoded `http://`. Behind the
+Cloudflare tunnel (which terminates TLS and forwards to the origin over plain HTTP), the
+spec therefore advertised an `http://` server URL even though the public endpoint is
+`https://`. An OpenAPI tool client loaded on an **https** page (e.g. Open WebUI) then
+refused to call any tool, because the browser blocks `http://` subresource fetches from an
+https origin as **mixed content** — surfacing as *"NetworkError when attempting to fetch
+resource."*
+
+The handler now honors the `X-Forwarded-Proto` header (set by Cloudflare / reverse
+proxies) when constructing the advertised base URL, so a TLS-terminated deployment
+advertises `https://`. The new `resolveForwardedProto()` helper validates the header
+against an allowlist — anything other than a literal `https` falls back to `http`, and
+comma-separated proxy chains take the first hop — so a spoofed value can't inject an
+arbitrary scheme into the spec. No behavior change for plain-HTTP deployments.
+
 ### 1.5.0
 **Feature — Omada resource graph: Tier 4 read coverage (VPN · profiles · schedules · backup · audit).**
 Extends graph mode with the *home-relevant* slice of the previously zero-coverage Omada

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Home Assistant MCP Wrapper",
-    "version": "1.5.0",
+    "version": "1.5.2",
     "description": "REST endpoints that wrap MCP tools for Home Assistant integration. Raw JSON-RPC passthrough available at POST / for n8n compatibility."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffeerunhobby/mcp-ha-connect",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Smart home MCP server for Home Assistant plus Local AI integration",
   "type": "module",
   "main": "dist/index.js",

package/src/server/http.ts

@@ -159,7 +159,7 @@ export function handleHealthCheck(res: ServerResponse): void {
 /**
  * Add CORS headers for REST API endpoints (always enabled for Open WebUI compatibility)
  */
-function addRestApiCors(req: IncomingMessage, res: ServerResponse): void {
+export function addRestApiCors(req: IncomingMessage, res: ServerResponse): void {
   const origin = req.headers.origin;
   res.setHeader('Access-Control-Allow-Origin', origin ?? '*');
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
@@ -167,6 +167,21 @@ function addRestApiCors(req: IncomingMessage, res: ServerResponse): void {
   res.setHeader('Access-Control-Max-Age', '86400');
 }
 
+/**
+ * Whether a request path is served by the browser-facing REST surface
+ * (`/openapi.json`, the `/api/*` bridge, or the SSE events stream) and therefore
+ * must always carry CORS headers — INCLUDING on responses produced before the
+ * route handler runs (rate-limit 429, auth 401). If those rejections go back
+ * without `Access-Control-Allow-Origin`, the browser discards the response and
+ * surfaces it as an opaque "NetworkError when attempting to fetch resource",
+ * masking the real status (this is why an Open WebUI 401 looked like a network
+ * failure). `url` is the raw request URL (query string included); `urlPath` is
+ * the path-only form used to match the configurable SSE events path.
+ */
+export function isRestApiCorsPath(url: string, urlPath: string, sseEventsPath: string): boolean {
+  return url === '/openapi.json' || url.startsWith('/api/') || urlPath === sseEventsPath;
+}
+
 /**
  * Resolve the permission a REST `/api/*` route requires.
  *
@@ -348,10 +363,26 @@ export async function handleRestApi(
   }
 }
 
+/**
+ * Resolve the public URL scheme, honoring `X-Forwarded-Proto` (set by Cloudflare /
+ * reverse proxies that TLS-terminate upstream). The header is validated against an
+ * allowlist so a spoofed value can't inject an arbitrary scheme; anything other than
+ * a literal `https` falls back to `http`. Comma-separated values (proxy chains) take
+ * the first hop.
+ */
+export function resolveForwardedProto(headerValue: string | string[] | undefined): 'http' | 'https' {
+  const first = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+  const proto = String(first ?? '')
+    .split(',')[0]
+    ?.trim()
+    .toLowerCase();
+  return proto === 'https' ? 'https' : 'http';
+}
+
 /**
  * Generate OpenAPI spec for Open WebUI compatibility
  */
-function getOpenApiSpec(baseUrl: string): object {
+export function getOpenApiSpec(baseUrl: string): object {
   return {
     openapi: '3.1.0',
     info: {
@@ -609,7 +640,7 @@ export async function startHttpServer(options: HttpServerOptions): Promise<void>
 
     // Handle OPTIONS (CORS preflight) - add CORS headers for REST API endpoints
     if (req.method === 'OPTIONS') {
-      if (url === '/openapi.json' || url.startsWith('/api/') || urlPath === sseEventsPath) {
+      if (isRestApiCorsPath(url, urlPath, sseEventsPath)) {
         addRestApiCors(req, res);
       } else {
         handleCors(req, res, config);
@@ -619,6 +650,14 @@ export async function startHttpServer(options: HttpServerOptions): Promise<void>
       return;
     }
 
+    // Apply CORS headers for the browser-facing REST surface BEFORE rate limiting
+    // and auth, so a 429 or 401 rejection still carries `Access-Control-Allow-Origin`.
+    // Otherwise the browser masks the real status as an opaque "NetworkError when
+    // attempting to fetch resource" (Open WebUI auth failures looked like this).
+    if (isRestApiCorsPath(url, urlPath, sseEventsPath)) {
+      addRestApiCors(req, res);
+    }
+
     // Apply rate limiting (skip health checks and certain paths)
     if (rateLimiter) {
       const allowed = rateLimiter.middleware()(req, res);
@@ -656,7 +695,12 @@ export async function startHttpServer(options: HttpServerOptions): Promise<void>
       // OpenAPI spec endpoint for Open WebUI compatibility
       if (req.method === 'GET' && url === '/openapi.json') {
         addRestApiCors(req, res);
-        const baseUrl = `http://${req.headers.host ?? `${bindAddr}:${port}`}`;
+        // Honor X-Forwarded-Proto (set by Cloudflare / reverse proxies) so the advertised
+        // server URL is https when the public endpoint is TLS-terminated upstream. Without
+        // this, an https Open WebUI page is handed an http:// server URL and the browser
+        // blocks tool calls as mixed content ("NetworkError when attempting to fetch resource").
+        const scheme = resolveForwardedProto(req.headers['x-forwarded-proto']);
+        const baseUrl = `${scheme}://${req.headers.host ?? `${bindAddr}:${port}`}`;
         sendJson(res, 200, getOpenApiSpec(baseUrl));
         return;
       }

package/src/version.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.5.0';
+export const VERSION = '1.5.2';

package/tests/server/http.test.ts

@@ -3,10 +3,16 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ServerResponse } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { HaClient } from '../../src/haClient/index.js';
 import type { EnvironmentConfig } from '../../src/config.js';
 import { VERSION } from '../../src/version.js';
+import {
+  resolveForwardedProto,
+  getOpenApiSpec,
+  addRestApiCors,
+  isRestApiCorsPath,
+} from '../../src/server/http.js';
 
 // Mock dependencies
 vi.mock('node:http');
@@ -414,4 +420,112 @@ describe('HTTP Server', () => {
       expect(duration).toBeLessThan(1000);
     });
   });
+
+  describe('OpenAPI spec scheme (X-Forwarded-Proto)', () => {
+    it('returns https only when the header is exactly https', () => {
+      expect(resolveForwardedProto('https')).toBe('https');
+      expect(resolveForwardedProto('HTTPS')).toBe('https');
+      expect(resolveForwardedProto(' https ')).toBe('https');
+    });
+
+    it('takes the first hop from a comma-separated proxy chain', () => {
+      expect(resolveForwardedProto('https,http')).toBe('https');
+      expect(resolveForwardedProto('http, https')).toBe('http');
+    });
+
+    it('falls back to http for missing, empty, or unknown values', () => {
+      expect(resolveForwardedProto(undefined)).toBe('http');
+      expect(resolveForwardedProto('')).toBe('http');
+      expect(resolveForwardedProto('http')).toBe('http');
+      // A spoofed/garbage scheme can never be injected into the advertised URL.
+      expect(resolveForwardedProto('javascript')).toBe('http');
+      expect(resolveForwardedProto('ftp')).toBe('http');
+    });
+
+    it('handles array-valued headers by using the first entry', () => {
+      expect(resolveForwardedProto(['https', 'http'])).toBe('https');
+      expect(resolveForwardedProto(['http'])).toBe('http');
+    });
+
+    it('advertises the resolved scheme + host as the OpenAPI server url', () => {
+      // The regression: behind Cloudflare the spec must say https, not http, or the
+      // browser blocks tool calls from the https Open WebUI page as mixed content.
+      const scheme = resolveForwardedProto('https');
+      const spec = getOpenApiSpec(`${scheme}://mcp.example.com`) as {
+        servers: { url: string }[];
+        info: { version: string };
+      };
+      expect(spec.servers[0].url).toBe('https://mcp.example.com');
+      expect(spec.info.version).toBe(VERSION);
+    });
+  });
+
+  describe('REST API CORS on pre-handler rejections', () => {
+    const SSE_PATH = '/subscribe_events';
+
+    it('identifies the browser-facing REST surface', () => {
+      expect(isRestApiCorsPath('/openapi.json', '/openapi.json', SSE_PATH)).toBe(true);
+      expect(isRestApiCorsPath('/api/version', '/api/version', SSE_PATH)).toBe(true);
+      expect(isRestApiCorsPath('/api/states/light.x', '/api/states/light.x', SSE_PATH)).toBe(true);
+      expect(isRestApiCorsPath('/subscribe_events', '/subscribe_events', SSE_PATH)).toBe(true);
+      // Query string must not defeat the SSE path match (urlPath is path-only).
+      expect(isRestApiCorsPath('/subscribe_events?token=x', '/subscribe_events', SSE_PATH)).toBe(true);
+    });
+
+    it('excludes MCP / health / unknown paths from the REST CORS surface', () => {
+      expect(isRestApiCorsPath('/mcp', '/mcp', SSE_PATH)).toBe(false);
+      expect(isRestApiCorsPath('/health', '/health', SSE_PATH)).toBe(false);
+      expect(isRestApiCorsPath('/', '/', SSE_PATH)).toBe(false);
+      // Must not be fooled by a path that merely contains "/api/".
+      expect(isRestApiCorsPath('/not/api/x', '/not/api/x', SSE_PATH)).toBe(false);
+    });
+
+    it('reflects the request Origin in the CORS headers', () => {
+      const set: Record<string, string> = {};
+      const res = { setHeader: (k: string, v: string) => { set[k] = v; } } as unknown as ServerResponse;
+      const req = { headers: { origin: 'https://owui.example.com' } } as unknown as IncomingMessage;
+      addRestApiCors(req, res);
+      expect(set['Access-Control-Allow-Origin']).toBe('https://owui.example.com');
+      expect(set['Access-Control-Allow-Methods']).toContain('GET');
+      expect(set['Access-Control-Allow-Headers']).toContain('Authorization');
+      expect(set['Access-Control-Max-Age']).toBe('86400');
+    });
+
+    it('falls back to * when the request has no Origin', () => {
+      const set: Record<string, string> = {};
+      const res = { setHeader: (k: string, v: string) => { set[k] = v; } } as unknown as ServerResponse;
+      const req = { headers: {} } as unknown as IncomingMessage;
+      addRestApiCors(req, res);
+      expect(set['Access-Control-Allow-Origin']).toBe('*');
+    });
+
+    it('REGRESSION: a 401 on /api/* still carries Access-Control-Allow-Origin', () => {
+      // Reproduces the request pipeline ordering: REST CORS is applied for the path
+      // BEFORE the auth middleware rejects, so the browser sees the real 401 instead
+      // of an opaque "NetworkError when attempting to fetch resource".
+      const set: Record<string, string> = {};
+      let status = 0;
+      const res = {
+        setHeader: (k: string, v: string) => { set[k] = v; },
+        writeHead: (code: number) => { status = code; },
+        end: () => {},
+      } as unknown as ServerResponse;
+      const req = { headers: { origin: 'https://owui.example.com' } } as unknown as IncomingMessage;
+
+      const url = '/api/version';
+      // 1) dispatcher applies REST CORS for the path...
+      if (isRestApiCorsPath(url, url, SSE_PATH)) {
+        addRestApiCors(req, res);
+      }
+      // 2) ...then auth fails and writes a 401.
+      const authOk = false;
+      if (!authOk) {
+        res.writeHead(401);
+        res.end();
+      }
+
+      expect(status).toBe(401);
+      expect(set['Access-Control-Allow-Origin']).toBe('https://owui.example.com');
+    });
+  });
 });

package/CLAUDE.md

@@ -1,403 +0,0 @@
-# mcp-ha-connect -- Claude Code Agent
-
-## Identity & Scope
-
-This agent owns the **mcp-ha-connect MCP server** — a Model Context Protocol server for
-Home Assistant, TP-Link Omada, and Local AI integration.
-
-**Repo:** `github.com/coffeerunhobby/mcp-ha-connect`
-**npm:** `@coffeerunhobby/mcp-ha-connect`
-**Docker:** `ghcr.io/coffeerunhobby/mcp-ha-connect`
-**Live endpoint:** Cloudflare domain → NAS Docker port 3000 (domain in NAS `.env`)
-
-**Working directory:** `C:\workspace\mcp` — this is the canonical copy.
-`W:\mcp-homeassistant` is a stale export at v0.8.0 — ignore it.
-
----
-
-## Stack
-
-- **Runtime:** Node.js 20+ (dev machine uses nvm)
-- **Language:** TypeScript, compiled to `dist/` via `tsc`
-- **MCP SDK:** `@modelcontextprotocol/sdk`
-- **Transport:** Streamable HTTP (port 3000, path `/mcp`)
-- **Auth:** JWT bearer tokens with RBAC permission system
-- **Plugins:** Home Assistant · TP-Link Omada SDN · Local AI (Ollama/OpenAI-compat)
-- **Tests:** Vitest (829 unit tests) + integration tests in `tests/integration/`
-- **Container:** Alpine Node image, deployed on Synology NAS via Docker Compose
-
----
-
-## Infrastructure
-
-| Resource | Address | Notes |
-|---|---|---|
-| **MCP server** | `mcpserver.10.0.0.18.nip.io:3000` | NAS Docker container |
-| **Home Assistant** | `homeassistant.10.0.0.19.nip.io:8123` | |
-| **Omada controller** | `omada.10.0.0.18.nip.io:8043` | HTTPS, self-signed cert |
-| **Ollama** | `ollama.10.0.0.17.nip.io:11434` | model `phi4:14b` |
-| **n8n** | `n8n.10.0.0.18.nip.io:5678` | also exposed via Cloudflare |
-| **NAS Docker path** | `/volume1/docker/mcp-ha-connect/` | compose.yaml + .env |
-| **Cloudflare** | proxies public domain → NAS port 3000 | domain stored in `.env` |
-
----
-
-## Secrets & Credentials
-
-All secrets live in the NAS `.env` file and as **Windows User environment variables**.
-Never store token values in source files, commit messages, or this file.
-
-| Variable | Purpose |
-|---|---|
-| `NPM_MCP_HA_TOKEN` | npm Granular token for publishing |
-| `GHCR_TOKEN` | GitHub PAT with `write:packages` scope |
-
-### Retrieve for use
-
-```powershell
-$npmToken  = [Environment]::GetEnvironmentVariable('NPM_MCP_HA_TOKEN', 'User')
-$ghcrToken = [Environment]::GetEnvironmentVariable('GHCR_TOKEN', 'User')
-```
-
-### npm token requirements
-
-The npm token must be **Granular type** with:
-- Scope `@coffeerunhobby` → **Read and write** (scope-level, not per-package)
-- **Bypass two-factor authentication** ✅ checked
-
-Create at: npmjs.com → Access Tokens → Generate New Token → Granular Access Token
-
-**Critical:** Never run `npm logout` — it revokes the token server-side and deletes it
-from npmjs.com. If the token disappears from the web UI, that's why.
-
----
-
-## Release Process
-
-### 1. Pre-flight
-
-```powershell
-cd C:\workspace\mcp
-npm test          # all tests must pass
-npm run build     # must compile clean
-npm run lint      # ZERO errors AND zero warnings (see Code Quality policy)
-```
-
-### 2. Version bump
-
-Update **both** files to the new version:
-- `package.json` → `"version": "X.Y.Z"`
-- `src/version.ts` → `export const VERSION = 'X.Y.Z';`
-
-Update `docs/CHANGELOG.md` with the new version section.
-
-### 3. Commit & tag
-
-```powershell
-git add .
-git commit -m "vX.Y.Z - <short description>"
-git tag vX.Y.Z
-git push origin main
-git push origin vX.Y.Z
-```
-
-Create the GitHub Release at:
-`https://github.com/coffeerunhobby/mcp-ha-connect/releases/new?tag=vX.Y.Z`
-
-### 4. npm publish
-
-**Preferred: interactive login (browser).** Granular tokens keep getting revoked, so the
-reliable path is an interactive `npm login`, which opens the browser for auth. The agent
-**cannot** complete this alone — it MUST ask the user to run/confirm the browser login,
-then publish together:
-
-```powershell
-cd C:\workspace\mcp
-npm login                  # opens browser — USER completes this, agent waits
-npm whoami                 # must print the account name, not 403
-npm publish --access public
-```
-
-**Do NOT run `npm logout`** afterward — it revokes any granular token server-side.
-
-> Agent rule: when a release reaches this step, STOP and ask the user to help with
-> `npm login` and `npm publish --access public` (browser-based). Do not silently fall
-> back to a stored token — if `npm whoami` returns 403, the token is dead.
-
-### 5. Docker build & push
-
-Docker Desktop must be running.
-
-```powershell
-$ghcrToken = [Environment]::GetEnvironmentVariable('GHCR_TOKEN', 'User')
-$ghcrToken | docker login ghcr.io -u coffeerunhobby --password-stdin
-
-cd C:\workspace\mcp
-docker build --no-cache `
-  -t ghcr.io/coffeerunhobby/mcp-ha-connect:X.Y.Z `
-  -t ghcr.io/coffeerunhobby/mcp-ha-connect:latest .
-
-docker push ghcr.io/coffeerunhobby/mcp-ha-connect:X.Y.Z
-docker push ghcr.io/coffeerunhobby/mcp-ha-connect:latest
-```
-
-Use `docker build`, not `docker buildx build --platform`. The NAS is amd64 and a plain
-build on a Windows/amd64 host produces the correct image.
-
-### 6. Deploy to NAS
-
-```bash
-cd /volume1/docker/mcp-ha-connect
-docker compose pull && docker compose up -d
-docker compose logs --tail=30
-```
-
----
-
-## NAS `.env` — critical settings
-
-```env
-MCP_HTTP_BIND_ADDR=0.0.0.0
-```
-
-Must be `0.0.0.0`, not `127.0.0.1`. Docker port mapping requires the server to listen on
-all interfaces inside the container — loopback only means Cloudflare gets a 502.
-
-```env
-MCP_HTTP_ALLOWED_ORIGINS=...,<cloudflare-domain>,https://<cloudflare-domain>
-```
-
-Must include both the bare hostname AND the `https://` form of the Cloudflare domain.
-The MCP SDK checks the `host` header (no protocol) for DNS rebinding protection AND
-the `origin` header (with protocol) for CORS.
-
----
-
-## Omada SDN — known issues
-
-**After upgrading the Omada controller version**, the `OMADA_OMADAC_ID` changes.
-Error code `-44106` is returned for BOTH wrong credentials AND wrong `OMADA_OMADAC_ID` —
-the API does not distinguish between them.
-
-**To get the new Omada ID:**
-Omada web UI → Settings → Open API → click the eye icon → copy **Omada ID**.
-
-```bash
-sed -i 's/OMADA_OMADAC_ID=.*/OMADA_OMADAC_ID=<new-id>/' /volume1/docker/mcp-ha-connect/.env
-docker compose up -d
-```
-
-If Omada is unreachable or credentials are wrong, the server **gracefully degrades** —
-Omada tools are disabled but HA and AI keep working. Set `OMADA_PLUGIN_ENABLED=false`
-to disable Omada entirely while troubleshooting.
-
-**`OMADA_SITE_ID` is validated at startup against the live site list** (the controller is
-the source of truth; the env var is only a selector). If `OMADA_SITE_ID` is set but **not**
-present on the controller — a site id can drift after a controller migration, exactly like
-`OMADA_OMADAC_ID` — the **Omada plugin is disabled** at boot with a `logger.error` that
-names the bad value and lists the valid sites (HA + AI stay up). This turns the old failure
-mode (a silent default scoping every read to a dead site → later "user does not have
-permissions to access this site") into a loud, self-diagnosing startup error. Fix by setting
-`OMADA_SITE_ID` to one of the listed ids. Validation lives in `checkConfiguredSite()`
-(`src/omadaClient/site.ts`); a *valid* default still auto-resolves, so site-scoped reads need
-no explicit `siteId`.
-
----
-
-## Code Quality — fix every error and warning
-
-**Always fix errors AND warnings. Never label something "pre-existing debt" and move on.**
-
-- `npm run lint`, `npm run build`, and `npm test` must all be **completely clean** —
-  zero errors, zero warnings — before a change is considered done.
-- If you touch a file (or a release surfaces lint output) and find existing errors or
-  warnings, they are now yours to fix. "It was already broken" is not an acceptable
-  reason to leave it.
-- **Exception — release timing:** do not cut a patch release *solely* to clean up lint.
-  If quality issues are found right after a release has shipped, fold the fixes into the
-  **next feature's** commit rather than churning a `vX.Y.(Z+1)`. Outstanding cleanup of
-  this kind is tracked in `.claude/NEXT-SESSION.md` so it isn't forgotten.
-
-> Currently outstanding: `Function`-type lint warnings in the test mock helpers
-> (`tests/tools/**/handlers.test.ts`). Fix these as part of the next feature change —
-> NOT as a standalone patch release.
-
----
-
-## Development
-
-```powershell
-cd C:\workspace\mcp
-npm run dev             # tsx watch with .env
-npm test                # vitest (excludes integration)
-npm run test:watch      # watch mode
-npm run lint            # eslint
-npm run build           # tsc compile to dist/
-npm run generate:jwt    # generate a test JWT token
-```
-
-### Integration tests (requires live .env)
-
-```powershell
-npm run test:integration
-```
-
----
-
-## Live testing against the running server
-
-The dev machine can exercise the deployed MCP server two ways:
-
-1. **Connected `homeassistant` MCP in Claude Desktop** — this agent has the live server
-   wired in as an MCP connection, so HA/Omada tools can be invoked directly (no curl, no
-   manual token; the configured bearer is used). **Caveat:** the MCP client caches the tool
-   list at *connection time*. After flipping `MCP_TOOL_REGISTRATION_MODE` (eager ⇄ graph)
-   and redeploying, that cached list is **stale** — Claude Desktop must reconnect (restart)
-   before the new tool surface (`omada_browse`/`omada_read`, or the typed getters) shows up.
-   Until it reconnects, calling a tool the live server no longer registers will fail.
-
-2. **Direct `/mcp` curl** — generate a token with
-   `npm run generate:jwt -- --sub <user> --exp 1h` (signs with the local `.env`
-   `MCP_AUTH_SECRET`, which currently matches the NAS), then POST JSON-RPC to the server's
-   `/mcp` with headers `Authorization: Bearer <tok>`, `Content-Type: application/json`,
-   `Accept: application/json, text/event-stream`. Responses come back as SSE
-   (`data: {...}` lines). `tools/list` and `tools/call` work **without** an initialize
-   handshake in stateless mode. The reachable server address lives in
-   `.claude/NEXT-SESSION.md` (gitignored — never put the real IP/domain here).
-
-Permissions are resolved **server-side** from the token's `sub` via `MCP_PERMISSIONS_CONFIG`
-(they are NOT carried in the token). Pick a `sub` whose mapped role has the bit you need —
-e.g. the ADMIN-gated `/security/threats` node needs a `sub` mapped to an ADMIN role. The NAS
-role map differs from the local `.env`, so don't assume `sub=admin` is actually ADMIN there.
-
----
-
-## Never assume. Always verify.
-
-- **Cloudflare 502**: check the container is running (`docker compose ps`) and
-  `MCP_HTTP_BIND_ADDR=0.0.0.0` is set.
-- **MCP client connects but tools fail**: check `MCP_HTTP_ALLOWED_ORIGINS` includes
-  the Cloudflare domain in both bare and `https://` form.
-- **Claude Desktop shows "Server disconnected" but `/health` is 200**: the client's
-  mcp-remote auth header is malformed. A `"Authorization: Bearer ${MCP_AUTH_TOKEN}"`
-  placeholder does NOT expand on Windows (`cmd /c` uses `%VAR%`, mcp-remote doesn't
-  substitute `${VAR}`) → literal text is sent → server 401 → mcp-remote drops into a
-  failing OAuth flow. Fix: inline the literal JWT in `claude_desktop_config.json`'s
-  `--header` arg, and add `-y` to `npx` so first run doesn't hang. Verify the server
-  side first with a direct `curl` POST to `/mcp` carrying the token.
-- **npm publish returns 404 on PUT**: token likely has per-package scope instead of
-  scope-level access, or "Bypass 2FA" is not ticked. Delete token and recreate.
-- **Omada auth error -44106**: check `OMADA_OMADAC_ID` first, not just credentials —
-  this error code covers both cases.
-- **Before a release**: always run `npm test` and `npm run build` clean.
-- **On release, bump the version everywhere**: `package.json`, `src/version.ts`,
-  `docs/CHANGELOG.md`, AND `openapi.json` (`info.version`) — the last one drifts easily.
-
----
-
-## Tool registration modes (`MCP_TOOL_REGISTRATION_MODE`)
-
-Implemented as a **resource-graph** mode for the Omada plugin (config parses the var;
-`config.toolRegistrationMode` threads through `createServer` → `registerAllTools` →
-`registerOmadaTools`). Values:
-
-- **`eager`** (default) — register every typed tool (~26 Omada tools). Today's behavior;
-  fully backwards-compatible.
-- **`graph`** — register only `omada_browse` + `omada_read` + the 5 typed write/action
-  tools. Reads collapse into a discoverable resource graph (`src/tools/omada/namespace.ts`
-  manifest + `src/tools/omada/graph.ts`), shrinking the tool-schema budget for low-context
-  models while still exposing every read endpoint.
-
-Design invariants (don't regress these):
-- **browse returns TYPES, not instances** — `omada_browse(path)` lists permission-filtered
-  child resource types + metadata (kind, permission, pagination, params). It never
-  enumerates MACs or calls the controller.
-- **read is per-path RBAC, fail-closed** — `omada_read` declares NO static tool permission;
-  each manifest node declares its own bit (most reads = QUERY; the `/security/*` subtree =
-  ADMIN). Unknown / container / under-privileged / missing-required-param paths all return a
-  clean error and never fetch.
-- **single-page pagination** — paginated nodes forward one page/pageSize to a single GET via
-  `OmadaClient.readResource()`; they never walk every page.
-- **graph is a complete superset of eager reads** — every eager read getter has a graph node,
-  including the ADMIN-gated IDS/IPS threat-management log at `/security/threats`. Its mandatory
-  epoch time-window is enforced via required `params.startTime`/`params.endTime` (epoch seconds),
-  validated by `omada_read` before any controller call.
-
-HA and AI plugins are unaffected (still eager). Writes stay typed + individually gated in
-both modes — generic write verbs were deliberately rejected (prompt-injection / hallucination
-surface).
-
----
-
-## Security
-
-This server controls real devices (HA, Omada) and is exposed publicly via Cloudflare, so
-treat it as security-sensitive. A full audit (2026-06-07) with file/line findings is in
-`.claude/NEXT-SESSION.md`; this section is the **durable policy** distilled from it.
-
-### Dependencies — update, don't rewrite
-
-- Runtime deps are intentionally tiny: `@modelcontextprotocol/sdk`, `ws`, `zod`.
-  **Do not hand-roll replacements** for these (or for transitive libs like `hono`,
-  `ajv`, `path-to-regexp`). A homegrown version loses community review and adds more
-  bugs than it removes. Zod and the MCP SDK earn their keep.
-- The alarming `npm audit` list (`hono`, `@hono/node-server`, `fast-uri`, `ajv`,
-  `path-to-regexp`, `qs`) is **entirely transitive under the SDK**:
-  `@modelcontextprotocol/sdk → @hono/node-server → hono`. **Bumping the SDK fixes most
-  of them.** `ws` is the one direct dep to bump on its own.
-- Triage with `npm audit --omit=dev` — dev-only vulns (vitest/esbuild/tsx) don't ship.
-  The question is *reachability in production*, not the raw count.
-- Remediate on a branch: `npm install @modelcontextprotocol/sdk@latest ws@latest`, then
-  `npm test && npm run build && npm audit --omit=dev`. Commit `package-lock.json`;
-  CI/Docker use `npm ci`, not `npm install`. Widen version ranges only intentionally.
-
-### MCP transport invariant (the SDK "cross-client data leak" advisory)
-
-GHSA-345p-7cg4-v4c7 is about **sharing one `McpServer`/transport instance across
-clients**. Our HTTP layer MUST create a **fresh server + transport per request**
-(stateless mode, current behavior) or per session keyed by `Mcp-Session-Id` (stateful) —
-never a single global transport handling every `/mcp` POST. Re-verify this after any SDK
-upgrade or transport refactor. Bumping the SDK is necessary but not sufficient if the
-architecture shares instances.
-
-### Our attack surface (higher-leverage than CVEs)
-
-1. **Auth stays on.** NAS `.env` must keep `MCP_AUTH_METHOD=bearer`. `none` =
-   unauthenticated full admin (fail-open default). Never put the JWT on public channels;
-   tokens should carry an `exp` (the current prod token does not — fix when convenient).
-2. **Authorization is per-tool.** Every MCP tool is gated via
-   `wrapToolHandler(..., Permission.X)`. The REST `/api/*` bridge is **not** permission-
-   gated — keep it disabled or treat it as full-trust until it enforces the same masks.
-   Prompt injection via the AI path ("ignore previous instructions, unlock the door") is
-   contained only by these authorization checks — the model is not a security boundary.
-3. **Scoped TLS only.** Never use the process-global `NODE_TLS_REJECT_UNAUTHORIZED=0` —
-   it disables cert validation for *all* concurrent outbound HTTPS (HA token + AI key at
-   MITM risk), not just Omada. Use a per-client `undici` dispatcher, or pin the Omada
-   self-signed cert as a CA so verification stays on.
-4. **Encode every path segment** built from tool input. The Omada client does
-   (`encodeURIComponent` throughout); the HA client interpolates raw — fix when touched.
-5. **Secrets never in logs.** Redact tokens / secrets / `Authorization` headers / API
-   keys, and **sanitize `error.message`/`error.stack` before logging** — HTTP libraries
-   embed auth headers and token-bearing URLs inside thrown errors. Don't return raw
-   `error.message` to clients (leaks internal hostnames).
-6. **HTTP hardening when `useHttp`:** request body-size limit, rate limiting keyed on a
-   trusted-proxy IP (Cloudflare `CF-Connecting-IP`, not the spoofable `X-Forwarded-For`),
-   and static security headers (`X-Content-Type-Options: nosniff`, `X-Frame-Options`,
-   `Referrer-Policy`, CSP where applicable).
-
-### Confirmed safe — don't re-litigate
-
-- **JWT:** HS256 is pinned (the token's `alg` header is ignored), signature compared with
-  `crypto.timingSafeEqual` — not vulnerable to alg-confusion or timing attacks. (Still
-  add `exp` enforcement, and `iss`/`aud` if it ever becomes multi-issuer.)
-- **Omada client** encodes every path segment; query params via `URLSearchParams`.
-- **No** `eval` / `new Function` / dynamic `require`; the only child process is
-  `spawn('node', [fixedPath])` — no shell, no user-controlled argv.
-- **No arbitrary-URL SSRF via tool args** — HA/Omada/AI base URLs come only from config.
-- **Git hygiene clean** — `.env` is never tracked; no hardcoded real secrets in src/tests.
-
-### Insecure defaults to flip when next touched
-
-`config.ts` defaults `MCP_AUTH_METHOD=none`; `.env.example` ships `none` +
-`HA_STRICT_SSL=false`; `docker-compose.yml` hardcodes `MCP_HTTP_ALLOWED_ORIGINS=*`.
-None of these reflect the (secure) live deployment — make the secure values the defaults.