@cyanmycelium/mcp-broker 0.4.0 → 1.2.0

package/dist/chunk-FTDKH2C4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../provider/src/protocol/envelope.ts","../src/stdio.upstream.ts","../src/remote.transports.ts","../src/remote.upstream.ts","../src/broker/adapters/broker.adapter.info.ts","../src/broker/broker.grammars.ts","../src/broker/behaviors/broker.behavior.info.ts","../src/broker/adapters/broker.adapter.providers.ts","../src/broker/behaviors/broker.behavior.providers.ts","../src/broker/broker.server.ts","../src/authorization/resource.path.ts","../src/authorization/capability.classifier.ts","../src/authorization/policy.engine.ts","../src/authorization/subject.mapper.ts","../src/authorization/slot.resource.ts","../src/authorization/runtime.ts","../src/authorization/audit.ts","../src/broker/aggregate/aggregate.catalog.ts","../src/broker/aggregate/provider.client.session.ts","../src/broker/aggregate/aggregate.server.ts","../src/auth/auth.types.ts","../src/auth/jwt.validator.ts","../src/auth/resource.metadata.ts","../src/auth/http.auth.ts","../src/auth/auth.config.ts","../src/auth/provider.auth.ts","../src/version.ts","../src/ws/ws.tunnel.ts","../src/ws/ws.tunnel.builder.ts","../src/mcpb/mcpb.unzip.ts","../src/mcpb/mcpb.loader.ts","../src/config.ts"],"names":["sep","McpAdapterBase","McpToolResults","McpBehavior","tool","request","resolve","PROTOCOL_VERSION","mcpScopesOf","require","WebSocket","https2","http2","slot","state","relative","fs2","readFileSync","dirname","join","tag","existsSync"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwCO,IAAM,gBAAA,GAAmB;;EAE5B,mBAAA,EAAqB,KAAA;;EAGrB,qBAAA,EAAuB;AAC3B,CAAA;AAiBO,SAAS,cAAA,CAAe,UAAkB,KAAA,EAAuB;AACpE,EAAA,OAAO,qBAAA,CAAsB,QAAA,EAAU,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA;AAC5D;AAGO,SAAS,qBAAA,CAAsB,UAAkB,OAAA,EAA0B;AAC9E,EAAA,MAAM,QAAA,GAA2B,EAAE,QAAA,EAAU,OAAA,EAAA;AAC7C,EAAA,OAAO,IAAA,CAAK,UAAU,QAAQ,CAAA;AAClC;AASO,SAAS,eAAe,GAAA,EAAyC;AACpE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;EAC3B,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,MAAA;AACX,EAAA;AACA,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,MAAA;AAEnF,EAAA,MAAM,EAAE,QAAA,EAAU,OAAA,EAAA,GAAY,MAAA;AAC9B,EAAA,IAAI,OAAO,aAAa,QAAA,IAAY,QAAA,CAAS,WAAW,CAAA,IAAK,OAAA,KAAY,QAAW,OAAO,MAAA;AAE3F,EAAA,OAAO,EAAE,UAAU,OAAA,EAAA;AACvB;AAGO,SAAS,cAAc,QAAA,EAAkC;AAC5D,EAAA,OAAO,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA;AAC1C;AAaO,SAAS,mBAAA,CAAoB,QAAA,EAAkB,IAAA,EAAgC,OAAA,EAAyB;AAC3G,EAAA,OAAO,qBAAA,CAAsB,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,EAAE,IAAA,EAAM,OAAA,EAAA,EAAW,CAAA;AACjG;ACjFO,IAAM,gBAAN,MAAyC;AAAA,EACnC,IAAA;AAAA,EAEQ,OAAA;AAAA,EACT,KAAA,GAA6B,IAAA;AAAA,EAC7B,OAAA,GAAU,EAAA;AAAA,EACV,KAAA,GAAQ,KAAA;AAAA,EACR,QAAA,GAAW,KAAA;AAAA;AAAA,EAGnB,SAAA,GAA6C,IAAA;AAAA;AAAA,EAG7C,MAAA,GAA8B,IAAA;AAAA;AAAA,EAG9B,OAAA,GAA+B,IAAA;AAAA;AAAA,EAG/B,OAAA,GAA2C,IAAA;AAAA,EAE3C,YAAY,MAAA,EAA8B;AACtC,IAAA,IAAA,CAAK,OAAO,MAAA,CAAO,IAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACnB;AAAA,EAEA,IAAI,MAAA,GAAkB;AAClB,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AAAA;AAAA,EAGA,OAAA,GAAgB;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAChB,IAAA,MAAM,EAAE,OAAA,EAAS,IAAA,GAAO,EAAC,EAAG,GAAA,KAAQ,IAAA,CAAK,OAAA;AAEzC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM;AAAA,MAC9B,KAAK,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAK,GAAG,GAAA,EAAI;AAAA,MAC9B,KAAA,EAAO,CAAC,MAAA,EAAQ,MAAA,EAAQ,SAAS;AAAA,KACpC,CAAA;AAED,IAAA,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AACnC,MAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,MAAA,IAAA,CAAK,OAAA,GAAU,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAA,CAAK,IAAI,CAAA,kBAAA,EAAqB,GAAA,CAAI,OAAO,CAAA,CAAE,CAAC,CAAA;AAAA,IAC3F,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,MAAM;AACzB,MAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,MAAA,IAAA,CAAK,MAAA,IAAS;AAAA,IAClB,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC7C,MAAA,IAAA,CAAK,OAAA,IAAW,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA;AACrC,MAAA,IAAI,EAAA;AACJ,MAAA,OAAA,CAAQ,KAAK,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,IAAI,OAAO,EAAA,EAAI;AAC7C,QAAA,MAAM,OAAO,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK;AAC5C,QAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAC,CAAA;AACxC,QAAA,IAAI,IAAA,EAAM,IAAA,CAAK,SAAA,GAAY,IAAI,CAAA;AAAA,MACnC;AAAA,IACJ,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC7B,MAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,MAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,MAAA,IAAA,CAAK,OAAA,IAAU;AACf,MAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAChB,QAAA,IAAA,CAAK,OAAA,GAAU,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,IAAA,CAAK,IAAI,CAAA,4BAAA,EAA+B,IAAA,IAAQ,MAAM,CAAA,CAAE,CAAC,CAAA;AAAA,MACxG;AAAA,IACJ,CAAC,CAAA;AAAA,EACL;AAAA;AAAA,EAGA,KAAK,IAAA,EAAoB;AACrB,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,IAAS,CAAC,IAAA,CAAK,KAAA,EAAO,OAAO,QAAA,EAAU;AACjD,IAAA,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,KAAA,CAAM,IAAA,GAAO,MAAM,MAAM,CAAA;AAAA,EAC9C;AAAA;AAAA,EAGA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,KAAA,EAAO,OAAO,GAAA,EAAI;AACvB,IAAA,IAAA,CAAK,OAAO,IAAA,EAAK;AACjB,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AAAA,EACjB;AACJ;ACxFA,SAAS,WAAA,CAAY,GAAA,EAAU,OAAA,EAAyB,UAAA,EAA2D;AAC/G,EAAA,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,GAAiB,KAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA,GAAS,IAAA,CAAA,OAAA,CAAQ,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AACtH;AAMA,IAAM,aAAN,MAAiB;AAAA,EACL,IAAA,GAAO,EAAA;AAAA,EAEf,IAAA,CAAK,OAAe,IAAA,EAAmD;AACnE,IAAA,IAAA,CAAK,IAAA,IAAQ,MAAM,OAAA,CAAQ,OAAA,EAAS,IAAI,CAAA,CAAE,OAAA,CAAQ,OAAO,IAAI,CAAA;AAC7D,IAAA,IAAIA,IAAAA;AACJ,IAAA,OAAA,CAAQA,OAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,MAAM,OAAO,EAAA,EAAI;AAC7C,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,GAAGA,IAAG,CAAA;AACpC,MAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,KAAA,CAAMA,OAAM,CAAC,CAAA;AACnC,MAAA,IAAI,KAAA,GAAQ,SAAA;AACZ,MAAA,MAAM,OAAiB,EAAC;AACxB,MAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAG;AAClC,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AAC1B,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,QAAA,MAAM,QAAQ,KAAA,KAAU,EAAA,GAAK,OAAO,IAAA,CAAK,KAAA,CAAM,GAAG,KAAK,CAAA;AACvD,QAAA,IAAI,QAAQ,KAAA,KAAU,EAAA,GAAK,KAAK,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAC,CAAA;AACpD,QAAA,IAAI,MAAM,UAAA,CAAW,GAAG,GAAG,KAAA,GAAQ,KAAA,CAAM,MAAM,CAAC,CAAA;AAChD,QAAA,IAAI,KAAA,KAAU,SAAS,KAAA,GAAQ,KAAA;AAAA,aAAA,IACtB,KAAA,KAAU,MAAA,EAAQ,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA;AAAA,MAC9C;AACA,MAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IACpD;AAAA,EACJ;AACJ,CAAA;AAMA,IAAM,2BAAN,MAA2D;AAAA,EAQvD,WAAA,CACqB,MACA,QAAA,EACnB;AAFmB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAClB;AAAA,EAFkB,IAAA;AAAA,EACA,QAAA;AAAA,EATrB,SAAA,GAA6C,IAAA;AAAA,EAC7C,MAAA,GAA8B,IAAA;AAAA,EAC9B,OAAA,GAA+B,IAAA;AAAA,EAC/B,OAAA,GAA2C,IAAA;AAAA,EAEnC,GAAA,GAAwB,IAAA;AAAA,EAOhC,OAAA,GAAgB;AACZ,IAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,IAAA,CAAK,MAAM,EAAE,OAAA,EAAS,IAAA,CAAK,QAAA,EAAU,CAAA;AAC9D,IAAA,IAAA,CAAK,GAAA,GAAM,EAAA;AACX,IAAA,EAAA,CAAG,EAAA,CAAG,MAAA,EAAQ,MAAM,IAAA,CAAK,UAAU,CAAA;AACnC,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAiB,IAAA,CAAK,YAAY,IAAA,CAAK,QAAA,CAAS,MAAM,CAAC,CAAC,CAAA;AAC1E,IAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,MAAM,IAAA,CAAK,WAAW,CAAA;AACrC,IAAA,EAAA,CAAG,GAAG,OAAA,EAAS,CAAC,QAAe,IAAA,CAAK,OAAA,GAAU,GAAG,CAAC,CAAA;AAAA,EACtD;AAAA,EAEA,KAAK,IAAA,EAAoB;AACrB,IAAA,IAAI,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA,CAAI,UAAA,KAAe,UAAU,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,EAC9E;AAAA,EAEA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAChB,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA;AAAA,EACf;AACJ,CAAA;AAMA,IAAM,qBAAN,MAAqD;AAAA,EAWjD,WAAA,CACqB,MACA,QAAA,EACnB;AAFmB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAClB;AAAA,EAFkB,IAAA;AAAA,EACA,QAAA;AAAA,EAZrB,SAAA,GAA6C,IAAA;AAAA,EAC7C,MAAA,GAA8B,IAAA;AAAA,EAC9B,OAAA,GAA+B,IAAA;AAAA,EAC/B,OAAA,GAA2C,IAAA;AAAA,EAE1B,QAAA,GAAW,IAAI,UAAA,EAAW;AAAA,EACnC,UAAA,GAAmC,IAAA;AAAA,EACnC,QAAA,GAA0B,IAAA;AAAA,EAC1B,OAAA,GAAU,KAAA;AAAA,EAOlB,OAAA,GAAgB;AACZ,IAAA,MAAM,GAAA,GAAM,YAAY,IAAI,GAAA,CAAI,KAAK,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,KAAA,EAAO,SAAS,EAAE,GAAG,KAAK,QAAA,EAAU,MAAA,EAAQ,qBAAoB,EAAE,EAAG,CAAC,GAAA,KAAQ;AAChI,MAAA,MAAM,MAAA,GAAS,IAAI,UAAA,IAAc,CAAA;AACjC,MAAA,IAAI,UAAU,GAAA,EAAK;AACf,QAAA,IAAA,CAAK,UAAU,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,MAAM,EAAE,CAAC,CAAA;AACvD,QAAA,GAAA,CAAI,MAAA,EAAO;AACX,QAAA;AAAA,MACJ;AACA,MAAA,GAAA,CAAI,YAAY,MAAM,CAAA;AACtB,MAAA,GAAA,CAAI,GAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB,IAAA,CAAK,SAAS,IAAA,CAAK,KAAA,EAAO,CAAC,EAAA,EAAI,SAAS,IAAA,CAAK,QAAA,CAAS,EAAA,EAAI,IAAI,CAAC,CAAC,CAAA;AAClG,MAAA,GAAA,CAAI,EAAA,CAAG,OAAO,MAAM;AAChB,QAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,OAAA,IAAU;AAAA,MACtC,CAAC,CAAA;AAAA,IACL,CAAC,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAClB,IAAA,GAAA,CAAI,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AAC5B,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,IACzC,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,GAAA,EAAI;AAAA,EACZ;AAAA,EAEQ,QAAA,CAAS,OAAe,IAAA,EAAoB;AAChD,IAAA,IAAI,UAAU,UAAA,EAAY;AACtB,MAAA,IAAA,CAAK,WAAW,IAAI,GAAA,CAAI,MAAM,IAAA,CAAK,IAAI,EAAE,QAAA,EAAS;AAClD,MAAA,IAAA,CAAK,MAAA,IAAS;AAAA,IAClB,CAAA,MAAA,IAAW,UAAU,SAAA,EAAW;AAC5B,MAAA,IAAA,CAAK,YAAY,IAAI,CAAA;AAAA,IACzB;AAAA,EACJ;AAAA,EAEA,KAAK,IAAA,EAAoB;AACrB,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACpB,IAAA,MAAM,GAAA,GAAM,YAAY,IAAI,GAAA,CAAI,KAAK,QAAQ,CAAA,EAAG,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,cAAA,EAAgB,kBAAA,EAAmB,IAAK,CAAC,GAAA,KAAQ,GAAA,CAAI,MAAA,EAAQ,CAAA;AAC5J,IAAA,GAAA,CAAI,GAAG,OAAA,EAAS,CAAC,QAAe,IAAA,CAAK,OAAA,GAAU,GAAG,CAAC,CAAA;AACnD,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EAChB;AAAA,EAEA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,IAAA,CAAK,YAAY,OAAA,EAAQ;AACzB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACtB;AACJ,CAAA;AAMA,IAAM,gCAAN,MAAgE;AAAA,EAU5D,WAAA,CACqB,MACA,QAAA,EACnB;AAFmB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAClB;AAAA,EAFkB,IAAA;AAAA,EACA,QAAA;AAAA,EAXrB,SAAA,GAA6C,IAAA;AAAA,EAC7C,MAAA,GAA8B,IAAA;AAAA,EAC9B,OAAA,GAA+B,IAAA;AAAA,EAC/B,OAAA,GAA2C,IAAA;AAAA,EAEnC,UAAA,GAA4B,IAAA;AAAA,EAC5B,UAAA,GAAmC,IAAA;AAAA,EACnC,OAAA,GAAU,KAAA;AAAA,EAOlB,OAAA,GAAgB;AAIZ,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,IAAA,CAAK,MAAA,IAAS;AAAA,EAClB;AAAA,EAEA,KAAK,IAAA,EAAoB;AACrB,IAAA,IAAI,KAAK,OAAA,EAAS;AAClB,IAAA,MAAM,OAAA,GAAkC;AAAA,MACpC,GAAG,IAAA,CAAK,QAAA;AAAA,MACR,cAAA,EAAgB,kBAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACZ;AACA,IAAA,IAAI,IAAA,CAAK,UAAA,EAAY,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,UAAA;AACtD,IAAA,MAAM,MAAM,WAAA,CAAY,IAAI,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,EAAG,CAAC,QAAQ,IAAA,CAAK,eAAA,CAAgB,GAAG,CAAC,CAAA;AAC3G,IAAA,GAAA,CAAI,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AAC5B,MAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,IACzC,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,EAChB;AAAA,EAEQ,gBAAgB,GAAA,EAA4B;AAChD,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AACxC,IAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,IAAK,GAAA,KAAQ,KAAK,UAAA,EAAY;AACtE,MAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAClB,MAAA,IAAA,CAAK,iBAAA,EAAkB;AAAA,IAC3B;AACA,IAAA,MAAM,MAAA,GAAS,IAAI,UAAA,IAAc,CAAA;AACjC,IAAA,IAAI,WAAW,GAAA,EAAK;AAChB,MAAA,GAAA,CAAI,MAAA,EAAO;AACX,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,UAAU,GAAA,EAAK;AACf,MAAA,IAAA,CAAK,UAAU,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,EAAE,CAAC,CAAA;AACpE,MAAA,GAAA,CAAI,MAAA,EAAO;AACX,MAAA;AAAA,IACJ;AACA,IAAA,GAAA,CAAI,YAAY,MAAM,CAAA;AACtB,IAAA,IAAI,MAAA,CAAO,IAAI,OAAA,CAAQ,cAAc,KAAK,EAAE,CAAA,CAAE,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzE,MAAA,MAAM,OAAA,GAAU,IAAI,UAAA,EAAW;AAC/B,MAAA,GAAA,CAAI,EAAA;AAAA,QAAG,MAAA;AAAA,QAAQ,CAAC,KAAA,KACZ,OAAA,CAAQ,KAAK,KAAA,EAAO,CAAC,IAAI,IAAA,KAAS;AAC9B,UAAA,IAAI,EAAA,KAAO,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,IAAI,CAAA;AAAA,QAC/C,CAAC;AAAA,OACL;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,IAAI,IAAA,GAAO,EAAA;AACX,MAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC9B,QAAA,IAAA,IAAQ,KAAA;AAAA,MACZ,CAAC,CAAA;AACD,MAAA,GAAA,CAAI,GAAG,KAAA,EAAO,MAAM,IAAA,CAAK,aAAA,CAAc,IAAI,CAAC,CAAA;AAAA,IAChD;AAAA,EACJ;AAAA,EAEQ,cAAc,IAAA,EAAoB;AACtC,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,IAAA,IAAI,CAAC,OAAA,EAAS;AACd,IAAA,IAAI;AACA,MAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAC1C,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACvB,QAAA,KAAA,MAAW,WAAW,MAAA,EAAQ,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AACtE,QAAA;AAAA,MACJ;AAAA,IACJ,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,YAAY,OAAO,CAAA;AAAA,EAC5B;AAAA;AAAA,EAGQ,iBAAA,GAA0B;AAC9B,IAAA,IAAI,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,UAAA,EAAY;AACrC,IAAA,MAAM,UAAkC,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,QAAQ,mBAAA,EAAoB;AACxF,IAAA,IAAI,IAAA,CAAK,UAAA,EAAY,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,UAAA;AACtD,IAAA,MAAM,GAAA,GAAM,WAAA,CAAY,IAAI,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAQ,EAAG,CAAC,GAAA,KAAQ;AAC7E,MAAA,IAAA,CAAK,GAAA,CAAI,UAAA,IAAc,CAAA,KAAM,GAAA,EAAK;AAE9B,QAAA,GAAA,CAAI,MAAA,EAAO;AACX,QAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,QAAA;AAAA,MACJ;AACA,MAAA,MAAM,OAAA,GAAU,IAAI,UAAA,EAAW;AAC/B,MAAA,GAAA,CAAI,YAAY,MAAM,CAAA;AACtB,MAAA,GAAA,CAAI,EAAA;AAAA,QAAG,MAAA;AAAA,QAAQ,CAAC,KAAA,KACZ,OAAA,CAAQ,KAAK,KAAA,EAAO,CAAC,IAAI,IAAA,KAAS;AAC9B,UAAA,IAAI,EAAA,KAAO,SAAA,EAAW,IAAA,CAAK,SAAA,GAAY,IAAI,CAAA;AAAA,QAC/C,CAAC;AAAA,OACL;AACA,MAAA,GAAA,CAAI,EAAA,CAAG,OAAO,MAAM;AAChB,QAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACL,CAAC,CAAA;AACD,IAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAClB,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM;AAClB,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,GAAA,EAAI;AAAA,EACZ;AAAA,EAEA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,IAAA,CAAK,YAAY,OAAA,EAAQ;AACzB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACtB;AACJ,CAAA;AAOO,SAAS,qBAAA,CAAsB,GAAA,EAAa,IAAA,EAA2B,OAAA,EAAmD;AAC7H,EAAA,QAAQ,IAAA;AAAM,IACV,KAAK,WAAA;AACD,MAAA,OAAO,IAAI,wBAAA,CAAyB,GAAA,EAAK,OAAO,CAAA;AAAA,IACpD,KAAK,KAAA;AACD,MAAA,OAAO,IAAI,kBAAA,CAAmB,GAAA,EAAK,OAAO,CAAA;AAAA,IAC9C,KAAK,iBAAA;AACD,MAAA,OAAO,IAAI,6BAAA,CAA8B,GAAA,EAAK,OAAO,CAAA;AAAA;AAEjE;AAMO,SAAS,gBAAgB,GAAA,EAAkC;AAC9D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,IAAI,IAAI,GAAG,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,iBAAA;AAAA,EACX;AACA,EAAA,IAAI,OAAO,QAAA,KAAa,KAAA,IAAS,MAAA,CAAO,QAAA,KAAa,QAAQ,OAAO,WAAA;AACpE,EAAA,IAAI,MAAA,CAAO,SAAS,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,KAAA;AACjE,EAAA,OAAO,iBAAA;AACX;;;ACvSO,IAAM,iBAAN,MAA0C;AAAA,EACpC,IAAA;AAAA,EAET,SAAA,GAA6C,IAAA;AAAA,EAC7C,MAAA,GAA8B,IAAA;AAAA,EAC9B,OAAA,GAA+B,IAAA;AAAA,EAC/B,OAAA,GAA2C,IAAA;AAAA,EAE1B,OAAA;AAAA,EACT,UAAA,GAAsC,IAAA;AAAA,EACtC,KAAA,GAAQ,KAAA;AAAA,EAEhB,YAAY,MAAA,EAA+B;AACvC,IAAA,IAAA,CAAK,OAAO,MAAA,CAAO,IAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACnB;AAAA,EAEA,IAAI,MAAA,GAAkB;AAClB,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AAAA,EAEA,OAAA,GAAgB;AACZ,IAAA,MAAM,OAAO,IAAA,CAAK,OAAA,CAAQ,aAAa,eAAA,CAAgB,IAAA,CAAK,QAAQ,GAAG,CAAA;AACvE,IAAA,MAAM,SAAA,GAAY,qBAAA,CAAsB,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,IAAW,EAAE,CAAA;AAC1F,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA;AAElB,IAAA,SAAA,CAAU,SAAS,MAAY;AAC3B,MAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,MAAA,IAAA,CAAK,MAAA,IAAS;AAAA,IAClB,CAAA;AACA,IAAA,SAAA,CAAU,SAAA,GAAY,CAAC,IAAA,KAAuB,IAAA,CAAK,YAAY,IAAI,CAAA;AACnE,IAAA,SAAA,CAAU,UAAU,MAAY;AAC5B,MAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,MAAA,IAAA,CAAK,OAAA,IAAU;AAAA,IACnB,CAAA;AACA,IAAA,SAAA,CAAU,OAAA,GAAU,CAAC,GAAA,KAAqB;AACtC,MAAA,IAAA,CAAK,OAAA,GAAU,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,IAAA,CAAK,IAAI,CAAA,GAAA,EAAM,GAAA,CAAI,OAAO,CAAA,CAAE,CAAC,CAAA;AAAA,IAC7E,CAAA;AAEA,IAAA,SAAA,CAAU,OAAA,EAAQ;AAAA,EACtB;AAAA,EAEA,KAAK,IAAA,EAAoB;AACrB,IAAA,IAAA,CAAK,UAAA,EAAY,KAAK,IAAI,CAAA;AAAA,EAC9B;AAAA,EAEA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACtB;AACJ;ACrEO,IAAM,eAAA,GAAkB,eAAA;AAMxB,IAAM,iBAAA,GAAN,cAAgC,cAAA,CAAe;AAAA,EAClD,YAA6B,QAAA,EAA0B;AACnD,IAAA,KAAA,CAAM,QAAQ,CAAA;AADW,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAE7B;AAAA,EAF6B,QAAA;AAAA,EAI7B,MAAa,kBAAkB,GAAA,EAAsD;AACjF,IAAA,IAAI,GAAA,KAAQ,iBAAiB,OAAO,MAAA;AACpC,IAAA,OAAO;AAAA,MACH,GAAA;AAAA,MACA,QAAA,EAAU,kBAAA;AAAA,MACV,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,WAAW;AAAA,KACzC;AAAA,EACJ;AAAA,EAEA,MAAa,gBAAA,CAAiB,IAAA,EAAc,QAAA,EAAkB,KAAA,EAAwD;AAClH,IAAA,IAAI,aAAa,aAAA,EAAe;AAC5B,MAAA,OAAO,cAAA,CAAe,KAAA,CAAM,CAAA,cAAA,EAAiB,QAAQ,CAAA,CAAE,CAAA;AAAA,IAC3D;AACA,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,SAAA,EAAW,CAAA;AAAA,EAC/C;AAAA,EAEQ,SAAA,GAAY;AAChB,IAAA,MAAM,IAAI,IAAA,CAAK,QAAA;AACf,IAAA,OAAO;AAAA,MACH,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,SAAA,EAAW,CAAA,CAAE,SAAA,EAAW,WAAA,EAAY,IAAK,IAAA;AAAA,MACzC,eAAe,CAAA,CAAE,aAAA;AAAA,MACjB,IAAA,EAAM,EAAE,IAAA,IAAQ,SAAA;AAAA,MAChB,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,KAAK,CAAA,CAAE,GAAA;AAAA,MACP,OAAO,CAAA,CAAE;AAAA,KACb;AAAA,EACJ;AACJ,CAAA;ACOO,SAAS,gBAAA,CAAiB,SAAA,EAA4B,MAAA,EAAsB,OAAA,EAA0B;AACzG,EAAA,MAAM,IAAA,GAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AACnC,EAAA,OAAO,OAAA,GAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAK,IAAA;AAC5C;AAUO,SAAS,uBAAuB,IAAA,EAAiE;AACpG,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,EAAA,IAAI,EAAA,GAAK,GAAG,OAAO,IAAA,CAAK,SAAS,CAAA,GAAI,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,IAAA;AACxD,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,CAAA;AACjC,EAAA,IAAI,OAAO,MAAA,KAAW,CAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,IAAA;AACxD,EAAA,OAAO,EAAE,QAAQ,OAAA,EAAQ;AAC7B;AA0BA,IAAM,YAAA,GAAe,KAAK,OAAA,CAAQ,aAAA,CAAc,YAAY,GAAG,CAAC,GAAG,UAAU,CAAA;AAE7E,IAAM,MAAA,uBAAa,GAAA,EAAwB;AAWpC,SAAS,iBAAA,CAAkB,SAAA,EAA4B,MAAA,EAAsB,OAAA,EAA0C;AAC1H,EAAA,MAAM,GAAA,GAAM,gBAAA,CAAiB,SAAA,EAAW,MAAA,EAAQ,OAAO,CAAA;AACvD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAC7B,EAAA,IAAI,QAAQ,OAAO,MAAA;AAEnB,EAAA,MAAM,QAAA,GAAW,UAAU,CAAA,EAAG,MAAM,IAAI,OAAO,CAAA,KAAA,CAAA,GAAU,GAAG,MAAM,CAAA,KAAA,CAAA;AAClE,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,YAAA,EAAc,SAAA,EAAW,QAAQ,CAAA;AACnD,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,MAAA;AAE9B,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC3B,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA;AACxC,EAAA,MAAA,CAAO,GAAA,CAAI,KAAK,OAAO,CAAA;AACvB,EAAA,OAAO,OAAA;AACX;AAqBO,UAAU,uBAAuB,WAAA,EAAqD;AACzF,EAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAE9B,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,WAAW,CAAA,CAAE,IAAA,EAAK;AACjD,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAChC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,EAAa,SAAS,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,CAAE,aAAY,EAAG;AAEpC,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,KAAK,CAAA,CAAE,IAAA,EAAK;AACtC,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,MAAA,IAAI,CAAC,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,EAAG;AAC7B,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,QAAQ,MAAM,CAAA;AAC1C,MAAA,MAAM,MAAA,GAAS,uBAAuB,IAAI,CAAA;AAC1C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACT,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,mDAAA,EAAsD,IAAI,OAAO,KAAK;AAAA,CAAI,CAAA;AAC/F,QAAA;AAAA,MACJ;AACA,MAAA,MAAM,EAAE,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AAC5B,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,EAAO,IAAI,CAAA;AAC7B,MAAA,IAAI;AACA,QAAA,MAAM,GAAA,GAAM,YAAA,CAAa,IAAA,EAAM,OAAO,CAAA;AACtC,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC3B,QAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA;AACxC,QAAA,MAAM;AAAA,UACF,SAAA;AAAA,UACA,MAAA;AAAA,UACA,OAAA;AAAA,UACA,GAAA,EAAK,gBAAA,CAAiB,SAAA,EAAW,MAAA,EAAQ,OAAO,CAAA;AAAA,UAChD;AAAA,SACJ;AAAA,MACJ,SAAS,GAAA,EAAK;AACV,QAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,oCAAA,EAAuC,IAAI,CAAA,EAAA,EAAM,IAAc,OAAO;AAAA,CAAI,CAAA;AAAA,MACnG;AAAA,IACJ;AAAA,EACJ;AACJ;AASO,UAAU,2BAAA,GAA8D;AAC3E,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC9C;AAmBO,SAAS,qBAAA,GAAoC;AAChD,EAAA,MAAM,CAAA,GAAI,iBAAA,CAAkB,SAAA,EAAW,IAAI,CAAA;AAC3C,EAAA,IAAI,CAAC,CAAA,EAAG;AACJ,IAAA,MAAM,IAAI,MAAM,CAAA,sEAAA,EAAyE,IAAA,CAAK,cAAc,SAAA,EAAW,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACxI;AACA,EAAA,OAAO,CAAA;AACX;AAOO,SAAS,8BAA8B,QAAA,EAA0B;AACpE,EAAA,MAAM,IAAA,GAAO,qBAAA,EAAsB,CAAE,kBAAA,CAAmB,QAAQ,CAAA;AAChE,EAAA,IAAI,CAAC,IAAA,EAAM;AACP,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uCAAA,EAA0C,QAAQ,CAAA,qBAAA,CAAuB,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,IAAA;AACX;AAMO,SAAS,iCAAA,CAAkC,UAAkB,YAAA,EAA8B;AAC9F,EAAA,MAAM,IAAA,GAAO,qBAAA,EAAsB,CAAE,sBAAA,CAAuB,UAAU,YAAY,CAAA;AAClF,EAAA,IAAI,CAAC,IAAA,EAAM;AACP,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,YAAY,CAAA,WAAA,EAAc,QAAQ,CAAA,qBAAA,CAAuB,CAAA;AAAA,EAC3H;AACA,EAAA,OAAO,IAAA;AACX;AAMO,SAAS,2BAA2B,GAAA,EAAqB;AAC5D,EAAA,MAAM,IAAA,GAAO,qBAAA,EAAsB,CAAE,eAAA,CAAgB,GAAG,CAAA;AACxD,EAAA,IAAI,CAAC,IAAA,EAAM;AACP,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,GAAG,CAAA,qBAAA,CAAuB,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAA;AACX;AAMO,SAAS,kCAAkC,GAAA,EAAqB;AACnE,EAAA,MAAM,IAAA,GAAO,qBAAA,EAAsB,CAAE,sBAAA,CAAuB,GAAG,CAAA;AAC/D,EAAA,IAAI,CAAC,IAAA,EAAM;AACP,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,GAAG,CAAA,qBAAA,CAAuB,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,IAAA;AACX;AAMO,SAAS,mCAAmC,WAAA,EAA6B;AAC5E,EAAA,MAAM,IAAA,GAAO,qBAAA,EAAsB,CAAE,uBAAA,CAAwB,WAAW,CAAA;AACxE,EAAA,IAAI,CAAC,IAAA,EAAM;AACP,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAgD,WAAW,CAAA,qBAAA,CAAuB,CAAA;AAAA,EACtG;AACA,EAAA,OAAO,IAAA;AACX;AAMO,SAAS,0CAA0C,WAAA,EAA6B;AACnF,EAAA,MAAM,IAAA,GAAO,qBAAA,EAAsB,CAAE,8BAAA,CAA+B,WAAW,CAAA;AAC/E,EAAA,IAAI,CAAC,IAAA,EAAM;AACP,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oDAAA,EAAuD,WAAW,CAAA,qBAAA,CAAuB,CAAA;AAAA,EAC7G;AACA,EAAA,OAAO,IAAA;AACX;;;ACtRO,IAAM,kBAAA,GAAN,MAAM,mBAAA,SAA2B,WAAA,CAAY;AAAA,EAChD,OAAuB,SAAA,GAAY,QAAA;AAAA,EAEnC,YAAY,OAAA,EAAyB;AACjC,IAAA,KAAA,CAAM,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAAA,MAClC,WAAW,mBAAA,CAAmB;AAAA,KACjC,CAAA;AAAA,EACL;AAAA,EAEmB,eAAA,GAAiC;AAChD,IAAA,OAAO;AAAA,MACH;AAAA,QACI,GAAA,EAAK,eAAA;AAAA,QACL,IAAA,EAAM,2BAA2B,eAAe,CAAA;AAAA,QAChD,QAAA,EAAU,kBAAA;AAAA,QACV,WAAA,EAAa,kCAAkC,eAAe;AAAA;AAClE,KACJ;AAAA,EACJ;AAAA,EAEmB,WAAA,GAAyB;AACxC,IAAA,OAAO;AAAA,MACH;AAAA,QACI,IAAA,EAAM,aAAA;AAAA,QACN,WAAA,EAAa,8BAA8B,aAAa,CAAA;AAAA,QACxD,WAAA,EAAa;AAAA,UACT,IAAA,EAAM,QAAA;AAAA,UACN,YAAY,EAAC;AAAA,UACb,oBAAA,EAAsB;AAAA;AAC1B;AACJ,KACJ;AAAA,EACJ;AACJ;ACxCO,IAAM,aAAA,GAAgB,oBAAA;AAGtB,IAAM,qBAAA,GAAwB,2BAAA;AAM9B,IAAM,sBAAA,GAAN,cAAqCC,cAAAA,CAAe;AAAA,EACvD,YAA6B,QAAA,EAA0B;AACnD,IAAA,KAAA,CAAM,QAAQ,CAAA;AADW,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAE7B;AAAA,EAF6B,QAAA;AAAA,EAI7B,MAAa,kBAAkB,GAAA,EAAsD;AACjF,IAAA,IAAI,QAAQ,aAAA,EAAe;AACvB,MAAA,OAAO;AAAA,QACH,GAAA;AAAA,QACA,QAAA,EAAU,kBAAA;AAAA,QACV,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAe;AAAA,OAC7C;AAAA,IACJ;AAGA,IAAA,MAAM,KAAA,GAAQ,iCAAA,CAAkC,IAAA,CAAK,GAAG,CAAA;AACxD,IAAA,IAAI,KAAA,EAAO;AACP,MAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA;AACxC,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,eAAA,CAAgB,IAAI,CAAA;AAC/C,MAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,MAAA,OAAO;AAAA,QACH,GAAA;AAAA,QACA,QAAA,EAAU,kBAAA;AAAA,QACV,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,OAC7B;AAAA,IACJ;AAEA,IAAA,OAAO,MAAA;AAAA,EACX;AAAA,EAEA,MAAa,gBAAA,CAAiB,IAAA,EAAc,QAAA,EAAkB,IAAA,EAAuD;AACjH,IAAA,QAAQ,QAAA;AAAU,MACd,KAAK,gBAAA;AACD,QAAA,OAAOC,cAAAA,CAAe,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,CAAA;AAAA,MAEnD,KAAK,iBAAA,EAAmB;AACpB,QAAA,MAAM,OAAO,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO,EAAA;AACzD,QAAA,IAAI,CAAC,IAAA,EAAM,OAAOA,cAAAA,CAAe,MAAM,6CAA6C,CAAA;AACpF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,eAAA,CAAgB,IAAI,CAAA;AAC/C,QAAA,IAAI,CAAC,IAAA,EAAM,OAAOA,eAAe,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,EAAA,CAAI,CAAA;AACrE,QAAA,OAAOA,cAAAA,CAAe,KAAK,IAAI,CAAA;AAAA,MACnC;AAAA,MAEA;AACI,QAAA,OAAOA,cAAAA,CAAe,KAAA,CAAM,CAAA,cAAA,EAAiB,QAAQ,CAAA,CAAE,CAAA;AAAA;AAC/D,EACJ;AAAA,EAEQ,aAAA,GAAqE;AACzE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,gBAAA,EAAiB;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,CAAU,MAAA,EAAQ,SAAA,EAAU;AAAA,EAChD;AACJ,CAAA;;;AC5CO,IAAM,uBAAA,GAAN,MAAM,wBAAA,SAAgCC,WAAAA,CAAY;AAAA,EACrD,OAAuB,SAAA,GAAY,kBAAA;AAAA,EAEnC,YAAY,OAAA,EAAyB;AACjC,IAAA,KAAA,CAAM,IAAI,sBAAA,CAAuB,OAAO,CAAA,EAAG;AAAA,MACvC,WAAW,wBAAA,CAAwB;AAAA,KACtC,CAAA;AAAA,EACL;AAAA,EAEmB,eAAA,GAAiC;AAChD,IAAA,OAAO;AAAA,MACH;AAAA,QACI,GAAA,EAAK,aAAA;AAAA,QACL,IAAA,EAAM,2BAA2B,aAAa,CAAA;AAAA,QAC9C,QAAA,EAAU,kBAAA;AAAA,QACV,WAAA,EAAa,kCAAkC,aAAa;AAAA;AAChE,KACJ;AAAA,EACJ;AAAA,EAEmB,cAAA,GAAwC;AACvD,IAAA,OAAO;AAAA,MACH;AAAA,QACI,WAAA,EAAa,qBAAA;AAAA,QACb,IAAA,EAAM,mCAAmC,qBAAqB,CAAA;AAAA,QAC9D,QAAA,EAAU,kBAAA;AAAA,QACV,WAAA,EAAa,0CAA0C,qBAAqB;AAAA;AAChF,KACJ;AAAA,EACJ;AAAA,EAEmB,WAAA,GAAyB;AACxC,IAAA,OAAO;AAAA,MACH;AAAA,QACI,IAAA,EAAM,gBAAA;AAAA,QACN,WAAA,EAAa,8BAA8B,gBAAgB,CAAA;AAAA,QAC3D,WAAA,EAAa;AAAA,UACT,IAAA,EAAM,QAAA;AAAA,UACN,YAAY,EAAC;AAAA,UACb,oBAAA,EAAsB;AAAA;AAC1B,OACJ;AAAA,MACA;AAAA,QACI,IAAA,EAAM,iBAAA;AAAA,QACN,WAAA,EAAa,8BAA8B,iBAAiB,CAAA;AAAA,QAC5D,WAAA,EAAa;AAAA,UACT,IAAA,EAAM,QAAA;AAAA,UACN,UAAA,EAAY;AAAA,YACR,IAAA,EAAM;AAAA,cACF,IAAA,EAAM,QAAA;AAAA,cACN,WAAA,EAAa,iCAAA,CAAkC,iBAAA,EAAmB,MAAM;AAAA;AAC5E,WACJ;AAAA,UACA,QAAA,EAAU,CAAC,MAAM,CAAA;AAAA,UACjB,oBAAA,EAAsB;AAAA;AAC1B;AACJ,KACJ;AAAA,EACJ;AACJ;ACnEO,IAAM,oBAAA,GAAuB;AAwDpC,eAAsB,iBAAA,CAClB,OAAA,EACA,OAAA,GAAqC,EAAC,EAIvC;AACC,EAAA,MAAM,CAAC,SAAA,EAAW,SAAS,CAAA,GAAI,kBAAkB,UAAA,EAAW;AAI5D,EAAA,MAAM,OAAA,GAAU,IAAI,gBAAA,EAAiB,CAChC,QAAA,CAAS,oBAAoB,CAAA,CAC7B,aAAA,CAAc,SAAS,CAAA,CACvB,eAAA,CAAgB;AAAA,IACb,YAAY,OAAO;AAAA,MACf,eAAA,EAAiB,YAAA;AAAA,MACjB,YAAY,EAAE,IAAA,EAAM,oBAAA,EAAsB,OAAA,EAAS,QAAQ,OAAA;AAAQ,KACvE;AAAA,GACH,CAAA,CACA,QAAA,CAAS,IAAI,kBAAA,CAAmB,OAAO,CAAA,EAAG,IAAI,uBAAA,CAAwB,OAAO,CAAC,CAAA;AASnF,EAAA,KAAA,MAAW,KAAA,IAAS,6BAA4B,EAAG;AAC/C,IAAA,OAAA,CAAQ,WAAA,CAAY,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,OAAO,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,QAAQ,gBAAA,EAAkB;AAC1B,IAAA,KAAA,MAAW,KAAA,IAAS,sBAAA,CAAuB,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAClE,MAAA,OAAA,CAAQ,WAAA,CAAY,KAAA,CAAM,GAAA,EAAK,KAAA,CAAM,OAAO,CAAA;AAAA,IAChD;AAAA,EACJ;AAOA,EAAA,OAAA,CAAQ,mBAAA,CAAoB;AAAA,IACxB,YAAA,EAAc,MAAM,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAAA,IACnD,GAAI,OAAA,CAAQ,sBAAA,IAA0B;AAAC,GAC1C,CAAA;AAID,EAAA,MAAM,MAAA,GAAS,QAAQ,KAAA,EAAM;AAE7B,EAAA,MAAM,OAAO,KAAA,EAAM;AAEnB,EAAA,OAAO,EAAE,MAAA,EAAQ,eAAA,EAAiB,SAAA,EAAU;AAChD;;;AC7HA,IAAM,QAAA,GAAW,GAAA;AACjB,IAAM,kBAAA,GAAqB,IAAA;AAE3B,SAAS,YAAA,CAAa,OAAe,KAAA,EAAqB;AACtD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,iCAAA,CAAmC,CAAA;AAAA,EAC/D;AACJ;AAEA,SAAS,iBAAA,CAAkB,OAAe,KAAA,EAAkC;AACxE,EAAA,YAAA,CAAa,OAAO,KAAK,CAAA;AACzB,EAAA,IAAI,CAAC,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAA,EAAM,KAAK,CAAA,sBAAA,CAAwB,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,KAAA,KAAU,GAAA,EAAK,OAAO,EAAC;AAE3B,EAAA,MAAM,oBAAA,GAAuB,MAAM,QAAA,CAAS,GAAG,IAAI,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,KAAA;AACxE,EAAA,MAAM,WAAW,oBAAA,CAAqB,KAAA,CAAM,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA;AACxD,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,OAAA,EAAS;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAA,EAAM,KAAK,CAAA,iCAAA,CAAmC,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,OAAA,KAAY,GAAA,IAAO,OAAA,KAAY,IAAA,EAAM;AACrC,MAAA,MAAM,IAAI,MAAM,CAAA,EAAG,KAAK,MAAM,KAAK,CAAA,wBAAA,EAA2B,OAAO,CAAA,UAAA,CAAY,CAAA;AAAA,IACrF;AAAA,EACJ;AACA,EAAA,OAAO,QAAA;AACX;AAEA,SAAS,gBAAgB,QAAA,EAAqC;AAC1D,EAAA,OAAO,QAAA,CAAS,WAAW,CAAA,GAAI,GAAA,GAAM,IAAI,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAC/D;AAQO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACb,KAAA;AAAA,EACA,QAAA;AAAA,EAED,YAAY,QAAA,EAA6B;AAC7C,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AAC3C,IAAA,IAAA,CAAK,KAAA,GAAQ,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA;AAAA,EAC9C;AAAA,EAEA,OAAO,MAAM,KAAA,EAA6B;AACtC,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,KAAA,EAAO,eAAe,CAAA;AACzD,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC5B,MAAA,IAAI,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,kBAAA,EAAoB;AACxD,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAgD,KAAK,CAAA,EAAA,CAAI,CAAA;AAAA,MAC7E;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,cAAa,QAAQ,CAAA;AAAA,EACpC;AAAA,EAEA,OAAO,SAAS,KAAA,EAAyC;AACrD,IAAA,IAAI;AACA,MAAA,OAAO,aAAA,CAAa,MAAM,KAAK,CAAA;AAAA,IACnC,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,MAAA;AAAA,IACX;AAAA,EACJ;AAAA,EAEA,QAAA,GAAmB;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AACJ;AAMO,IAAM,mBAAA,GAAN,MAAM,oBAAA,CAAoB;AAAA,EACpB,KAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EAED,YAAY,QAAA,EAA6B;AAC7C,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,QAAQ,CAAC,CAAA;AAC3C,IAAA,IAAA,CAAK,KAAA,GAAQ,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA;AAC1C,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,CAAC,OAAO,OAAA,KAAY;AACxD,MAAA,IAAI,OAAA,KAAY,oBAAoB,OAAO,KAAA;AAC3C,MAAA,IAAI,OAAA,KAAY,QAAA,EAAU,OAAO,KAAA,GAAQ,CAAA;AACzC,MAAA,OAAO,KAAA,GAAQ,CAAA;AAAA,IACnB,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AAAA,EAC3B;AAAA,EAEA,OAAO,MAAM,KAAA,EAAoC;AAC7C,IAAA,MAAM,SAAA,GAAY,KAAA,KAAU,kBAAA,GAAqB,CAAA,CAAA,EAAI,kBAAkB,CAAA,CAAA,GAAK,KAAA;AAC5E,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,SAAA,EAAW,kBAAkB,CAAA;AAChE,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,QAAA,CAAS,MAAA,EAAQ,SAAS,CAAA,EAAG;AACrD,MAAA,MAAM,OAAA,GAAU,SAAS,KAAK,CAAA;AAC9B,MAAA,IAAI,YAAY,kBAAA,EAAoB;AAChC,QAAA,IAAI,KAAA,KAAU,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC/B,UAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qDAAA,EAAwD,KAAK,CAAA,EAAA,CAAI,CAAA;AAAA,QACrF;AACA,QAAA,aAAA,GAAgB,IAAA;AAAA,MACpB,WAAW,aAAA,EAAe;AACtB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iDAAA,EAAoD,KAAK,CAAA,EAAA,CAAI,CAAA;AAAA,MACjF,WAAW,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA,EAAG;AAC3D,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+DAAA,EAAkE,KAAK,CAAA,EAAA,CAAI,CAAA;AAAA,MAC/F;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,qBAAoB,QAAQ,CAAA;AAAA,EAC3C;AAAA,EAEA,QAAQ,IAAA,EAA6B;AACjC,IAAA,MAAM,UAAU,IAAA,CAAK,QAAA;AACrB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA;AACpB,IAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAS,CAAA,EAAG;AACpD,MAAA,MAAM,OAAA,GAAU,QAAQ,KAAK,CAAA;AAC7B,MAAA,IAAI,OAAA,KAAY,oBAAoB,OAAO,IAAA;AAC3C,MAAA,IAAI,KAAA,IAAS,MAAA,CAAO,MAAA,EAAQ,OAAO,KAAA;AACnC,MAAA,IAAI,YAAY,QAAA,IAAY,OAAA,KAAY,MAAA,CAAO,KAAK,GAAG,OAAO,KAAA;AAAA,IAClE;AACA,IAAA,OAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,MAAA;AAAA,EACrC;AAAA,EAEA,QAAA,GAAmB;AACf,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EAChB;AACJ;;;ACxGA,IAAM,mBAAA,GAAwD;AAAA,EAC1D,gBAAA,EAAkB,oBAAA;AAAA,EAClB,gBAAA,EAAkB,oBAAA;AAAA,EAClB,YAAA,EAAc,gBAAA;AAAA,EACd,cAAA,EAAgB,kBAAA;AAAA,EAChB,aAAA,EAAe,kBAAA;AAAA,EACf,qBAAA,EAAuB,oBAAA;AAAA,EACvB,sCAAA,EAAwC,oBAAA;AAAA,EACxC,iCAAA,EAAmC,oBAAA;AAAA,EACnC,kCAAA,EAAoC,gBAAA;AAAA,EACpC,oCAAA,EAAsC;AAC1C,CAAA;AAEA,IAAM,oCAAoB,IAAI,GAAA,CAAI,CAAC,aAAA,EAAe,gBAAA,EAAkB,iBAAiB,CAAC,CAAA;AAEtF,SAAS,aAAa,MAAA,EAAqC;AACvD,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,MAAA;AACnF,EAAA,MAAM,IAAA,GAAQ,OAA6C,MAAM,CAAA;AACjE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,GAAO,IAAA,GAAO,MAAA;AACrD;AAEO,SAAS,kBAAA,CAAmB,UAAA,EAAoB,KAAA,GAAQ,YAAA,EAAoB;AAC/E,EAAA,IAAI,OAAO,eAAe,QAAA,IAAa,UAAA,KAAe,OAAO,CAAC,+BAAA,CAAgC,IAAA,CAAK,UAAU,CAAA,EAAI;AAC7G,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,KAAK,CAAA,GAAA,EAAM,UAAU,CAAA,eAAA,CAAiB,CAAA;AAAA,EAC3E;AACJ;AAOO,IAAM,iCAAN,MAAsE;AAAA,EACxD,YAAA;AAAA,EACA,iBAAA;AAAA,EAEjB,YAAY,gBAAA,GAAqD,EAAC,EAAG,wBAAA,GAAuF,EAAC,EAAG;AAC5J,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAC/D,MAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAC1F,MAAA,kBAAA,CAAmB,UAAA,EAAY,CAAA,kBAAA,EAAqB,IAAI,CAAA,EAAA,CAAI,CAAA;AAAA,IAChE;AACA,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,kBAAkB,CAAA;AAEzD,IAAA,MAAM,WAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,CAAC,YAAA,EAAc,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,wBAAwB,CAAA,EAAG;AAC1E,MAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,KAAA,CAAM,YAAY,CAAA;AACtD,MAAA,KAAA,MAAW,CAAC,IAAA,EAAM,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACpD,QAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,KAAA,CAAM,CAAA,wCAAA,EAA2C,YAAY,CAAA,iCAAA,CAAmC,CAAA;AACrH,QAAA,kBAAA,CAAmB,UAAA,EAAY,CAAA,0BAAA,EAA6B,YAAY,CAAA,IAAA,EAAO,IAAI,CAAA,EAAA,CAAI,CAAA;AAAA,MAC3F;AACA,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,KAAA,EAAO,CAAA,EAAG,CAAA;AAAA,IACjE;AACA,IAAA,QAAA,CAAS,KAAK,CAAC,IAAA,EAAM,KAAA,KAAU,KAAA,CAAM,QAAQ,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,WAAA,IAAe,KAAK,OAAA,CAAQ,KAAA,CAAM,cAAc,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAC,CAAA;AAC5I,IAAA,IAAA,CAAK,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAA;AAAA,EACnD;AAAA,EAEA,QAAA,CAAS,SAAA,EAA0B,QAAA,EAAwB,QAAA,EAAsD;AAC7G,IAAA,MAAM,SAAS,SAAA,CAAU,MAAA;AACzB,IAAA,IAAI,CAAC,QAAQ,OAAO,MAAA;AAEpB,IAAA,IAAI,aAAa,SAAA,EAAW;AACxB,MAAA,IAAI,MAAA,KAAW,YAAA,IAAgB,MAAA,KAAW,gBAAA,IAAoB,WAAW,gBAAA,EAAkB;AACvF,QAAA,OAAO,EAAE,YAAY,uBAAA,EAAwB;AAAA,MACjD;AACA,MAAA,IAAI,WAAW,YAAA,EAAc;AACzB,QAAA,MAAMC,KAAAA,GAAO,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AAC1C,QAAA,IAAIA,KAAAA,IAAQ,iBAAA,CAAkB,GAAA,CAAIA,KAAI,CAAA,SAAU,EAAE,UAAA,EAAY,uBAAA,EAAyB,IAAA,EAAAA,KAAAA,EAAK;AAAA,MAChG;AAAA,IACJ;AAEA,IAAA,IAAI,WAAW,YAAA,EAAc;AACzB,MAAA,MAAM,UAAA,GAAa,oBAAoB,MAAM,CAAA;AAC7C,MAAA,OAAO,UAAA,GAAa,EAAE,UAAA,EAAW,GAAI,MAAA;AAAA,IACzC;AAEA,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AAC1C,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,YAAY,gBAAA,EAAiB;AACjD,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,iBAAA,EAAmB;AAC1C,MAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnC,QAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,KAAA,CAAM,IAAI,CAAA;AACrC,QAAA,IAAI,UAAA,EAAY,OAAO,EAAE,UAAA,EAAY,IAAA,EAAK;AAAA,MAC9C;AAAA,IACJ;AACA,IAAA,OAAO,EAAE,UAAA,EAAY,IAAA,CAAK,aAAa,IAAI,CAAA,IAAK,kBAAkB,IAAA,EAAK;AAAA,EAC3E;AACJ;;;ACxFA,SAAS,YAAA,CAAa,OAAe,KAAA,EAAqB;AACtD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,KAAM,KAAA,IAAS,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACtF,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,KAAK,CAAA,GAAA,EAAM,KAAK,CAAA,aAAA,CAAe,CAAA;AAAA,EACpE;AACJ;AAEA,SAAS,eAAA,CAAgB,SAAiB,KAAA,EAAqB;AAC3D,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,6BAAA,CAA8B,IAAA,CAAK,OAAO,CAAA,EAAG;AAC7E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,KAAK,CAAA,WAAA,EAAc,OAAO,CAAA,8DAAA,CAAgE,CAAA;AAAA,EAC/H;AACJ;AAEA,SAAS,gBAAA,CAAiB,IAAY,KAAA,EAAqB;AACvD,EAAA,IAAI,OAAO,OAAO,QAAA,IAAY,CAAC,MAAM,EAAA,CAAG,IAAA,OAAW,EAAA,EAAI;AACnD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,cAAA,EAAiB,KAAK,CAAA,2EAAA,CAA6E,CAAA;AAAA,EACvH;AACJ;AAEA,SAAS,YAAY,KAAA,EAA4F;AAC7G,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAiC;AACtD,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC9C,IAAA,YAAA,CAAa,MAAM,MAAM,CAAA;AACzB,IAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,MAAA,IAAI,GAAA,KAAQ,UAAA,IAAc,GAAA,KAAQ,cAAA,EAAgB;AAC9C,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,IAAI,CAAA,sBAAA,EAAyB,GAAG,CAAA,kDAAA,CAAoD,CAAA;AAAA,MAC/H;AAAA,IACJ;AACA,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,IAAI,CAAA,iCAAA,CAAmC,CAAA;AAAA,IAClF;AACA,IAAA,IAAI,IAAA,CAAK,aAAa,MAAA,IAAa,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,IAAI,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC9E;AACA,IAAA,KAAA,MAAW,cAAc,IAAA,CAAK,YAAA,qBAAiC,UAAA,EAAY,CAAA,MAAA,EAAS,IAAI,CAAA,YAAA,CAAc,CAAA;AACtG,IAAA,KAAA,MAAW,SAAA,IAAa,IAAA,CAAK,QAAA,IAAY,EAAC,EAAG;AACzC,MAAA,YAAA,CAAa,SAAA,EAAW,CAAA,MAAA,EAAS,IAAI,CAAA,aAAA,CAAe,CAAA;AACpD,MAAA,IAAI,CAAC,KAAA,CAAM,SAAS,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,IAAI,CAAA,mBAAA,EAAsB,SAAS,CAAA,iBAAA,CAAmB,CAAA;AAAA,MACjG;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,KAAsC;AACjD,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAChC,IAAA,IAAI,QAAQ,OAAO,MAAA;AAEnB,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,IAAI,CAAA;AACxC,IAAA,IAAI,cAAc,CAAA,EAAG;AACjB,MAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,QAAA,CAAS,KAAA,CAAM,UAAU,CAAA,EAAG,IAAI,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAC/D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iDAAA,EAAoD,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,IAChF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAI,CAAA;AACvB,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAChF,IAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAClB,IAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AACrC,IAAA,KAAA,MAAW,SAAA,IAAa,IAAA,CAAK,QAAA,IAAY,EAAC,EAAG;AACzC,MAAA,KAAA,MAAW,cAAc,KAAA,CAAM,SAAS,CAAA,EAAG,YAAA,CAAa,IAAI,UAAU,CAAA;AAAA,IAC1E;AACA,IAAA,KAAA,MAAW,UAAA,IAAc,IAAA,CAAK,YAAA,EAAc,YAAA,CAAa,IAAI,UAAU,CAAA;AACvE,IAAA,QAAA,CAAS,GAAA,EAAI;AACb,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,YAAY,CAAA;AACzC,IAAA,QAAA,CAAS,GAAA,CAAI,MAAM,MAAM,CAAA;AACzB,IAAA,OAAO,MAAA;AAAA,EACX,CAAA;AAEA,EAAA,KAAA,MAAW,QAAQ,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,QAAS,IAAI,CAAA;AACjD,EAAA,OAAO,QAAA;AACX;AAEA,SAAS,eAAuD,OAAA,EAA0D;AACtH,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAiB;AACrC,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AACzB,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAAA,iBAChB,GAAA,CAAI,KAAA,CAAM,OAAA,EAAS,CAAC,KAAK,CAAC,CAAA;AAAA,EAC3C;AACA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAA0B;AAC7C,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,MAAM,CAAA,IAAK,OAAA,EAAS,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AAClF,EAAA,OAAO,MAAA;AACX;AAEA,SAAS,MAAA,CAAO,cAAmC,SAAA,EAA4B;AAC3E,EAAA,OAAO,aAAa,GAAA,CAAI,GAAG,CAAA,IAAK,YAAA,CAAa,IAAI,SAAS,CAAA;AAC9D;AAMO,IAAM,qBAAN,MAAkD;AAAA,EACpC,qBAAA;AAAA,EACA,gBAAA;AAAA,EAEjB,WAAA,CAAY,KAAA,EAAkD,WAAA,EAA2C,MAAA,EAAgC;AACrI,IAAA,MAAM,aAAA,GAAgB,YAAY,KAAK,CAAA;AACvC,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAElC,IAAA,MAAM,SAAA,GAAY,CAAC,EAAA,EAAY,KAAA,KAAwB;AACnD,MAAA,gBAAA,CAAiB,IAAI,KAAK,CAAA;AAC1B,MAAA,IAAI,SAAA,CAAU,IAAI,EAAE,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAgD,EAAE,CAAA,EAAA,CAAI,CAAA;AAC7F,MAAA,SAAA,CAAU,IAAI,EAAE,CAAA;AAAA,IACpB,CAAA;AAEA,IAAA,MAAM,mBAAA,GAAsB,WAAA,CAAY,GAAA,CAAI,CAAC,YAAY,KAAA,KAA+B;AACpF,MAAA,MAAM,EAAA,GAAK,UAAA,CAAW,EAAA,IAAM,CAAA,WAAA,EAAc,KAAK,CAAA,CAAA;AAC/C,MAAA,SAAA,CAAU,EAAA,EAAI,CAAA,WAAA,EAAc,KAAK,CAAA,CAAE,CAAA;AACnC,MAAA,eAAA,CAAgB,UAAA,CAAW,OAAA,EAAS,CAAA,YAAA,EAAe,EAAE,CAAA,CAAA,CAAG,CAAA;AACxD,MAAA,YAAA,CAAa,UAAA,CAAW,IAAA,EAAM,CAAA,YAAA,EAAe,EAAE,CAAA,MAAA,CAAQ,CAAA;AACvD,MAAA,MAAM,YAAA,GAAe,aAAA,CAAc,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA;AACtD,MAAA,IAAI,CAAC,YAAA,EAAc;AACf,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,EAAE,CAAA,SAAA,EAAY,UAAA,CAAW,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAAA,MACjG;AACA,MAAA,IAAI,CAAC,WAAW,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,EAAE,CAAA,8BAAA,CAAgC,CAAA;AACzG,MAAA,OAAO;AAAA,QACH,EAAA;AAAA,QACA,SAAS,UAAA,CAAW,OAAA;AAAA,QACpB,YAAA;AAAA,QACA,QAAA,EAAU,mBAAA,CAAoB,KAAA,CAAM,UAAA,CAAW,QAAQ;AAAA,OAC3D;AAAA,IACJ,CAAC,CAAA;AAED,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,GAAA,CAAI,CAAC,MAAM,KAAA,KAAyB;AAC9D,MAAA,MAAM,EAAA,GAAK,IAAA,CAAK,EAAA,IAAM,CAAA,KAAA,EAAQ,KAAK,CAAA,CAAA;AACnC,MAAA,SAAA,CAAU,EAAA,EAAI,CAAA,KAAA,EAAQ,KAAK,CAAA,CAAE,CAAA;AAC7B,MAAA,eAAA,CAAgB,IAAA,CAAK,OAAA,EAAS,CAAA,MAAA,EAAS,EAAE,CAAA,CAAA,CAAG,CAAA;AAC5C,MAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,IAAa,IAAA,CAAK,WAAW,MAAA,EAAQ;AACrD,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,EAAE,CAAA,yBAAA,CAA2B,CAAA;AAAA,MACxE;AACA,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,IAAK,IAAA,CAAK,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AACrE,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,EAAE,CAAA,uCAAA,CAAyC,CAAA;AAAA,MACtF;AACA,MAAA,MAAM,YAAA,uBAAmB,GAAA,EAAY;AACrC,MAAA,KAAA,MAAW,UAAA,IAAc,KAAK,YAAA,EAAc;AACxC,QAAA,kBAAA,CAAmB,UAAA,EAAY,CAAA,MAAA,EAAS,EAAE,CAAA,YAAA,CAAc,CAAA;AACxD,QAAA,YAAA,CAAa,IAAI,UAAU,CAAA;AAAA,MAC/B;AACA,MAAA,IAAI,CAAC,KAAK,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,EAAE,CAAA,8BAAA,CAAgC,CAAA;AAC7F,MAAA,OAAO;AAAA,QACH,EAAA;AAAA,QACA,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO,YAAY,CAAA;AAAA,QACxC,QAAA,EAAU,mBAAA,CAAoB,KAAA,CAAM,IAAA,CAAK,QAAQ;AAAA,OACrD;AAAA,IACJ,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,qBAAA,GAAwB,eAAe,mBAAmB,CAAA;AAC/D,IAAA,IAAA,CAAK,gBAAA,GAAmB,eAAe,cAAc,CAAA;AAAA,EACzD;AAAA,EAEA,UAAUC,QAAAA,EAAwD;AAC9D,IAAA,IAAI,CAACA,SAAQ,QAAA,EAAU,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,kBAAA,EAAmB;AAC3E,IAAA,IAAI;AACA,MAAA,kBAAA,CAAmBA,QAAAA,CAAQ,YAAY,oBAAoB,CAAA;AAAA,IAC/D,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,IACzD;AAEA,IAAA,MAAM,cAAA,uBAAqB,GAAA,EAAY;AACvC,IAAA,KAAA,MAAW,OAAA,IAAWA,QAAAA,CAAQ,OAAA,CAAQ,GAAA,EAAK;AACvC,MAAA,KAAA,MAAW,QAAQ,IAAA,CAAK,gBAAA,CAAiB,IAAI,OAAO,CAAA,IAAK,EAAC,EAAG;AACzD,QAAA,IAAI,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQA,QAAAA,CAAQ,QAAQ,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,YAAA,EAAcA,QAAAA,CAAQ,UAAU,CAAA,EAAG;AAC1F,UAAA,cAAA,CAAe,GAAA,CAAI,KAAK,EAAE,CAAA;AAAA,QAC9B;AAAA,MACJ;AAAA,IACJ;AACA,IAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG;AACzB,MAAA,OAAO;AAAA,QACH,OAAA,EAAS,KAAA;AAAA,QACT,MAAA,EAAQ,eAAA;AAAA,QACR,eAAA,EAAiB,OAAO,MAAA,CAAO,CAAC,GAAG,cAAc,CAAA,CAAE,MAAM;AAAA,OAC7D;AAAA,IACJ;AAEA,IAAA,MAAM,cAAA,uBAAqB,GAAA,EAAY;AACvC,IAAA,KAAA,MAAW,OAAA,IAAWA,QAAAA,CAAQ,OAAA,CAAQ,GAAA,EAAK;AACvC,MAAA,KAAA,MAAW,cAAc,IAAA,CAAK,qBAAA,CAAsB,IAAI,OAAO,CAAA,IAAK,EAAC,EAAG;AACpE,QAAA,IAAI,UAAA,CAAW,QAAA,CAAS,OAAA,CAAQA,QAAAA,CAAQ,QAAQ,CAAA,IAAK,MAAA,CAAO,UAAA,CAAW,YAAA,EAAcA,QAAAA,CAAQ,UAAU,CAAA,EAAG;AACtG,UAAA,cAAA,CAAe,GAAA,CAAI,WAAW,EAAE,CAAA;AAAA,QACpC;AAAA,MACJ;AAAA,IACJ;AACA,IAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG;AACzB,MAAA,OAAO;AAAA,QACH,OAAA,EAAS,IAAA;AAAA,QACT,MAAA,EAAQ,YAAA;AAAA,QACR,eAAA,EAAiB,OAAO,MAAA,CAAO,CAAC,GAAG,cAAc,CAAA,CAAE,MAAM;AAAA,OAC7D;AAAA,IACJ;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,mBAAA,EAAoB;AAAA,EACzD;AACJ;;;AC7MO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC3C,YAAY,OAAA,EAAiB;AACzB,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EAChB;AACJ;AAOA,SAAS,OAAA,CAAQ,QAA2C,SAAA,EAA4B;AACpF,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,IAAI,OAAA,GAAmB,MAAA;AACvB,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACtB,IAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,IAAA,IAAQ,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAO,MAAA;AAC/F,IAAA,OAAA,GAAW,QAA8C,IAAI,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,OAAA;AACX;AAEA,SAAS,QAAA,CAAS,OAAgB,SAAA,EAAsC;AACpE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,SAAa,EAAC;AACnD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU,OAAO,QAAQ,CAAC,KAAK,IAAI,EAAC;AACzD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,KAAA,CAAM,CAAC,KAAA,KAAU,OAAO,KAAA,KAAU,QAAQ,CAAA,EAAG;AAC3E,IAAA,OAAO,KAAA,CAAM,OAAO,CAAC,KAAA,KAA2B,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,mBAAA,EAAsB,SAAS,CAAA,0CAAA,CAA4C,CAAA;AAC7G;AAEA,SAAS,iBAAA,CAAkB,OAAe,KAAA,EAAqB;AAC3D,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,CAAC,IAAI,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+BAAA,EAAkC,KAAK,CAAA,gCAAA,CAAkC,CAAA;AAAA,EAC7F;AACJ;AAGO,IAAM,mBAAN,MAAiD;AAAA,EACnC,MAAA;AAAA,EAEjB,WAAA,CAAY,MAAA,GAAgC,EAAC,EAAG;AAC5C,IAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,KAAA;AACtC,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,WAAA,IAAe,CAAC,UAAU,OAAO,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,OAAO,WAAA,IAAe,WAAA;AAC1C,IAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,aAAA,IAAiB,EAAC;AAE/C,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAC/G,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,aAAa,GAAG,MAAM,IAAI,MAAM,gEAAgE,CAAA;AACnH,IAAA,iBAAA,CAAkB,WAAW,WAAW,CAAA;AACxC,IAAA,iBAAA,CAAkB,aAAa,aAAa,CAAA;AAC5C,IAAA,KAAA,MAAW,KAAA,IAAS,WAAA,EAAa,iBAAA,CAAkB,KAAA,EAAO,aAAa,CAAA;AACvE,IAAA,KAAA,MAAW,KAAA,IAAS,aAAA,EAAe,iBAAA,CAAkB,KAAA,EAAO,eAAe,CAAA;AAE3E,IAAA,IAAA,CAAK,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,MACxB,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAU;AAAA,MACnC,GAAG,YAAY,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAA,EAAS,KAAA,EAAM,CAAE,CAAA;AAAA,MAC1D,EAAE,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO,WAAA,EAAY;AAAA,MACvC,GAAG,cAAc,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAM,CAAE;AAAA,KACjE,CAAA;AAAA,EACL;AAAA,EAEA,IAAI,MAAA,EAAkE;AAClE,IAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,MAAA,EAAQ;AAC5B,MAAA,KAAA,MAAW,KAAA,IAAS,SAAS,OAAA,CAAQ,MAAA,EAAQ,KAAK,KAAK,CAAA,EAAG,IAAA,CAAK,KAAK,CAAA,EAAG;AACnE,QAAA,GAAA,CAAI,IAAI,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,MACrC;AAAA,IACJ;AACA,IAAA,OAAO,EAAE,KAAK,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,GAAG,CAAC,CAAA,EAAG,MAAA,EAAO;AAAA,EAClD;AACJ;;;ACvEA,IAAM,kBAAA,GAAuD;AAAA,EACzD,OAAA,EAAS,iBAAA;AAAA,EACT,IAAA,EAAM;AACV,CAAA;AAEA,SAAS,oBAAoB,QAAA,EAAiC;AAC1D,EAAA,OAAO,SAAS,KAAA,KAAU,UAAA,IAAc,QAAA,CAAS,KAAA,CAAM,WAAW,WAAW,CAAA;AACjF;AAGO,IAAM,8BAAN,MAAmE;AAAA,EACrD,SAAA,uBAAgB,GAAA,EAA0B;AAAA,EAE3D,WAAA,CAAY,aAAA,GAAkD,EAAC,EAAG;AAC9D,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,cAAc,KAAK,MAAA,CAAO,OAAA,CAAQ,aAAa,CAAA,EAAG;AAChE,MAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,4DAA4D,CAAA;AACvF,MAAA,MAAM,QAAA,GAAW,YAAA,CAAa,KAAA,CAAM,cAAc,CAAA;AAClD,MAAA,MAAM,QAAA,GAAW,mBAAmB,IAAI,CAAA;AACxC,MAAA,IAAI,mBAAA,CAAoB,QAAQ,CAAA,IAAK,QAAA,KAAa,SAAS,KAAA,EAAO;AAC9D,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAI,CAAA,iCAAA,EAAoC,QAAA,CAAS,KAAK,CAAA,EAAA,CAAI,CAAA;AAAA,MACpH;AACA,MAAA,IAAI,QAAA,IAAY,QAAA,CAAS,KAAA,KAAU,QAAA,EAAU;AACzC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4CAAA,EAA+C,IAAI,CAAA,mBAAA,EAAsB,QAAQ,CAAA,EAAA,CAAI,CAAA;AAAA,MACzG;AACA,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,QAAQ,CAAA;AAAA,IACrC;AAAA,EACJ;AAAA,EAEA,QAAQ,IAAA,EAAwC;AAC5C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA;AACxC,IAAA,IAAI,UAAU,OAAO,QAAA;AAErB,IAAA,MAAM,QAAA,GAAW,mBAAmB,IAAI,CAAA;AACxC,IAAA,IAAI,QAAA,EAAU,OAAO,YAAA,CAAa,KAAA,CAAM,QAAQ,CAAA;AAChD,IAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAElB,IAAA,MAAM,YAAY,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AACxD,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,QAAA,CAAS,SAAS,CAAA;AAChD,IAAA,OAAO,QAAA,IAAY,CAAC,mBAAA,CAAoB,QAAQ,IAAI,QAAA,GAAW,MAAA;AAAA,EACnE;AACJ;;;AChCO,SAAS,yBAAyB,MAAA,EAA6C;AAClF,EAAA,OAAO,OAAO,IAAA,CAAK,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,CAAE,MAAA,GAAS,CAAA,IAAA,CAAM,MAAA,CAAO,aAAa,MAAA,IAAU,CAAA,IAAK,MAAM,MAAA,CAAO,MAAA,EAAQ,UAAU,CAAA,IAAK,CAAA;AACjI;AAGO,SAAS,2BAA2B,MAAA,EAA0D;AACjG,EAAA,IAAI,MAAA,CAAO,OAAO,UAAA,KAAe,MAAA,IAAa,OAAO,MAAA,CAAO,KAAA,CAAM,eAAe,SAAA,EAAW;AACxF,IAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,EACvE;AACA,EAAA,MAAM,MAAA,GAAS,IAAI,kBAAA,CAAmB,MAAA,CAAO,SAAS,EAAC,EAAG,MAAA,CAAO,WAAA,IAAe,EAAC,EAAG,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA;AACvG,EAAA,MAAM,aAAA,GAAgB,IAAI,gBAAA,CAAiB,MAAA,CAAO,cAAc,CAAA;AAChE,EAAA,MAAM,oBAAA,GAAuB,IAAI,2BAAA,CAA4B,MAAA,CAAO,aAAa,CAAA;AACjF,EAAA,MAAM,uBAAuB,IAAI,8BAAA,CAA+B,MAAA,CAAO,gBAAA,EAAkB,OAAO,wBAAwB,CAAA;AACxH,EAAA,OAAO;AAAA,IACH,MAAA;AAAA,IACA,aAAA;AAAA,IACA,oBAAA;AAAA,IACA,oBAAA;AAAA,IACA,KAAA,EAAO,OAAO,MAAA,CAAO,EAAE,YAAY,MAAA,CAAO,KAAA,EAAO,UAAA,IAAc,KAAA,EAAO;AAAA,GAC1E;AACJ;AAEO,SAAS,uBAAA,CACZ,MAAA,EACA,SAAA,GAKI,EAAC,EACe;AACpB,EAAA,OAAO;AAAA,IACH,MAAA;AAAA,IACA,aAAA,EAAe,SAAA,CAAU,aAAA,IAAiB,IAAI,gBAAA,EAAiB;AAAA,IAC/D,oBAAA,EAAsB,SAAA,CAAU,oBAAA,IAAwB,IAAI,2BAAA,EAA4B;AAAA,IACxF,oBAAA,EAAsB,SAAA,CAAU,oBAAA,IAAwB,IAAI,8BAAA,EAA+B;AAAA,IAC3F,KAAA,EAAO,OAAO,MAAA,CAAO,EAAE,YAAY,SAAA,CAAU,KAAA,EAAO,UAAA,IAAc,KAAA,EAAO;AAAA,GAC7E;AACJ;;;ACxCO,SAAS,2BAAA,CAA4B,SAAwB,QAAA,EAA4D;AAC5H,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,SAAS,CAAC,CAAA,EAAG,KAAA,CAAM,UAAU,MAAM,CAAA;AACnG,EAAA,OAAO;AAAA,IACH,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IAClC,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,UAAA,EAAY,QAAQ,OAAA,CAAQ,GAAA;AAAA,IAC5B,QAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,QAAA,EAAU,QAAQ,QAAA,EAAU,KAAA;AAAA,IAC5B,YAAY,OAAA,CAAQ,UAAA;AAAA,IACpB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,iBAAiB,QAAA,CAAS;AAAA,GAC9B;AACJ;AAEO,SAAS,6BAA6B,KAAA,EAAuC;AAChF,EAAA,OAAA,CAAQ,MAAM,CAAA,uBAAA,EAA0B,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AACnE;;;ACOA,IAAM,SAAA,GAAY,GAAA;AAGlB,IAAM,oBAAA,GAAuB,EAAA;AAEtB,IAAM,mBAAN,MAAuB;AAAA,EACT,UAAA,uBAAiB,GAAA,EAA4B;AAAA,EACtD,SAAyB,EAAC;AAAA,EAC1B,WAA6B,EAAC;AAAA,EAC9B,WAAA,uBAAkB,GAAA,EAAoB;AAAA,EACtC,aAAA,uBAAoB,GAAA,EAAoB;AAAA;AAAA,EAGhD,IAAI,aAAA,GAAwB;AACxB,IAAA,OAAO,KAAK,UAAA,CAAW,IAAA;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAI,KAAA,GAAwB;AACxB,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,OAAA,GAA4B;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EAChB;AAAA;AAAA,EAGA,WAAA,CAAY,UAAkB,KAAA,EAA6B;AACvD,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,KAAK,CAAA;AACnC,IAAA,IAAA,CAAK,QAAA,EAAS;AAAA,EAClB;AAAA;AAAA,EAGA,eAAe,QAAA,EAAwB;AACnC,IAAA,IAAI,KAAK,UAAA,CAAW,MAAA,CAAO,QAAQ,CAAA,OAAQ,QAAA,EAAS;AAAA,EACxD;AAAA;AAAA,EAGA,SAAS,KAAA,EAAsD;AAC3D,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,CAAC,IAAA,KAAS;AAChC,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,KAAK,IAAI,CAAA;AAC5C,MAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,QAAQ,CAAA,GAAI,KAAA;AAAA,IAC3C,CAAC,CAAA;AAAA,EACL;AAAA;AAAA,EAGA,WAAW,KAAA,EAAwD;AAC/D,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,CAAC,MAAA,KAAW;AACpC,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,OAAO,IAAI,CAAA;AAChD,MAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,QAAQ,CAAA,GAAI,KAAA;AAAA,IAC3C,CAAC,CAAA;AAAA,EACL;AAAA;AAAA,EAGA,YAAY,IAAA,EAAkC;AAC1C,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,IAAI,CAAA;AAAA,EACpC;AAAA;AAAA,EAGA,cAAc,IAAA,EAAkC;AAC5C,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAAA,EACtC;AAAA,EAEQ,QAAA,GAAiB;AACrB,IAAA,MAAM,QAAwB,EAAC;AAC/B,IAAA,MAAM,UAA4B,EAAC;AACnC,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,IAAA,MAAM,YAAA,uBAAmB,GAAA,EAAoB;AAE7C,IAAA,KAAA,MAAW,CAAC,QAAA,EAAU,KAAK,CAAA,IAAK,KAAK,UAAA,EAAY;AAC7C,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,KAAA,EAAO;AAC5B,QAAA,MAAM,IAAA,GAAO,OAAO,WAAA,CAAY,QAAA,CAAS,UAAU,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,UAAU,CAAA;AAC1E,QAAA,UAAA,CAAW,IAAI,IAAA,EAAM,EAAE,UAAU,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA;AACtD,QAAA,KAAA,CAAM,IAAA,CAAK,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,WAAA,EAAa,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,WAAW,CAAA,EAAG,CAAA;AAAA,MAC9E;AACA,MAAA,KAAA,MAAW,MAAA,IAAU,MAAM,OAAA,EAAS;AAChC,QAAA,MAAM,OAAO,MAAA,CAAO,QAAA,CAAS,UAAU,MAAA,CAAO,IAAI,GAAG,YAAY,CAAA;AACjE,QAAA,YAAA,CAAa,IAAI,IAAA,EAAM,EAAE,UAAU,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAC1D,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAG,MAAA,EAAQ,IAAA,EAAM,WAAA,EAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,WAAW,CAAA,EAAG,CAAA;AAAA,MACpF;AAAA,IACJ;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS,KAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,WAAA,GAAc,UAAA;AACnB,IAAA,IAAA,CAAK,aAAA,GAAgB,YAAA;AAAA,EACzB;AACJ,CAAA;AAcA,SAAS,QAAA,CAAS,UAAkB,QAAA,EAA0B;AAC1D,EAAA,OAAO,CAAA,EAAG,QAAQ,CAAA,EAAG,SAAS,GAAG,QAAQ,CAAA,CAAA;AAC7C;AAGA,SAAS,GAAA,CAAI,UAAkB,WAAA,EAAyC;AACpE,EAAA,MAAM,KAAA,GAAQ,IAAI,QAAQ,CAAA,CAAA,CAAA;AAC1B,EAAA,OAAO,WAAA,GAAc,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA,GAAK,KAAA;AACrD;AAGA,SAAS,YAAY,IAAA,EAAsB;AACvC,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,oBAAA,EAAsB,OAAO,IAAA;AAChD,EAAA,MAAM,IAAA,GAAO,KAAK,IAAI,CAAA;AACtB,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,EAAG,oBAAA,GAAuB,KAAK,MAAA,GAAS,CAAC,IAAI,SAAA,GAAY,IAAA;AAC/E;AAGA,SAAS,MAAA,CAAO,WAAmB,KAAA,EAA6C;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,SAAS,GAAG,OAAO,SAAA;AAClC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,EAAG,SAAS,GAAG,SAAS,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA,EAAG,CAAA,EAAA;AAClD,EAAA,OAAO,CAAA,EAAG,SAAS,CAAA,EAAG,SAAS,GAAG,CAAC,CAAA,CAAA;AACvC;AAGA,SAAS,KAAK,KAAA,EAAuB;AACjC,EAAA,IAAI,CAAA,GAAI,IAAA;AACR,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,CAAA,GAAA,CAAM,KAAK,CAAA,IAAK,CAAA,GAAI,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA,KAAO,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAA,CAAE,KAAA,CAAM,EAAE,CAAA;AACnD;;;ACxKA,IAAM,gBAAA,GAAmB,YAAA;AAGzB,IAAM,kBAAA,GAAqB,GAAA;AA6BpB,IAAM,wBAAN,MAA4B;AAAA,EACtB,QAAA;AAAA,EAEQ,OAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA,uBAAe,GAAA,EAA6B;AAAA,EACrD,OAAA,GAAU,CAAA;AAAA,EACV,SAAyB,EAAC;AAAA,EAC1B,WAA6B,EAAC;AAAA,EAC9B,OAAA,GAAU,KAAA;AAAA;AAAA,EAGlB,gBAAA,GAAwC,IAAA;AAAA;AAAA,EAGxC,QAAA,GAAgC,IAAA;AAAA,EAEhC,WAAA,CAAY,UAAkB,MAAA,EAAyB;AACnD,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,QAAQ,CAAA,CAAA,CAAA;AAChC,IAAA,MAAA,CAAO,SAAA,GAAY,CAAC,IAAA,KAAuB,IAAA,CAAK,eAAe,IAAI,CAAA;AACnE,IAAA,MAAA,CAAO,UAAU,MAAY;AACzB,MAAA,IAAI,KAAK,OAAA,EAAS;AAClB,MAAA,IAAA,CAAK,WAAW,uBAAuB,CAAA;AACvC,MAAA,IAAA,CAAK,QAAA,IAAW;AAAA,IACpB,CAAA;AAAA,EACJ;AAAA,EAEA,IAAI,KAAA,GAAwB;AACxB,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EAChB;AAAA,EAEA,IAAI,OAAA,GAA4B;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EAChB;AAAA;AAAA,EAGA,MAAM,UAAA,GAA4B;AAC9B,IAAA,MAAM,IAAA,CAAK,SAAS,YAAA,EAAc;AAAA,MAC9B,eAAA,EAAiB,gBAAA;AAAA,MACjB,cAAc,EAAC;AAAA,MACf,UAAA,EAAY,EAAE,IAAA,EAAM,sBAAA,EAAwB,SAAS,GAAA;AAAI,KAC5D,CAAA;AACD,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,EAAE,SAAS,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA6B,CAAC,CAAA;AACzF,IAAA,MAAM,KAAK,QAAA,EAAS;AAAA,EACxB;AAAA;AAAA,EAGA,QAAA,CAAS,MAAc,IAAA,EAAqD;AACxE,IAAA,OAAO,KAAK,QAAA,CAAS,YAAA,EAAc,EAAE,IAAA,EAAM,SAAA,EAAW,MAAM,CAAA;AAAA,EAChE;AAAA;AAAA,EAGA,SAAA,CAAU,MAAc,IAAA,EAAqD;AACzE,IAAA,OAAO,KAAK,QAAA,CAAS,aAAA,EAAe,EAAE,IAAA,EAAM,SAAA,EAAW,MAAM,CAAA;AAAA,EACjE;AAAA;AAAA,EAGA,KAAA,GAAc;AACV,IAAA,IAAI,KAAK,OAAA,EAAS;AAClB,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AACf,IAAA,IAAA,CAAK,WAAW,gBAAgB,CAAA;AAChC,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACvB;AAAA,EAEA,MAAc,QAAA,GAA0B;AACpC,IAAA,IAAA,CAAK,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAuB,cAAc,OAAO,CAAA;AACrE,IAAA,IAAA,CAAK,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAyB,gBAAgB,SAAS,CAAA;AAC7E,IAAA,IAAA,CAAK,gBAAA,IAAmB;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,QAAA,CAAY,MAAA,EAAgB,GAAA,EAA2B;AACjE,IAAA,MAAM,QAAa,EAAC;AACpB,IAAA,IAAI,MAAA;AACJ,IAAA,GAAG;AACC,MAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,MAAA,GAAS,EAAE,MAAA,EAAO,GAAI,EAAE,CAAA;AAC9E,MAAA,IAAI,KAAA,SAAc,EAAC;AACnB,MAAA,MAAM,IAAA,GAAQ,UAAU,EAAC;AACzB,MAAA,MAAM,IAAA,GAAO,KAAK,GAAG,CAAA;AACrB,MAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,GAAG,KAAA,CAAM,IAAA,CAAK,GAAI,IAAY,CAAA;AACpD,MAAA,MAAA,GAAS,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,MAAA;AAAA,IACrE,CAAA,QAAS,MAAA;AACT,IAAA,OAAO,KAAA;AAAA,EACX;AAAA,EAEQ,QAAA,CAAS,QAAgB,MAAA,EAAuC;AACpE,IAAA,OAAO,IAAI,OAAA,CAAqB,CAACC,QAAAA,KAAY;AACzC,MAAA,IAAI,KAAK,OAAA,EAAS;AACd,QAAAA,QAAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,MAAM,KAAA,EAAQ,OAAA,EAAS,gBAAA,EAAiB,EAAG,CAAA;AAC9D,QAAA;AAAA,MACJ;AACA,MAAA,MAAM,KAAK,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,EAAE,KAAK,OAAO,CAAA;AACjD,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC3B,QAAA,IAAA,CAAK,QAAA,CAAS,OAAO,EAAE,CAAA;AACvB,QAAAA,QAAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,KAAA,EAAQ,OAAA,EAAS,CAAA,SAAA,EAAY,MAAM,CAAA,WAAA,CAAA,EAAc,EAAG,CAAA;AAAA,MACjF,GAAG,kBAAkB,CAAA;AACrB,MAAA,IAAA,CAAK,SAAS,GAAA,CAAI,EAAA,EAAI,EAAE,OAAA,EAAAA,QAAAA,EAAS,OAAO,CAAA;AACxC,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAQ,MAAA,EAAQ,CAAC,CAAA;AAAA,IAC5E,CAAC,CAAA;AAAA,EACL;AAAA,EAEQ,eAAe,IAAA,EAAoB;AACvC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACJ,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,OAAO,GAAA,CAAI,EAAA,KAAO,QAAA,EAAU;AAC5B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAI,EAAE,CAAA;AACxC,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAC3B,QAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,QAAA,OAAA,CAAQ,OAAA,CAAQ,EAAE,MAAA,EAAQ,GAAA,CAAI,QAAQ,KAAA,EAAO,GAAA,CAAI,OAAO,CAAA;AAAA,MAC5D;AACA,MAAA;AAAA,IACJ;AACA,IAAA,IAAI,GAAA,CAAI,MAAM,IAAA,KAAS,GAAA,CAAI,WAAW,kCAAA,IAAsC,GAAA,CAAI,WAAW,oCAAA,CAAA,EAAuC;AAC9H,MAAA,KAAK,KAAK,QAAA,EAAS;AAAA,IACvB;AAAA,EACJ;AAAA,EAEQ,WAAW,MAAA,EAAsB;AACrC,IAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,EAAG;AAC1C,MAAA,YAAA,CAAa,QAAQ,KAAK,CAAA;AAC1B,MAAA,OAAA,CAAQ,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,MAAM,KAAA,EAAQ,OAAA,EAAS,MAAA,EAAO,EAAG,CAAA;AAAA,IAChE;AACA,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACxB;AACJ,CAAA;;;AC3JA,IAAMC,iBAAAA,GAAmB,YAAA;AAyBlB,IAAM,eAAA,GAAN,MAAM,gBAAA,CAA6C;AAAA;AAAA,EAEtD,OAAgB,IAAA,GAAO,MAAA;AAAA,EAEN,QAAA,GAAW,IAAI,gBAAA,EAAiB;AAAA,EAChC,SAAA,uBAAgB,GAAA,EAAmC;AAAA,EACnD,WAAA;AAAA,EACT,QAAA,GAAW,KAAA;AAAA;AAAA,EAEX,YAAA,GAA4C,IAAA;AAAA;AAAA,EAE5C,cAAA,GAA8C,IAAA;AAAA,EAEtD,SAAA,GAA6C,IAAA;AAAA,EAC7C,MAAA,GAA8B,IAAA;AAAA,EAC9B,OAAA,GAA+B,IAAA;AAAA,EAC/B,OAAA,GAA2C,IAAA;AAAA,EAE3C,YAAY,UAAA,EAAmC;AAC3C,IAAA,IAAA,CAAK,WAAA,GAAc,UAAA;AAAA,EACvB;AAAA,EAEA,IAAI,MAAA,GAAkB;AAClB,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,aAAA,GAAwB;AACxB,IAAA,OAAO,KAAK,SAAA,CAAU,IAAA;AAAA,EAC1B;AAAA;AAAA,EAGA,KAAA,GAAc;AACV,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAAA,EACpB;AAAA;AAAA,EAGA,eAAe,MAAA,EAA2C;AACtD,IAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,EACxB;AAAA;AAAA,EAGA,uBAAuB,aAAA,EAAkD;AACrE,IAAA,IAAA,CAAK,cAAA,GAAiB,aAAA;AAAA,EAC1B;AAAA;AAAA,EAGA,KAAK,IAAA,EAAoB;AACrB,IAAA,KAAK,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,IAAI,CAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,CAAO,MAAc,SAAA,EAAoC;AACrD,IAAA,KAAK,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,SAAS,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,KAAA,GAAc;AACV,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACpB,IAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAChB,IAAA,KAAA,MAAW,WAAW,IAAA,CAAK,SAAA,CAAU,MAAA,EAAO,UAAW,KAAA,EAAM;AAC7D,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,OAAA,IAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAY,IAAA,EAA6B;AAC3C,IAAA,IAAI,SAAS,gBAAA,CAAgB,IAAA,IAAQ,KAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,EAAG;AAE/D,IAAA,MAAM,UAAU,IAAI,qBAAA,CAAsB,MAAM,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AACtE,IAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,OAAO,CAAA;AAEhC,IAAA,OAAA,CAAQ,mBAAmB,MAAY;AACnC,MAAA,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,IAAA,EAAM,EAAE,KAAA,EAAO,QAAQ,KAAA,EAAO,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAClF,MAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,IAC1B,CAAA;AACA,IAAA,OAAA,CAAQ,QAAA,GAAW,MAAY,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AAEvD,IAAA,IAAI;AACA,MAAA,MAAM,QAAQ,UAAA,EAAW;AAAA,IAC7B,CAAA,CAAA,MAAQ;AACJ,MAAA,IAAA,CAAK,eAAe,IAAI,CAAA;AAAA,IAC5B;AAAA,EACJ;AAAA;AAAA,EAGA,eAAe,IAAA,EAAoB;AAC/B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA;AACvC,IAAA,IAAI,CAAC,OAAA,EAAS;AACd,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,IAAI,CAAA;AAC1B,IAAA,OAAA,CAAQ,KAAA,EAAM;AACd,IAAA,IAAA,CAAK,QAAA,CAAS,eAAe,IAAI,CAAA;AACjC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,EAC1B;AAAA,EAEQ,YAAY,SAAA,EAAqD;AACrE,IAAA,IAAI,SAAA,EAAW,OAAA,EAAS,OAAO,SAAA,CAAU,OAAA;AACzC,IAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,GAAA,EAAK,EAAC,EAAE;AACjC,IAAA,IAAI;AACA,MAAA,OACI,KAAK,cAAA,EAAgB,aAAA,CAAc,GAAA,CAAI,SAAA,CAAU,MAAM,CAAA,IAAK;AAAA,QACxD,KAAK,EAAC;AAAA,QACN,QAAQ,SAAA,CAAU;AAAA,OACtB;AAAA,IAER,SAAS,KAAA,EAAO;AACZ,MAAA,IAAI,EAAE,iBAAiB,mBAAA,CAAA,EAAsB;AACzC,QAAA,OAAA,CAAQ,MAAM,0DAA0D,CAAA;AAAA,MAC5E;AACA,MAAA,OAAO,EAAE,GAAA,EAAK,EAAC,EAAG,MAAA,EAAQ,UAAU,MAAA,EAAO;AAAA,IAC/C;AAAA,EACJ;AAAA,EAEQ,YAAA,CAAa,WAA8B,QAAA,EAA2B;AAC1E,IAAA,MAAM,SAAS,IAAA,CAAK,YAAA;AACpB,IAAA,OAAO,CAAC,MAAA,IAAU,CAAC,SAAA,IAAa,MAAA,CAAO,WAAW,QAAQ,CAAA;AAAA,EAC9D;AAAA,EAEQ,aAAA,CAAc,SAAA,EAA8B,QAAA,EAAkB,SAAA,EAAmC;AACrG,IAAA,MAAM,gBAAgB,IAAA,CAAK,cAAA;AAC3B,IAAA,IAAI,CAAC,eAAe,OAAO,IAAA;AAE3B,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,SAAS,CAAA;AAC1C,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,oBAAA,CAAqB,OAAA,CAAQ,QAAQ,CAAA;AACpE,IAAA,IAAI,CAAC,QAAA,EAAU;AACX,MAAA,MAAM,QAAA,GAAmC,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,kBAAA,EAAmB;AACtF,MAAA,4BAAA,CAA6B,2BAAA,CAA4B,EAAE,OAAA,EAAS,IAAA,EAAM,iBAAgB,IAAA,EAAM,QAAA,EAAS,EAAG,QAAQ,CAAC,CAAA;AACrH,MAAA,OAAO,KAAA;AAAA,IACX;AAEA,IAAA,IAAI;AACA,MAAA,MAAM,aAAa,aAAA,CAAc,oBAAA,CAAqB,QAAA,CAAS,SAAA,EAAW,UAAU,QAAQ,CAAA;AAC5F,MAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,MAAA,MAAM,QAAA,GAAW,aAAA,CAAc,MAAA,CAAO,SAAA,CAAU;AAAA,QAC5C,OAAA;AAAA,QACA,YAAY,UAAA,CAAW,UAAA;AAAA,QACvB,QAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAM,UAAA,CAAW;AAAA,OACpB,CAAA;AACD,MAAA,IAAI,CAAC,QAAA,CAAS,OAAA,IAAW,aAAA,CAAc,MAAM,UAAA,EAAY;AACrD,QAAA,4BAAA;AAAA,UACI,2BAAA;AAAA,YACI;AAAA,cACI,OAAA;AAAA,cACA,MAAM,gBAAA,CAAgB,IAAA;AAAA,cACtB,QAAA;AAAA,cACA,YAAY,UAAA,CAAW,UAAA;AAAA,cACvB,QAAA;AAAA,cACA,MAAM,UAAA,CAAW;AAAA,aACrB;AAAA,YACA;AAAA;AACJ,SACJ;AAAA,MACJ;AACA,MAAA,OAAO,QAAA,CAAS,OAAA;AAAA,IACpB,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAA,CAAQ,MAAM,8CAA8C,CAAA;AAC5D,MAAA,MAAM,QAAA,GAAmC,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AACvF,MAAA,4BAAA;AAAA,QACI,2BAAA;AAAA,UACI;AAAA,YACI,OAAA;AAAA,YACA,MAAM,gBAAA,CAAgB,IAAA;AAAA,YACtB,QAAA;AAAA,YACA;AAAA,WACJ;AAAA,UACA;AAAA;AACJ,OACJ;AACA,MAAA,OAAO,KAAA;AAAA,IACX;AAAA,EACJ;AAAA,EAEQ,OAAA,CAAQ,SAAA,EAA8B,QAAA,EAAkB,SAAA,EAAmC;AAC/F,IAAA,OAAO,IAAA,CAAK,aAAa,SAAA,EAAW,QAAQ,KAAK,IAAA,CAAK,aAAA,CAAc,SAAA,EAAW,QAAA,EAAU,SAAS,CAAA;AAAA,EACtG;AAAA,EAEA,MAAc,oBAAA,CAAqB,IAAA,EAAc,SAAA,EAA6C;AAC1F,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACA,MAAA,GAAA,GAAM,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACJ,MAAA;AAAA,IACJ;AACA,IAAA,MAAM,KAAK,GAAA,CAAI,EAAA;AACf,IAAA,IAAI,MAAM,IAAA,EAAM;AAEhB,IAAA,QAAQ,IAAI,MAAA;AAAQ,MAChB,KAAK,YAAA;AACD,QAAA,IAAA,CAAK,OAAO,EAAA,EAAI;AAAA,UACZ,MAAA,EAAQ;AAAA,YACJ,eAAA,EAAiBA,iBAAAA;AAAA,YACjB,YAAY,EAAE,IAAA,EAAM,gBAAA,CAAgB,IAAA,EAAM,SAAS,GAAA,EAAI;AAAA,YACvD,YAAA,EAAc,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK,EAAG,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA,EAAK;AAAE;AACjF,SACH,CAAA;AACD,QAAA;AAAA,MACJ,KAAK,MAAA;AACD,QAAA,IAAA,CAAK,OAAO,EAAA,EAAI,EAAE,MAAA,EAAQ,IAAI,CAAA;AAC9B,QAAA;AAAA,MACJ,KAAK,YAAA;AACD,QAAA,IAAA,CAAK,OAAO,EAAA,EAAI;AAAA,UACZ,MAAA,EAAQ;AAAA,YACJ,KAAA,EAAO,IAAA,CAAK,QAAA,CAAS,QAAA,CAAS,CAAC,QAAA,KAAa,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,QAAA,EAAU,EAAE,MAAA,EAAQ,YAAA,EAAc,CAAC;AAAA;AAC3G,SACH,CAAA;AACD,QAAA;AAAA,MACJ,KAAK,cAAA;AACD,QAAA,IAAA,CAAK,OAAO,EAAA,EAAI;AAAA,UACZ,MAAA,EAAQ;AAAA,YACJ,OAAA,EAAS,IAAA,CAAK,QAAA,CAAS,UAAA,CAAW,CAAC,QAAA,KAAa,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,QAAA,EAAU,EAAE,MAAA,EAAQ,cAAA,EAAgB,CAAC;AAAA;AACjH,SACH,CAAA;AACD,QAAA;AAAA,MACJ,KAAK,YAAA;AACD,QAAA,MAAM,KAAK,MAAA,CAAO,EAAA,EAAI,GAAA,CAAI,MAAA,EAAQ,QAAQ,SAAS,CAAA;AACnD,QAAA;AAAA,MACJ,KAAK,aAAA;AACD,QAAA,MAAM,KAAK,MAAA,CAAO,EAAA,EAAI,GAAA,CAAI,MAAA,EAAQ,UAAU,SAAS,CAAA;AACrD,QAAA;AAAA,MACJ;AACI,QAAA,IAAA,CAAK,MAAA,CAAO,EAAA,EAAI,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,CAAA,kBAAA,EAAqB,GAAA,CAAI,MAAA,IAAU,QAAQ,CAAA,CAAA,IAAM,CAAA;AAAA;AAC3G,EACJ;AAAA,EAEA,MAAc,MAAA,CAAO,EAAA,EAAqB,MAAA,EAAiB,MAAyB,SAAA,EAA6C;AAC7H,IAAA,MAAM,CAAA,GAAK,UAAU,EAAC;AACtB,IAAA,MAAM,QAAQ,CAAA,CAAE,IAAA,GAAQ,IAAA,KAAS,MAAA,GAAS,KAAK,QAAA,CAAS,WAAA,CAAY,CAAA,CAAE,IAAI,IAAI,IAAA,CAAK,QAAA,CAAS,aAAA,CAAc,CAAA,CAAE,IAAI,CAAA,GAAK,MAAA;AAGrH,IAAA,MAAM,SAAA,GAAuC,QACvC,IAAA,KAAS,MAAA,GACL,EAAE,MAAA,EAAQ,YAAA,EAAc,MAAA,EAAQ,EAAE,IAAA,EAAM,KAAA,CAAM,UAAS,EAAE,GACzD,EAAE,MAAA,EAAQ,aAAA,EAAe,MAAA,EAAQ,EAAE,IAAA,EAAM,KAAA,CAAM,QAAA,EAAS,EAAE,GAC9D,MAAA;AACN,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,SAAA,IAAa,CAAC,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,KAAA,CAAM,QAAA,EAAU,SAAS,CAAA,EAAG;AAC7E,MAAA,IAAA,CAAK,OAAO,EAAA,EAAI,EAAE,KAAA,EAAO,EAAE,MAAM,MAAA,EAAQ,OAAA,EAAS,CAAA,mBAAA,EAAsB,IAAI,KAAK,CAAA,CAAE,IAAA,IAAQ,QAAQ,CAAA,CAAA,IAAM,CAAA;AACzG,MAAA;AAAA,IACJ;AACA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,QAAQ,CAAA;AACjD,IAAA,IAAI,CAAC,OAAA,EAAS;AACV,MAAA,IAAA,CAAK,MAAA,CAAO,EAAA,EAAI,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,KAAA,EAAQ,OAAA,EAAS,CAAA,UAAA,EAAa,KAAA,CAAM,QAAQ,CAAA,wBAAA,CAAA,IAA8B,CAAA;AAC3G,MAAA;AAAA,IACJ;AACA,IAAA,MAAM,IAAA,GAAO,CAAA,CAAE,SAAA,IAAa,EAAC;AAC7B,IAAA,MAAM,OAAA,GAAU,IAAA,KAAS,MAAA,GAAS,MAAM,QAAQ,QAAA,CAAS,KAAA,CAAM,QAAA,EAAU,IAAI,IAAI,MAAM,OAAA,CAAQ,SAAA,CAAU,KAAA,CAAM,UAAU,IAAI,CAAA;AAC7H,IAAA,IAAA,CAAK,MAAA,CAAO,EAAA,EAAI,OAAA,CAAQ,KAAA,KAAU,SAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EACvG;AAAA,EAEQ,MAAA,CAAO,IAAqB,IAAA,EAAmD;AACnF,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,OAAO,EAAA,EAAI,GAAG,IAAA,EAAM,CAAC,CAAA;AAAA,EACpE;AAAA,EAEQ,gBAAA,GAAyB;AAC7B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACpB,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,CAAU,EAAE,SAAS,KAAA,EAAO,MAAA,EAAQ,kCAAA,EAAoC,CAAC,CAAA;AAC/F,IAAA,IAAA,CAAK,SAAA,GAAY,KAAK,SAAA,CAAU,EAAE,SAAS,KAAA,EAAO,MAAA,EAAQ,oCAAA,EAAsC,CAAC,CAAA;AAAA,EACrG;AACJ,CAAA;AClRO,IAAM,SAAA,GAAY;AAsElB,SAAS,SAAS,MAAA,EAAyC;AAC9D,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAYC,UAAA,CAAY,MAAM,CAAC,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAqB,OAAO,QAAQ,CAAA;AAC1C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAC1B,IAAA,KAAA,MAAW,KAAA,IAAS,WAAW,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,GAAA;AACX;ACjFO,IAAM,oBAAN,MAAmD;AAAA,EACrC,KAAA;AAAA,EACA,OAAA;AAAA,EACA,eAAA;AAAA,EAEjB,YAAY,OAAA,EAA+B;AACvC,IAAA,IAAA,CAAK,QAAQ,kBAAA,CAAmB,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAO,CAAC,CAAA;AACxD,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,MAAA;AACvB,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,iBAAA,IAAqB,CAAA;AAAA,EACxD;AAAA,EAEA,MAAM,QAAA,CAAS,KAAA,EAAe,QAAA,EAA+C;AACzE,IAAA,IAAI;AACA,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,KAAA,EAAO,KAAK,KAAA,EAAO;AAAA,QACnD,QAAA,EAAU,QAAA;AAAA,QACV,QAAQ,IAAA,CAAK,OAAA;AAAA,QACb,gBAAgB,IAAA,CAAK;AAAA,OACxB,CAAA;AACD,MAAA,OAAO,OAAA;AAAA,IACX,SAAS,GAAA,EAAK;AAKV,MAAA,IAAI,GAAA,YAAe,OAAO,SAAA,EAAW;AACjC,QAAA,MAAM,IAAI,SAAA,CAAU,GAAA,EAAK,eAAA,EAAiB,IAAI,OAAO,CAAA;AAAA,MACzD;AACA,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ;AACJ;ACnCO,SAAS,sBAAsB,MAAA,EAAsH;AACxJ,EAAA,OAAO,8BAAA,CAA+B;AAAA,IAClC,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,sBAAsB,MAAA,CAAO,oBAAA;AAAA,IAC7B,iBAAiB,MAAA,CAAO;AAAA,GAC3B,CAAA;AACL;AClBA,IAAM,UAAA,GAAa,GAAG,kCAAkC,CAAA,CAAA,CAAA;AAYjD,IAAM,gBAAN,MAAoB;AAAA,EACN,KAAA;AAAA;AAAA,EAEA,UAAA;AAAA,EAEjB,WAAA,CAAY,MAAqB,SAAA,EAAmB;AAChD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,IAAA,CAAK,UAAA,GAAa,SAAA,CAAU,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAAA,EACjD;AAAA;AAAA,EAGA,YAAY,IAAA,EAAsB;AAC9B,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA,CAAA,EAAI,mBAAmB,IAAI,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,EACrF;AAAA;AAAA,EAGA,eAAe,IAAA,EAAsB;AACjC,IAAA,OAAO,CAAA,EAAG,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA,EAAG,UAAU,CAAA,EAAG,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,EACjG;AAAA;AAAA,EAGA,kBAAkB,IAAA,EAAwB;AACtC,IAAA,OAAO,IAAA,CAAK,MAAM,aAAA,GAAgB,IAAI,KAAK,IAAA,CAAK,KAAA,CAAM,kBAAkB,EAAC;AAAA,EAC7E;AAAA;AAAA,EAGA,YAAY,IAAA,EAA0C;AAClD,IAAA,OAAO,qBAAA,CAAsB;AAAA,MACzB,QAAA,EAAU,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AAAA,MAC/B,oBAAA,EAAsB,KAAK,KAAA,CAAM,oBAAA;AAAA,MACjC,eAAA,EAAiB,KAAK,KAAA,CAAM;AAAA,KAC/B,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,MAAA,EAA+B;AAChD,IAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,UAAU,GAAG,OAAO,IAAA;AAC3C,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,CAAM,UAAA,CAAW,MAAM,EAAE,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA;AACvE,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA,KAAM,IAAA,CAAK,YAAY,OAAO,IAAA;AAC/D,IAAA,OAAO,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAA,CAAU,GAAA,EAAsB,IAAA,EAAmC;AACrE,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAC,CAAA;AACtD,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,MAAM,IAAI,SAAA,CAAU,GAAA,EAAK,eAAA,EAAiB,sBAAsB,CAAA;AAAA,IACpE;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU,SAAS,KAAA,EAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAChF,IAAA,MAAM,MAAA,GAAS,SAAS,MAAM,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,iBAAA,CAAkB,IAAI,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,SAAS,MAAA,CAAO,CAAC,MAAM,CAAC,MAAA,CAAO,GAAA,CAAI,CAAC,CAAC,CAAA;AACrD,IAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,SAAA,CAAU,GAAA,EAAK,oBAAA,EAAsB,CAAA,2BAAA,EAA8B,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,EAAI,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACxH;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACA,MAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,aAAA,EAAe,aAAA,CAAc,IAAI,MAAM,CAAA;AAAA,IAChE,SAAS,KAAA,EAAO;AACZ,MAAA,IAAI,iBAAiB,mBAAA,EAAqB;AACtC,QAAA,MAAM,IAAI,SAAA,CAAU,GAAA,EAAK,oBAAA,EAAsB,wCAAwC,CAAA;AAAA,MAC3F;AACA,MAAA,MAAM,KAAA;AAAA,IACV;AAEA,IAAA,OAAO,OAAA,GAAU,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAQ,GAAI,EAAE,QAAQ,MAAA,EAAO;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAA,CAAgB,MAAc,GAAA,EAAwB;AAClD,IAAA,OAAO,oBAAA,CAAqB;AAAA,MACxB,gBAAA,EAAkB,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA;AAAA,MAC1C,OAAO,GAAA,CAAI,IAAA;AAAA,MACX,kBAAkB,GAAA,CAAI,WAAA;AAAA,MACtB,OAAO,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAA,CAAe,GAAA,EAAqB,IAAA,EAAc,GAAA,EAAsB;AACpE,IAAA,GAAA,CAAI,UAAU,kBAAA,EAAoB,IAAA,CAAK,eAAA,CAAgB,IAAA,EAAM,GAAG,CAAC,CAAA;AACjE,IAAA,GAAA,CAAI,UAAU,GAAA,CAAI,MAAA,EAAQ,EAAE,cAAA,EAAgB,mCAAmC,CAAA;AAC/E,IAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,iBAAA,EAAmB,GAAA,CAAI,WAAA,EAAa,CAAC,CAAA;AAAA,EACnF;AACJ;;;AC3FA,SAAS,wBAAwB,cAAA,EAAgE;AAC7F,EAAA,OAAO,CAAC,WAAW,YAAA,KAAiB;AAChC,IAAA,MAAM,QAAA,GAAW,eAAe,YAAY,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,KAAW,GAAG,OAAO,IAAA;AAC/C,IAAA,OAAO,QAAA,CAAS,KAAK,CAAC,KAAA,KAAU,UAAU,MAAA,CAAO,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EAC/D,CAAA;AACJ;AAGA,SAAS,mBAAmB,GAAA,EAAqB;AAC7C,EAAA,OAAO,GAAA,CAAI,SAAS,GAAG,CAAA,GAAI,IAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,GAAA;AAClD;AAOO,SAAS,aAAa,OAAA,EAAyC;AAClE,EAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AACxB,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,CAAC,OAAA,CAAQ,oBAAA,IAAwB,OAAA,CAAQ,oBAAA,CAAqB,WAAW,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,MAAM,4DAA4D,CAAA;AAAA,EAChF;AACA,EAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AAClB,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AAEA,EAAA,MAAM,aAAA,GAAgB,kBAAA,CAAmB,OAAA,CAAQ,aAAa,CAAA;AAC9D,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,KAAW,OAAA,CAAQ,oBAAA,CAAqB,WAAW,CAAA,GAAI,OAAA,CAAQ,oBAAA,CAAqB,CAAC,CAAA,GAAI,MAAA,CAAA;AAEhH,EAAA,MAAM,SAAA,GAAY,IAAI,iBAAA,CAAkB;AAAA,IACpC,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,MAAA;AAAA,IACA,mBAAmB,OAAA,CAAQ;AAAA,GAC9B,CAAA;AAED,EAAA,MAAM,QAAA,GAA0B;AAAA,IAC5B,aAAA;AAAA,IACA,sBAAsB,OAAA,CAAQ,oBAAA;AAAA,IAC9B;AAAA,GACJ;AACA,EAAA,IAAI,OAAA,CAAQ,eAAA,EAAiB,QAAA,CAAS,eAAA,GAAkB,OAAA,CAAQ,eAAA;AAChE,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,cAAA,GAAiB,OAAA,CAAQ,cAAA;AAC9D,EAAA,IAAI,OAAA,CAAQ,aAAA,EAAe,QAAA,CAAS,aAAA,GAAgB,OAAA,CAAQ,aAAA;AAC5D,EAAA,IAAI,OAAA,CAAQ,kBAAkB,MAAA,CAAO,IAAA,CAAK,QAAQ,cAAc,CAAA,CAAE,SAAS,CAAA,EAAG;AAC1E,IAAA,OAAA,CAAQ,KAAK,gGAAgG,CAAA;AAC7G,IAAA,QAAA,CAAS,oBAAA,GAAuB,uBAAA,CAAwB,OAAA,CAAQ,cAAc,CAAA;AAAA,EAClF;AACA,EAAA,IAAI,OAAA,CAAQ,iBAAiB,MAAA,CAAO,IAAA,CAAK,QAAQ,aAAa,CAAA,CAAE,SAAS,CAAA,EAAG;AACxE,IAAA,QAAA,CAAS,oBAAA,GAAuB,IAAI,2BAAA,CAA4B,OAAA,CAAQ,aAAa,CAAA;AAAA,EACzF;AACA,EAAA,IAAI,wBAAA,CAAyB,OAAO,CAAA,EAAG;AACnC,IAAA,QAAA,CAAS,aAAA,GAAgB,2BAA2B,OAAO,CAAA;AAC3D,IAAA,QAAA,CAAS,oBAAA,GAAuB,SAAS,aAAA,CAAc,oBAAA;AAAA,EAC3D;AACA,EAAA,OAAO,QAAA;AACX;AC7DO,SAAS,+BAAA,CAAgC,MAAA,EAAqC,UAAA,GAAa,iBAAA,EAAiD;AAC/I,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC7B,IAAA,OAAO,SAAS,EAAE,aAAA,EAAe,IAAA,EAAM,SAAA,EAAW,EAAE,EAAA,EAAI,UAAA,EAAY,gBAAA,EAAkB,CAAC,IAAI,CAAA,EAAE,EAAE,GAAI,EAAE,eAAe,KAAA,EAAM;AAAA,EAC9H;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,aAAA,EAAe,OAAO,MAAA;AAClC,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,EAAA,SAAW,EAAE,aAAA,EAAe,KAAA,EAAO,MAAA,EAAQ,gCAAA,EAAiC;AAClG,EAAA,OAAO,MAAA;AACX;AAEO,SAAS,kBAAA,CAAmB,WAA+B,QAAA,EAAiC;AAC/F,EAAA,MAAM,UAAU,SAAA,CAAU,gBAAA;AAC1B,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,IAAA;AAClC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACjC,EAAA,IAAI;AACA,IAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,CAAI,CAAC,YAAY,mBAAA,CAAoB,KAAA,CAAM,OAAO,CAAC,CAAA;AAC5E,IAAA,OAAO,SAAS,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAC,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGA,SAAS,SAAA,CAAU,GAAW,CAAA,EAAoB;AAC9C,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACxB,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA;AACxB,EAAA,IAAI,EAAA,CAAG,MAAA,KAAW,EAAA,CAAG,MAAA,EAAQ,OAAO,KAAA;AACpC,EAAA,OAAO,eAAA,CAAgB,IAAI,EAAE,CAAA;AACjC;AAMA,SAAS,gBAAgB,GAAA,EAAqC;AAC1D,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC9C,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,OAAA,CAAQ,MAAK,EAAG,OAAO,QAAQ,IAAA,EAAK;AAEvE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACxC,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC1B,IAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AACjD,IAAA,IAAI,KAAA,EAAO,OAAO,KAAA,CAAM,CAAC,EAAE,IAAA,EAAK;AAAA,EACpC;AACA,EAAA,OAAO,IAAA;AACX;AASO,IAAM,oCAAN,MAA0E;AAAA,EAC5D,OAAA;AAAA,EAEjB,YAAY,MAAA,EAAgB;AACxB,IAAA,IAAI,CAAC,MAAA,EAAQ;AACT,MAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,IAC3E;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACnB;AAAA,EAEA,aAAa,GAAA,EAAoD;AAC7D,IAAA,MAAM,SAAA,GAAY,gBAAgB,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,SAAA,IAAa,CAAC,UAAU,SAAA,EAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AACnD,MAAA,OAAO,EAAE,eAAe,KAAA,EAAM;AAAA,IAClC;AACA,IAAA,OAAO;AAAA,MACH,aAAA,EAAe,IAAA;AAAA,MACf,SAAA,EAAW;AAAA,QACP,EAAA,EAAI,eAAA;AAAA,QACJ,gBAAA,EAAkB,CAAC,IAAI;AAAA;AAC3B,KACJ;AAAA,EACJ;AACJ;ACvGA,IAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAC7C,IAAM,GAAA,GAAMA,SAAQ,iBAAiB,CAAA;AAE9B,IAAM,UAAkB,GAAA,CAAI;AAC5B,IAAM,eAAuB,GAAA,CAAI;;;ACsCxC,IAAM,IAAA,GAAyC;AAAA,EAC3C,OAAA,EAAS,0BAAA;AAAA,EACT,KAAA,EAAO,uCAAA;AAAA,EACP,MAAA,EAAQ,uCAAA;AAAA,EACR,MAAA,EAAQ,yBAAA;AAAA,EACR,OAAA,EAAS,iCAAA;AAAA,EACT,MAAA,EAAQ,iCAAA;AAAA,EACR,MAAA,EAAQ,eAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,cAAA;AAAA,EACR,QAAA,EAAU,YAAA;AAAA,EACV,OAAA,EAAS;AACb,CAAA;AAaA,SAAS,YAAY,KAAA,EAA4C;AAC7D,EAAA,IAAI;AACA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,IAAA,IAAI,OAAO,QAAQ,EAAA,KAAO,QAAA,IAAY,OAAO,MAAA,EAAQ,EAAA,KAAO,QAAA,EAAU,OAAO,MAAA,CAAO,EAAA;AAAA,EACxF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,MAAA;AACX;AAWA,SAAS,gBAAgB,OAAA,EAAkE;AACvF,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,MAAM,KAAA;AAC3B,EAAA,IAAI,OAAO,OAAA,KAAY,UAAA,EAAY,OAAO,OAAA;AAC1C,EAAA,IAAI,mBAAmB,MAAA,EAAQ;AAC3B,IAAA,OAAO,CAAC,MAAA,KAAW;AACf,MAAA,OAAA,CAAQ,SAAA,GAAY,CAAA;AACpB,MAAA,OAAO,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,IAC9B,CAAA;AAAA,EACJ;AACA,EAAA,MAAM,KAAA,GAAQ,IAAI,GAAA,CAAI,OAAO,CAAA;AAC7B,EAAA,OAAO,CAAC,MAAA,KAAW,KAAA,CAAM,GAAA,CAAI,MAAM,CAAA;AACvC;AAWA,SAAS,cAAc,SAAA,EAAoC;AACvD,EAAA,IAAI,SAAA,IAAa,SAAA,IAAa,OAAQ,SAAA,CAAmC,YAAY,UAAA,EAAY;AAC7F,IAAC,UAAkC,OAAA,EAAQ;AAAA,EAC/C;AACJ;AA2BO,IAAM,WAAN,MAAyC;AAAA,EAC3B,QAAA;AAAA,EACT,WAAA,GAAiD,IAAA;AAAA,EACjD,IAAA,GAA+B,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtB,UAAA,uBAAiB,GAAA,EAA4B;AAAA;AAAA,EAG7C,iBAAA,uBAAwB,GAAA,EAA4B;AAAA;AAAA,EAGpD,UAAA,uBAAiB,GAAA,EAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxC,kBAAA,uBAAyB,GAAA,EAA+B;AAAA;AAAA,EAGjE,aAAA,GAAmC,IAAA;AAAA;AAAA,EAGnC,gBAAA,GAA2C,IAAA;AAAA;AAAA,EAG3C,oBAAA,GAAsC,IAAA;AAAA;AAAA,EAGtC,qBAAA,GAA+C,IAAA;AAAA;AAAA,EAG/C,UAAA,GAA0B,IAAA;AAAA;AAAA,EAGjB,UAAA;AAAA;AAAA,EAGA,aAAA;AAAA;AAAA,EAGA,cAAA;AAAA;AAAA,EAGA,qBAAA;AAAA;AAAA,EAGA,eAAA;AAAA;AAAA,EAGA,wBAAA,uBAA+B,OAAA,EAAqC;AAAA;AAAA,EAGpE,iBAAA,uBAAwB,OAAA,EAA+B;AAAA;AAAA,EAGvD,iBAAA,uBAAwB,OAAA,EAAoC;AAAA;AAAA,EAG5D,0BAAA,uBAAiC,OAAA,EAA6C;AAAA,EAC9E,mBAAA,uBAA0B,OAAA,EAAuC;AAAA,EAElF,YAAY,OAAA,EAA2B;AACnC,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,IAAA,GAAO,IAAI,aAAA,CAAc,QAAQ,IAAA,EAAM,OAAA,CAAQ,OAAA,IAAW,MAAM,CAAA,GAAI,IAAA;AAC9F,IAAA,IAAA,CAAK,aAAA,GAAgB,QAAQ,YAAA,IAAgB,IAAA;AAC7C,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA,CAAgB,OAAA,CAAQ,cAAc,CAAA;AAC7D,IAAA,IAAA,CAAK,cAAA,GAAiB,OAAA,CAAQ,aAAA,IAAiB,OAAA,CAAQ,MAAM,aAAA,IAAiB,IAAA;AAC9E,IAAA,IAAA,CAAK,qBAAA,GACD,OAAA,CAAQ,oBAAA,IAAwB,IAAA,CAAK,cAAA,EAAgB,wBAAwB,OAAA,CAAQ,IAAA,EAAM,oBAAA,IAAwB,IAAI,2BAAA,EAA4B;AAAA,EAC3J;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,OAAA,GAAkB;AAClB,IAAA,OAAO,OAAA;AAAA,EACX;AAAA,EAEA,IAAI,IAAA,GAAe;AACf,IAAA,OAAO,IAAA,CAAK,SAAS,UAAA,IAAc,YAAA;AAAA,EACvC;AAAA,EAEA,IAAI,SAAA,GAAyB;AACzB,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EAChB;AAAA,EAEA,IAAI,aAAA,GAAwB;AACxB,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,EAAY,OAAO,CAAA;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAO,IAAA,CAAK,GAAA,KAAQ,IAAA,CAAK,UAAA,CAAW,OAAA,EAAQ,IAAK,GAAI,CAAA;AAAA,EACrE;AAAA,EAEA,IAAI,IAAA,GAA2B;AAC3B,IAAA,OAAO,KAAK,QAAA,CAAS,IAAA;AAAA,EACzB;AAAA,EAEA,IAAI,IAAA,GAAe;AACf,IAAA,OAAO,KAAK,QAAA,CAAS,IAAA;AAAA,EACzB;AAAA,EAEA,IAAI,GAAA,GAAe;AACf,IAAA,OAAO,CAAC,CAAC,IAAA,CAAK,QAAA,CAAS,GAAA;AAAA,EAC3B;AAAA,EAEA,IAAI,KAAA,GAAiC;AACjC,IAAA,MAAM,IAAI,IAAA,CAAK,QAAA;AACf,IAAA,OAAO;AAAA,MACH,QAAA,EAAU,EAAE,YAAA,IAAgB,WAAA;AAAA,MAC5B,SAAA,EAAW,EAAE,aAAA,IAAiB,YAAA;AAAA,MAC9B,MAAA,EAAQ,EAAE,UAAA,IAAc,GAAA;AAAA,MACxB,GAAA,EAAK,EAAE,OAAA,IAAW,MAAA;AAAA,MAClB,GAAA,EAAK,EAAE,OAAA,IAAW,MAAA;AAAA,MAClB,QAAA,EAAU,EAAE,YAAA,IAAgB;AAAA,KAChC;AAAA,EACJ;AAAA,EAEO,gBAAA,GAA0C;AAC7C,IAAA,MAAM,MAA6B,EAAC;AACpC,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,KAAK,UAAA,EAAY;AACzC,MAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,IACjD;AACA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEO,gBAAgB,IAAA,EAA+C;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AACtC,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,IAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,KAAK,CAAA;AAAA,EAC9C;AAAA,EAEQ,kBAAA,CAAmB,MAAc,KAAA,EAA4C;AACjF,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI,SAAA;AAEJ,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,IAAI,GAAG,MAAA,EAAQ;AAC3C,MAAA,SAAA,GAAY,UAAA;AACZ,MAAA,SAAA,GAAY,IAAA;AAAA,IAChB,WAAW,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,GAAG,MAAA,EAAQ;AAC1C,MAAA,SAAA,GAAY,OAAA;AACZ,MAAA,SAAA,GAAY,IAAA;AAAA,IAChB,CAAA,MAAA,IAAW,KAAA,CAAM,EAAA,EAAI,UAAA,KAAeC,UAAU,IAAA,EAAM;AAChD,MAAA,SAAA,GAAY,KAAK,iBAAA,CAAkB,GAAA,CAAI,KAAA,CAAM,EAAE,IAAI,cAAA,GAAiB,IAAA;AACpE,MAAA,SAAA,GAAY,IAAA;AAAA,IAChB,CAAA,MAAO;AACH,MAAA,SAAA,GAAY,MAAA;AACZ,MAAA,SAAA,GAAY,KAAA;AAAA,IAChB;AAEA,IAAA,OAAO;AAAA,MACH,IAAA;AAAA,MACA,SAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA,EAAa,MAAM,SAAA,CAAU,IAAA;AAAA,MAC7B,YAAA,EAAc,KAAA,CAAM,WAAA,CAAY,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA;AAAA,MAC1D,YAAA,EAAc,MAAM,OAAA,CAAQ;AAAA,KAChC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaO,wBAAA,CAAyB,MAAc,SAAA,EAAoC;AAC9E,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,IAAI,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,IAAI,CAAA,wBAAA,CAA0B,CAAA;AAAA,IACxE;AACA,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,IAAI,CAAA,sDAAA,CAAwD,CAAA;AAAA,IAC7G;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,IAAA,EAAM,SAAS,CAAA;AAE3C,IAAA,SAAA,CAAU,YAAY,CAAC,IAAA,KAAiB,KAAK,kBAAA,CAAmB,KAAA,EAAO,MAAM,IAAI,CAAA;AACjF,IAAA,SAAA,CAAU,UAAU,MAAM;AACtB,MAAA,IAAA,CAAK,kBAAA,CAAmB,OAAO,IAAI,CAAA;AACnC,MAAA,IAAA,CAAK,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAA;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWO,mBAAmB,YAAA,EAAuC;AAC7D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,YAAY,CAAA;AACzD,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,MAAM,MAAA,GAA0B;AAAA,MAC5B,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS,IAAA;AAAA,MACT,IAAA,EAAM,CAAC,OAAA,KAA0B;AAC7B,QAAA,IAAI,MAAA,EAAQ;AACZ,QAAA,IAAI,EAAA,GAA6B,IAAA;AACjC,QAAA,IAAI;AACA,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,UAAA,IAAI,MAAA,EAAQ,EAAA,IAAM,IAAA,EAAM,EAAA,GAAK,MAAA,CAAO,EAAA;AAAA,QACxC,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,YAAA,EAAc,KAAK,CAAA,EAAG;AAChD,UAAA,IAAI,EAAA,IAAM,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,EAAE,IAAA,EAAM,UAAA,EAAY,MAAA,EAAQ,CAAA;AAClE,UAAA,IAAA,CAAK,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,OAAO,CAAA;AAAA,QACrD,CAAA,MAAA,IAAW,MAAM,IAAA,EAAM;AACnB,UAAA,MAAA,CAAO,SAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACX,OAAA,EAAS,KAAA;AAAA,cACT,EAAA;AAAA,cACA,OAAO,EAAE,IAAA,EAAM,OAAQ,OAAA,EAAS,CAAA,UAAA,EAAa,YAAY,CAAA,eAAA,CAAA;AAAkB,aAC9E;AAAA,WACL;AAAA,QACJ;AAAA,MACJ,CAAA;AAAA,MACA,OAAO,MAAY;AACf,QAAA,IAAI,MAAA,EAAQ;AACZ,QAAA,MAAA,GAAS,IAAA;AACT,QAAA,KAAA,CAAM,eAAA,CAAgB,OAAO,MAAM,CAAA;AACnC,QAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAM,OAAA,EAAS;AACpC,UAAA,IAAI,IAAA,CAAK,SAAS,UAAA,IAAc,IAAA,CAAK,WAAW,MAAA,EAAQ,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,EAAE,CAAA;AAAA,QACnF;AAAA,MACJ;AAAA,KACJ;AAEA,IAAA,KAAA,CAAM,eAAA,CAAgB,IAAI,MAAM,CAAA;AAChC,IAAA,OAAO,MAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAA,GAAuB;AACvB,IAAA,OAAO,IAAA,CAAK,aAAa,SAAA,IAAa,KAAA;AAAA,EAC1C;AAAA;AAAA,EAGA,IAAI,WAAA,GAAsB;AACtB,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,EAAG;AACtC,MAAA,CAAA,IAAK,EAAE,SAAA,CAAU,IAAA,GAAO,EAAE,WAAA,CAAY,IAAA,GAAO,EAAE,YAAA,CAAa,IAAA;AAAA,IAChE;AACA,IAAA,OAAO,CAAA;AAAA,EACX;AAAA;AAAA,EAGA,IAAI,aAAA,GAAmC;AACnC,IAAA,OAAO,CAAC,GAAG,IAAA,CAAK,UAAA,CAAW,OAAA,EAAS,CAAA,CAAE,MAAA,CAAO,CAAC,CAAC,IAAA,EAAM,CAAC,MAAM,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,CAAC,CAAC,CAAA,CAAE,IAAI,CAAC,CAAC,IAAI,CAAA,KAAM,IAAI,CAAA;AAAA,EACxH;AAAA;AAAA,EAGA,IAAI,WAAA,GAAuB;AACvB,IAAA,OAAO,IAAA,CAAK,cAAc,MAAA,GAAS,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAA,GAAuB;AACnB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAACJ,QAAAA,KAAY;AAC5B,MAAA,MAAM,UAAU,CAAC,GAAA,EAAsB,QAAwB,IAAA,CAAK,WAAA,CAAY,KAAK,GAAG,CAAA;AACxF,MAAA,IAAA,CAAK,WAAA,GAAc,KAAK,QAAA,CAAS,GAAA,GAAYK,mBAAa,EAAE,IAAA,EAAM,KAAK,QAAA,CAAS,GAAA,CAAI,MAAM,GAAA,EAAK,IAAA,CAAK,SAAS,GAAA,CAAI,GAAA,IAAO,OAAO,CAAA,GAASC,kBAAa,OAAO,CAAA;AAI5J,MAAA,IAAA,CAAK,IAAA,GAAO,IAAI,eAAA,CAAgB,EAAE,MAAA,EAAQ,IAAA,CAAK,WAAA,EAAa,iBAAA,EAAmB,KAAA,EAAO,YAAA,EAAc,IAAA,CAAK,iBAAA,IAAqB,CAAA;AAE9H,MAAA,IAAA,CAAK,IAAA,CAAK,EAAA,CAAG,YAAA,EAAc,CAAC,IAAe,GAAA,KAAyB;AAChE,QAAA,MAAM,GAAA,GAAM,IAAI,GAAA,IAAO,GAAA;AACvB,QAAA,MAAM,YAAA,GAAe,IAAA,CAAK,QAAA,CAAS,YAAA,IAAgB,WAAA;AACnD,QAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,QAAA,CAAS,aAAA,IAAiB,YAAA;AAErD,QAAA,IAAI,QAAQ,aAAA,IAAiB,GAAA,CAAI,UAAA,CAAW,aAAA,GAAgB,GAAG,CAAA,EAAG;AAE9D,UAAA,IAAA,CAAK,2BAAA,CAA4B,IAAI,GAAG,CAAA;AAAA,QAC5C,WAAW,GAAA,CAAI,UAAA,CAAW,eAAe,GAAG,CAAA,IAAK,QAAQ,YAAA,EAAc;AAEnE,UAAA,MAAM,GAAA,GAAM,IAAI,KAAA,CAAM,YAAA,CAAa,MAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC5D,UAAA,MAAM,IAAA,GAAO,mBAAmB,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA,IAAK,WAAA;AACtD,UAAA,IAAA,CAAK,kBAAA,CAAmB,EAAA,EAAI,IAAA,EAAM,GAAG,CAAA;AAAA,QACzC,CAAA,MAAO;AAEH,UAAA,MAAM,GAAA,GAAM,IAAI,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAC/C,UAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,GAAG,CAAA,IAAK,EAAA;AACxC,UAAA,IAAA,CAAK,gBAAA,CAAiB,EAAA,EAAI,IAAA,EAAM,GAAG,CAAA;AAAA,QACvC;AAAA,MACJ,CAAC,CAAA;AAED,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,IAAA,CAAK,QAAA,CAAS,MAAM,IAAA,CAAK,QAAA,CAAS,IAAA,IAAQ,SAAA,EAAW,MAAM;AAG/E,QAAA,IAAA,CAAK,0BAAA,EAA2B;AAKhC,QAAA,MAAM,YAAA,GAAe,CAAC,GAAA,EAA4C,QAAA,KAA8B;AAC5F,UAAA,QAAA,CAAS,SAAA,GAAY,CAAC,IAAA,KAAS;AAC3B,YAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,GAAA,CAAI,IAAI,CAAA;AACrD,YAAA,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,IAAI,CAAA;AAAA,UACjD,CAAA;AACA,UAAA,QAAA,CAAS,OAAA,GAAU,CAAC,GAAA,KAAQ;AACxB,YAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,SAAA,EAAY,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,UAC3C,CAAA;AACA,UAAA,QAAA,CAAS,UAAU,MAAM;AACrB,YAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,IAAI,CAAA;AAC1C,YAAA,IAAI,KAAA,EAAO,IAAA,CAAK,yBAAA,CAA0B,KAAA,EAAO,IAAI,IAAI,CAAA;AAAA,UAC7D,CAAA;AACA,UAAA,IAAI,IAAI,SAAA,EAAW;AACf,YAAA,QAAA,CAAS,SAAS,MAAM,KAAK,KAAK,gBAAA,EAAkB,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,UAC5E;AACA,UAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,QAAQ,CAAA;AACtC,UAAA,QAAA,CAAS,OAAA,EAAQ;AAAA,QACrB,CAAA;AACA,QAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,QAAA,CAAS,cAAA,IAAkB,EAAC,EAAG,YAAA,CAAa,GAAA,EAAK,IAAI,aAAA,CAAc,GAAG,CAAC,CAAA;AAC9F,QAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,QAAA,CAAS,eAAA,IAAmB,EAAC,EAAG,YAAA,CAAa,GAAA,EAAK,IAAI,cAAA,CAAe,GAAG,CAAC,CAAA;AAIhG,QAAA,IAAI,IAAA,CAAK,SAAS,WAAA,EAAa;AAC3B,UAAA,IAAA,CAAK,oBAAA,GAAuB,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,YAAA;AACtD,UAAA,MAAM,SAAA,GAAY,IAAI,cAAA,EAAe;AACrC,UAAA,IAAA,CAAK,qBAAA,GAAwB,SAAA;AAC7B,UAAA,SAAA,CAAU,SAAA,GAAY,CAAC,IAAA,KAAuB;AAC1C,YAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,IAAA,CAAK,oBAAqB,CAAA;AACvE,YAAA,IAAA,CAAK,qBAAA,CAAsB,OAAO,IAAI,CAAA;AAAA,UAC1C,CAAA;AACA,UAAA,SAAA,CAAU,OAAA,GAAU,CAAC,GAAA,KAAqB;AACtC,YAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,iCAAA,EAAoC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,UACnE,CAAA;AACA,UAAA,SAAA,CAAU,UAAU,MAAY;AAAA,UAEhC,CAAA;AACA,UAAA,SAAA,CAAU,OAAA,EAAQ;AAAA,QACtB;AAEA,QAAA,IAAA,CAAK,UAAA,uBAAiB,IAAA,EAAK;AAI3B,QAAA,KAAK,IAAA,CAAK,yBAAwB,CAAE,IAAA;AAAA,UAChC,MAAMN,QAAAA,EAAQ;AAAA,UACd,CAAC,GAAA,KAAiB;AACd,YAAA,OAAA,CAAQ,KAAA,CAAM,oDAAoD,GAAG,CAAA;AAErE,YAAAA,QAAAA,EAAQ;AAAA,UACZ;AAAA,SACJ;AAAA,MACJ,CAAC,CAAA;AAAA,IACL,CAAC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,uBAAA,GAAyC;AACnD,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,oBAAA,KAAyB,KAAA,EAAO;AAClD,IAAA,MAAM,EAAE,MAAA,EAAQ,eAAA,EAAgB,GAAI,MAAM,kBAAkB,IAAA,EAAM;AAAA,MAC9D,sBAAA,EAAwB,KAAK,QAAA,CAAS,4BAAA;AAAA,MACtC,gBAAA,EAAkB,KAAK,QAAA,CAAS;AAAA,KACnC,CAAA;AACD,IAAA,IAAA,CAAK,aAAA,GAAgB,MAAA;AACrB,IAAA,IAAA,CAAK,wBAAA,CAAyB,sBAAsB,eAAe,CAAA;AAKnE,IAAA,KAAK,IAAA,CAAK,gBAAA,EAAkB,WAAA,CAAY,oBAAoB,CAAA;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,0BAAA,GAAmC;AACvC,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,uBAAA,KAA4B,KAAA,EAAO;AACrD,IAAA,IAAI;AACA,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,CAAC,iBAAiB,IAAA,CAAK,kBAAA,CAAmB,YAAY,CAAC,CAAA;AAC1F,MAAA,MAAA,CAAO,cAAA,CAAe,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,wBAAwB,IAAI,CAAA;AACtE,MAAA,MAAA,CAAO,sBAAA,CAAuB,KAAK,cAAc,CAAA;AACjD,MAAA,MAAA,CAAO,KAAA,EAAM;AACb,MAAA,IAAA,CAAK,wBAAA,CAAyB,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA;AAC1D,MAAA,IAAA,CAAK,gBAAA,GAAmB,MAAA;AAAA,IAC5B,SAAS,GAAA,EAAK;AACV,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,2CAAA,EAA+C,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,IACxF;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAA,GAAsB;AAGxB,IAAA,MAAM,eAAe,IAAA,CAAK,aAAA;AAC1B,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AACrB,IAAA,IAAI,YAAA,EAAc;AACd,MAAA,IAAI;AACA,QAAA,MAAM,aAAa,IAAA,EAAK;AAAA,MAC5B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAIA,IAAA,MAAM,kBAAkB,IAAA,CAAK,gBAAA;AAC7B,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,IAAA,IAAI,eAAA,EAAiB;AACjB,MAAA,IAAI;AACA,QAAA,eAAA,CAAgB,KAAA,EAAM;AAAA,MAC1B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,IAAA,CAAK,uBAAuB,KAAA,EAAM;AAClC,IAAA,IAAA,CAAK,qBAAA,GAAwB,IAAA;AAC7B,IAAA,IAAA,CAAK,oBAAA,GAAuB,IAAA;AAK5B,IAAA,MAAM,QAAQ,GAAA,CAAI,CAAC,GAAG,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA,CAAE,IAAI,CAAC,KAAA,KAAU,MAAM,YAAA,EAAc,QAAA,MAAc,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA;AAEnH,IAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,EAAS,MAAA,KAAW;AACpC,MAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,EAAG;AAC1C,QAAA,KAAA,MAAW,OAAO,KAAA,CAAM,WAAA,CAAY,MAAA,EAAO,MAAO,GAAA,EAAI;AACtD,QAAA,KAAA,CAAM,YAAY,KAAA,EAAM;AACxB,QAAA,KAAA,CAAM,aAAa,KAAA,EAAM;AACzB,QAAA,KAAA,CAAM,YAAA,GAAe,IAAA;AACrB,QAAA,KAAA,MAAW,MAAA,IAAU,KAAA,CAAM,SAAA,EAAW,MAAA,CAAO,KAAA,EAAM;AACnD,QAAA,KAAA,CAAM,UAAU,KAAA,EAAM;AACtB,QAAA,KAAA,CAAM,IAAI,KAAA,EAAM;AAAA,MACpB;AACA,MAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,MAAA,IAAA,CAAK,kBAAkB,KAAA,EAAM;AAC7B,MAAA,KAAA,MAAW,YAAY,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,WAAY,KAAA,EAAM;AAChE,MAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,MAAA,KAAA,MAAW,YAAY,IAAA,CAAK,kBAAA,CAAmB,MAAA,EAAO,WAAY,KAAA,EAAM;AACxE,MAAA,IAAA,CAAK,mBAAmB,KAAA,EAAM;AAC9B,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,MAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AACjB,MAAA,IAAA,CAAK,WAAA,EAAa,MAAM,CAAC,GAAA,KAAS,MAAM,MAAA,CAAO,GAAG,CAAA,GAAIA,QAAAA,EAAU,CAAA;AAAA,IACpE,CAAC,CAAA;AAAA,EACL;AAAA,EAEQ,sBAAsB,SAAA,EAAqD;AAC/E,IAAA,IAAI,SAAA,EAAW,OAAA,EAAS,OAAO,SAAA,CAAU,OAAA;AACzC,IAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,GAAA,EAAK,EAAC,EAAE;AACjC,IAAA,IAAI;AACA,MAAA,OACI,KAAK,cAAA,EAAgB,aAAA,CAAc,GAAA,CAAI,SAAA,CAAU,MAAM,CAAA,IAAK;AAAA,QACxD,KAAK,EAAC;AAAA,QACN,QAAQ,SAAA,CAAU;AAAA,OACtB;AAAA,IAER,SAAS,KAAA,EAAO;AACZ,MAAA,IAAI,EAAE,iBAAiB,mBAAA,CAAA,EAAsB;AACzC,QAAA,OAAA,CAAQ,MAAM,gDAAgD,CAAA;AAAA,MAClE;AACA,MAAA,OAAO,EAAE,GAAA,EAAK,EAAC,EAAG,MAAA,EAAQ,UAAU,MAAA,EAAO;AAAA,IAC/C;AAAA,EACJ;AAAA,EAEQ,eACJ,OAAA,EACA,IAAA,EACA,QAAA,EACA,UAAA,EACA,MACA,QAAA,EACI;AACJ,IAAA,MAAM,gBAAgB,IAAA,CAAK,cAAA;AAC3B,IAAA,IAAI,CAAC,aAAA,IAAkB,QAAA,CAAS,WAAW,CAAC,aAAA,CAAc,MAAM,UAAA,EAAa;AAC7E,IAAA,4BAAA;AAAA,MACI,2BAAA;AAAA,QACI;AAAA,UACI,OAAA;AAAA,UACA,IAAA;AAAA,UACA,QAAA;AAAA,UACA,UAAA;AAAA,UACA,QAAA,EAAU,IAAA;AAAA,UACV;AAAA,SACJ;AAAA,QACA;AAAA;AACJ,KACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,kBAAA,CAAmB,YAAA,EAAsB,IAAA,EAAc,SAAA,EAAuC;AAClG,IAAA,MAAM,gBAAgB,IAAA,CAAK,cAAA;AAC3B,IAAA,IAAI,CAAC,aAAA,IAAiB,YAAA,KAAiB,eAAA,CAAgB,MAAM,OAAO,IAAA;AAEpE,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,qBAAA,CAAsB,SAAS,CAAA;AACpD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,qBAAA,CAAsB,OAAA,CAAQ,YAAY,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACX,MAAA,MAAM,QAAA,GAAmC,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,kBAAA,EAAmB;AACtF,MAAA,IAAA,CAAK,eAAe,OAAA,EAAS,YAAA,EAAc,MAAA,EAAW,MAAA,EAAW,QAAW,QAAQ,CAAA;AACpF,MAAA,OAAO,KAAA;AAAA,IACX;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACA,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,IAAA;AAAA,IACX;AACA,IAAA,MAAM,aAAa,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA,GAAS,CAAC,MAAM,CAAA;AAC3D,IAAA,KAAA,MAAW,SAAS,UAAA,EAAY;AAC5B,MAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzE,MAAA,MAAM,SAAA,GAAY,KAAA;AAClB,MAAA,IAAI;AACA,QAAA,MAAM,aAAa,aAAA,CAAc,oBAAA,CAAqB,QAAA,CAAS,SAAA,EAAW,UAAU,YAAY,CAAA;AAChG,QAAA,IAAI,CAAC,UAAA,EAAY;AACjB,QAAA,MAAM,QAAA,GAAW,aAAA,CAAc,MAAA,CAAO,SAAA,CAAU;AAAA,UAC5C,OAAA;AAAA,UACA,YAAY,UAAA,CAAW,UAAA;AAAA,UACvB,QAAA;AAAA,UACA,QAAA,EAAU,YAAA;AAAA,UACV,MAAM,UAAA,CAAW;AAAA,SACpB,CAAA;AACD,QAAA,IAAA,CAAK,cAAA,CAAe,SAAS,YAAA,EAAc,QAAA,EAAU,WAAW,UAAA,EAAY,UAAA,CAAW,MAAM,QAAQ,CAAA;AACrG,QAAA,IAAI,CAAC,QAAA,CAAS,OAAA,EAAS,OAAO,KAAA;AAAA,MAClC,CAAA,CAAA,MAAQ;AACJ,QAAA,OAAA,CAAQ,MAAM,oCAAoC,CAAA;AAClD,QAAA,MAAM,QAAA,GAAmC,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,mBAAA,EAAoB;AACvF,QAAA,IAAA,CAAK,eAAe,OAAA,EAAS,YAAA,EAAc,QAAA,EAAU,MAAA,EAAW,QAAW,QAAQ,CAAA;AACnF,QAAA,OAAO,KAAA;AAAA,MACX;AAAA,IACJ;AACA,IAAA,OAAO,IAAA;AAAA,EACX;AAAA,EAEQ,qBAAqB,IAAA,EAAsB;AAC/C,IAAA,IAAI,EAAA,GAA6B,IAAA;AACjC,IAAA,IAAI;AACA,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,MAAA,IAAI,OAAO,MAAA,CAAO,EAAA,KAAO,QAAA,IAAY,OAAO,OAAO,EAAA,KAAO,QAAA,IAAY,MAAA,CAAO,EAAA,KAAO,IAAA,EAAM;AACtF,QAAA,EAAA,GAAK,MAAA,CAAO,EAAA;AAAA,MAChB;AAAA,IACJ,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,OAAO,KAAK,SAAA,CAAU;AAAA,MAClB,OAAA,EAAS,KAAA;AAAA,MACT,EAAA;AAAA,MACA,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,WAAA;AAAY,KAC/C,CAAA;AAAA,EACL;AAAA;AAAA,EAGQ,oBAAA,CAAqB,cAAsB,KAAA,EAAuB;AACtE,IAAA,OAAO,KAAK,SAAA,CAAU;AAAA,MAClB,OAAA,EAAS,KAAA;AAAA,MACT,EAAA,EAAI,WAAA,CAAY,KAAK,CAAA,IAAK,IAAA;AAAA,MAC1B,OAAO,EAAE,IAAA,EAAM,OAAQ,OAAA,EAAS,CAAA,UAAA,EAAa,YAAY,CAAA,eAAA,CAAA;AAAkB,KAC9E,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAMQ,WAAA,CAAY,KAAsB,GAAA,EAA2B;AACjE,IAAA,MAAM,MAAA,GAAS,IAAI,MAAA,IAAU,KAAA;AAC7B,IAAA,MAAM,UAAU,GAAA,CAAI,GAAA,IAAO,KAAK,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAG5C,IAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,GAAG,CAAA;AAChD,IAAA,GAAA,CAAI,SAAA,CAAU,gCAAgC,4BAA4B,CAAA;AAC1E,IAAA,GAAA,CAAI,UAAU,8BAAA,EAAgC,GAAA,CAAI,OAAA,CAAQ,gCAAgC,KAAK,sCAAsC,CAAA;AACrI,IAAA,GAAA,CAAI,SAAA,CAAU,iCAAiC,gBAAgB,CAAA;AAE/D,IAAA,IAAI,WAAW,SAAA,EAAW;AACtB,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA;AAAA,IACJ;AAGA,IAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,QAAA,CAAS,gBAAA,IAAoB,oBAAA;AAC3D,IAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,gBAAA,EAAkB;AACjD,MAAA,IAAA,CAAK,oBAAoB,GAAG,CAAA;AAC5B,MAAA;AAAA,IACJ;AAIA,IAAA,IAAI,IAAA,CAAK,UAAA,IAAc,MAAA,KAAW,KAAA,EAAO;AACrC,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,UAAA,CAAW,oBAAA,CAAqB,MAAM,CAAA;AAC5D,MAAA,IAAI,QAAA,EAAU;AACV,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,mCAAmC,CAAA;AACxE,QAAA,GAAA,CAAI,GAAA,CAAI,KAAK,SAAA,CAAU,IAAA,CAAK,WAAW,WAAA,CAAY,QAAQ,CAAC,CAAC,CAAA;AAC7D,QAAA;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,mBAAA,CAAoB,MAAM,CAAA;AAC7C,IAAA,IAAI,KAAA,EAAO;AACP,MAAA,MAAM,EAAE,YAAA,EAAc,QAAA,EAAS,GAAI,KAAA;AACnC,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,gBAAA,CAAiB,QAAA,EAAU,MAAM,CAAA;AACnD,MAAA,IAAI,IAAA,EAAM;AACN,QAAA,IAAI,KAAK,UAAA,EAAY;AAGjB,UAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AACnB,UAAA,KAAK,KAAA,CAAM,SAAA,CAAU,GAAA,EAAK,YAAY,CAAA,CAAE,IAAA;AAAA,YACpC,CAAC,cAAc,IAAA,CAAK,oBAAA,CAAqB,MAAM,GAAA,EAAK,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,YAChF,CAAC,GAAA,KAAiB,IAAA,CAAK,mBAAmB,KAAA,EAAO,GAAA,EAAK,cAAc,GAAG;AAAA,WAC3E;AAAA,QACJ,CAAA,MAAO;AACH,UAAA,IAAA,CAAK,oBAAA,CAAqB,IAAA,EAAM,GAAA,EAAK,GAAA,EAAK,cAAc,IAAI,CAAA;AAAA,QAChE;AACA,QAAA;AAAA,MACJ;AAAA,IACJ;AAGA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,YAAA,EAAc,MAAA,EAAQ;AACpC,MAAA,IAAA,CAAK,YAAA,CAAa,KAAK,GAAG,CAAA;AAAA,IAC9B,CAAA,MAAO;AACH,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACZ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,MAAA,EAAmE;AAC3F,IAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC9C,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC/B,IAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA;AAChD,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,KAAA,CAAM,CAAC,CAAC,CAAA;AAC5C,IAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,QAAA,EAAU,OAAO,IAAA;AACvC,IAAA,OAAO,EAAE,cAAc,QAAA,EAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAA,CAAiB,UAAkB,MAAA,EAAwC;AAC/E,IAAA,MAAM,aAAa,IAAA,CAAK,QAAA,CAAS,WAAW,MAAA,EAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrE,IAAA,MAAM,aAAa,IAAA,CAAK,QAAA,CAAS,WAAW,MAAA,EAAQ,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrE,IAAA,MAAM,kBAAkB,IAAA,CAAK,QAAA,CAAS,gBAAgB,WAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAEpF,IAAA,IAAI,QAAA,KAAa,WAAW,OAAO,KAAA;AACnC,IAAA,IAAI,QAAA,KAAa,SAAA,IAAa,MAAA,KAAW,KAAA,EAAO,OAAO,aAAA;AACvD,IAAA,IAAI,QAAA,KAAa,cAAA,IAAkB,MAAA,KAAW,MAAA,EAAQ,OAAO,aAAA;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA,EAGQ,oBAAA,CAAqB,IAAA,EAAuB,GAAA,EAAsB,GAAA,EAAqB,cAAsB,SAAA,EAAoC;AACrJ,IAAA,QAAQ,IAAA;AAAM,MACV,KAAK,KAAA;AACD,QAAA,IAAA,CAAK,qBAAA,CAAsB,GAAA,EAAK,GAAA,EAAK,YAAA,EAAc,SAAS,CAAA;AAC5D,QAAA;AAAA,MACJ,KAAK,aAAA;AACD,QAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,EAAK,GAAA,EAAK,YAAA,EAAc,SAAS,CAAA;AACxD,QAAA;AAAA,MACJ,KAAK,aAAA;AACD,QAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,EAAK,GAAA,EAAK,YAAA,EAAc,SAAS,CAAA;AACxD,QAAA;AAAA;AACR,EACJ;AAAA;AAAA,EAGQ,kBAAA,CAAmB,KAAA,EAAsB,GAAA,EAAqB,YAAA,EAAsB,GAAA,EAAoB;AAC5G,IAAA,IAAI,eAAe,SAAA,EAAW;AAC1B,MAAA,KAAA,CAAM,cAAA,CAAe,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAC3C,MAAA;AAAA,IACJ;AAGA,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qCAAA,EAAwC,YAAY,CAAA,EAAA,CAAA,EAAM,GAAG,CAAA;AAC3E,IAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,mCAAmC,CAAA;AACxE,IAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeQ,iBAAA,GAA2D;AAC/D,IAAA,MAAM,QAAQ,IAAA,CAAK,UAAA;AACnB,IAAA,MAAM,eAAe,IAAA,CAAK,aAAA;AAC1B,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,YAAA,EAAc,OAAO,MAAA;AAEpC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,QAAA,CAAS,YAAA,IAAgB,WAAA;AACnD,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,QAAA,CAAS,aAAA,IAAiB,YAAA;AAErD,IAAA,OAAO,CAAC,MAAM,EAAA,KAAO;AACjB,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAA,IAAO,GAAA;AAC5B,MAAA,MAAM,cAAc,GAAA,KAAQ,aAAA,IAAiB,GAAA,CAAI,UAAA,CAAW,gBAAgB,GAAG,CAAA;AAC/E,MAAA,MAAM,cAAc,GAAA,CAAI,UAAA,CAAW,YAAA,GAAe,GAAG,KAAK,GAAA,KAAQ,YAAA;AAElE,MAAA,IAAI,eAAe,WAAA,EAAa;AAE5B,QAAA,IAAI,CAAC,YAAA,EAAc;AACf,UAAA,EAAA,CAAG,IAAI,CAAA;AACP,UAAA;AAAA,QACJ;AACA,QAAA,MAAMO,QAAO,WAAA,GAAc,kBAAA,CAAmB,IAAI,KAAA,CAAM,YAAA,CAAa,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAE,EAAE,KAAA,CAAM,GAAG,EAAE,CAAC,CAAC,KAAK,MAAA,GAAY,MAAA;AAC9H,QAAA,OAAA,CAAQ,QAAQ,YAAA,CAAa,YAAA,CAAa,KAAK,GAAA,EAAKA,KAAI,CAAC,CAAA,CAAE,IAAA;AAAA,UACvD,CAAC,SAAA,KAAc;AACX,YAAA,MAAM,MAAA,GAAS,gCAAgC,SAAS,CAAA;AACxD,YAAA,IAAI,CAAC,OAAO,aAAA,EAAe;AACvB,cAAA,EAAA,CAAG,OAAO,GAAA,EAAK,cAAA,EAAgB,EAAE,kBAAA,EAAoB,2BAA2B,CAAA;AAChF,cAAA;AAAA,YACJ;AACA,YAAA,IAAIA,UAAS,MAAA,EAAW;AACpB,cAAA,MAAM,QAAA,GAAW,IAAA,CAAK,qBAAA,CAAsB,OAAA,CAAQA,KAAI,CAAA;AACxD,cAAA,IAAI,CAAC,QAAA,IAAY,CAAC,mBAAmB,MAAA,CAAO,SAAA,EAAW,QAAQ,CAAA,EAAG;AAC9D,gBAAA,IAAA,CAAK,wBAAA,CAAyB,MAAA,CAAO,SAAA,EAAWA,KAAAA,EAAM,UAAU,KAAK,CAAA;AACrE,gBAAA,EAAA,CAAG,KAAA,EAAO,KAAK,WAAW,CAAA;AAC1B,gBAAA;AAAA,cACJ;AAAA,YACJ;AACA,YAAA,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,OAAO,SAAS,CAAA;AAC9D,YAAA,EAAA,CAAG,IAAI,CAAA;AAAA,UACX,CAAA;AAAA,UACA,MAAM;AACF,YAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,4CAAA,EAA+CA,KAAAA,IAAQ,aAAa,CAAA,EAAA,CAAI,CAAA;AACtF,YAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,UACjC;AAAA,SACJ;AACA,QAAA;AAAA,MACJ;AAGA,MAAA,IAAI,CAAC,KAAA,EAAO;AACR,QAAA,EAAA,CAAG,IAAI,CAAA;AACP,QAAA;AAAA,MACJ;AACA,MAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA;AACpE,MAAA,KAAK,KAAA,CAAM,SAAA,CAAU,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA,CAAE,IAAA;AAAA,QACjC,CAAC,SAAA,KAAc;AAEX,UAAA,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AACrD,UAAA,EAAA,CAAG,IAAI,CAAA;AAAA,QACX,CAAA;AAAA,QACA,CAAC,GAAA,KAAiB;AACd,UAAA,IAAI,eAAe,SAAA,EAAW;AAC1B,YAAA,EAAA,CAAG,KAAA,EAAO,GAAA,CAAI,MAAA,EAAQ,GAAA,CAAI,IAAA,EAAM,EAAE,kBAAA,EAAoB,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAG,CAAA,EAAG,CAAA;AAAA,UAC5F,CAAA,MAAO;AACH,YAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,+CAAA,EAAkD,IAAI,CAAA,EAAA,CAAA,EAAM,GAAG,CAAA;AAC7E,YAAA,EAAA,CAAG,KAAA,EAAO,KAAK,cAAc,CAAA;AAAA,UACjC;AAAA,QACJ;AAAA,OACJ;AAAA,IACJ,CAAA;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,iBAAA,CAAkB,GAAA,EAAsB,GAAA,EAAqB,YAAA,EAAsB,SAAA,EAAoC;AAC3H,IAAA,MAAM,YAAY,UAAA,EAAW;AAC7B,IAAA,MAAM,kBAAkB,IAAA,CAAK,QAAA,CAAS,gBAAgB,WAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AACpF,IAAA,MAAM,cAAc,CAAA,CAAA,EAAI,kBAAA,CAAmB,YAAY,CAAC,IAAI,cAAc,CAAA,CAAA;AAE1E,IAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,MACf,cAAA,EAAgB,mBAAA;AAAA,MAChB,eAAA,EAAiB,wBAAA;AAAA,MACjB,UAAA,EAAY;AAAA,KACf,CAAA;AACD,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA;AAAA,MAAA,EAA0B,WAAW,cAAc,SAAS;;AAAA,CAAM,CAAA;AAE5E,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,YAAY,CAAA;AACzD,IAAA,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,SAAA,EAAW,GAAG,CAAA;AACpC,IAAA,IAAI,SAAA,EAAW,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,KAAK,SAAS,CAAA;AAExD,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM;AAClB,MAAA,KAAA,CAAM,WAAA,CAAY,OAAO,SAAS,CAAA;AAClC,MAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAM,OAAA,EAAS;AACpC,QAAA,IAAI,IAAA,CAAK,SAAS,KAAA,IAAS,IAAA,CAAK,cAAc,SAAA,EAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,EAAE,CAAA;AAAA,MACpF;AAAA,IACJ,CAAC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAA,CAAkB,GAAA,EAAsB,GAAA,EAAqB,YAAA,EAAsB,SAAA,EAAoC;AAC3H,IAAA,MAAM,SAAS,IAAI,GAAA,CAAI,IAAI,GAAA,IAAO,EAAA,EAAI,kBAAkB,CAAA,CAAE,YAAA;AAC1D,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA,IAAK,EAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,YAAY,CAAA;AAEzD,IAAA,IAAI,CAAC,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,SAAS,CAAA,EAAG;AACnC,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,4BAA4B,CAAA;AACpC,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC9B,MAAA,IAAA,IAAQ,MAAM,QAAA,EAAS;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,OAAO,MAAM;AAChB,MAAA,IAAI,CAAC,IAAA,CAAK,kBAAA,CAAmB,YAAA,EAAc,IAAA,EAAM,SAAS,CAAA,EAAG;AACzD,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,mCAAmC,CAAA;AACxE,QAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,oBAAA,CAAqB,IAAI,CAAC,CAAA;AACvC,QAAA;AAAA,MACJ;AACA,MAAA,IAAI;AACA,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC3B,QAAA,IAAI,GAAA,CAAI,EAAA,IAAM,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,EAAE,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,MAC5E,CAAA,CAAA,MAAQ;AAAA,MAER;AAEA,MAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,YAAA,EAAc,KAAK,CAAA,EAAG;AAChD,QAAA,IAAA,CAAK,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,SAAS,CAAA;AAAA,MAC7D,CAAA,MAAO;AACH,QAAA,MAAM,MAAA,GAAS,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,SAAS,CAAA;AAC9C,QAAA,IAAI,MAAA,EAAQ;AACR,UAAA,IAAI,KAAA,GAAgC,IAAA;AACpC,UAAA,IAAI;AACA,YAAA,KAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,CAA+B,EAAA,IAAM,IAAA;AAAA,UACjE,CAAA,CAAA,MAAQ;AAAA,UAER;AACA,UAAA,IAAA,CAAK,aAAA;AAAA,YACD,MAAA;AAAA,YACA,KAAK,SAAA,CAAU;AAAA,cACX,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,KAAA;AAAA,cACJ,OAAO,EAAE,IAAA,EAAM,OAAQ,OAAA,EAAS,CAAA,UAAA,EAAa,YAAY,CAAA,eAAA,CAAA;AAAkB,aAC9E;AAAA,WACL;AAAA,QACJ;AAAA,MACJ;AAEA,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACZ,CAAC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaQ,qBAAA,CAAsB,GAAA,EAAsB,GAAA,EAAqB,YAAA,EAAsB,SAAA,EAAoC;AAC/H,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,YAAY,CAAA;AAMzD,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAA;AAC9C,IAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AAC/B,MAAA,MAAM,OAAA,GAAU,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAChD,MAAA,IAAI,OAAA,UAAiB,SAAA,GAAY,SAAA;AAAA,IACrC;AAEA,IAAA,KAAK,KAAK,YAAA,CAAa,YAAA,EAAc,KAAK,CAAA,CAAE,aAAA,CAAc,KAAK,GAAG,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,YAAA,CAAa,cAAsB,KAAA,EAA+C;AACtF,IAAA,IAAI,KAAA,CAAM,YAAA,EAAc,OAAO,KAAA,CAAM,YAAA;AAErC,IAAA,KAAA,CAAM,YAAA,GAAe,IAAI,sBAAA,CAAuB;AAAA,MAC5C,gBAAgB,IAAA,CAAK,eAAA;AAAA,MAErB,YAAA,EAAc,CAAC,SAAA,EAAW,SAAA,EAAW,UAAA,KAAe;AAChD,QAAA,MAAM,OAAA,GAAwB,EAAE,SAAA,EAAW,SAAA,EAAW,IAAA,EAAK;AAC3D,QAAA,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,SAAA,EAAW,OAAO,CAAA;AAEzC,QAAA,SAAA,CAAU,SAAA,GAAY,CAAC,KAAA,KAAkB,IAAA,CAAK,iBAAiB,KAAA,EAAO,YAAA,EAAc,SAAA,EAAW,OAAA,EAAS,KAAK,CAAA;AAE7G,QAAA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,UAKH,KAAA,EAAO,MAAM,aAAA,CAAc,SAAS,CAAA;AAAA,UACpC,MAAM,MAAM;AACR,YAAA,KAAA,CAAM,YAAA,CAAa,OAAO,SAAS,CAAA;AAGnC,YAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAM,OAAA,EAAS;AACpC,cAAA,IAAI,IAAA,CAAK,SAAS,cAAA,IAAkB,IAAA,CAAK,cAAc,SAAA,EAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,EAAE,CAAA;AAAA,YAC7F;AAAA,UACJ;AAAA,SACJ;AAAA,MACJ;AAAA,KACH,CAAA;AAED,IAAA,OAAO,KAAA,CAAM,YAAA;AAAA,EACjB;AAAA;AAAA,EAGQ,gBAAA,CAAiB,KAAA,EAAuB,YAAA,EAAsB,SAAA,EAAmB,SAAuB,KAAA,EAAqB;AACjI,IAAA,IAAI,CAAC,IAAA,CAAK,kBAAA,CAAmB,cAAc,KAAA,EAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AAClE,MAAA,OAAA,CAAQ,SAAA,CAAU,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB,KAAK,CAAC,CAAA;AACvD,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,IAAA,CAAK,oBAAA,CAAqB,YAAA,EAAc,KAAK,CAAA,EAAG;AACjD,MAAA,OAAA,CAAQ,UAAU,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB,YAAA,EAAc,KAAK,CAAC,CAAA;AACrE,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,EAAA,GAAK,YAAY,KAAK,CAAA;AAC5B,IAAA,IAAI,EAAA,KAAO,MAAA,EAAW,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,EAAE,IAAA,EAAM,cAAA,EAAgB,SAAA,EAAW,CAAA;AAE/E,IAAA,IAAA,CAAK,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,KAAA,EAAO,QAAQ,SAAS,CAAA;AAAA,EACtE;AAAA;AAAA,EAGQ,aAAA,CAAc,KAAqB,IAAA,EAAoB;AAE3D,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA;AAAA,MAAA,EAAyB,IAAI;;AAAA,CAAM,CAAA;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAA,CAAyB,SAAA,EAA+B,IAAA,EAAc,QAAA,EAAoC,OAAA,EAAwB;AACtI,IAAA,MAAM,KAAA,GAAQ;AAAA,MACV,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MAClC,YAAY,SAAA,CAAU,EAAA;AAAA,MACtB,IAAA;AAAA,MACA,UAAU,QAAA,EAAU,KAAA;AAAA,MACpB;AAAA,KACJ;AACA,IAAA,MAAM,IAAA,GAAO,CAAA,+BAAA,EAAkC,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAA;AACpE,IAAA,IAAI,OAAA,EAAS,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA;AAAA,SACzB,OAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EAC1B;AAAA,EAEQ,kBAAA,CAAmB,EAAA,EAAe,IAAA,EAAc,GAAA,EAA4B;AAChF,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,GAAG,CAAA;AACjE,IAAA,IAAI,iBAAA,EAAmB;AACnB,MAAA,IAAA,CAAK,0BAAA,CAA2B,OAAO,GAAG,CAAA;AAC1C,MAAA,IAAA,CAAK,mBAAA,CAAoB,GAAA,CAAI,EAAA,EAAI,iBAAiB,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,IAAA;AAAA,QACJ,yCAAyC,IAAI,CAAA,gHAAA;AAAA,OACjD;AACA,MAAA,EAAA,CAAG,KAAA,CAAM,IAAA,EAAM,CAAA,UAAA,EAAa,IAAI,CAAA,gCAAA,CAAkC,CAAA;AAClE,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,IAAI,CAAA,EAAG;AACnC,MAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,sCAAA,EAAyC,IAAI,CAAA,8EAAA,CAAgF,CAAA;AAC1I,MAAA,EAAA,CAAG,KAAA,CAAM,IAAA,EAAM,CAAA,UAAA,EAAa,IAAI,CAAA,2BAAA,CAA6B,CAAA;AAC7D,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AACzC,IAAA,IAAI,QAAA,EAAU,EAAA,EAAI,UAAA,KAAeH,SAAAA,CAAU,IAAA,EAAM;AAC7C,MAAA,EAAA,CAAG,KAAA,CAAM,IAAA,EAAM,CAAA,UAAA,EAAa,IAAI,CAAA,sBAAA,CAAwB,CAAA;AACxD,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,IAAI,CAAA;AACjD,IAAA,KAAA,CAAM,EAAA,GAAK,EAAA;AACX,IAAA,IAAI,iBAAA,EAAmB;AACnB,MAAA,IAAA,CAAK,wBAAA,CAAyB,mBAAmB,IAAA,EAAM,IAAA,CAAK,sBAAsB,OAAA,CAAQ,IAAI,GAAG,IAAI,CAAA;AAAA,IACzG;AAMA,IAAA,IAAI,mBAAA,GAAsB,KAAA;AAC1B,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAiB;AAC/B,MAAA,MAAM,IAAA,GAAO,KAAK,QAAA,EAAS;AAC3B,MAAA,IAAI,CAAC,mBAAA,EAAqB;AACtB,QAAA,mBAAA,GAAsB,IAAA;AACtB,QAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,IAAA,EAAM,IAAI,CAAA,EAAG;AAAA,MACjD;AACA,MAAA,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,IAC7C,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACjB,MAAA,KAAA,CAAM,EAAA,GAAK,IAAA;AACX,MAAA,IAAA,CAAK,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,IAC9C,CAAC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,sBAAA,CAAuB,MAAc,IAAA,EAAuB;AAChE,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACA,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACJ,MAAA,OAAO,KAAA;AAAA,IACX;AACA,IAAA,IAAI,MAAM,OAAA,KAAY,MAAA,IAAa,KAAA,CAAM,IAAA,KAAS,YAAY,OAAO,KAAA;AACrE,IAAA,IAAI,KAAA,CAAM,cAAc,IAAA,EAAM;AAC1B,MAAA,KAAK,IAAA,CAAK,gBAAA,EAAkB,WAAA,CAAY,IAAI,CAAA;AAAA,IAChD;AACA,IAAA,OAAO,IAAA;AAAA,EACX;AAAA,EAEQ,gBAAA,CAAiB,EAAA,EAAe,YAAA,EAAsB,GAAA,EAA4B;AACtF,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,YAAY,CAAA;AACzD,IAAA,KAAA,CAAM,SAAA,CAAU,IAAI,EAAE,CAAA;AAItB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,GAAG,CAAA;AACvD,IAAA,IAAI,SAAA,EAAW;AACX,MAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,EAAA,EAAI,SAAS,CAAA;AACxC,MAAA,IAAA,CAAK,wBAAA,CAAyB,OAAO,GAAG,CAAA;AAAA,IAC5C;AAEA,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAiB,IAAA,CAAK,gBAAA,CAAiB,EAAA,EAAI,KAAA,EAAO,YAAA,EAAc,IAAA,CAAK,QAAA,EAAU,CAAC,CAAA;AAElG,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACjB,MAAA,KAAA,CAAM,SAAA,CAAU,OAAO,EAAE,CAAA;AACzB,MAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAM,OAAA,EAAS;AACpC,QAAA,IAAI,IAAA,CAAK,SAAS,IAAA,IAAQ,IAAA,CAAK,WAAW,EAAA,EAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,EAAE,CAAA;AAAA,MACzE;AAAA,IACJ,CAAC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,2BAAA,CAA4B,IAAe,GAAA,EAA4B;AAC3E,IAAA,MAAM,aAAA,uBAAoB,GAAA,EAAY;AACtC,IAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,EAAA,EAAI,aAAa,CAAA;AAC5C,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,0BAAA,CAA2B,GAAA,CAAI,GAAG,CAAA;AACjE,IAAA,IAAI,iBAAA,EAAmB;AACnB,MAAA,IAAA,CAAK,0BAAA,CAA2B,OAAO,GAAG,CAAA;AAC1C,MAAA,IAAA,CAAK,mBAAA,CAAoB,GAAA,CAAI,EAAA,EAAI,iBAAiB,CAAA;AAAA,IACtD;AAEA,IAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAiB;AAC/B,MAAA,MAAM,QAAA,GAAW,cAAA,CAAe,IAAA,CAAK,QAAA,EAAU,CAAA;AAC/C,MAAA,IAAI,CAAC,QAAA,EAAU;AAEf,MAAA,MAAM,OAAO,QAAA,CAAS,QAAA;AAGtB,MAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1B,QAAA,IAAI,iBAAA,EAAmB;AACnB,UAAA,MAAM,QAAA,GAAW,IAAA,CAAK,qBAAA,CAAsB,OAAA,CAAQ,IAAI,CAAA;AACxD,UAAA,IAAI,CAAC,QAAA,IAAY,CAAC,kBAAA,CAAmB,iBAAA,EAAmB,QAAQ,CAAA,EAAG;AAC/D,YAAA,IAAA,CAAK,wBAAA,CAAyB,iBAAA,EAAmB,IAAA,EAAM,QAAA,EAAU,KAAK,CAAA;AACtE,YAAA,EAAA,CAAG,KAAK,mBAAA,CAAoB,IAAA,EAAM,gBAAA,CAAiB,qBAAA,EAAuB,iCAAiC,CAAC,CAAA;AAC5G,YAAA;AAAA,UACJ;AAAA,QACJ;AACA,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,UAAA,OAAA,CAAQ,IAAA;AAAA,YACJ,qDAAqD,IAAI,CAAA,gHAAA;AAAA,WAE7D;AACA,UAAA,EAAA,CAAG,IAAA,CAAK,oBAAoB,IAAA,EAAM,gBAAA,CAAiB,qBAAqB,CAAA,UAAA,EAAa,IAAI,kCAAkC,CAAC,CAAA;AAC5H,UAAA;AAAA,QACJ;AAEA,QAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,IAAI,CAAA,EAAG;AACnC,UAAA,EAAA,CAAG,IAAA,CAAK,oBAAoB,IAAA,EAAM,gBAAA,CAAiB,qBAAqB,CAAA,UAAA,EAAa,IAAI,6BAA6B,CAAC,CAAA;AACvH,UAAA;AAAA,QACJ;AAEA,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AACzC,QAAA,IAAI,QAAA,EAAU,EAAA,EAAI,UAAA,KAAeA,SAAAA,CAAU,IAAA,EAAM;AAE7C,UAAA,EAAA,CAAG,IAAA,CAAK,oBAAoB,IAAA,EAAM,gBAAA,CAAiB,qBAAqB,CAAA,UAAA,EAAa,IAAI,wBAAwB,CAAC,CAAA;AAClH,UAAA;AAAA,QACJ;AACA,QAAA,aAAA,CAAc,IAAI,IAAI,CAAA;AACtB,QAAA,MAAMI,MAAAA,GAAQ,IAAA,CAAK,yBAAA,CAA0B,IAAI,CAAA;AACjD,QAAAA,OAAM,EAAA,GAAK,EAAA;AACX,QAAA,IAAI,iBAAA,EAAmB;AACnB,UAAA,IAAA,CAAK,wBAAA,CAAyB,mBAAmB,IAAA,EAAM,IAAA,CAAK,sBAAsB,OAAA,CAAQ,IAAI,GAAG,IAAI,CAAA;AAAA,QACzG;AAAA,MACJ;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AACtC,MAAA,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,IAAA,EAAM,aAAA,CAAc,QAAQ,CAAC,CAAA;AAAA,IAChE,CAAC,CAAA;AAED,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACjB,MAAA,KAAA,MAAW,QAAQ,aAAA,EAAe;AAC9B,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AACtC,QAAA,IAAI,KAAA,IAAS,KAAA,CAAM,EAAA,KAAO,EAAA,EAAI;AAC1B,UAAA,KAAA,CAAM,EAAA,GAAK,IAAA;AACX,UAAA,IAAA,CAAK,yBAAA,CAA0B,OAAO,IAAI,CAAA;AAAA,QAC9C;AAAA,MACJ;AACA,MAAA,IAAA,CAAK,iBAAA,CAAkB,OAAO,EAAE,CAAA;AAAA,IACpC,CAAC,CAAA;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,eAAA,CAAgB,KAAA,EAAuB,YAAA,EAAsB,IAAA,EAAc,YAA+B,IAAA,EAAY;AAI1H,IAAA,IAAI,YAAA,KAAiB,eAAA,CAAgB,IAAA,IAAQ,IAAA,CAAK,gBAAA,EAAkB;AAChE,MAAA,IAAA,CAAK,gBAAA,CAAiB,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA;AAC5C,MAAA;AAAA,IACJ;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,YAAY,CAAA;AACjD,IAAA,IAAI,UAAU,MAAA,EAAQ;AAClB,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAClB,MAAA;AAAA,IACJ;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,GAAA,CAAI,YAAY,CAAA;AACzD,IAAA,IAAI,UAAU,MAAA,EAAQ;AAClB,MAAA,QAAA,CAAS,KAAK,IAAI,CAAA;AAClB,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,KAAA,CAAM,EAAA,IAAM,MAAM,EAAA,CAAG,UAAA,KAAeJ,UAAU,IAAA,EAAM;AAEzD,IAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,KAAA,CAAM,EAAE,CAAA,EAAG;AAEtC,MAAA,KAAA,CAAM,EAAA,CAAG,IAAA,CAAK,cAAA,CAAe,YAAA,EAAc,IAAI,CAAC,CAAA;AAAA,IACpD,CAAA,MAAO;AACH,MAAA,KAAA,CAAM,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,IACtB;AAAA,EACJ;AAAA,EAEQ,qBAAA,CAAsB,OAAuB,IAAA,EAAoB;AACrE,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,GAAA,EAAK,EAAA,IAAM,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAAA,IACpE,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,IAAA,CAAK,oBAAA,EAAuB,KAAK,CAAA,EAAG;AAC9D,MAAA,IAAA,CAAK,eAAA,CAAgB,KAAA,EAAO,IAAA,CAAK,oBAAA,EAAuB,IAAI,CAAA;AAAA,IAChE,CAAA,MAAO;AACH,MAAA,IAAI,KAAA,GAAgC,IAAA;AACpC,MAAA,IAAI;AACA,QAAA,KAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,CAA+B,EAAA,IAAM,IAAA;AAAA,MACjE,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAI,SAAS,IAAA,EAAM;AACf,QAAA,IAAA,CAAK,qBAAA,EAAuB,IAAA;AAAA,UACxB,KAAK,SAAA,CAAU;AAAA,YACX,OAAA,EAAS,KAAA;AAAA,YACT,EAAA,EAAI,KAAA;AAAA,YACJ,KAAA,EAAO,EAAE,IAAA,EAAM,KAAA,EAAQ,SAAS,CAAA,UAAA,EAAa,IAAA,CAAK,oBAAoB,CAAA,eAAA,CAAA;AAAkB,WAC3F;AAAA,SACL;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAAA,EAEQ,gBAAA,CAAiB,MAAA,EAAmB,KAAA,EAAuB,YAAA,EAAsB,IAAA,EAAoB;AACzG,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,IAAA;AACxD,IAAA,IAAI,CAAC,IAAA,CAAK,kBAAA,CAAmB,YAAA,EAAc,IAAA,EAAM,SAAS,CAAA,EAAG;AACzD,MAAA,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,oBAAA,CAAqB,IAAI,CAAC,CAAA;AAC3C,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC3B,MAAA,IAAI,GAAA,EAAK,EAAA,IAAM,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,EAAE,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AAAA,IACjF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,IAAA,CAAK,oBAAA,CAAqB,YAAA,EAAc,KAAK,CAAA,EAAG;AAChD,MAAA,IAAA,CAAK,eAAA,CAAgB,KAAA,EAAO,YAAA,EAAc,IAAA,EAAM,SAAS,CAAA;AAAA,IAC7D,CAAA,MAAO;AACH,MAAA,MAAA,CAAO,IAAA;AAAA,QACH,KAAK,SAAA,CAAU;AAAA,UACX,OAAA,EAAS,KAAA;AAAA,UACT,EAAA,EAAI,IAAA;AAAA,UACJ,KAAA,EAAO,EAAE,IAAA,EAAM,KAAA,EAAQ,SAAS,uBAAA;AAAwB,SAC3D;AAAA,OACL;AAAA,IACJ;AAAA,EACJ;AAAA,EAEQ,kBAAA,CAAmB,KAAA,EAAuB,YAAA,EAAsB,IAAA,EAAoB;AACxF,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE3B,MAAA,IAAI,GAAA,CAAI,MAAM,IAAA,EAAM;AAEhB,QAAA,MAAM,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,IAAI,EAAE,CAAA;AACrC,QAAA,IAAI,MAAM,IAAA,KAAS,IAAA,IAAQ,KAAK,MAAA,CAAO,UAAA,KAAeA,UAAU,IAAA,EAAM;AAClE,UAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,QACzB,CAAA,MAAA,IAAW,IAAA,EAAM,IAAA,KAAS,KAAA,EAAO;AAC7B,UAAA,MAAM,MAAA,GAAS,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,KAAK,SAAS,CAAA;AACnD,UAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,IAAI,CAAA;AAAA,QAC/C,CAAA,MAAA,IAAW,IAAA,EAAM,IAAA,KAAS,cAAA,EAAgB;AAGtC,UAAA,KAAA,CAAM,aAAa,GAAA,CAAI,IAAA,CAAK,SAAS,CAAA,EAAG,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,QAC/D,CAAA,MAAA,IAAW,IAAA,EAAM,IAAA,KAAS,OAAA,EAAS;AAC/B,UAAA,IAAA,CAAK,qBAAA,EAAuB,KAAK,IAAI,CAAA;AAAA,QACzC,CAAA,MAAA,IAAW,IAAA,EAAM,IAAA,KAAS,UAAA,EAAY;AAClC,UAAA,IAAA,CAAK,MAAA,CAAO,YAAY,IAAI,CAAA;AAAA,QAChC;AACA,QAAA,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,MAC/B,CAAA,MAAO;AAEH,QAAA,IAAA,CAAK,UAAA,CAAW,KAAA,EAAO,YAAA,EAAc,IAAI,CAAA;AAAA,MAC7C;AAAA,IACJ,CAAA,CAAA,MAAQ;AACJ,MAAA,IAAA,CAAK,UAAA,CAAW,KAAA,EAAO,YAAA,EAAc,IAAI,CAAA;AAAA,IAC7C;AAAA,EACJ;AAAA;AAAA,EAGQ,UAAA,CAAW,KAAA,EAAuB,YAAA,EAAsB,IAAA,EAAoB;AAChF,IAAA,KAAA,MAAW,MAAA,IAAU,MAAM,SAAA,EAAW;AAClC,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,IAAA;AACxD,MAAA,IAAI,MAAA,CAAO,eAAeA,SAAAA,CAAU,IAAA,IAAQ,KAAK,kBAAA,CAAmB,YAAA,EAAc,IAAA,EAAM,SAAS,CAAA,EAAG;AAChG,QAAA,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,MACpB;AAAA,IACJ;AACA,IAAA,KAAA,MAAW,MAAA,IAAU,KAAA,CAAM,WAAA,CAAY,MAAA,EAAO,EAAG;AAC7C,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,IAAA;AACxD,MAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,YAAA,EAAc,IAAA,EAAM,SAAS,CAAA,EAAG;AACxD,QAAA,IAAA,CAAK,aAAA,CAAc,QAAQ,IAAI,CAAA;AAAA,MACnC;AAAA,IACJ;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAA,CAAM,YAAA,CAAa,MAAA,EAAO,EAAG;AAI/C,MAAA,IAAI,KAAK,kBAAA,CAAmB,YAAA,EAAc,IAAA,EAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AAChE,QAAA,OAAA,CAAQ,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,MAC/B;AAAA,IACJ;AACA,IAAA,KAAA,MAAW,EAAA,IAAM,MAAM,eAAA,EAAiB;AACpC,MAAA,EAAA,CAAG,YAAY,IAAI,CAAA;AAAA,IACvB;AAEA,IAAA,IAAI,IAAA,CAAK,wBAAwB,IAAA,CAAK,UAAA,CAAW,IAAI,IAAA,CAAK,oBAAoB,MAAM,KAAA,EAAO;AACvF,MAAA,IAAA,CAAK,qBAAA,EAAuB,KAAK,IAAI,CAAA;AAAA,IACzC;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,yBAAA,CAA0B,OAAuB,IAAA,EAAoB;AAIzE,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,IAAI,CAAA,IAAK,MAAM,OAAA,EAAS;AACpC,MAAA,MAAM,KAAA,GAAQ,KAAK,SAAA,CAAU;AAAA,QACzB,OAAA,EAAS,KAAA;AAAA,QACT,EAAA;AAAA,QACA,OAAO,EAAE,IAAA,EAAM,OAAQ,OAAA,EAAS,CAAA,UAAA,EAAa,IAAI,CAAA,cAAA,CAAA;AAAiB,OACrE,CAAA;AACD,MAAA,IAAI,KAAK,IAAA,KAAS,IAAA,IAAQ,KAAK,MAAA,CAAO,UAAA,KAAeA,UAAU,IAAA,EAAM;AACjE,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,MAC1B,CAAA,MAAA,IAAW,IAAA,CAAK,IAAA,KAAS,KAAA,EAAO;AAC5B,QAAA,MAAM,MAAA,GAAS,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,KAAK,SAAS,CAAA;AACnD,QAAA,IAAI,MAAA,EAAQ,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,KAAK,CAAA;AAAA,MAChD,CAAA,MAAA,IAAW,IAAA,CAAK,IAAA,KAAS,cAAA,EAAgB;AACrC,QAAA,KAAA,CAAM,aAAa,GAAA,CAAI,IAAA,CAAK,SAAS,CAAA,EAAG,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAChE,CAAA,MAAA,IAAW,IAAA,CAAK,IAAA,KAAS,OAAA,EAAS;AAC9B,QAAA,IAAA,CAAK,qBAAA,EAAuB,KAAK,KAAK,CAAA;AAAA,MAC1C,CAAA,MAAA,IAAW,IAAA,CAAK,IAAA,KAAS,UAAA,EAAY;AACjC,QAAA,IAAA,CAAK,MAAA,CAAO,YAAY,KAAK,CAAA;AAAA,MACjC;AAAA,IACJ;AACA,IAAA,KAAA,CAAM,QAAQ,KAAA,EAAM;AACpB,IAAA,KAAA,MAAW,EAAA,IAAM,KAAA,CAAM,eAAA,EAAiB,EAAA,CAAG,OAAA,IAAU;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,oBAAA,CAAqB,cAAsB,KAAA,EAAgC;AAC/E,IAAA,IAAI,KAAK,UAAA,CAAW,GAAA,CAAI,YAAY,CAAA,EAAG,QAAQ,OAAO,IAAA;AACtD,IAAA,IAAI,KAAK,kBAAA,CAAmB,GAAA,CAAI,YAAY,CAAA,EAAG,QAAQ,OAAO,IAAA;AAC9D,IAAA,IAAI,KAAA,CAAM,EAAA,EAAI,UAAA,KAAeA,SAAAA,CAAU,MAAM,OAAO,IAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACX;AAAA;AAAA,EAGQ,0BAA0B,IAAA,EAA8B;AAC5D,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,KAAA,GAAQ;AAAA,QACJ,EAAA,EAAI,IAAA;AAAA,QACJ,OAAA,sBAAa,GAAA,EAAI;AAAA,QACjB,WAAA,sBAAiB,GAAA,EAAI;AAAA,QACrB,YAAA,sBAAkB,GAAA,EAAI;AAAA,QACtB,SAAA,sBAAe,GAAA,EAAI;AAAA,QACnB,eAAA,sBAAqB,GAAA,EAAI;AAAA,QACzB,YAAA,EAAc;AAAA,OAClB;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,KAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,GAAA,EAA2B;AACnD,IAAA,MAAM,SAAA,GAAA,CAAa,IAAA,CAAK,QAAA,CAAS,YAAA,IAAgB,EAAC,EAAG,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAA,KAAc,GAAG,CAAA;AAEpF,IAAA,IAAI,QAAkB,EAAC;AACvB,IAAA,IAAI,SAAA,EAAW;AACX,MAAA,MAAM,UAAA,GAAsB,QAAA,CAAA,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,SAAS,CAAA;AACzD,MAAA,IAAI;AACA,QAAA,IAAO,cAAW,UAAU,CAAA,IAAQ,YAAS,UAAU,CAAA,CAAE,aAAY,EAAG;AACpE,UAAA,KAAA,GAAW,EAAA,CAAA,WAAA,CAAY,UAAU,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAY,EAAA,CAAA,QAAA,CAAkB,QAAA,CAAA,IAAA,CAAK,UAAA,EAAY,IAAI,CAAC,CAAA,CAAE,QAAQ,CAAA;AAAA,QAC7G;AAAA,MACJ,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACJ;AAEA,IAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,mCAAmC,CAAA;AACxE,IAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,CAAC,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA,EAMQ,YAAA,CAAa,KAAsB,GAAA,EAA2B;AAClE,IAAA,MAAM,MAAA,GAAA,CAAU,GAAA,CAAI,GAAA,IAAO,GAAA,EAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA;AAC1D,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,CAAS,YAAA,IAAgB,EAAC;AAE9C,IAAA,MAAM,QAAQ,CAAC,GAAG,MAAM,CAAA,CACnB,MAAA,CAAO,CAAC,CAAA,KAAM;AACX,MAAA,MAAM,MAAA,GAAS,EAAE,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA,GAAI,CAAA,CAAE,SAAA,GAAY,CAAA,CAAE,SAAA,GAAY,GAAA;AACvE,MAAA,OAAO,MAAA,KAAW,CAAA,CAAE,SAAA,IAAa,MAAA,CAAO,WAAW,MAAM,CAAA;AAAA,IAC7D,CAAC,CAAA,CACA,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,MAAA,GAAS,CAAA,CAAE,SAAA,CAAU,MAAM,EAAE,CAAC,CAAA;AAE9D,IAAA,IAAI,CAAC,KAAA,EAAO;AACR,MAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,cAAc,CAAA;AACnD,MAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,MAAA;AAAA,IACJ;AAEA,IAAA,MAAMK,YAAW,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,SAAA,CAAU,MAAM,CAAA,IAAK,GAAA;AACzD,IAAA,MAAM,UAAA,GAAsB,mBAAUA,SAAQ,CAAA;AAE9C,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA,EAAG;AAC7B,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,QAAA,GAAoB,QAAA,CAAA,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AAC3C,IAAA,IAAI,QAAA,GAAoB,QAAA,CAAA,IAAA,CAAK,QAAA,EAAU,UAAU,CAAA;AAEjD,IAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,WAAoB,QAAA,CAAA,GAAG,CAAA,IAAK,aAAa,QAAA,EAAU;AACxE,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI;AACA,MAAA,IAAO,EAAA,CAAA,QAAA,CAAS,QAAQ,CAAA,CAAE,WAAA,IAAe,QAAA,GAAoB,QAAA,CAAA,IAAA,CAAK,UAAU,YAAY,CAAA;AAAA,IAC5F,CAAA,CAAA,MAAQ;AACJ,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,MAAA;AAAA,IACJ;AAEA,IAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC1B,MAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,MAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,MAAA;AAAA,IACJ;AAEA,IAAA,MAAM,GAAA,GAAe,QAAA,CAAA,OAAA,CAAQ,QAAQ,CAAA,CAAE,WAAA,EAAY;AACnD,IAAA,GAAA,CAAI,SAAA,CAAU,KAAK,EAAE,cAAA,EAAgB,KAAK,GAAG,CAAA,IAAK,4BAA4B,CAAA;AAC9E,IAAG,EAAA,CAAA,gBAAA,CAAiB,QAAQ,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,EAC1C;AACJ;AChjDO,IAAM,kBAAN,MAAsB;AAAA,EACjB,KAAA,GAAQ,GAAA;AAAA,EACR,KAAA;AAAA,EACA,aAAA,GAAgB,WAAA;AAAA,EAChB,cAAA,GAAiB,YAAA;AAAA,EACjB,WAAA,GAAc,GAAA;AAAA,EACd,QAAA,GAAW,MAAA;AAAA,EACX,aAAA,GAAgB,WAAA;AAAA,EAChB,QAAA,GAAW,MAAA;AAAA,EACX,iBAAA,GAAoB,oBAAA;AAAA,EACpB,eAAA,GAA8C,MAAA;AAAA,EAC9C,gBAAgC,EAAC;AAAA,EACjC,kBAA0C,EAAC;AAAA,EAC3C,mBAA4C,EAAC;AAAA,EAC7C,YAAA,GAAqD,MAAA;AAAA,EACrD,IAAA,GAAkD,MAAA;AAAA,EAClD,uBAAA,GAA8C,MAAA;AAAA,EAC9C,KAAA,GAAmC,MAAA;AAAA,EACnC,aAAA,GAAoD,MAAA;AAAA,EACpD,cAAA,GAAmD,MAAA;AAAA,EACnD,qBAAA,GAA2D,MAAA;AAAA;AAAA,EAGnE,SAAS,IAAA,EAAoB;AACzB,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,IAAA,EAAoB;AACzB,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAiB,IAAA,EAAoB;AACjC,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AACrB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAkB,IAAA,EAAoB;AAClC,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe,IAAA,EAAoB;AAC/B,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,IAAA,EAAoB;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAiB,IAAA,EAAoB;AACjC,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AACrB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,IAAA,EAAoB;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,IAAA,EAAoB;AACrC,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA;AACzB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,mBAAmB,OAAA,EAA+B;AAC9C,IAAA,IAAA,CAAK,eAAA,GAAkB,OAAA;AACvB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAA,CAAgB,WAAmB,GAAA,EAAmB;AAClD,IAAA,IAAA,CAAK,aAAA,CAAc,IAAA,CAAK,EAAE,SAAA,EAAW,KAAK,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,kBAAkB,MAAA,EAAoC;AAClD,IAAA,IAAA,CAAK,eAAA,CAAgB,KAAK,MAAM,CAAA;AAChC,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAmB,MAAA,EAAqC;AACpD,IAAA,IAAA,CAAK,gBAAA,CAAiB,KAAK,MAAM,CAAA;AACjC,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,gBAAgB,YAAA,EAA4B;AACxC,IAAA,IAAA,CAAK,YAAA,GAAe,EAAE,YAAA,EAAa;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,MAAc,GAAA,EAAmB;AACrC,IAAA,IAAA,CAAK,IAAA,GAAO,EAAE,IAAA,EAAM,GAAA,EAAI;AACxB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAA,CAAa,UAAkB,OAAA,EAAuB;AAClD,IAAA,OAAO,IAAA,CAAK,QAAWC,EAAA,CAAA,YAAA,CAAa,QAAA,EAAU,MAAM,CAAA,EAAMA,EAAA,CAAA,YAAA,CAAa,OAAA,EAAS,MAAM,CAAC,CAAA;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,2BAA2B,GAAA,EAAmB;AAC1C,IAAA,IAAA,CAAK,uBAAA,GAA0B,GAAA;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,IAAA,EAA2B;AAChC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,OAAA,EAAgC;AACxC,IAAA,IAAA,CAAK,KAAA,GAAQ,aAAa,OAAO,CAAA;AACjC,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA,EAGA,iBAAiB,MAAA,EAA6B;AAC1C,IAAA,IAAA,CAAK,cAAA,GAAiB,wBAAwB,MAAA,EAAQ;AAAA,MAClD,sBAAsB,IAAA,CAAK;AAAA,KAC9B,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA,EAGA,wBAAwB,MAAA,EAA0C;AAC9D,IAAA,IAAA,CAAK,cAAA,GAAiB,2BAA2B,MAAM,CAAA;AACvD,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA,EAGA,yBAAyB,QAAA,EAAuC;AAC5D,IAAA,IAAA,CAAK,qBAAA,GAAwB,QAAA;AAC7B,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAiB,aAAA,EAA6C;AAC1D,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACrB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmB,MAAA,EAAsB;AACrC,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAI,iCAAA,CAAkC,MAAM,CAAA;AACjE,IAAA,OAAO,IAAA;AAAA,EACX;AAAA;AAAA,EAGA,KAAA,GAAkB;AACd,IAAA,MAAM,iBAAA,GAAoB,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,KAAA,EAAO,aAAA;AAC7D,IAAA,MAAM,aAAA,GAAgB,iBAAA,IAAqB,IAAA,CAAK,qBAAA,GAAwB,EAAE,GAAG,iBAAA,EAAmB,oBAAA,EAAsB,IAAA,CAAK,qBAAA,EAAsB,GAAI,iBAAA;AACrJ,IAAA,MAAM,OAAA,GAA4B;AAAA,MAC9B,MAAM,IAAA,CAAK,KAAA;AAAA,MACX,MAAM,IAAA,CAAK,KAAA;AAAA,MACX,cAAc,IAAA,CAAK,aAAA;AAAA,MACnB,eAAe,IAAA,CAAK,cAAA;AAAA,MACpB,YAAY,IAAA,CAAK,WAAA;AAAA,MACjB,SAAS,IAAA,CAAK,QAAA;AAAA,MACd,cAAc,IAAA,CAAK,aAAA;AAAA,MACnB,SAAS,IAAA,CAAK,QAAA;AAAA,MACd,kBAAkB,IAAA,CAAK,iBAAA;AAAA,MACvB,gBAAgB,IAAA,CAAK,eAAA;AAAA,MACrB,YAAA,EAAc,KAAK,aAAA,CAAc,MAAA,GAAS,IAAI,CAAC,GAAG,IAAA,CAAK,aAAa,CAAA,GAAI,MAAA;AAAA,MACxE,cAAA,EAAgB,KAAK,eAAA,CAAgB,MAAA,GAAS,IAAI,CAAC,GAAG,IAAA,CAAK,eAAe,CAAA,GAAI,MAAA;AAAA,MAC9E,eAAA,EAAiB,KAAK,gBAAA,CAAiB,MAAA,GAAS,IAAI,CAAC,GAAG,IAAA,CAAK,gBAAgB,CAAA,GAAI,MAAA;AAAA,MACjF,aAAa,IAAA,CAAK,YAAA;AAAA,MAClB,KAAK,IAAA,CAAK,IAAA;AAAA,MACV,wBAAwB,IAAA,CAAK,uBAAA;AAAA,MAC7B,MAAM,IAAA,CAAK,KAAA;AAAA,MACX,cAAc,IAAA,CAAK,aAAA;AAAA,MACnB,aAAA;AAAA,MACA,sBAAsB,IAAA,CAAK,qBAAA,IAAyB,aAAA,EAAe,oBAAA,IAAwB,KAAK,KAAA,EAAO;AAAA,KAC3G;AACA,IAAA,OAAO,IAAI,SAAS,OAAO,CAAA;AAAA,EAC/B;AACJ;ACrTA,IAAM,cAAA,GAAiB,SAAA;AACvB,IAAM,wBAAA,GAA2B,QAAA;AACjC,IAAM,sBAAA,GAAyB,QAAA;AAG/B,SAAS,SAAS,GAAA,EAAqB;AAEnC,EAAA,MAAM,SAAS,IAAA,CAAK,GAAA,CAAI,GAAG,GAAA,CAAI,MAAA,GAAS,KAAK,KAAM,CAAA;AACnD,EAAA,KAAA,IAAS,MAAM,GAAA,CAAI,MAAA,GAAS,EAAA,EAAI,GAAA,IAAO,QAAQ,GAAA,EAAA,EAAO;AAClD,IAAA,IAAI,GAAA,CAAI,YAAA,CAAa,GAAG,CAAA,KAAM,gBAAgB,OAAO,GAAA;AAAA,EACzD;AACA,EAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAClF;AAOO,SAAS,SAAA,CAAU,UAAkB,OAAA,EAAuB;AAC/D,EAAA,MAAM,GAAA,GAAMC,aAAa,QAAQ,CAAA;AACjC,EAAA,MAAM,IAAA,GAAO,SAAS,GAAG,CAAA;AAEzB,EAAA,MAAM,YAAA,GAAe,GAAA,CAAI,YAAA,CAAa,IAAA,GAAO,EAAE,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,GAAA,CAAI,YAAA,CAAa,IAAA,GAAO,EAAE,CAAA;AACnD,EAAA,IAAI,gBAAA,KAAqB,UAAA,IAAc,YAAA,KAAiB,KAAA,EAAQ;AAC5D,IAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,OAAA,GAAUX,QAAQ,OAAO,CAAA;AAC/B,EAAA,SAAA,CAAU,OAAA,EAAS,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAEtC,EAAA,IAAI,GAAA,GAAM,gBAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,EAAc,CAAA,EAAA,EAAK;AACnC,IAAA,IAAI,GAAA,CAAI,YAAA,CAAa,GAAG,CAAA,KAAM,wBAAA,EAA0B;AACpD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oDAAA,EAAuD,GAAG,CAAA,CAAE,CAAA;AAAA,IAChF;AACA,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AACxC,IAAA,MAAM,cAAA,GAAiB,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AAChD,IAAA,MAAM,gBAAA,GAAmB,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AACzC,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AAC1C,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AAC5C,IAAA,MAAM,iBAAA,GAAoB,GAAA,CAAI,YAAA,CAAa,GAAA,GAAM,EAAE,CAAA;AACnD,IAAA,MAAM,IAAA,GAAO,IAAI,QAAA,CAAS,MAAA,EAAQ,MAAM,EAAA,EAAI,GAAA,GAAM,KAAK,OAAO,CAAA;AAC9D,IAAA,GAAA,IAAO,EAAA,GAAK,UAAU,QAAA,GAAW,UAAA;AAEjC,IAAA,IAAI,cAAA,KAAmB,UAAA,IAAc,gBAAA,KAAqB,UAAA,IAAc,sBAAsB,UAAA,EAAY;AACtG,MAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,IACtD;AAGA,IAAA,MAAM,MAAA,GAASA,OAAAA,CAAQ,OAAA,EAAS,IAAI,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,OAAA,EAAS,MAAM,CAAA;AACpC,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACzC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,IAAI,CAAA,CAAE,CAAA;AAAA,IAC/D;AAGA,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AACpB,MAAA,SAAA,CAAU,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACrC,MAAA;AAAA,IACJ;AAGA,IAAA,IAAI,GAAA,CAAI,YAAA,CAAa,iBAAiB,CAAA,KAAM,sBAAA,EAAwB;AAChE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IACjE;AACA,IAAA,MAAM,YAAA,GAAe,GAAA,CAAI,YAAA,CAAa,iBAAA,GAAoB,EAAE,CAAA;AAC5D,IAAA,MAAM,aAAA,GAAgB,GAAA,CAAI,YAAA,CAAa,iBAAA,GAAoB,EAAE,CAAA;AAC7D,IAAA,MAAM,SAAA,GAAY,iBAAA,GAAoB,EAAA,GAAK,YAAA,GAAe,aAAA;AAC1D,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,QAAA,CAAS,SAAA,EAAW,YAAY,cAAc,CAAA;AAErE,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,WAAW,CAAA,EAAG;AACd,MAAA,IAAA,GAAO,UAAA;AAAA,IACX,CAAA,MAAA,IAAW,WAAW,CAAA,EAAG;AACrB,MAAA,IAAA,GAAO,eAAe,UAAU,CAAA;AAAA,IACpC,CAAA,MAAO;AACH,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mCAAA,EAAsC,MAAM,CAAA,MAAA,EAAS,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAChF;AAEA,IAAA,SAAA,CAAUY,QAAQ,MAAM,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,aAAA,CAAc,QAAQ,IAAI,CAAA;AAAA,EAC9B;AACJ;;;ACnDA,SAAS,cAAc,GAAA,EAAwB;AAC3C,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACnC,IAAA,OAAO,IAAI,eAAA,CAAgB,GAAG,CAAA,CAAE,SAAA;AAAA,EACpC;AACA,EAAA,OAAO,gBAAgB,GAAG,CAAA;AAC9B;AAGA,SAAS,uBAAA,CAAwB,IAAA,EAAc,SAAA,EAAmB,SAAA,EAA+B;AAE7F,EAAA,MAAM,UAAU,SAAA,CAAU,iBAAA;AAC1B,EAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,IAAa,OAAA,KAAY,UAAU,IAAA,GAAO,QAAA;AACxE,EAAA,OAAO,MAAA,CAAO,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,SAAS,CAAA;AACvD;AAGA,SAAS,kBAAA,CAAmB,GAAA,EAAaA,QAAAA,EAAiB,UAAA,EAA6G;AACnK,EAAA,IAAI,GAAA,KAAQ,aAAa,OAAOA,QAAAA;AAChC,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAQ,OAAO,OAAA,EAAQ;AACnC,EAAA,IAAI,QAAQ,SAAA,EAAW,OAAOC,IAAAA,CAAK,OAAA,IAAW,SAAS,CAAA;AACvD,EAAA,IAAI,QAAQ,WAAA,EAAa,OAAOA,IAAAA,CAAK,OAAA,IAAW,WAAW,CAAA;AAC3D,EAAA,IAAI,QAAQ,WAAA,EAAa,OAAOA,IAAAA,CAAK,OAAA,IAAW,WAAW,CAAA;AAC3D,EAAA,IAAI,GAAA,KAAQ,eAAA,IAAmB,GAAA,KAAQ,GAAA,EAAK,OAAOnB,GAAAA;AACnD,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,cAAc,CAAA,EAAG;AAChC,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,cAAA,CAAe,MAAM,CAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,aAAa,IAAI,CAAA;AAC/B,IAAA,IAAI,UAAU,MAAA,EAAW,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,IAAI,CAAA,CAAA,CAAG,CAAA;AAC/E,IAAA,OAAO,KAAA;AAAA,EACX;AACA,EAAA,OAAO,MAAA;AACX;AAGA,SAAS,YAAA,CAAa,KAAA,EAAekB,QAAAA,EAAiB,UAAA,EAAqD;AACvG,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,gBAAA,EAAkB,CAAC,OAAO,GAAA,KAAgB;AAC3D,IAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,GAAA,EAAKA,QAAAA,EAAS,UAAU,CAAA;AACzD,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,KAAA;AAChC,IAAA,IAAI,KAAA,CAAM,QAAQ,KAAK,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,GAAG,CAAA,0CAAA,CAA4C,CAAA;AAC5G,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACvB,CAAC,CAAA;AACL;AAGA,SAAS,SAAA,CAAU,GAAA,EAAaA,QAAAA,EAAiB,UAAA,EAAuD;AACpG,EAAA,MAAM,UAAA,GAAa,8BAAA,CAA+B,IAAA,CAAK,GAAG,CAAA;AAC1D,EAAA,IAAI,UAAA,EAAY;AACZ,IAAA,MAAM,QAAQ,kBAAA,CAAmB,UAAA,CAAW,CAAC,CAAA,EAAGA,UAAS,UAAU,CAAA;AACnE,IAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,MAAM,CAAA;AACjD,IAAA,OAAO,CAAC,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,CAAC,YAAA,CAAa,GAAA,EAAKA,QAAAA,EAAS,UAAU,CAAC,CAAA;AAClD;AASA,eAAsB,cAAA,CAAe,KAAwB,OAAA,EAAuD;AAChH,EAAA,MAAME,IAAAA,GAAM,CAAA,0BAAA,EAA6B,GAAA,CAAI,IAAI,CAAA,CAAA,CAAA;AACjD,EAAA,IAAI;AACA,IAAA,MAAM,QAAA,GAAWd,OAAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,IAAI,CAAA;AAC1C,IAAA,MAAM,aAAA,GAAgBA,OAAAA,CAAQ,OAAA,EAAS,GAAA,CAAI,SAAS,CAAA;AACpD,IAAA,MAAM,aAAA,GAAgB,IAAI,SAAA,GAAYA,OAAAA,CAAQ,SAAS,GAAA,CAAI,SAAS,CAAA,GAAI,CAAA,EAAG,QAAQ,CAAA,IAAA,CAAA;AAEnF,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,CAAA,IAAK;AAAA,MACxB,CAAC,UAAU,QAAQ,CAAA;AAAA,MACnB,CAAC,cAAc,aAAa,CAAA;AAAA,MAC5B,CAAC,aAAa,aAAa;AAAA,KAC/B,EAAY;AACR,MAAA,IAAI,CAACe,UAAAA,CAAW,IAAI,CAAA,EAAG;AACnB,QAAA,OAAA,CAAQ,MAAM,CAAA,EAAGD,IAAG,KAAK,KAAK,CAAA,mBAAA,EAAsB,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAC3E,QAAA,OAAO,IAAA;AAAA,MACX;AAAA,IACJ;AAGA,IAAA,MAAM,WAAA,GAAcH,aAAa,QAAQ,CAAA;AACzC,IAAA,MAAM,cAAA,GAAiBA,aAAa,aAAa,CAAA;AACjD,IAAA,MAAM,SAAA,GAAY,aAAA,CAAcA,YAAAA,CAAa,aAAA,EAAe,MAAM,CAAC,CAAA;AACnE,IAAA,IAAI,CAAC,uBAAA,CAAwB,WAAA,EAAa,cAAA,EAAgB,SAAS,CAAA,EAAG;AAClE,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAGG,IAAG,CAAA,8EAAA,CAAgF,CAAA;AACpG,MAAA,OAAO,IAAA;AAAA,IACX;AAGA,IAAA,MAAM,YAAYd,OAAAA,CAAQ,OAAA,EAAS,QAAA,EAAU,MAAA,EAAQ,IAAI,IAAI,CAAA;AAC7D,IAAA,MAAA,CAAO,WAAW,EAAE,SAAA,EAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAClD,IAAA,SAAA,CAAU,UAAU,SAAS,CAAA;AAG7B,IAAA,MAAM,YAAA,GAAea,IAAAA,CAAK,SAAA,EAAW,eAAe,CAAA;AACpD,IAAA,IAAI,CAACE,UAAAA,CAAW,YAAY,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAGD,IAAG,CAAA,0DAAA,CAA4D,CAAA;AAChF,MAAA,OAAO,IAAA;AAAA,IACX;AACA,IAAA,MAAM,WAAW,IAAA,CAAK,KAAA,CAAMH,YAAAA,CAAa,YAAA,EAAc,MAAM,CAAC,CAAA;AAC9D,IAAA,MAAM,SAAA,GAAY,SAAS,MAAA,EAAQ,UAAA;AACnC,IAAA,IAAI,CAAC,SAAA,EAAW;AACZ,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAGG,IAAG,CAAA,oDAAA,CAAsD,CAAA;AAC1E,MAAA,OAAO,IAAA;AAAA,IACX;AAGA,IAAA,MAAM,QAAA,GAAW,SAAA,CAAU,kBAAA,GAAqB,OAAA,CAAQ,QAAQ,CAAA;AAChE,IAAA,MAAM,OAAA,GAAU,QAAA,EAAU,OAAA,IAAW,SAAA,CAAU,OAAA;AAC/C,IAAA,MAAM,OAAA,GAAU,QAAA,EAAU,IAAA,IAAQ,SAAA,CAAU,QAAQ,EAAC;AACrD,IAAA,MAAM,SAAS,EAAE,GAAG,UAAU,GAAA,EAAK,GAAG,UAAU,GAAA,EAAI;AACpD,IAAA,IAAI,CAAC,OAAA,EAAS;AACV,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAGA,IAAG,CAAA,qDAAA,CAAuD,CAAA;AAC3E,MAAA,OAAO,IAAA;AAAA,IACX;AAGA,IAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,OAAA,EAAS,SAAA,EAAW,IAAI,UAAU,CAAA;AACvE,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,OAAA,CAAQ,CAAC,GAAA,KAAQ,UAAU,GAAA,EAAK,SAAA,EAAW,GAAA,CAAI,UAAU,CAAC,CAAA;AACvF,IAAA,MAAM,cAAsC,EAAC;AAC7C,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC/C,MAAA,WAAA,CAAY,GAAG,CAAA,GAAI,YAAA,CAAa,KAAA,EAAO,SAAA,EAAW,IAAI,UAAU,CAAA;AAAA,IACpE;AAEA,IAAA,OAAO;AAAA,MACH,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,OAAA,EAAS,eAAA;AAAA,MACT,IAAA,EAAM,YAAA;AAAA,MACN,KAAK,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,CAAE,MAAA,GAAS,IAAI,WAAA,GAAc,KAAA,CAAA;AAAA,MACzD,SAAA,EAAW,IAAI,SAAA,IAAa;AAAA,KAChC;AAAA,EACJ,SAAS,GAAA,EAAK;AACV,IAAA,OAAA,CAAQ,MAAM,CAAA,EAAGA,IAAG,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,iBAAA,CAAmB,CAAA;AAClE,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;ACQO,IAAM,kBAAA,GAAqB,aAAA;AAG3B,IAAM,uBAAA,GAA0B;AAGhC,IAAM,sBAAA,GAAyB,wBAAA;AAmB/B,SAAS,iBAAiB,IAAA,EAAoC;AACjE,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,EAAI;AACxB,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAE/C,EAAA,IAAI,UAAA,GAA4B,IAAA;AAEhC,EAAA,IAAI,IAAA,EAAM;AACN,IAAA,UAAA,GAAad,OAAAA,CAAQ,KAAK,IAAI,CAAA;AAAA,EAClC,WAAW,OAAA,EAAS;AAChB,IAAA,UAAA,GAAaA,OAAAA,CAAQ,KAAK,OAAO,CAAA;AAAA,EACrC,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAASA,OAAAA,CAAQ,GAAA,EAAK,kBAAA,EAAoB,uBAAuB,CAAA;AACvE,IAAA,MAAM,MAAA,GAASA,OAAAA,CAAQ,GAAA,EAAK,sBAAsB,CAAA;AAClD,IAAA,IAAIe,UAAAA,CAAW,MAAM,CAAA,EAAG;AACpB,MAAA,UAAA,GAAa,MAAA;AAAA,IACjB,CAAA,MAAA,IAAWA,UAAAA,CAAW,MAAM,CAAA,EAAG;AAC3B,MAAA,UAAA,GAAa,MAAA;AACb,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACX,uCAAuC,MAAM,CAAA,aAAA,EAAqBf,QAAQ,GAAA,EAAK,kBAAA,EAAoB,uBAAuB,CAAC,CAAA;AAAA;AAAA,OAC/H;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,IAAI,CAAC,UAAA,IAAc,CAACe,UAAAA,CAAW,UAAU,CAAA,EAAG;AACxC,IAAA,OAAO,EAAE,MAAA,EAAQ,IAAI,OAAA,EAAS,GAAA,EAAK,YAAY,IAAA,EAAK;AAAA,EACxD;AAEA,EAAA,MAAM,OAAA,GAAUH,QAAQ,UAAU,CAAA;AAElC,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GAAMD,YAAAA,CAAa,UAAA,EAAY,OAAO,CAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,UAAA,EAAW;AAAA,EACzC,SAAS,GAAA,EAAK;AACV,IAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,4CAAA,EAA+C,UAAU,CAAA,EAAA,EAAM,IAAc,OAAO;AAAA,CAAI,CAAA;AAC7G,IAAA,OAAO,EAAE,MAAA,EAAQ,IAAI,OAAA,EAAS,GAAA,EAAK,YAAY,IAAA,EAAK;AAAA,EACxD;AACJ","file":"chunk-FTDKH2C4.js","sourcesContent":["/**\n * The CyanMycelium tunnel envelope protocol.\n *\n * A multiplexed tunnel socket carries traffic for several providers at once, so\n * every JSON-RPC message is wrapped with the name of the provider slot it\n * belongs to. Both ends of the tunnel encode and decode with the helpers here:\n * the client transports that publish a provider, and the broker that routes\n * between providers and MCP clients.\n *\n * This module is the single definition of that wire format. It is deliberately\n * dependency-free and isomorphic, so the browser side and the Node broker share\n * exactly one implementation rather than two that drift apart.\n *\n * Wire format:\n * ```json\n * { \"provider\": \"scene-1\", \"payload\": { \"jsonrpc\": \"2.0\", \"id\": 1, \"result\": {} } }\n * ```\n */\n\n/** One framed message on a multiplexed tunnel socket. */\nexport interface TunnelEnvelope {\n    /** Name of the provider slot this message belongs to. */\n    provider: string;\n\n    /** The JSON-RPC message itself, already parsed. */\n    payload: unknown;\n}\n\n/**\n * Notification a client sends to claim a provider slot as soon as the tunnel\n * opens, before any MCP client shows up.\n *\n * Without it the broker only discovers a provider name on its first real\n * message, so an MCP client connecting in between is told the provider is not\n * connected. It is a plain JSON-RPC notification, which any peer that does not\n * recognize it ignores.\n */\nexport const TUNNEL_REGISTER_METHOD = \"notifications/register\";\n\n/** JSON-RPC error codes the broker returns on the tunnel itself. */\nexport const TunnelErrorCodes = {\n    /** The slot is taken by another upstream, or the provider is not connected. */\n    ProviderUnavailable: -32000,\n\n    /** The provider's credentials do not allow publishing on this slot. */\n    RegistrationForbidden: -32001,\n} as const;\n\nexport type TunnelErrorCode = (typeof TunnelErrorCodes)[keyof typeof TunnelErrorCodes];\n\n/** A JSON-RPC error as carried inside an envelope payload. */\nexport interface TunnelError {\n    code: number;\n    message: string;\n    data?: unknown;\n}\n\n/**\n * Wraps an already-serialized JSON-RPC frame for `provider`.\n *\n * @throws SyntaxError when `frame` is not valid JSON. Callers hold a frame they\n *         just serialized, so a failure here is a bug rather than bad input.\n */\nexport function encodeEnvelope(provider: string, frame: string): string {\n    return encodeEnvelopeMessage(provider, JSON.parse(frame));\n}\n\n/** Wraps an already-parsed JSON-RPC message for `provider`. */\nexport function encodeEnvelopeMessage(provider: string, payload: unknown): string {\n    const envelope: TunnelEnvelope = { provider, payload };\n    return JSON.stringify(envelope);\n}\n\n/**\n * Parses a raw tunnel frame.\n *\n * Returns `undefined` for anything malformed rather than throwing: a tunnel\n * socket is a public surface, and a peer sending garbage must not take the\n * receiver down. Both ends drop such frames silently.\n */\nexport function decodeEnvelope(raw: string): TunnelEnvelope | undefined {\n    let parsed: unknown;\n    try {\n        parsed = JSON.parse(raw);\n    } catch {\n        return undefined;\n    }\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return undefined;\n\n    const { provider, payload } = parsed as Partial<TunnelEnvelope>;\n    if (typeof provider !== \"string\" || provider.length === 0 || payload === undefined) return undefined;\n\n    return { provider, payload };\n}\n\n/** Serializes an envelope's payload back into a plain JSON-RPC frame. */\nexport function envelopeFrame(envelope: TunnelEnvelope): string {\n    return JSON.stringify(envelope.payload);\n}\n\n/** Builds the registration notification that claims `provider`. */\nexport function encodeRegisterEnvelope(provider: string): string {\n    return encodeEnvelopeMessage(provider, { jsonrpc: \"2.0\", method: TUNNEL_REGISTER_METHOD });\n}\n\n/**\n * Builds the error envelope the broker returns when it refuses a slot.\n *\n * The id is `null` because the refusal answers no particular request: it\n * reacts to the registration itself.\n */\nexport function encodeErrorEnvelope(provider: string, code: TunnelErrorCode | number, message: string): string {\n    return encodeEnvelopeMessage(provider, { jsonrpc: \"2.0\", id: null, error: { code, message } });\n}\n\n/**\n * Reads the JSON-RPC error out of an envelope payload, when there is one.\n *\n * Lets the client side notice a refused registration instead of handing an\n * `id: null` error frame to an MCP server, which would classify it as an\n * unknown notification and drop it without a word.\n */\nexport function tunnelErrorOf(payload: unknown): TunnelError | undefined {\n    if (typeof payload !== \"object\" || payload === null) return undefined;\n\n    const { error } = payload as { error?: unknown };\n    if (typeof error !== \"object\" || error === null) return undefined;\n\n    const { code, message } = error as Partial<TunnelError>;\n    if (typeof code !== \"number\" || typeof message !== \"string\") return undefined;\n\n    return error as TunnelError;\n}\n","import { spawn, ChildProcess } from \"node:child_process\";\nimport type { IUpstream } from \"./upstream\";\n\n// ---------------------------------------------------------------------------\n// Configuration\n// ---------------------------------------------------------------------------\n\nexport interface IStdioUpstreamConfig {\n    /** Logical name of this provider (matched against incoming WebSocket provider names). */\n    name: string;\n    /** Executable to spawn (e.g. `\"node\"`, `\"python\"`, an absolute path). */\n    command: string;\n    /** Arguments passed to the command. */\n    args?: string[];\n    /** Extra environment variables merged with `process.env`. */\n    env?: NodeJS.ProcessEnv;\n    /** When `true`, this upstream joins the `_all` aggregate slot once connected. */\n    aggregate?: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// StdioUpstream\n// ---------------------------------------------------------------------------\n\n/**\n * Manages a stdio-based MCP server process.\n * JSON-RPC messages are exchanged over the child process stdin/stdout using\n * newline-delimited framing (matching the MCP SDK stdio transport).\n *\n * One instance per configured provider. The broker uses this to bridge\n * WebSocket/SSE/HTTP clients to local MCP server processes.\n */\nexport class StdioUpstream implements IUpstream {\n    readonly name: string;\n\n    private readonly _config: IStdioUpstreamConfig;\n    private _proc: ChildProcess | null = null;\n    private _buffer = \"\";\n    private _open = false;\n    private _stopped = false;\n\n    /** Called when a complete JSON-RPC line arrives from the process stdout. */\n    onMessage: ((data: string) => void) | null = null;\n\n    /** Called when the process has started and stdin is writable. */\n    onOpen: (() => void) | null = null;\n\n    /** Called when the process exits (cleanly or otherwise). */\n    onClose: (() => void) | null = null;\n\n    /** Called on spawn or runtime errors. */\n    onError: ((error: Error) => void) | null = null;\n\n    constructor(config: IStdioUpstreamConfig) {\n        this.name = config.name;\n        this._config = config;\n    }\n\n    get isOpen(): boolean {\n        return this._open;\n    }\n\n    /** Spawns the child process and wires up stdio listeners. */\n    connect(): void {\n        this._stopped = false;\n        const { command, args = [], env } = this._config;\n\n        this._proc = spawn(command, args, {\n            env: { ...process.env, ...env },\n            stdio: [\"pipe\", \"pipe\", \"inherit\"],\n        });\n\n        this._proc.on(\"error\", (err: Error) => {\n            this._open = false;\n            this.onError?.(new Error(`StdioUpstream \"${this.name}\": process error, ${err.message}`));\n        });\n\n        this._proc.on(\"spawn\", () => {\n            this._open = true;\n            this.onOpen?.();\n        });\n\n        this._proc.stdout!.on(\"data\", (chunk: Buffer) => {\n            this._buffer += chunk.toString(\"utf8\");\n            let nl: number;\n            while ((nl = this._buffer.indexOf(\"\\n\")) !== -1) {\n                const line = this._buffer.slice(0, nl).trim();\n                this._buffer = this._buffer.slice(nl + 1);\n                if (line) this.onMessage?.(line);\n            }\n        });\n\n        this._proc.on(\"close\", (code) => {\n            this._open = false;\n            this._proc = null;\n            this.onClose?.();\n            if (!this._stopped) {\n                this.onError?.(new Error(`StdioUpstream \"${this.name}\": process exited with code ${code ?? \"null\"}`));\n            }\n        });\n    }\n\n    /** Sends a JSON-RPC message to the process stdin (appends newline). */\n    send(data: string): void {\n        if (!this._open || !this._proc?.stdin?.writable) return;\n        this._proc.stdin.write(data + \"\\n\", \"utf8\");\n    }\n\n    /** Kills the child process and prevents further reconnection attempts. */\n    close(): void {\n        this._stopped = true;\n        this._open = false;\n        this._proc?.stdin?.end();\n        this._proc?.kill();\n        this._proc = null;\n    }\n}\n\n/** @deprecated Use {@link IStdioUpstreamConfig}. */\nexport type StdioUpstreamConfig = IStdioUpstreamConfig;\n","/**\n * Hand-rolled client transports for reaching a remote MCP server by URL.\n *\n * No `@modelcontextprotocol/sdk` dependency: the broker stays SDK-free, the\n * official SDK is only used outside the broker (in the demo) to prove the\n * broker is implementation-agnostic. Each transport is a thin frame relay ,\n * it does not interpret MCP, it pipes JSON-RPC strings both ways.\n */\nimport * as http from \"node:http\";\nimport * as https from \"node:https\";\nimport type { ClientRequest, IncomingMessage, RequestOptions } from \"node:http\";\nimport { WebSocket } from \"ws\";\n\n/** Lifecycle + callbacks shared by every remote client transport. */\nexport interface IRemoteTransport {\n    onMessage: ((data: string) => void) | null;\n    onOpen: (() => void) | null;\n    onClose: (() => void) | null;\n    onError: ((error: Error) => void) | null;\n    connect(): void;\n    send(data: string): void;\n    close(): void;\n}\n\n/** The three supported remote transports. */\nexport type RemoteTransportKind = \"streamable-http\" | \"sse\" | \"websocket\";\n\n/** Issues an http/https request, picking the module from the URL scheme. */\nfunction makeRequest(url: URL, options: RequestOptions, onResponse: (res: IncomingMessage) => void): ClientRequest {\n    return url.protocol === \"https:\" ? https.request(url, options, onResponse) : http.request(url, options, onResponse);\n}\n\n/**\n * Incremental Server-Sent-Events decoder. Normalizes line endings, buffers\n * across chunks, and emits one `(event, data)` pair per complete SSE block.\n */\nclass SseDecoder {\n    private _buf = \"\";\n\n    feed(chunk: string, emit: (event: string, data: string) => void): void {\n        this._buf += chunk.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n        let sep: number;\n        while ((sep = this._buf.indexOf(\"\\n\\n\")) !== -1) {\n            const block = this._buf.slice(0, sep);\n            this._buf = this._buf.slice(sep + 2);\n            let event = \"message\";\n            const data: string[] = [];\n            for (const line of block.split(\"\\n\")) {\n                if (line.startsWith(\":\")) continue; // comment\n                const colon = line.indexOf(\":\");\n                const field = colon === -1 ? line : line.slice(0, colon);\n                let value = colon === -1 ? \"\" : line.slice(colon + 1);\n                if (value.startsWith(\" \")) value = value.slice(1);\n                if (field === \"event\") event = value;\n                else if (field === \"data\") data.push(value);\n            }\n            if (data.length > 0) emit(event, data.join(\"\\n\"));\n        }\n    }\n}\n\n// ---------------------------------------------------------------------------\n// WebSocket\n// ---------------------------------------------------------------------------\n\nclass WebSocketRemoteTransport implements IRemoteTransport {\n    onMessage: ((data: string) => void) | null = null;\n    onOpen: (() => void) | null = null;\n    onClose: (() => void) | null = null;\n    onError: ((error: Error) => void) | null = null;\n\n    private _ws: WebSocket | null = null;\n\n    constructor(\n        private readonly _url: string,\n        private readonly _headers: Record<string, string>\n    ) {}\n\n    connect(): void {\n        const ws = new WebSocket(this._url, { headers: this._headers });\n        this._ws = ws;\n        ws.on(\"open\", () => this.onOpen?.());\n        ws.on(\"message\", (data: Buffer) => this.onMessage?.(data.toString(\"utf8\")));\n        ws.on(\"close\", () => this.onClose?.());\n        ws.on(\"error\", (err: Error) => this.onError?.(err));\n    }\n\n    send(data: string): void {\n        if (this._ws && this._ws.readyState === WebSocket.OPEN) this._ws.send(data);\n    }\n\n    close(): void {\n        this._ws?.close();\n        this._ws = null;\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Legacy MCP SSE (GET event stream + POST message endpoint)\n// ---------------------------------------------------------------------------\n\nclass SseRemoteTransport implements IRemoteTransport {\n    onMessage: ((data: string) => void) | null = null;\n    onOpen: (() => void) | null = null;\n    onClose: (() => void) | null = null;\n    onError: ((error: Error) => void) | null = null;\n\n    private readonly _decoder = new SseDecoder();\n    private _streamReq: ClientRequest | null = null;\n    private _postUrl: string | null = null;\n    private _closed = false;\n\n    constructor(\n        private readonly _url: string,\n        private readonly _headers: Record<string, string>\n    ) {}\n\n    connect(): void {\n        const req = makeRequest(new URL(this._url), { method: \"GET\", headers: { ...this._headers, Accept: \"text/event-stream\" } }, (res) => {\n            const status = res.statusCode ?? 0;\n            if (status >= 400) {\n                this.onError?.(new Error(`SSE GET responded ${status}`));\n                res.resume();\n                return;\n            }\n            res.setEncoding(\"utf8\");\n            res.on(\"data\", (chunk: string) => this._decoder.feed(chunk, (ev, data) => this._onEvent(ev, data)));\n            res.on(\"end\", () => {\n                if (!this._closed) this.onClose?.();\n            });\n        });\n        this._streamReq = req;\n        req.on(\"error\", (err: Error) => {\n            if (!this._closed) this.onError?.(err);\n        });\n        req.end();\n    }\n\n    private _onEvent(event: string, data: string): void {\n        if (event === \"endpoint\") {\n            this._postUrl = new URL(data, this._url).toString();\n            this.onOpen?.();\n        } else if (event === \"message\") {\n            this.onMessage?.(data);\n        }\n    }\n\n    send(data: string): void {\n        if (!this._postUrl) return;\n        const req = makeRequest(new URL(this._postUrl), { method: \"POST\", headers: { ...this._headers, \"Content-Type\": \"application/json\" } }, (res) => res.resume());\n        req.on(\"error\", (err: Error) => this.onError?.(err));\n        req.end(data);\n    }\n\n    close(): void {\n        this._closed = true;\n        this._streamReq?.destroy();\n        this._streamReq = null;\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Streamable HTTP (MCP 2025-03-26)\n// ---------------------------------------------------------------------------\n\nclass StreamableHttpRemoteTransport implements IRemoteTransport {\n    onMessage: ((data: string) => void) | null = null;\n    onOpen: (() => void) | null = null;\n    onClose: (() => void) | null = null;\n    onError: ((error: Error) => void) | null = null;\n\n    private _sessionId: string | null = null;\n    private _streamReq: ClientRequest | null = null;\n    private _closed = false;\n\n    constructor(\n        private readonly _url: string,\n        private readonly _headers: Record<string, string>\n    ) {}\n\n    connect(): void {\n        // Streamable HTTP is stateless, there is no connection to open. The\n        // transport is usable as soon as connect() is called; the session id\n        // is captured later from the first response that carries one.\n        this._closed = false;\n        this.onOpen?.();\n    }\n\n    send(data: string): void {\n        if (this._closed) return;\n        const headers: Record<string, string> = {\n            ...this._headers,\n            \"Content-Type\": \"application/json\",\n            Accept: \"application/json, text/event-stream\",\n        };\n        if (this._sessionId) headers[\"Mcp-Session-Id\"] = this._sessionId;\n        const req = makeRequest(new URL(this._url), { method: \"POST\", headers }, (res) => this._handleResponse(res));\n        req.on(\"error\", (err: Error) => {\n            if (!this._closed) this.onError?.(err);\n        });\n        req.end(data);\n    }\n\n    private _handleResponse(res: IncomingMessage): void {\n        const sid = res.headers[\"mcp-session-id\"];\n        if (typeof sid === \"string\" && sid.length > 0 && sid !== this._sessionId) {\n            this._sessionId = sid;\n            this._openServerStream();\n        }\n        const status = res.statusCode ?? 0;\n        if (status === 202) {\n            res.resume();\n            return;\n        }\n        if (status >= 400) {\n            this.onError?.(new Error(`Streamable HTTP POST responded ${status}`));\n            res.resume();\n            return;\n        }\n        res.setEncoding(\"utf8\");\n        if (String(res.headers[\"content-type\"] ?? \"\").includes(\"text/event-stream\")) {\n            const decoder = new SseDecoder();\n            res.on(\"data\", (chunk: string) =>\n                decoder.feed(chunk, (ev, data) => {\n                    if (ev === \"message\") this.onMessage?.(data);\n                })\n            );\n        } else {\n            let body = \"\";\n            res.on(\"data\", (chunk: string) => {\n                body += chunk;\n            });\n            res.on(\"end\", () => this._emitJsonBody(body));\n        }\n    }\n\n    private _emitJsonBody(body: string): void {\n        const trimmed = body.trim();\n        if (!trimmed) return;\n        try {\n            const parsed: unknown = JSON.parse(trimmed);\n            if (Array.isArray(parsed)) {\n                for (const message of parsed) this.onMessage?.(JSON.stringify(message));\n                return;\n            }\n        } catch {\n            /* not JSON, forward verbatim */\n        }\n        this.onMessage?.(trimmed);\n    }\n\n    /** Opens the optional standalone GET stream for server-initiated messages. */\n    private _openServerStream(): void {\n        if (this._closed || this._streamReq) return;\n        const headers: Record<string, string> = { ...this._headers, Accept: \"text/event-stream\" };\n        if (this._sessionId) headers[\"Mcp-Session-Id\"] = this._sessionId;\n        const req = makeRequest(new URL(this._url), { method: \"GET\", headers }, (res) => {\n            if ((res.statusCode ?? 0) >= 400) {\n                // The server may not support the standalone GET stream (405). Fine.\n                res.resume();\n                this._streamReq = null;\n                return;\n            }\n            const decoder = new SseDecoder();\n            res.setEncoding(\"utf8\");\n            res.on(\"data\", (chunk: string) =>\n                decoder.feed(chunk, (ev, data) => {\n                    if (ev === \"message\") this.onMessage?.(data);\n                })\n            );\n            res.on(\"end\", () => {\n                this._streamReq = null;\n            });\n        });\n        this._streamReq = req;\n        req.on(\"error\", () => {\n            this._streamReq = null;\n        });\n        req.end();\n    }\n\n    close(): void {\n        this._closed = true;\n        this._streamReq?.destroy();\n        this._streamReq = null;\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/** Builds the transport of the given kind. */\nexport function createRemoteTransport(url: string, kind: RemoteTransportKind, headers: Record<string, string>): IRemoteTransport {\n    switch (kind) {\n        case \"websocket\":\n            return new WebSocketRemoteTransport(url, headers);\n        case \"sse\":\n            return new SseRemoteTransport(url, headers);\n        case \"streamable-http\":\n            return new StreamableHttpRemoteTransport(url, headers);\n    }\n}\n\n/** @deprecated Use {@link IRemoteTransport}. */\nexport type RemoteTransport = IRemoteTransport;\n\n/** Heuristic transport detection from the URL when none is configured. */\nexport function detectTransport(url: string): RemoteTransportKind {\n    let parsed: URL;\n    try {\n        parsed = new URL(url);\n    } catch {\n        return \"streamable-http\";\n    }\n    if (parsed.protocol === \"ws:\" || parsed.protocol === \"wss:\") return \"websocket\";\n    if (parsed.pathname.replace(/\\/+$/, \"\").endsWith(\"/sse\")) return \"sse\";\n    return \"streamable-http\";\n}\n","import type { IUpstream } from \"./upstream\";\nimport { createRemoteTransport, detectTransport, type IRemoteTransport, type RemoteTransportKind } from \"./remote.transports\";\n\nexport interface IRemoteUpstreamConfig {\n    /** Provider slot name this upstream is bound to. */\n    name: string;\n    /** URL of the remote MCP server. */\n    url: string;\n    /** Transport to use. Auto-detected from the URL scheme/path when omitted. */\n    transport?: RemoteTransportKind;\n    /** Extra HTTP / WebSocket headers (e.g. an `Authorization` header). */\n    headers?: Record<string, string>;\n    /** When `true`, this upstream joins the `_all` aggregate slot once connected. */\n    aggregate?: boolean;\n}\n\n/**\n * Bridges a remote MCP server (reachable by URL) into a broker provider slot.\n *\n * The broker-facing contract is identical to {@link StdioUpstream}: the broker\n * muxes the slot's clients onto this single upstream. The only difference is\n * the transport, Streamable HTTP / SSE / WebSocket instead of a child process.\n */\nexport class RemoteUpstream implements IUpstream {\n    readonly name: string;\n\n    onMessage: ((data: string) => void) | null = null;\n    onOpen: (() => void) | null = null;\n    onClose: (() => void) | null = null;\n    onError: ((error: Error) => void) | null = null;\n\n    private readonly _config: IRemoteUpstreamConfig;\n    private _transport: IRemoteTransport | null = null;\n    private _open = false;\n\n    constructor(config: IRemoteUpstreamConfig) {\n        this.name = config.name;\n        this._config = config;\n    }\n\n    get isOpen(): boolean {\n        return this._open;\n    }\n\n    connect(): void {\n        const kind = this._config.transport ?? detectTransport(this._config.url);\n        const transport = createRemoteTransport(this._config.url, kind, this._config.headers ?? {});\n        this._transport = transport;\n\n        transport.onOpen = (): void => {\n            this._open = true;\n            this.onOpen?.();\n        };\n        transport.onMessage = (data: string): void => this.onMessage?.(data);\n        transport.onClose = (): void => {\n            this._open = false;\n            this.onClose?.();\n        };\n        transport.onError = (err: Error): void => {\n            this.onError?.(new Error(`RemoteUpstream \"${this.name}\": ${err.message}`));\n        };\n\n        transport.connect();\n    }\n\n    send(data: string): void {\n        this._transport?.send(data);\n    }\n\n    close(): void {\n        this._open = false;\n        this._transport?.close();\n        this._transport = null;\n    }\n}\n\n/** @deprecated Use {@link IRemoteUpstreamConfig}. */\nexport type RemoteUpstreamConfig = IRemoteUpstreamConfig;\n","import { McpAdapterBase, McpToolResults } from \"@cyanmycelium/mcp-core\";\nimport type { McpResourceContent, McpToolResult } from \"@cyanmycelium/mcp-core\";\nimport type { IBrokerContext } from \"../broker.context\";\n\n/** URI of the static resource backing the `broker_info` snapshot. */\nexport const BROKER_INFO_URI = \"broker://info\";\n\n/**\n * Read-only adapter that produces a snapshot of the broker's identity and\n * configuration. Backed by the live {@link IBrokerContext}.\n */\nexport class BrokerInfoAdapter extends McpAdapterBase {\n    constructor(private readonly _context: IBrokerContext) {\n        super(\"broker\");\n    }\n\n    public async readResourceAsync(uri: string): Promise<McpResourceContent | undefined> {\n        if (uri !== BROKER_INFO_URI) return undefined;\n        return {\n            uri,\n            mimeType: \"application/json\",\n            text: JSON.stringify(this._snapshot()),\n        };\n    }\n\n    public async executeToolAsync(_uri: string, toolName: string, _args: Record<string, unknown>): Promise<McpToolResult> {\n        if (toolName !== \"broker_info\") {\n            return McpToolResults.error(`Unknown tool: ${toolName}`);\n        }\n        return McpToolResults.json(this._snapshot());\n    }\n\n    private _snapshot() {\n        const c = this._context;\n        return {\n            name: c.name,\n            version: c.version,\n            startedAt: c.startedAt?.toISOString() ?? null,\n            uptimeSeconds: c.uptimeSeconds,\n            host: c.host ?? \"0.0.0.0\",\n            port: c.port,\n            tls: c.tls,\n            paths: c.paths,\n        };\n    }\n}\n","import { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { McpGrammar } from \"@cyanmycelium/mcp-core\";\n\n// ---------------------------------------------------------------------------\n// Open string types, extensibility by convention\n// ---------------------------------------------------------------------------\n\n/**\n * Locale identifier used to look up a grammar JSON file under\n * `<userAgent>/<locale>.json`. Open string: a host application can use any\n * value its grammar resources support.\n *\n * The broker registers each `(userAgent, locale)` pair found on disk as a\n * separate `McpGrammar` keyed by {@link brokerGrammarKey}. The actual\n * resolution of \"which key to use for this session\" is delegated to\n * `@cyanmycelium/mcp-core@0.3.0`'s `grammarResolverFromOptions`, which\n * handles BCP-47 narrowing (`fr-CA` → `fr` → `en`), agent-family fallback,\n * and the optional version dimension natively.\n */\nexport type BrokerLocale = string;\n\n/**\n * User-agent family identifier used to look up a grammar JSON file under\n * `<userAgent>/<locale>.json`. Open string. Conventional values follow\n * the defaults emitted by `grammarResolverFromOptions`: `claude`, `gpt`,\n * `mistral`, `copilot`, plus the universal `default`. Custom families\n * are supported by passing a custom `agents` map in\n * `IStartBrokerServerOptions.grammarResolverOptions`.\n */\nexport type BrokerUserAgent = string;\n\n// ---------------------------------------------------------------------------\n// Canonical grammar key\n// ---------------------------------------------------------------------------\n\n/**\n * Builds the canonical grammar key for the `(userAgent, locale, version?)`\n * matrix the broker registers on disk.\n *\n * Pattern:\n *   - `\"<userAgent>:<locale>\"` (no version), e.g. `\"claude:fr\"`, `\"default:en\"`\n *   - `\"<userAgent>:<locale>@<version>\"` (versioned), e.g. `\"claude:fr@v2\"`\n *\n * The colon separator is reserved for the `<ua>:<locale>` composition; the\n * `@` separator is reserved for the optional version suffix. Neither\n * character is allowed inside the identifier segments. This matches the\n * default `composeKey` of `grammarResolverFromOptions` exactly, so a\n * broker-loaded grammar at `claude/fr@v2.json` is automatically picked up\n * when a Claude session resolves to the `claude:fr@v2` candidate.\n */\nexport function brokerGrammarKey(userAgent: BrokerUserAgent, locale: BrokerLocale, version?: string): string {\n    const base = `${userAgent}:${locale}`;\n    return version ? `${base}@${version}` : base;\n}\n\n/**\n * Parses a grammar JSON filename of the form `<locale>.json` or\n * `<locale>@<version>.json` (without the `.json` suffix) into its\n * components. The first `@` (if any) separates locale from version; any\n * additional `@` is folded into the version string.\n *\n * Returns `null` when the input cannot be split into a usable locale.\n */\nexport function parseBrokerGrammarStem(stem: string): { locale: BrokerLocale; version?: string } | null {\n    const at = stem.indexOf(\"@\");\n    if (at < 0) return stem.length > 0 ? { locale: stem } : null;\n    const locale = stem.slice(0, at);\n    const version = stem.slice(at + 1);\n    if (locale.length === 0 || version.length === 0) return null;\n    return { locale, version };\n}\n\n// ---------------------------------------------------------------------------\n// JSON resource loading\n// ---------------------------------------------------------------------------\n\n/**\n * Absolute path of the directory holding the grammar JSON resources.\n *\n * Layout (one folder per user-agent family, one JSON file per locale):\n * ```\n * <GRAMMARS_DIR>/\n * ├── default/\n * │   ├── en.json\n * │   ├── fr.json\n * │   └── zh.json\n * └── claude/\n *     ├── en.json\n *     └── fr.json\n * ```\n *\n * JSON files live alongside this module in `src/broker/grammars/` during\n * development and are mirrored under `dist/broker/grammars/` at build time\n * by `scripts/copy-assets.mjs`. Adding a new `(userAgent, locale)` pair is\n * just a matter of dropping a new JSON file: no code change required.\n */\nconst GRAMMARS_DIR = join(dirname(fileURLToPath(import.meta.url)), \"grammars\");\n\nconst _cache = new Map<string, McpGrammar>();\n\n/**\n * Loads and caches the grammar for a given `(userAgent, locale, version?)`\n * combination. Returns `undefined` (instead of throwing) when the resource\n * file is missing, so the caller can implement a fallback chain.\n *\n * Filename convention on disk:\n *   - `<userAgent>/<locale>.json` (no version)\n *   - `<userAgent>/<locale>@<version>.json` (versioned)\n */\nexport function loadBrokerGrammar(userAgent: BrokerUserAgent, locale: BrokerLocale, version?: string): McpGrammar | undefined {\n    const key = brokerGrammarKey(userAgent, locale, version);\n    const cached = _cache.get(key);\n    if (cached) return cached;\n\n    const filename = version ? `${locale}@${version}.json` : `${locale}.json`;\n    const path = join(GRAMMARS_DIR, userAgent, filename);\n    if (!existsSync(path)) return undefined;\n\n    const raw = readFileSync(path, \"utf-8\");\n    const data = JSON.parse(raw);\n    const grammar = McpGrammar.fromJSON(data);\n    _cache.set(key, grammar);\n    return grammar;\n}\n\n/**\n * Walks a grammars directory and yields every `(userAgent, locale)` pair\n * found on disk. The directory must follow the layout\n * `<dir>/<userAgent>/<locale>.json`.\n *\n * Used by the broker server at startup to bulk-register both the packaged\n * grammars and any local overrides. No hard-coded list of supported\n * user-agents or locales, adding a new grammar is dropping a JSON file.\n */\nexport interface IBrokerGrammarEntry {\n    userAgent: BrokerUserAgent;\n    locale: BrokerLocale;\n    /** Set only for filenames carrying an `@<version>` suffix. */\n    version?: string;\n    /** Composed via {@link brokerGrammarKey} from the three segments above. */\n    key: string;\n    grammar: McpGrammar;\n}\n\nexport function* iterBrokerGrammarsFrom(grammarsDir: string): Generator<IBrokerGrammarEntry> {\n    if (!existsSync(grammarsDir)) return;\n\n    const userAgents = readdirSync(grammarsDir).sort();\n    for (const userAgent of userAgents) {\n        const uaDir = join(grammarsDir, userAgent);\n        if (!statSync(uaDir).isDirectory()) continue;\n\n        const files = readdirSync(uaDir).sort();\n        for (const file of files) {\n            if (!file.endsWith(\".json\")) continue;\n            const stem = file.slice(0, -\".json\".length);\n            const parsed = parseBrokerGrammarStem(stem);\n            if (!parsed) {\n                process.stderr.write(`[mcp-broker] Skipping unparseable grammar filename ${file} in ${uaDir}\\n`);\n                continue;\n            }\n            const { locale, version } = parsed;\n            const path = join(uaDir, file);\n            try {\n                const raw = readFileSync(path, \"utf-8\");\n                const data = JSON.parse(raw);\n                const grammar = McpGrammar.fromJSON(data);\n                yield {\n                    userAgent,\n                    locale,\n                    version,\n                    key: brokerGrammarKey(userAgent, locale, version),\n                    grammar,\n                };\n            } catch (err) {\n                process.stderr.write(`[mcp-broker] Failed to load grammar ${path}: ${(err as Error).message}\\n`);\n            }\n        }\n    }\n}\n\n/**\n * Walks the **packaged** grammars directory (the one shipped with the\n * mcp-broker package). Equivalent to `iterBrokerGrammarsFrom(<packaged-dir>)`.\n *\n * For local user overrides, see {@link iterBrokerGrammarsFrom} with a custom\n * directory, typically `.mcp-broker/grammars/` next to the config file.\n */\nexport function* iterAvailableBrokerGrammars(): Generator<IBrokerGrammarEntry> {\n    yield* iterBrokerGrammarsFrom(GRAMMARS_DIR);\n}\n\n/** @deprecated Use {@link IBrokerGrammarEntry}. */\nexport type BrokerGrammarEntry = IBrokerGrammarEntry;\n\n// ---------------------------------------------------------------------------\n// Baseline helpers (used by behaviors to source their inline descriptions)\n// ---------------------------------------------------------------------------\n\n/**\n * Returns the baseline grammar used by the broker behaviors as their\n * source-of-truth for inline tool / property descriptions.\n *\n * Conventionally this is `default:en`. Session-specific grammars selected by\n * the resolver override individual entries on top of this baseline.\n *\n * Throws if the JSON resource is missing: the broker behaviors cannot be\n * built without baseline descriptions.\n */\nexport function brokerBaselineGrammar(): McpGrammar {\n    const g = loadBrokerGrammar(\"default\", \"en\");\n    if (!g) {\n        throw new Error(`Required baseline broker grammar \"default:en\" is missing, expected at ${join(GRAMMARS_DIR, \"default\", \"en.json\")}.`);\n    }\n    return g;\n}\n\n/**\n * Convenience accessor for a baseline tool description. Throws when the\n * tool is not listed in the baseline grammar, i.e. the JSON file is missing\n * an entry for a tool the code knows about.\n */\nexport function brokerBaselineToolDescription(toolName: string): string {\n    const desc = brokerBaselineGrammar().getToolDescription(toolName);\n    if (!desc) {\n        throw new Error(`Missing baseline description for tool \"${toolName}\" in default/en.json.`);\n    }\n    return desc;\n}\n\n/**\n * Convenience accessor for a baseline property description. Throws when the\n * property is not listed under the tool in the baseline grammar.\n */\nexport function brokerBaselinePropertyDescription(toolName: string, propertyName: string): string {\n    const desc = brokerBaselineGrammar().getPropertyDescription(toolName, propertyName);\n    if (!desc) {\n        throw new Error(`Missing baseline description for property \"${propertyName}\" of tool \"${toolName}\" in default/en.json.`);\n    }\n    return desc;\n}\n\n/**\n * Convenience accessor for a baseline resource name. Throws when the resource\n * URI has no entry in the baseline grammar.\n */\nexport function brokerBaselineResourceName(uri: string): string {\n    const name = brokerBaselineGrammar().getResourceName(uri);\n    if (!name) {\n        throw new Error(`Missing baseline name for resource \"${uri}\" in default/en.json.`);\n    }\n    return name;\n}\n\n/**\n * Convenience accessor for a baseline resource description. Throws when the\n * resource URI has no entry in the baseline grammar.\n */\nexport function brokerBaselineResourceDescription(uri: string): string {\n    const desc = brokerBaselineGrammar().getResourceDescription(uri);\n    if (!desc) {\n        throw new Error(`Missing baseline description for resource \"${uri}\" in default/en.json.`);\n    }\n    return desc;\n}\n\n/**\n * Convenience accessor for a baseline resource template name. Throws when the\n * template URI has no entry in the baseline grammar.\n */\nexport function brokerBaselineResourceTemplateName(uriTemplate: string): string {\n    const name = brokerBaselineGrammar().getResourceTemplateName(uriTemplate);\n    if (!name) {\n        throw new Error(`Missing baseline name for resource template \"${uriTemplate}\" in default/en.json.`);\n    }\n    return name;\n}\n\n/**\n * Convenience accessor for a baseline resource template description. Throws\n * when the template URI has no entry in the baseline grammar.\n */\nexport function brokerBaselineResourceTemplateDescription(uriTemplate: string): string {\n    const desc = brokerBaselineGrammar().getResourceTemplateDescription(uriTemplate);\n    if (!desc) {\n        throw new Error(`Missing baseline description for resource template \"${uriTemplate}\" in default/en.json.`);\n    }\n    return desc;\n}\n","import { McpBehavior } from \"@cyanmycelium/mcp-core\";\nimport type { McpResource, McpTool } from \"@cyanmycelium/mcp-core\";\nimport { BROKER_INFO_URI, BrokerInfoAdapter } from \"../adapters/broker.adapter.info\";\nimport { brokerBaselineResourceDescription, brokerBaselineResourceName, brokerBaselineToolDescription } from \"../broker.grammars\";\nimport type { IBrokerContext } from \"../broker.context\";\n\n/**\n * Exposes basic broker identity (name, version, uptime, listening config) as\n * one tool (`broker_info`) and one resource (`broker://info`).\n *\n * An MCP agent typically calls `broker_info` first to learn who it is talking to.\n */\nexport class BrokerInfoBehavior extends McpBehavior {\n    public static readonly NAMESPACE = \"broker\";\n\n    constructor(context: IBrokerContext) {\n        super(new BrokerInfoAdapter(context), {\n            namespace: BrokerInfoBehavior.NAMESPACE,\n        });\n    }\n\n    protected override _buildResources(): McpResource[] {\n        return [\n            {\n                uri: BROKER_INFO_URI,\n                name: brokerBaselineResourceName(BROKER_INFO_URI),\n                mimeType: \"application/json\",\n                description: brokerBaselineResourceDescription(BROKER_INFO_URI),\n            },\n        ];\n    }\n\n    protected override _buildTools(): McpTool[] {\n        return [\n            {\n                name: \"broker_info\",\n                description: brokerBaselineToolDescription(\"broker_info\"),\n                inputSchema: {\n                    type: \"object\",\n                    properties: {},\n                    additionalProperties: false,\n                },\n            },\n        ];\n    }\n}\n","import { McpAdapterBase, McpToolResults } from \"@cyanmycelium/mcp-core\";\nimport type { McpResourceContent, McpToolResult } from \"@cyanmycelium/mcp-core\";\nimport type { IBrokerContext, IBrokerProviderInfo } from \"../broker.context\";\n\n/** URI of the static resource that lists every provider slot. */\nexport const PROVIDERS_URI = \"broker://providers\";\n\n/** RFC 6570 URI template for one specific provider slot. */\nexport const PROVIDER_URI_TEMPLATE = \"broker://providers/{name}\";\n\n/**\n * Adapter that exposes the broker's current provider slots, both as a list\n * (read of `broker://providers`) and individually (`broker://providers/<name>`).\n */\nexport class BrokerProvidersAdapter extends McpAdapterBase {\n    constructor(private readonly _context: IBrokerContext) {\n        super(\"broker\");\n    }\n\n    public async readResourceAsync(uri: string): Promise<McpResourceContent | undefined> {\n        if (uri === PROVIDERS_URI) {\n            return {\n                uri,\n                mimeType: \"application/json\",\n                text: JSON.stringify(this._listSnapshot()),\n            };\n        }\n\n        // broker://providers/<name>\n        const match = /^broker:\\/\\/providers\\/([^/]+)$/.exec(uri);\n        if (match) {\n            const name = decodeURIComponent(match[1]);\n            const info = this._context.getProviderInfo(name);\n            if (!info) return undefined;\n            return {\n                uri,\n                mimeType: \"application/json\",\n                text: JSON.stringify(info),\n            };\n        }\n\n        return undefined;\n    }\n\n    public async executeToolAsync(_uri: string, toolName: string, args: Record<string, unknown>): Promise<McpToolResult> {\n        switch (toolName) {\n            case \"providers_list\":\n                return McpToolResults.json(this._listSnapshot());\n\n            case \"provider_status\": {\n                const name = typeof args.name === \"string\" ? args.name : \"\";\n                if (!name) return McpToolResults.error('Missing required argument: \"name\" (string).');\n                const info = this._context.getProviderInfo(name);\n                if (!info) return McpToolResults.error(`Unknown provider: \"${name}\".`);\n                return McpToolResults.json(info);\n            }\n\n            default:\n                return McpToolResults.error(`Unknown tool: ${toolName}`);\n        }\n    }\n\n    private _listSnapshot(): { count: number; providers: IBrokerProviderInfo[] } {\n        const providers = this._context.getProvidersInfo();\n        return { count: providers.length, providers };\n    }\n}\n","import { McpBehavior } from \"@cyanmycelium/mcp-core\";\nimport type { McpResource, McpResourceTemplate, McpTool } from \"@cyanmycelium/mcp-core\";\nimport { BrokerProvidersAdapter, PROVIDERS_URI, PROVIDER_URI_TEMPLATE } from \"../adapters/broker.adapter.providers\";\nimport {\n    brokerBaselinePropertyDescription,\n    brokerBaselineResourceDescription,\n    brokerBaselineResourceName,\n    brokerBaselineResourceTemplateDescription,\n    brokerBaselineResourceTemplateName,\n    brokerBaselineToolDescription,\n} from \"../broker.grammars\";\nimport type { IBrokerContext } from \"../broker.context\";\n\n/**\n * Exposes the broker's provider slots so an MCP agent can discover what is\n * currently routable behind the broker, with two tools:\n *\n * - `providers_list`: every slot (including disconnected ones).\n * - `provider_status({ name })`, detail on one slot.\n *\n * Plus matching resources at `broker://providers` and `broker://providers/<name>`.\n */\nexport class BrokerProvidersBehavior extends McpBehavior {\n    public static readonly NAMESPACE = \"broker_providers\";\n\n    constructor(context: IBrokerContext) {\n        super(new BrokerProvidersAdapter(context), {\n            namespace: BrokerProvidersBehavior.NAMESPACE,\n        });\n    }\n\n    protected override _buildResources(): McpResource[] {\n        return [\n            {\n                uri: PROVIDERS_URI,\n                name: brokerBaselineResourceName(PROVIDERS_URI),\n                mimeType: \"application/json\",\n                description: brokerBaselineResourceDescription(PROVIDERS_URI),\n            },\n        ];\n    }\n\n    protected override _buildTemplate(): McpResourceTemplate[] {\n        return [\n            {\n                uriTemplate: PROVIDER_URI_TEMPLATE,\n                name: brokerBaselineResourceTemplateName(PROVIDER_URI_TEMPLATE),\n                mimeType: \"application/json\",\n                description: brokerBaselineResourceTemplateDescription(PROVIDER_URI_TEMPLATE),\n            },\n        ];\n    }\n\n    protected override _buildTools(): McpTool[] {\n        return [\n            {\n                name: \"providers_list\",\n                description: brokerBaselineToolDescription(\"providers_list\"),\n                inputSchema: {\n                    type: \"object\",\n                    properties: {},\n                    additionalProperties: false,\n                },\n            },\n            {\n                name: \"provider_status\",\n                description: brokerBaselineToolDescription(\"provider_status\"),\n                inputSchema: {\n                    type: \"object\",\n                    properties: {\n                        name: {\n                            type: \"string\",\n                            description: brokerBaselinePropertyDescription(\"provider_status\", \"name\"),\n                        },\n                    },\n                    required: [\"name\"],\n                    additionalProperties: false,\n                },\n            },\n        ];\n    }\n}\n","import { McpServerBuilder, LoopbackTransport } from \"@cyanmycelium/mcp-core\";\nimport type { GrammarResolverOptions, IMcpServer, IMessageTransport } from \"@cyanmycelium/mcp-core\";\nimport { BrokerInfoBehavior } from \"./behaviors/broker.behavior.info\";\nimport { BrokerProvidersBehavior } from \"./behaviors/broker.behavior.providers\";\nimport { iterAvailableBrokerGrammars, iterBrokerGrammarsFrom } from \"./broker.grammars\";\nimport type { IBrokerContext } from \"./broker.context\";\n\n/**\n * Reserved provider slot name under which the broker exposes itself as an MCP\n * server. Clients reach it via `<host>/_broker/mcp` (or any other client transport).\n *\n * Prefixed with `_` to make it unambiguously a system slot, and to reduce the\n * chance of collision with user-supplied provider names.\n */\nexport const BROKER_PROVIDER_NAME = \"_broker\";\n\n/**\n * Optional knobs passed to {@link startBrokerServer}. Lets the embedder\n * replace either resolver with custom logic without touching mcp-broker\n * internals.\n */\nexport interface IStartBrokerServerOptions {\n    /**\n     * Overrides for the built-in grammar resolver from `@cyanmycelium/mcp-core`.\n     *\n     * The broker installs sensible defaults: `localeSource` reads\n     * `process.env.MCP_BROKER_LOCALE`, the `agents` map uses the mcp-core\n     * defaults (`claude`, `gpt`, `mistral`, `copilot`, `default`), the\n     * narrowing chain is BCP-47-style, and `fallbackKey` is `default:en`\n     * so the baseline grammar always matches as last resort.\n     *\n     * Pass partial overrides here to inject a custom `localeSource` (e.g.\n     * pull from an HTTP header proxied by your transport), enable the\n     * `versionFrom` dimension, or extend the `agents` map with additional\n     * LLM families. Anything you omit keeps the broker default.\n     */\n    grammarResolverOptions?: Partial<GrammarResolverOptions>;\n\n    /**\n     * Path to a user-supplied grammars directory whose `<userAgent>/<locale>.json`\n     * files are registered **in addition to** the packaged grammars.\n     *\n     * Both packaged and local entries are registered raw against the server\n     * via `withGrammar(brokerGrammarKey(ua, locale), grammar)`. The\n     * candidate-chain resolution implemented by `McpServer.initialize` in\n     * mcp-core@0.3.0 then walks the chain and merges the four layers\n     * (behavior, adapter, static, store) for the first matching key ,\n     * the old hand-rolled pre-merge cascade is no longer needed.\n     *\n     * When `undefined` (default), only the packaged grammars are loaded.\n     */\n    localGrammarsDir?: string;\n}\n\n/**\n * Constructs the broker's own MCP server (the Tier-1 introspection behaviors)\n * and returns the running server plus the loopback transport that must be\n * registered against the {@link WsTunnel} as the `_broker` provider slot.\n *\n * Usage from {@link WsTunnel.start}:\n * ```ts\n * const { server, clientTransport } = await startBrokerServer(this, { ... });\n * this._registerLoopbackProvider(BROKER_PROVIDER_NAME, clientTransport);\n * ```\n *\n * @param context  Read-only view of the broker's state.\n * @param options  Optional resolver overrides.\n * @returns The running {@link IMcpServer} (call `.stop()` on shutdown) and the\n *          loopback transport to attach to the tunnel.\n */\nexport async function startBrokerServer(\n    context: IBrokerContext,\n    options: IStartBrokerServerOptions = {}\n): Promise<{\n    server: IMcpServer;\n    clientTransport: IMessageTransport;\n}> {\n    const [serverEnd, clientEnd] = LoopbackTransport.createPair();\n\n    // Without an initializer, McpServerBuilder reports `version: \"0.0.0\"` in the\n    // `initialize` handshake. Supply the real package version from the context.\n    const builder = new McpServerBuilder()\n        .withName(BROKER_PROVIDER_NAME)\n        .withTransport(serverEnd)\n        .withInitializer({\n            initialize: () => ({\n                protocolVersion: \"2024-11-05\",\n                serverInfo: { name: BROKER_PROVIDER_NAME, version: context.version },\n            }),\n        })\n        .register(new BrokerInfoBehavior(context), new BrokerProvidersBehavior(context));\n\n    // Register every `(userAgent, locale)` JSON found on disk as a raw\n    // grammar layer. The candidate-chain resolution in\n    // McpServer.initialize (mcp-core@0.3.0) walks the resolver's chain\n    // and merges all matching layers: so partial user-agent files no\n    // longer need to be pre-merged with the default-locale baseline at\n    // boot. Local overrides come after packaged entries; identical keys\n    // get overlaid via the registry's last-write-wins.\n    for (const entry of iterAvailableBrokerGrammars()) {\n        builder.withGrammar(entry.key, entry.grammar);\n    }\n    if (options.localGrammarsDir) {\n        for (const entry of iterBrokerGrammarsFrom(options.localGrammarsDir)) {\n            builder.withGrammar(entry.key, entry.grammar);\n        }\n    }\n\n    // Wire the resolver via mcp-core's declarative helper. The broker\n    // ships sensible defaults (locale from MCP_BROKER_LOCALE env, agents\n    // from mcp-core's catalogue, BCP-47 narrowing, default:en fallback);\n    // anything the host application sets via `grammarResolverOptions`\n    // takes precedence.\n    builder.withGrammarResolver({\n        localeSource: () => process.env[\"MCP_BROKER_LOCALE\"],\n        ...(options.grammarResolverOptions ?? {}),\n    });\n\n    // No reconnect policy → the McpServer does not attempt to reopen the loopback\n    // when WsTunnel.stop() closes it. Clean shutdown.\n    const server = builder.build();\n\n    await server.start();\n\n    return { server, clientTransport: clientEnd };\n}\n\n/** @deprecated Use {@link IStartBrokerServerOptions}. */\nexport type StartBrokerServerOptions = IStartBrokerServerOptions;\n","const WILDCARD = \"*\";\nconst RECURSIVE_WILDCARD = \"**\";\n\nfunction assertString(value: string, label: string): void {\n    if (typeof value !== \"string\" || value.length === 0) {\n        throw new Error(`${label}: a non-empty string is required.`);\n    }\n}\n\nfunction splitAbsolutePath(value: string, label: string): readonly string[] {\n    assertString(value, label);\n    if (!value.startsWith(\"/\")) {\n        throw new Error(`${label}: \"${value}\" must start with \"/\".`);\n    }\n    if (value === \"/\") return [];\n\n    const withoutTrailingSlash = value.endsWith(\"/\") ? value.slice(0, -1) : value;\n    const segments = withoutTrailingSlash.slice(1).split(\"/\");\n    for (const segment of segments) {\n        if (!segment) {\n            throw new Error(`${label}: \"${value}\" contains an empty path segment.`);\n        }\n        if (segment === \".\" || segment === \"..\") {\n            throw new Error(`${label}: \"${value}\" contains a forbidden \"${segment}\" segment.`);\n        }\n    }\n    return segments;\n}\n\nfunction normalizedValue(segments: readonly string[]): string {\n    return segments.length === 0 ? \"/\" : `/${segments.join(\"/\")}`;\n}\n\n/**\n * A normalized, case-sensitive hierarchical resource path.\n *\n * Parsing is deliberately independent from URLs and transports. A path is a\n * stable resource identity, not a network address.\n */\nexport class ResourcePath {\n    readonly value: string;\n    readonly segments: readonly string[];\n\n    private constructor(segments: readonly string[]) {\n        this.segments = Object.freeze([...segments]);\n        this.value = normalizedValue(this.segments);\n    }\n\n    static parse(value: string): ResourcePath {\n        const segments = splitAbsolutePath(value, \"resource path\");\n        for (const segment of segments) {\n            if (segment === WILDCARD || segment === RECURSIVE_WILDCARD) {\n                throw new Error(`resource path: wildcards are not allowed in \"${value}\".`);\n            }\n        }\n        return new ResourcePath(segments);\n    }\n\n    static tryParse(value: string): ResourcePath | undefined {\n        try {\n            return ResourcePath.parse(value);\n        } catch {\n            return undefined;\n        }\n    }\n\n    toString(): string {\n        return this.value;\n    }\n}\n\n/**\n * A compiled resource expression supporting exact segments, `*` for one\n * segment, and a final `**` for zero or more trailing segments.\n */\nexport class ResourcePathPattern {\n    readonly value: string;\n    readonly segments: readonly string[];\n    readonly specificity: number;\n\n    private constructor(segments: readonly string[]) {\n        this.segments = Object.freeze([...segments]);\n        this.value = normalizedValue(this.segments);\n        this.specificity = this.segments.reduce((score, segment) => {\n            if (segment === RECURSIVE_WILDCARD) return score;\n            if (segment === WILDCARD) return score + 1;\n            return score + 4;\n        }, this.segments.length);\n    }\n\n    static parse(value: string): ResourcePathPattern {\n        const canonical = value === RECURSIVE_WILDCARD ? `/${RECURSIVE_WILDCARD}` : value;\n        const segments = splitAbsolutePath(canonical, \"resource pattern\");\n        let recursiveSeen = false;\n        for (let index = 0; index < segments.length; index += 1) {\n            const segment = segments[index];\n            if (segment === RECURSIVE_WILDCARD) {\n                if (index !== segments.length - 1) {\n                    throw new Error(`resource pattern: \"**\" must be the final segment in \"${value}\".`);\n                }\n                recursiveSeen = true;\n            } else if (recursiveSeen) {\n                throw new Error(`resource pattern: no segment may follow \"**\" in \"${value}\".`);\n            } else if (segment !== WILDCARD && segment.includes(WILDCARD)) {\n                throw new Error(`resource pattern: wildcards must occupy a complete segment in \"${value}\".`);\n            }\n        }\n        return new ResourcePathPattern(segments);\n    }\n\n    matches(path: ResourcePath): boolean {\n        const pattern = this.segments;\n        const target = path.segments;\n        for (let index = 0; index < pattern.length; index += 1) {\n            const segment = pattern[index];\n            if (segment === RECURSIVE_WILDCARD) return true;\n            if (index >= target.length) return false;\n            if (segment !== WILDCARD && segment !== target[index]) return false;\n        }\n        return target.length === pattern.length;\n    }\n\n    toString(): string {\n        return this.value;\n    }\n}\n","import { ResourcePath, ResourcePathPattern } from \"./resource.path\";\n\nexport interface IMcpOperation {\n    readonly method?: string;\n    readonly params?: unknown;\n}\n\nexport interface IClassifiedCapability {\n    readonly capability: string;\n    readonly tool?: string;\n}\n\nexport interface ICapabilityClassifier {\n    classify(operation: IMcpOperation, resource: ResourcePath, provider?: string): IClassifiedCapability | undefined;\n}\n\ninterface IProviderMapping {\n    readonly pattern: ResourcePathPattern;\n    readonly tools: Readonly<Record<string, string>>;\n}\n\nconst STATIC_CAPABILITIES: Readonly<Record<string, string>> = {\n    \"resources/list\": \"mcp.resources.read\",\n    \"resources/read\": \"mcp.resources.read\",\n    \"tools/list\": \"mcp.tools.list\",\n    \"prompts/list\": \"mcp.prompts.read\",\n    \"prompts/get\": \"mcp.prompts.read\",\n    \"completion/complete\": \"mcp.completion.use\",\n    \"notifications/resources/list_changed\": \"mcp.resources.read\",\n    \"notifications/resources/updated\": \"mcp.resources.read\",\n    \"notifications/tools/list_changed\": \"mcp.tools.list\",\n    \"notifications/prompts/list_changed\": \"mcp.prompts.read\",\n};\n\nconst BROKER_READ_TOOLS = new Set([\"broker_info\", \"providers_list\", \"provider_status\"]);\n\nfunction toolNameFrom(params: unknown): string | undefined {\n    if (typeof params !== \"object\" || params === null || Array.isArray(params)) return undefined;\n    const name = (params as Readonly<Record<string, unknown>>)[\"name\"];\n    return typeof name === \"string\" && name ? name : undefined;\n}\n\nexport function validateCapability(capability: string, label = \"capability\"): void {\n    if (typeof capability !== \"string\" || (capability !== \"*\" && !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(capability))) {\n        throw new Error(`authorization ${label}: \"${capability}\" is malformed.`);\n    }\n}\n\n/**\n * Classifies MCP methods without deriving privilege from arbitrary tool names.\n * Provider-qualified mappings win over global mappings, then tools/call falls\n * back to `mcp.tools.call`.\n */\nexport class ConfiguredCapabilityClassifier implements ICapabilityClassifier {\n    private readonly _globalTools: Readonly<Record<string, string>>;\n    private readonly _providerMappings: readonly IProviderMapping[];\n\n    constructor(toolCapabilities: Readonly<Record<string, string>> = {}, providerToolCapabilities: Readonly<Record<string, Readonly<Record<string, string>>>> = {}) {\n        for (const [tool, capability] of Object.entries(toolCapabilities)) {\n            if (!tool) throw new Error(\"authorization toolCapabilities: tool names must not be empty.\");\n            validateCapability(capability, `toolCapabilities[\"${tool}\"]`);\n        }\n        this._globalTools = Object.freeze({ ...toolCapabilities });\n\n        const mappings: IProviderMapping[] = [];\n        for (const [patternValue, tools] of Object.entries(providerToolCapabilities)) {\n            const pattern = ResourcePathPattern.parse(patternValue);\n            for (const [tool, capability] of Object.entries(tools)) {\n                if (!tool) throw new Error(`authorization providerToolCapabilities[\"${patternValue}\"]: tool names must not be empty.`);\n                validateCapability(capability, `providerToolCapabilities[\"${patternValue}\"][\"${tool}\"]`);\n            }\n            mappings.push({ pattern, tools: Object.freeze({ ...tools }) });\n        }\n        mappings.sort((left, right) => right.pattern.specificity - left.pattern.specificity || left.pattern.value.localeCompare(right.pattern.value));\n        this._providerMappings = Object.freeze(mappings);\n    }\n\n    classify(operation: IMcpOperation, resource: ResourcePath, provider?: string): IClassifiedCapability | undefined {\n        const method = operation.method;\n        if (!method) return undefined;\n\n        if (provider === \"_broker\") {\n            if (method === \"tools/list\" || method === \"resources/list\" || method === \"resources/read\") {\n                return { capability: \"broker.providers.read\" };\n            }\n            if (method === \"tools/call\") {\n                const tool = toolNameFrom(operation.params);\n                if (tool && BROKER_READ_TOOLS.has(tool)) return { capability: \"broker.providers.read\", tool };\n            }\n        }\n\n        if (method !== \"tools/call\") {\n            const capability = STATIC_CAPABILITIES[method];\n            return capability ? { capability } : undefined;\n        }\n\n        const tool = toolNameFrom(operation.params);\n        if (!tool) return { capability: \"mcp.tools.call\" };\n        for (const mapping of this._providerMappings) {\n            if (mapping.pattern.matches(resource)) {\n                const capability = mapping.tools[tool];\n                if (capability) return { capability, tool };\n            }\n        }\n        return { capability: this._globalTools[tool] ?? \"mcp.tools.call\", tool };\n    }\n}\n\n/** @deprecated Use {@link IMcpOperation}. */\nexport type McpOperation = IMcpOperation;\n/** @deprecated Use {@link IClassifiedCapability}. */\nexport type ClassifiedCapability = IClassifiedCapability;\n/** @deprecated Use {@link ICapabilityClassifier}. */\nexport type CapabilityClassifier = ICapabilityClassifier;\n","import { validateCapability } from \"./capability.classifier\";\nimport type { IAuthorizationDecision, IAuthorizationRequest, IDenyPolicy, IPolicyAssignment, IPolicyEngine, IRoleDefinition } from \"./policy.types\";\nimport { ResourcePathPattern } from \"./resource.path\";\n\ninterface ICompiledAssignment {\n    readonly id: string;\n    readonly subject: string;\n    readonly capabilities: ReadonlySet<string>;\n    readonly resource: ResourcePathPattern;\n}\n\ninterface ICompiledDeny {\n    readonly id: string;\n    readonly subject: string;\n    readonly capabilities: ReadonlySet<string>;\n    readonly resource: ResourcePathPattern;\n}\n\nfunction validateName(value: string, label: string): void {\n    if (typeof value !== \"string\" || !value || value.trim() !== value || value.includes(\"/\")) {\n        throw new Error(`authorization ${label}: \"${value}\" is invalid.`);\n    }\n}\n\nfunction validateSubject(subject: string, label: string): void {\n    if (typeof subject !== \"string\" || !/^[A-Za-z][A-Za-z0-9_-]*:.+$/.test(subject)) {\n        throw new Error(`authorization ${label}: subject \"${subject}\" must use a non-empty extensible prefix such as \"user:alice\".`);\n    }\n}\n\nfunction validatePolicyId(id: string, label: string): void {\n    if (typeof id !== \"string\" || !id || id.trim() !== id) {\n        throw new Error(`authorization ${label}: policy ids must be non-empty and must not contain surrounding whitespace.`);\n    }\n}\n\nfunction expandRoles(roles: Readonly<Record<string, IRoleDefinition>>): ReadonlyMap<string, ReadonlySet<string>> {\n    const expanded = new Map<string, ReadonlySet<string>>();\n    const visiting: string[] = [];\n\n    for (const [name, role] of Object.entries(roles)) {\n        validateName(name, \"role\");\n        for (const key of Object.keys(role)) {\n            if (key !== \"inherits\" && key !== \"capabilities\") {\n                throw new Error(`authorization role \"${name}\": unsupported field \"${key}\"; roles contain capabilities, not resource paths.`);\n            }\n        }\n        if (!Array.isArray(role.capabilities)) {\n            throw new Error(`authorization role \"${name}\": capabilities must be an array.`);\n        }\n        if (role.inherits !== undefined && !Array.isArray(role.inherits)) {\n            throw new Error(`authorization role \"${name}\": inherits must be an array.`);\n        }\n        for (const capability of role.capabilities) validateCapability(capability, `role \"${name}\" capability`);\n        for (const inherited of role.inherits ?? []) {\n            validateName(inherited, `role \"${name}\" inheritance`);\n            if (!roles[inherited]) {\n                throw new Error(`authorization role \"${name}\": inherited role \"${inherited}\" is not defined.`);\n            }\n        }\n    }\n\n    const visit = (name: string): ReadonlySet<string> => {\n        const cached = expanded.get(name);\n        if (cached) return cached;\n\n        const cycleStart = visiting.indexOf(name);\n        if (cycleStart >= 0) {\n            const cycle = [...visiting.slice(cycleStart), name].join(\" -> \");\n            throw new Error(`authorization roles: inheritance cycle detected: ${cycle}.`);\n        }\n\n        const role = roles[name];\n        if (!role) throw new Error(`authorization roles: role \"${name}\" is not defined.`);\n        visiting.push(name);\n        const capabilities = new Set<string>();\n        for (const inherited of role.inherits ?? []) {\n            for (const capability of visit(inherited)) capabilities.add(capability);\n        }\n        for (const capability of role.capabilities) capabilities.add(capability);\n        visiting.pop();\n        const frozen = Object.freeze(capabilities);\n        expanded.set(name, frozen);\n        return frozen;\n    };\n\n    for (const name of Object.keys(roles)) visit(name);\n    return expanded;\n}\n\nfunction indexBySubject<T extends { readonly subject: string }>(entries: readonly T[]): ReadonlyMap<string, readonly T[]> {\n    const mutable = new Map<string, T[]>();\n    for (const entry of entries) {\n        const bucket = mutable.get(entry.subject);\n        if (bucket) bucket.push(entry);\n        else mutable.set(entry.subject, [entry]);\n    }\n    const result = new Map<string, readonly T[]>();\n    for (const [subject, bucket] of mutable) result.set(subject, Object.freeze(bucket));\n    return result;\n}\n\nfunction grants(capabilities: ReadonlySet<string>, requested: string): boolean {\n    return capabilities.has(\"*\") || capabilities.has(requested);\n}\n\n/**\n * Immutable, indexed in-memory policy engine. Role inheritance and resource\n * expressions are fully compiled in the constructor.\n */\nexport class ConfigPolicyEngine implements IPolicyEngine {\n    private readonly _assignmentsBySubject: ReadonlyMap<string, readonly ICompiledAssignment[]>;\n    private readonly _deniesBySubject: ReadonlyMap<string, readonly ICompiledDeny[]>;\n\n    constructor(roles: Readonly<Record<string, IRoleDefinition>>, assignments: readonly IPolicyAssignment[], denies: readonly IDenyPolicy[]) {\n        const expandedRoles = expandRoles(roles);\n        const policyIds = new Set<string>();\n\n        const reserveId = (id: string, label: string): void => {\n            validatePolicyId(id, label);\n            if (policyIds.has(id)) throw new Error(`authorization policies: duplicate policy id \"${id}\".`);\n            policyIds.add(id);\n        };\n\n        const compiledAssignments = assignments.map((assignment, index): ICompiledAssignment => {\n            const id = assignment.id ?? `assignment:${index}`;\n            reserveId(id, `assignment ${index}`);\n            validateSubject(assignment.subject, `assignment \"${id}\"`);\n            validateName(assignment.role, `assignment \"${id}\" role`);\n            const capabilities = expandedRoles.get(assignment.role);\n            if (!capabilities) {\n                throw new Error(`authorization assignment \"${id}\": role \"${assignment.role}\" is not defined.`);\n            }\n            if (!assignment.resource) throw new Error(`authorization assignment \"${id}\": resource must not be empty.`);\n            return {\n                id,\n                subject: assignment.subject,\n                capabilities,\n                resource: ResourcePathPattern.parse(assignment.resource),\n            };\n        });\n\n        const compiledDenies = denies.map((deny, index): ICompiledDeny => {\n            const id = deny.id ?? `deny:${index}`;\n            reserveId(id, `deny ${index}`);\n            validateSubject(deny.subject, `deny \"${id}\"`);\n            if (deny.effect !== undefined && deny.effect !== \"deny\") {\n                throw new Error(`authorization deny \"${id}\": effect must be \"deny\".`);\n            }\n            if (!Array.isArray(deny.capabilities) || deny.capabilities.length === 0) {\n                throw new Error(`authorization deny \"${id}\": at least one capability is required.`);\n            }\n            const capabilities = new Set<string>();\n            for (const capability of deny.capabilities) {\n                validateCapability(capability, `deny \"${id}\" capability`);\n                capabilities.add(capability);\n            }\n            if (!deny.resource) throw new Error(`authorization deny \"${id}\": resource must not be empty.`);\n            return {\n                id,\n                subject: deny.subject,\n                capabilities: Object.freeze(capabilities),\n                resource: ResourcePathPattern.parse(deny.resource),\n            };\n        });\n\n        this._assignmentsBySubject = indexBySubject(compiledAssignments);\n        this._deniesBySubject = indexBySubject(compiledDenies);\n    }\n\n    authorize(request: IAuthorizationRequest): IAuthorizationDecision {\n        if (!request.resource) return { allowed: false, reason: \"invalid-resource\" };\n        try {\n            validateCapability(request.capability, \"request capability\");\n        } catch {\n            return { allowed: false, reason: \"no-matching-grant\" };\n        }\n\n        const matchingDenies = new Set<string>();\n        for (const subject of request.subject.ids) {\n            for (const deny of this._deniesBySubject.get(subject) ?? []) {\n                if (deny.resource.matches(request.resource) && grants(deny.capabilities, request.capability)) {\n                    matchingDenies.add(deny.id);\n                }\n            }\n        }\n        if (matchingDenies.size > 0) {\n            return {\n                allowed: false,\n                reason: \"explicit-deny\",\n                matchedPolicies: Object.freeze([...matchingDenies].sort()),\n            };\n        }\n\n        const matchingGrants = new Set<string>();\n        for (const subject of request.subject.ids) {\n            for (const assignment of this._assignmentsBySubject.get(subject) ?? []) {\n                if (assignment.resource.matches(request.resource) && grants(assignment.capabilities, request.capability)) {\n                    matchingGrants.add(assignment.id);\n                }\n            }\n        }\n        if (matchingGrants.size > 0) {\n            return {\n                allowed: true,\n                reason: \"role-grant\",\n                matchedPolicies: Object.freeze([...matchingGrants].sort()),\n            };\n        }\n        return { allowed: false, reason: \"no-matching-grant\" };\n    }\n}\n","import type { IAuthorizationSubject, ISubjectMappingConfig } from \"./policy.types\";\n\nexport interface ISubjectMapper {\n    map(claims: Readonly<Record<string, unknown>>): IAuthorizationSubject;\n}\n\nexport class SubjectMappingError extends Error {\n    constructor(message: string) {\n        super(message);\n        this.name = \"SubjectMappingError\";\n    }\n}\n\ninterface IClaimRule {\n    readonly prefix: string;\n    readonly claim: string;\n}\n\nfunction claimAt(claims: Readonly<Record<string, unknown>>, claimName: string): unknown {\n    const parts = claimName.split(\".\");\n    let current: unknown = claims;\n    for (const part of parts) {\n        if (!part || typeof current !== \"object\" || current === null || Array.isArray(current)) return undefined;\n        current = (current as Readonly<Record<string, unknown>>)[part];\n    }\n    return current;\n}\n\nfunction valuesOf(value: unknown, claimName: string): readonly string[] {\n    if (value === undefined || value === null) return [];\n    if (typeof value === \"string\") return value ? [value] : [];\n    if (Array.isArray(value) && value.every((entry) => typeof entry === \"string\")) {\n        return value.filter((entry): entry is string => typeof entry === \"string\" && entry.length > 0);\n    }\n    throw new SubjectMappingError(`JWT subject claim \"${claimName}\" must be a string or an array of strings.`);\n}\n\nfunction validateClaimName(value: string, label: string): void {\n    if (!value || value.split(\".\").some((part) => !part)) {\n        throw new Error(`authorization subject mapping: ${label} contains an invalid claim name.`);\n    }\n}\n\n/** Maps validated JWT claims to canonical, deduplicated authorization subjects. */\nexport class JwtSubjectMapper implements ISubjectMapper {\n    private readonly _rules: readonly IClaimRule[];\n\n    constructor(config: ISubjectMappingConfig = {}) {\n        const userClaim = config.userClaim ?? \"sub\";\n        const groupClaims = config.groupClaims ?? [\"groups\", \"roles\"];\n        const clientClaim = config.clientClaim ?? \"client_id\";\n        const serviceClaims = config.serviceClaims ?? [];\n\n        if (!Array.isArray(groupClaims)) throw new Error(\"authorization subject mapping: groupClaims must be an array.\");\n        if (!Array.isArray(serviceClaims)) throw new Error(\"authorization subject mapping: serviceClaims must be an array.\");\n        validateClaimName(userClaim, \"userClaim\");\n        validateClaimName(clientClaim, \"clientClaim\");\n        for (const claim of groupClaims) validateClaimName(claim, \"groupClaims\");\n        for (const claim of serviceClaims) validateClaimName(claim, \"serviceClaims\");\n\n        this._rules = Object.freeze([\n            { prefix: \"user\", claim: userClaim },\n            ...groupClaims.map((claim) => ({ prefix: \"group\", claim })),\n            { prefix: \"client\", claim: clientClaim },\n            ...serviceClaims.map((claim) => ({ prefix: \"service\", claim })),\n        ]);\n    }\n\n    map(claims: Readonly<Record<string, unknown>>): IAuthorizationSubject {\n        const ids = new Set<string>();\n        for (const rule of this._rules) {\n            for (const value of valuesOf(claimAt(claims, rule.claim), rule.claim)) {\n                ids.add(`${rule.prefix}:${value}`);\n            }\n        }\n        return { ids: Object.freeze([...ids]), claims };\n    }\n}\n\n/** @deprecated Use {@link ISubjectMapper}. */\nexport type SubjectMapper = ISubjectMapper;\n","import { ResourcePath } from \"./resource.path\";\n\nexport interface ISlotResourceResolver {\n    resolve(slot: string): ResourcePath | undefined;\n}\n\nconst RESERVED_RESOURCES: Readonly<Record<string, string>> = {\n    _broker: \"/_system/broker\",\n    _all: \"/_system/all\",\n};\n\nfunction isReservedNamespace(resource: ResourcePath): boolean {\n    return resource.value === \"/_system\" || resource.value.startsWith(\"/_system/\");\n}\n\n/** Default resolver with optional explicit technical-slot mappings. */\nexport class DefaultSlotResourceResolver implements ISlotResourceResolver {\n    private readonly _explicit = new Map<string, ResourcePath>();\n\n    constructor(slotResources: Readonly<Record<string, string>> = {}) {\n        for (const [slot, configuredPath] of Object.entries(slotResources)) {\n            if (!slot) throw new Error(\"authorization slotResources: slot names must not be empty.\");\n            const resource = ResourcePath.parse(configuredPath);\n            const reserved = RESERVED_RESOURCES[slot];\n            if (isReservedNamespace(resource) && reserved !== resource.value) {\n                throw new Error(`authorization slotResources: slot \"${slot}\" may not use reserved resource \"${resource.value}\".`);\n            }\n            if (reserved && resource.value !== reserved) {\n                throw new Error(`authorization slotResources: reserved slot \"${slot}\" must resolve to \"${reserved}\".`);\n            }\n            this._explicit.set(slot, resource);\n        }\n    }\n\n    resolve(slot: string): ResourcePath | undefined {\n        const explicit = this._explicit.get(slot);\n        if (explicit) return explicit;\n\n        const reserved = RESERVED_RESOURCES[slot];\n        if (reserved) return ResourcePath.parse(reserved);\n        if (!slot) return undefined;\n\n        const candidate = slot.startsWith(\"/\") ? slot : `/${slot}`;\n        const resource = ResourcePath.tryParse(candidate);\n        return resource && !isReservedNamespace(resource) ? resource : undefined;\n    }\n}\n\n/** @deprecated Use {@link ISlotResourceResolver}. */\nexport type SlotResourceResolver = ISlotResourceResolver;\n","import { ConfiguredCapabilityClassifier, type ICapabilityClassifier } from \"./capability.classifier\";\nimport { ConfigPolicyEngine } from \"./policy.engine\";\nimport type { IAuthorizationAuditConfig, IAuthorizationPolicyConfig, IPolicyEngine } from \"./policy.types\";\nimport { DefaultSlotResourceResolver, type ISlotResourceResolver } from \"./slot.resource\";\nimport { JwtSubjectMapper, type ISubjectMapper } from \"./subject.mapper\";\n\nexport interface IPolicyAuthorization {\n    readonly engine: IPolicyEngine;\n    readonly subjectMapper: ISubjectMapper;\n    readonly slotResourceResolver: ISlotResourceResolver;\n    readonly capabilityClassifier: ICapabilityClassifier;\n    readonly audit: Readonly<Required<IAuthorizationAuditConfig>>;\n}\n\nexport function hasAuthorizationPolicies(config: IAuthorizationPolicyConfig): boolean {\n    return Object.keys(config.roles ?? {}).length > 0 || (config.assignments?.length ?? 0) > 0 || (config.denies?.length ?? 0) > 0;\n}\n\n/** Compiles and validates the complete hierarchical authorization runtime. */\nexport function compileAuthorizationPolicy(config: IAuthorizationPolicyConfig): IPolicyAuthorization {\n    if (config.audit?.logAllowed !== undefined && typeof config.audit.logAllowed !== \"boolean\") {\n        throw new Error(\"authorization audit.logAllowed must be a boolean.\");\n    }\n    const engine = new ConfigPolicyEngine(config.roles ?? {}, config.assignments ?? [], config.denies ?? []);\n    const subjectMapper = new JwtSubjectMapper(config.subjectMapping);\n    const slotResourceResolver = new DefaultSlotResourceResolver(config.slotResources);\n    const capabilityClassifier = new ConfiguredCapabilityClassifier(config.toolCapabilities, config.providerToolCapabilities);\n    return {\n        engine,\n        subjectMapper,\n        slotResourceResolver,\n        capabilityClassifier,\n        audit: Object.freeze({ logAllowed: config.audit?.logAllowed ?? false }),\n    };\n}\n\nexport function authorizationWithEngine(\n    engine: IPolicyEngine,\n    overrides: {\n        readonly subjectMapper?: ISubjectMapper;\n        readonly slotResourceResolver?: ISlotResourceResolver;\n        readonly capabilityClassifier?: ICapabilityClassifier;\n        readonly audit?: IAuthorizationAuditConfig;\n    } = {}\n): IPolicyAuthorization {\n    return {\n        engine,\n        subjectMapper: overrides.subjectMapper ?? new JwtSubjectMapper(),\n        slotResourceResolver: overrides.slotResourceResolver ?? new DefaultSlotResourceResolver(),\n        capabilityClassifier: overrides.capabilityClassifier ?? new ConfiguredCapabilityClassifier(),\n        audit: Object.freeze({ logAllowed: overrides.audit?.logAllowed ?? false }),\n    };\n}\n\n/** @deprecated Use {@link IPolicyAuthorization}. */\nexport type PolicyAuthorization = IPolicyAuthorization;\n","import type { IAuthorizationAuditEvent, IAuthorizationDecision, IAuthorizationSubject } from \"./policy.types\";\nimport type { ResourcePath } from \"./resource.path\";\n\nexport interface IAuditContext {\n    readonly subject: IAuthorizationSubject;\n    readonly slot: string;\n    readonly resource?: ResourcePath;\n    readonly capability?: string;\n    readonly provider?: string;\n    readonly tool?: string;\n}\n\nexport function makeAuthorizationAuditEvent(context: IAuditContext, decision: IAuthorizationDecision): IAuthorizationAuditEvent {\n    const clientId = context.subject.ids.find((id) => id.startsWith(\"client:\"))?.slice(\"client:\".length);\n    return {\n        timestamp: new Date().toISOString(),\n        allowed: decision.allowed,\n        subjectIds: context.subject.ids,\n        clientId,\n        slot: context.slot,\n        resource: context.resource?.value,\n        capability: context.capability,\n        provider: context.provider,\n        tool: context.tool,\n        reason: decision.reason,\n        matchedPolicies: decision.matchedPolicies,\n    };\n}\n\nexport function writeAuthorizationAuditEvent(event: IAuthorizationAuditEvent): void {\n    console.error(`[broker] authorization ${JSON.stringify(event)}`);\n}\n\n/** @deprecated Use {@link IAuditContext}. */\nexport type AuditContext = IAuditContext;\n","/**\n * AggregateCatalog, merges the tool and prompt catalogs of several providers\n * into a single namespaced view, and routes aggregated names back to their\n * origin provider.\n *\n * Aggregated names use the `<provider>-<original>` shape. Routing never parses\n * that string back: a forward lookup table is the single source of truth, so\n * the `-` separator stays safe even when provider or tool names contain dashes.\n */\n\n/** Minimal shape of an MCP tool entry. Extra fields are preserved as-is. */\nexport interface ICatalogTool {\n    name: string;\n    description?: string;\n    [key: string]: unknown;\n}\n\n/** Minimal shape of an MCP prompt entry. Extra fields are preserved as-is. */\nexport interface ICatalogPrompt {\n    name: string;\n    title?: string;\n    description?: string;\n    [key: string]: unknown;\n}\n\n/** One provider's raw contribution to the aggregate. */\nexport interface IProviderEntry {\n    tools: ICatalogTool[];\n    prompts: ICatalogPrompt[];\n}\n\n/** Where an aggregated name routes back to. */\nexport interface IRoute {\n    provider: string;\n    original: string;\n}\n\n/** Separator between the provider prefix and the original name. */\nconst SEPARATOR = \"-\";\n\n/** Anthropic API tool-name limit; aggregated tool names must fit inside it. */\nconst MAX_TOOL_NAME_LENGTH = 64;\n\nexport class AggregateCatalog {\n    private readonly _providers = new Map<string, IProviderEntry>();\n    private _tools: ICatalogTool[] = [];\n    private _prompts: ICatalogPrompt[] = [];\n    private _toolRoutes = new Map<string, IRoute>();\n    private _promptRoutes = new Map<string, IRoute>();\n\n    /** Number of providers currently contributing to the aggregate. */\n    get providerCount(): number {\n        return this._providers.size;\n    }\n\n    /** The merged, namespaced tool list. */\n    get tools(): ICatalogTool[] {\n        return this._tools;\n    }\n\n    /** The merged, namespaced prompt list. */\n    get prompts(): ICatalogPrompt[] {\n        return this._prompts;\n    }\n\n    /** Adds or replaces a provider's contribution, then rebuilds the merged view. */\n    setProvider(provider: string, entry: IProviderEntry): void {\n        this._providers.set(provider, entry);\n        this._rebuild();\n    }\n\n    /** Drops a provider from the aggregate, then rebuilds. */\n    removeProvider(provider: string): void {\n        if (this._providers.delete(provider)) this._rebuild();\n    }\n\n    /** The merged tool list restricted to providers `allow` returns `true` for. */\n    toolsFor(allow: (provider: string) => boolean): ICatalogTool[] {\n        return this._tools.filter((tool) => {\n            const route = this._toolRoutes.get(tool.name);\n            return route ? allow(route.provider) : false;\n        });\n    }\n\n    /** The merged prompt list restricted to providers `allow` returns `true` for. */\n    promptsFor(allow: (provider: string) => boolean): ICatalogPrompt[] {\n        return this._prompts.filter((prompt) => {\n            const route = this._promptRoutes.get(prompt.name);\n            return route ? allow(route.provider) : false;\n        });\n    }\n\n    /** Resolves an aggregated tool name to its origin, or `undefined` if unknown. */\n    resolveTool(name: string): IRoute | undefined {\n        return this._toolRoutes.get(name);\n    }\n\n    /** Resolves an aggregated prompt name to its origin, or `undefined` if unknown. */\n    resolvePrompt(name: string): IRoute | undefined {\n        return this._promptRoutes.get(name);\n    }\n\n    private _rebuild(): void {\n        const tools: ICatalogTool[] = [];\n        const prompts: ICatalogPrompt[] = [];\n        const toolRoutes = new Map<string, IRoute>();\n        const promptRoutes = new Map<string, IRoute>();\n\n        for (const [provider, entry] of this._providers) {\n            for (const tool of entry.tools) {\n                const name = unique(capToolName(prefixed(provider, tool.name)), toolRoutes);\n                toolRoutes.set(name, { provider, original: tool.name });\n                tools.push({ ...tool, name, description: tag(provider, tool.description) });\n            }\n            for (const prompt of entry.prompts) {\n                const name = unique(prefixed(provider, prompt.name), promptRoutes);\n                promptRoutes.set(name, { provider, original: prompt.name });\n                prompts.push({ ...prompt, name, description: tag(provider, prompt.description) });\n            }\n        }\n\n        this._tools = tools;\n        this._prompts = prompts;\n        this._toolRoutes = toolRoutes;\n        this._promptRoutes = promptRoutes;\n    }\n}\n\n/** @deprecated Use {@link ICatalogTool}. */\nexport type CatalogTool = ICatalogTool;\n\n/** @deprecated Use {@link ICatalogPrompt}. */\nexport type CatalogPrompt = ICatalogPrompt;\n\n/** @deprecated Use {@link IProviderEntry}. */\nexport type ProviderEntry = IProviderEntry;\n\n/** @deprecated Use {@link IRoute}. */\nexport type Route = IRoute;\n\nfunction prefixed(provider: string, original: string): string {\n    return `${provider}${SEPARATOR}${original}`;\n}\n\n/** Tags a description with the origin provider so the model and user see the source. */\nfunction tag(provider: string, description: string | undefined): string {\n    const label = `[${provider}]`;\n    return description ? `${label} ${description}` : label;\n}\n\n/** Caps a tool name to the API limit, replacing the overflow with a stable hash. */\nfunction capToolName(name: string): string {\n    if (name.length <= MAX_TOOL_NAME_LENGTH) return name;\n    const hash = djb2(name);\n    return name.slice(0, MAX_TOOL_NAME_LENGTH - hash.length - 1) + SEPARATOR + hash;\n}\n\n/** Disambiguates a name already present in `taken` by appending `-2`, `-3`, ... */\nfunction unique(candidate: string, taken: ReadonlyMap<string, unknown>): string {\n    if (!taken.has(candidate)) return candidate;\n    let n = 2;\n    while (taken.has(`${candidate}${SEPARATOR}${n}`)) n++;\n    return `${candidate}${SEPARATOR}${n}`;\n}\n\n/** Small deterministic string hash rendered as 8 base-36 characters. */\nfunction djb2(input: string): string {\n    let h = 5381;\n    for (let i = 0; i < input.length; i++) {\n        h = ((h << 5) + h + input.charCodeAt(i)) >>> 0;\n    }\n    return h.toString(36).padStart(8, \"0\").slice(-8);\n}\n","import type { IInternalClient } from \"../../ws/ws.interfaces\";\nimport type { ICatalogTool, ICatalogPrompt } from \"./aggregate.catalog\";\n\n/** MCP protocol version the aggregate sessions negotiate with sub-providers. */\nconst PROTOCOL_VERSION = \"2024-11-05\";\n\n/** Per-request timeout for sub-provider calls. */\nconst REQUEST_TIMEOUT_MS = 30_000;\n\n/** Outcome of a JSON-RPC request: exactly one of `result` / `error` is set. */\ninterface IRpcOutcome {\n    result?: unknown;\n    error?: unknown;\n}\n\ninterface IPendingRequest {\n    resolve: (outcome: IRpcOutcome) => void;\n    timer: ReturnType<typeof setTimeout>;\n}\n\ninterface IIncomingMessage {\n    id?: string | number | null;\n    method?: string;\n    result?: unknown;\n    error?: unknown;\n}\n\n/**\n * A hand-rolled JSON-RPC client session to one aggregated provider, running\n * over an in-process {@link IInternalClient}.\n *\n * Performs the MCP `initialize` handshake, caches the provider's `tools/list`\n * and `prompts/list`, and re-fetches them when the provider emits a\n * `list_changed` notification. `tools/call` and `prompts/get` are forwarded and\n * their raw result or error relayed back unchanged.\n */\nexport class ProviderClientSession {\n    readonly provider: string;\n\n    private readonly _client: IInternalClient;\n    private readonly _idPrefix: string;\n    private readonly _pending = new Map<string, IPendingRequest>();\n    private _nextId = 0;\n    private _tools: ICatalogTool[] = [];\n    private _prompts: ICatalogPrompt[] = [];\n    private _closed = false;\n\n    /** Fires after the cached catalog changes (initial load or `list_changed`). */\n    onCatalogChanged: (() => void) | null = null;\n\n    /** Fires when the underlying provider slot disconnects. */\n    onClosed: (() => void) | null = null;\n\n    constructor(provider: string, client: IInternalClient) {\n        this.provider = provider;\n        this._client = client;\n        this._idPrefix = `agg-${provider}-`;\n        client.onMessage = (data: string): void => this._handleMessage(data);\n        client.onClose = (): void => {\n            if (this._closed) return;\n            this._rejectAll(\"provider disconnected\");\n            this.onClosed?.();\n        };\n    }\n\n    get tools(): ICatalogTool[] {\n        return this._tools;\n    }\n\n    get prompts(): ICatalogPrompt[] {\n        return this._prompts;\n    }\n\n    /** Runs the `initialize` handshake and the first catalog fetch. */\n    async initialize(): Promise<void> {\n        await this._request(\"initialize\", {\n            protocolVersion: PROTOCOL_VERSION,\n            capabilities: {},\n            clientInfo: { name: \"mcp-broker-aggregate\", version: \"0\" },\n        });\n        this._client.send(JSON.stringify({ jsonrpc: \"2.0\", method: \"notifications/initialized\" }));\n        await this._refresh();\n    }\n\n    /** Forwards a `tools/call` to the provider, relaying the raw outcome. */\n    callTool(name: string, args: Record<string, unknown>): Promise<IRpcOutcome> {\n        return this._request(\"tools/call\", { name, arguments: args });\n    }\n\n    /** Forwards a `prompts/get` to the provider, relaying the raw outcome. */\n    getPrompt(name: string, args: Record<string, unknown>): Promise<IRpcOutcome> {\n        return this._request(\"prompts/get\", { name, arguments: args });\n    }\n\n    /** Detaches the session and its internal client. */\n    close(): void {\n        if (this._closed) return;\n        this._closed = true;\n        this._rejectAll(\"session closed\");\n        this._client.close();\n    }\n\n    private async _refresh(): Promise<void> {\n        this._tools = await this._listAll<ICatalogTool>(\"tools/list\", \"tools\");\n        this._prompts = await this._listAll<ICatalogPrompt>(\"prompts/list\", \"prompts\");\n        this.onCatalogChanged?.();\n    }\n\n    /**\n     * Calls a list method, following `nextCursor` pagination. A provider that\n     * does not implement the primitive answers with an error, which is treated\n     * as an empty list.\n     */\n    private async _listAll<T>(method: string, key: string): Promise<T[]> {\n        const items: T[] = [];\n        let cursor: string | undefined;\n        do {\n            const { result, error } = await this._request(method, cursor ? { cursor } : {});\n            if (error) return [];\n            const page = (result ?? {}) as Record<string, unknown>;\n            const list = page[key];\n            if (Array.isArray(list)) items.push(...(list as T[]));\n            cursor = typeof page.nextCursor === \"string\" ? page.nextCursor : undefined;\n        } while (cursor);\n        return items;\n    }\n\n    private _request(method: string, params: unknown): Promise<IRpcOutcome> {\n        return new Promise<IRpcOutcome>((resolve) => {\n            if (this._closed) {\n                resolve({ error: { code: -32000, message: \"session closed\" } });\n                return;\n            }\n            const id = this._idPrefix + String(++this._nextId);\n            const timer = setTimeout(() => {\n                this._pending.delete(id);\n                resolve({ error: { code: -32000, message: `request \"${method}\" timed out` } });\n            }, REQUEST_TIMEOUT_MS);\n            this._pending.set(id, { resolve, timer });\n            this._client.send(JSON.stringify({ jsonrpc: \"2.0\", id, method, params }));\n        });\n    }\n\n    private _handleMessage(data: string): void {\n        let msg: IIncomingMessage;\n        try {\n            msg = JSON.parse(data) as IIncomingMessage;\n        } catch {\n            return;\n        }\n        if (typeof msg.id === \"string\") {\n            const pending = this._pending.get(msg.id);\n            if (pending) {\n                this._pending.delete(msg.id);\n                clearTimeout(pending.timer);\n                pending.resolve({ result: msg.result, error: msg.error });\n            }\n            return;\n        }\n        if (msg.id == null && (msg.method === \"notifications/tools/list_changed\" || msg.method === \"notifications/prompts/list_changed\")) {\n            void this._refresh();\n        }\n    }\n\n    private _rejectAll(reason: string): void {\n        for (const pending of this._pending.values()) {\n            clearTimeout(pending.timer);\n            pending.resolve({ error: { code: -32000, message: reason } });\n        }\n        this._pending.clear();\n    }\n}\n","import type { IMessageTransport } from \"@cyanmycelium/mcp-core\";\nimport type { IInternalClient } from \"../../ws/ws.interfaces\";\nimport type { AggregateScopeFilter, IPrincipal } from \"../../auth/index\";\nimport {\n    SubjectMappingError,\n    makeAuthorizationAuditEvent,\n    writeAuthorizationAuditEvent,\n    type IAuthorizationDecision,\n    type IAuthorizationSubject,\n    type IMcpOperation,\n    type IPolicyAuthorization,\n} from \"../../authorization/index\";\nimport { AggregateCatalog } from \"./aggregate.catalog\";\nimport { ProviderClientSession } from \"./provider.client.session\";\n\n/** MCP protocol version advertised by the aggregate server. */\nconst PROTOCOL_VERSION = \"2024-11-05\";\n\n/** Opens an in-process client to a named provider slot. Supplied by WsTunnel. */\nexport type InternalClientFactory = (providerName: string) => IInternalClient;\n\ninterface IClientMessage {\n    id?: string | number | null;\n    method?: string;\n    params?: unknown;\n}\n\ninterface ICallParams {\n    name?: string;\n    arguments?: Record<string, unknown>;\n}\n\n/**\n * The `_all` aggregate MCP server. Presents the union of every opted-in\n * provider's tools and prompts as a single MCP server, reachable on the\n * reserved `_all` slot.\n *\n * It implements {@link IMessageTransport} so it can be registered on the\n * WsTunnel as a loopback provider: `send` receives client requests, `onMessage`\n * (assigned by the tunnel) carries responses and notifications back to clients.\n */\nexport class AggregateServer implements IMessageTransport {\n    /** Reserved provider slot the aggregate is published on. */\n    static readonly SLOT = \"_all\";\n\n    private readonly _catalog = new AggregateCatalog();\n    private readonly _sessions = new Map<string, ProviderClientSession>();\n    private readonly _openClient: InternalClientFactory;\n    private _running = false;\n    /** Per-caller provider visibility filter; `null` ⇒ every caller sees all. */\n    private _scopeFilter: AggregateScopeFilter | null = null;\n    /** Provider-aware hierarchical authorization, absent in legacy mode. */\n    private _authorization: IPolicyAuthorization | null = null;\n\n    onMessage: ((data: string) => void) | null = null;\n    onOpen: (() => void) | null = null;\n    onClose: (() => void) | null = null;\n    onError: ((error: Error) => void) | null = null;\n\n    constructor(openClient: InternalClientFactory) {\n        this._openClient = openClient;\n    }\n\n    get isOpen(): boolean {\n        return this._running;\n    }\n\n    /** Number of providers currently in the aggregate. */\n    get providerCount(): number {\n        return this._sessions.size;\n    }\n\n    /** Marks the aggregate transport open. Call before registering it. */\n    start(): void {\n        this._running = true;\n    }\n\n    /** Sets the per-caller provider visibility filter. `null` disables filtering. */\n    setScopeFilter(filter: AggregateScopeFilter | null): void {\n        this._scopeFilter = filter;\n    }\n\n    /** Sets the compiled hierarchical policy runtime. */\n    setPolicyAuthorization(authorization: IPolicyAuthorization | null): void {\n        this._authorization = authorization;\n    }\n\n    /** WsTunnel hands a client request for the `_all` slot here (no principal). */\n    send(data: string): void {\n        void this._handleClientMessage(data, null);\n    }\n\n    /**\n     * Like {@link send}, but carries the authenticated caller so the aggregate\n     * narrows the catalog and routing to the providers the caller may see.\n     */\n    sendAs(data: string, principal: IPrincipal | null): void {\n        void this._handleClientMessage(data, principal);\n    }\n\n    /** Closes every provider session and the aggregate transport. */\n    close(): void {\n        if (!this._running) return;\n        this._running = false;\n        for (const session of this._sessions.values()) session.close();\n        this._sessions.clear();\n        this.onClose?.();\n    }\n\n    /**\n     * Adds a provider to the aggregate: opens an internal client, runs the\n     * session handshake, and merges the provider's catalog. A no-op for an\n     * already-aggregated provider or the reserved `_all` slot itself.\n     */\n    async addProvider(name: string): Promise<void> {\n        if (name === AggregateServer.SLOT || this._sessions.has(name)) return;\n\n        const session = new ProviderClientSession(name, this._openClient(name));\n        this._sessions.set(name, session);\n\n        session.onCatalogChanged = (): void => {\n            this._catalog.setProvider(name, { tools: session.tools, prompts: session.prompts });\n            this._emitListChanged();\n        };\n        session.onClosed = (): void => this.removeProvider(name);\n\n        try {\n            await session.initialize();\n        } catch {\n            this.removeProvider(name);\n        }\n    }\n\n    /** Removes a provider from the aggregate. */\n    removeProvider(name: string): void {\n        const session = this._sessions.get(name);\n        if (!session) return;\n        this._sessions.delete(name);\n        session.close();\n        this._catalog.removeProvider(name);\n        this._emitListChanged();\n    }\n\n    private _subjectFor(principal: IPrincipal | null): IAuthorizationSubject {\n        if (principal?.subject) return principal.subject;\n        if (!principal) return { ids: [] };\n        try {\n            return (\n                this._authorization?.subjectMapper.map(principal.claims) ?? {\n                    ids: [],\n                    claims: principal.claims,\n                }\n            );\n        } catch (error) {\n            if (!(error instanceof SubjectMappingError)) {\n                console.error(\"[broker] aggregate authorization subject mapping failed.\");\n            }\n            return { ids: [], claims: principal.claims };\n        }\n    }\n\n    private _scopeAllows(principal: IPrincipal | null, provider: string): boolean {\n        const filter = this._scopeFilter;\n        return !filter || !principal || filter(principal, provider);\n    }\n\n    private _policyAllows(principal: IPrincipal | null, provider: string, operation: IMcpOperation): boolean {\n        const authorization = this._authorization;\n        if (!authorization) return true;\n\n        const subject = this._subjectFor(principal);\n        const resource = authorization.slotResourceResolver.resolve(provider);\n        if (!resource) {\n            const decision: IAuthorizationDecision = { allowed: false, reason: \"unknown-resource\" };\n            writeAuthorizationAuditEvent(makeAuthorizationAuditEvent({ subject, slot: AggregateServer.SLOT, provider }, decision));\n            return false;\n        }\n\n        try {\n            const classified = authorization.capabilityClassifier.classify(operation, resource, provider);\n            if (!classified) return true;\n            const decision = authorization.engine.authorize({\n                subject,\n                capability: classified.capability,\n                resource,\n                provider,\n                tool: classified.tool,\n            });\n            if (!decision.allowed || authorization.audit.logAllowed) {\n                writeAuthorizationAuditEvent(\n                    makeAuthorizationAuditEvent(\n                        {\n                            subject,\n                            slot: AggregateServer.SLOT,\n                            resource,\n                            capability: classified.capability,\n                            provider,\n                            tool: classified.tool,\n                        },\n                        decision\n                    )\n                );\n            }\n            return decision.allowed;\n        } catch {\n            console.error(\"[broker] aggregate policy evaluation failed.\");\n            const decision: IAuthorizationDecision = { allowed: false, reason: \"no-matching-grant\" };\n            writeAuthorizationAuditEvent(\n                makeAuthorizationAuditEvent(\n                    {\n                        subject,\n                        slot: AggregateServer.SLOT,\n                        resource,\n                        provider,\n                    },\n                    decision\n                )\n            );\n            return false;\n        }\n    }\n\n    private _allows(principal: IPrincipal | null, provider: string, operation: IMcpOperation): boolean {\n        return this._scopeAllows(principal, provider) && this._policyAllows(principal, provider, operation);\n    }\n\n    private async _handleClientMessage(data: string, principal: IPrincipal | null): Promise<void> {\n        let msg: IClientMessage;\n        try {\n            msg = JSON.parse(data) as IClientMessage;\n        } catch {\n            return;\n        }\n        const id = msg.id;\n        if (id == null) return; // client notification: nothing to answer\n\n        switch (msg.method) {\n            case \"initialize\":\n                this._reply(id, {\n                    result: {\n                        protocolVersion: PROTOCOL_VERSION,\n                        serverInfo: { name: AggregateServer.SLOT, version: \"0\" },\n                        capabilities: { tools: { listChanged: true }, prompts: { listChanged: true } },\n                    },\n                });\n                break;\n            case \"ping\":\n                this._reply(id, { result: {} });\n                break;\n            case \"tools/list\":\n                this._reply(id, {\n                    result: {\n                        tools: this._catalog.toolsFor((provider) => this._allows(principal, provider, { method: \"tools/list\" })),\n                    },\n                });\n                break;\n            case \"prompts/list\":\n                this._reply(id, {\n                    result: {\n                        prompts: this._catalog.promptsFor((provider) => this._allows(principal, provider, { method: \"prompts/list\" })),\n                    },\n                });\n                break;\n            case \"tools/call\":\n                await this._route(id, msg.params, \"tool\", principal);\n                break;\n            case \"prompts/get\":\n                await this._route(id, msg.params, \"prompt\", principal);\n                break;\n            default:\n                this._reply(id, { error: { code: -32601, message: `Method not found: ${msg.method ?? \"(none)\"}` } });\n        }\n    }\n\n    private async _route(id: string | number, params: unknown, kind: \"tool\" | \"prompt\", principal: IPrincipal | null): Promise<void> {\n        const p = (params ?? {}) as ICallParams;\n        const route = p.name ? (kind === \"tool\" ? this._catalog.resolveTool(p.name) : this._catalog.resolvePrompt(p.name)) : undefined;\n        // Treat a provider the caller may not see as if it did not exist, do not\n        // leak its presence through a distinct \"forbidden\" error.\n        const operation: IMcpOperation | undefined = route\n            ? kind === \"tool\"\n                ? { method: \"tools/call\", params: { name: route.original } }\n                : { method: \"prompts/get\", params: { name: route.original } }\n            : undefined;\n        if (!route || !operation || !this._allows(principal, route.provider, operation)) {\n            this._reply(id, { error: { code: -32602, message: `Unknown aggregated ${kind}: ${p.name ?? \"(none)\"}` } });\n            return;\n        }\n        const session = this._sessions.get(route.provider);\n        if (!session) {\n            this._reply(id, { error: { code: -32000, message: `Provider \"${route.provider}\" is no longer connected` } });\n            return;\n        }\n        const args = p.arguments ?? {};\n        const outcome = kind === \"tool\" ? await session.callTool(route.original, args) : await session.getPrompt(route.original, args);\n        this._reply(id, outcome.error !== undefined ? { error: outcome.error } : { result: outcome.result });\n    }\n\n    private _reply(id: string | number, body: { result?: unknown; error?: unknown }): void {\n        this.onMessage?.(JSON.stringify({ jsonrpc: \"2.0\", id, ...body }));\n    }\n\n    private _emitListChanged(): void {\n        if (!this._running) return;\n        this.onMessage?.(JSON.stringify({ jsonrpc: \"2.0\", method: \"notifications/tools/list_changed\" }));\n        this.onMessage?.(JSON.stringify({ jsonrpc: \"2.0\", method: \"notifications/prompts/list_changed\" }));\n    }\n}\n","/**\n * Core contracts for the broker's OAuth 2.1 **resource server** layer.\n *\n * The broker never acts as an authorization server: it only validates the\n * access tokens minted by an external AS and advertises that AS through\n * Protected Resource Metadata (RFC 9728). These types are the seam every other\n * auth module builds on, so a host can drop in a custom {@link ITokenValidator}\n * (e.g. RFC 7662 introspection) without touching the enforcement code.\n *\n * Everything the MCP specification itself defines comes from `mcp-core` and is\n * re-exported here under the broker's historical names: the claim shape, the\n * validator seam, the error carrying a challenge. What stays broker-owned is\n * what the spec does not define, namely a multi-slot resource server whose\n * principals feed a hierarchical policy engine.\n */\nimport { McpAuthError, scopesOf as mcpScopesOf, type IAccessTokenClaims, type IMcpPrincipal, type ITokenValidator } from \"@cyanmycelium/mcp-core\";\nimport type { IAuthorizationSubject, IPolicyAuthorization, ISlotResourceResolver } from \"../authorization/index\";\n\nexport type { IAccessTokenClaims, ITokenValidator } from \"@cyanmycelium/mcp-core\";\n\n/** OAuth 2.1 error codes the broker emits in `WWW-Authenticate` challenges. */\nexport type AuthErrorCode = import(\"@cyanmycelium/mcp-core\").McpAuthErrorCode;\n\n/**\n * A thrown authorization failure carrying the HTTP status and OAuth error code\n * the enforcement point should surface. `scope` is set for `insufficient_scope`\n * challenges to advertise the scope(s) the resource requires.\n *\n * The broker's own name for `mcp-core`'s `McpAuthError`, kept so `instanceof`\n * checks and the published API survive the consolidation. There is one class at\n * runtime, so an error thrown by `mcp-core` is caught by the broker and the\n * other way round.\n */\nexport const AuthError = McpAuthError;\nexport type AuthError = McpAuthError;\n\n/**\n * The authenticated caller, produced once a token passes validation and the\n * required scopes are satisfied. Threaded through the request so downstream\n * components (e.g. the `_all` aggregate) can make scope-aware decisions.\n *\n * Extends `mcp-core`'s principal with the subject the policy engine reasons\n * about, which the specification says nothing about and which therefore stays\n * here.\n */\nexport interface IPrincipal extends IMcpPrincipal {\n    readonly claims: IAccessTokenClaims;\n    readonly scopes: ReadonlySet<string>;\n    /** Subjects derived exclusively from validated token claims. */\n    readonly subject?: IAuthorizationSubject;\n}\n\n/**\n * Decides, per authenticated caller, whether a given provider is visible in the\n * `_all` aggregate. This is the content-confidentiality enforcement point: a\n * client only sees (and can call) tools/prompts from providers it is authorized\n * for. Return `true` to include the provider for this principal.\n */\nexport type AggregateScopeFilter = (principal: IPrincipal, providerName: string) => boolean;\n\n/**\n * A fully resolved authorization configuration, ready for the enforcement\n * layer. Built either from JSON config (via `buildJwtAuth`) or supplied\n * directly by an embedder with a custom {@link ITokenValidator}.\n */\nexport interface IResolvedAuth {\n    /**\n     * Public origin the broker is reached at, used to build canonical resource\n     * URIs and metadata URLs. No trailing slash (e.g. `https://mcp.example.com`).\n     */\n    publicBaseUrl: string;\n    /** One or more authorization server issuer URLs, advertised in the PRM. */\n    authorizationServers: string[];\n    /** Optional list of scopes advertised in the PRM `scopes_supported`. */\n    scopesSupported?: string[];\n    /** The token validator (JWKS-backed by default). */\n    validator: ITokenValidator;\n    /** Baseline scope(s) required to reach any slot. Empty ⇒ any valid token. */\n    requiredScopes?: string[];\n    /** Per-slot required-scope overrides (e.g. an admin scope for `_broker`). */\n    perSlotScopes?: Record<string, string[]>;\n    /**\n     * Per-caller filter for the `_all` aggregate. When set, a client's view of\n     * `_all` is narrowed to the providers this returns `true` for. When absent,\n     * every authenticated caller sees the full aggregate.\n     */\n    aggregateScopeFilter?: AggregateScopeFilter;\n    /** Compiled hierarchical policy runtime, absent for legacy OAuth behavior. */\n    authorization?: IPolicyAuthorization;\n    /** Optional resolver usable for provider namespace checks without policies. */\n    slotResourceResolver?: ISlotResourceResolver;\n}\n\n/**\n * Extracts the effective set of granted scopes from token claims.\n *\n * A deliberate superset of `mcp-core`'s: OAuth 2.1 only defines the\n * space-delimited `scope` string, which is what the spec-level helper reads,\n * but several authorization servers emit an array-form `scopes` claim instead.\n * Dropping that here would silently strip every scope for those deployments, so\n * the two are unioned. The `scope` half is parsed by `mcp-core` rather than\n * re-implemented.\n */\nexport function scopesOf(claims: IAccessTokenClaims): Set<string> {\n    const set = new Set<string>(mcpScopesOf(claims));\n    const arrayForm: unknown = claims[\"scopes\"];\n    if (Array.isArray(arrayForm)) {\n        for (const scope of arrayForm) if (typeof scope === \"string\" && scope) set.add(scope);\n    }\n    return set;\n}\n\n/** @deprecated Use {@link IAccessTokenClaims}. */\nexport type AccessTokenClaims = IAccessTokenClaims;\n/** @deprecated Use {@link ITokenValidator}. */\nexport type TokenValidator = ITokenValidator;\n/** @deprecated Use {@link IPrincipal}. */\nexport type Principal = IPrincipal;\n/** @deprecated Use {@link IResolvedAuth}. */\nexport type ResolvedAuth = IResolvedAuth;\n","import { createRemoteJWKSet, jwtVerify, errors, type JWTVerifyGetKey } from \"jose\";\nimport { AuthError, type IAccessTokenClaims, type ITokenValidator } from \"./auth.types\";\n\n/**\n * Options for {@link JwtTokenValidator}. `jwksUri` points at the authorization\n * server's JWKS endpoint; `issuer` (when set) is checked against the token `iss`.\n */\nexport interface IJwtValidatorOptions {\n    /** URL of the authorization server's JWKS document. */\n    jwksUri: string;\n    /** Expected token issuer(s). When omitted, the `iss` claim is not checked. */\n    issuer?: string | string[];\n    /** Leeway in seconds for `exp`/`nbf` checks. Defaults to jose's `0`. */\n    clockToleranceSec?: number;\n}\n\n/**\n * An {@link ITokenValidator} that verifies JWT access tokens **statelessly** by\n * checking the signature against the authorization server's JWKS and validating\n * the standard claims. This is the default validator for a public deployment:\n * no per-request round-trip to the AS, no shared introspection secret.\n *\n * Audience binding (RFC 8707) is enforced by passing the per-request canonical\n * resource URI as the required `audience`, so a token minted for another slot ,\n * or another service, is rejected.\n *\n * The JWKS is fetched lazily and cached (with rotation/cooldown) by\n * `jose.createRemoteJWKSet`.\n */\nexport class JwtTokenValidator implements ITokenValidator {\n    private readonly _jwks: JWTVerifyGetKey;\n    private readonly _issuer?: string | string[];\n    private readonly _clockTolerance: number;\n\n    constructor(options: IJwtValidatorOptions) {\n        this._jwks = createRemoteJWKSet(new URL(options.jwksUri));\n        this._issuer = options.issuer;\n        this._clockTolerance = options.clockToleranceSec ?? 0;\n    }\n\n    async validate(token: string, resource: string): Promise<IAccessTokenClaims> {\n        try {\n            const { payload } = await jwtVerify(token, this._jwks, {\n                audience: resource,\n                issuer: this._issuer,\n                clockTolerance: this._clockTolerance,\n            });\n            return payload as IAccessTokenClaims;\n        } catch (err) {\n            // Token-level failures (bad signature, wrong audience/issuer, expired,\n            // no matching key) are JOSEError subclasses ⇒ a genuine 401. Anything\n            // else (JWKS endpoint unreachable, malformed config) is infrastructure:\n            // rethrow so the caller surfaces a 500 instead of a misleading 401.\n            if (err instanceof errors.JOSEError) {\n                throw new AuthError(401, \"invalid_token\", err.message);\n            }\n            throw err;\n        }\n    }\n}\n\n/** @deprecated Use {@link IJwtValidatorOptions}. */\nexport type JwtValidatorOptions = IJwtValidatorOptions;\n","/**\n * OAuth 2.0 Protected Resource Metadata (RFC 9728).\n *\n * Each slot exposed over HTTP is an independent resource server; its metadata\n * document tells an MCP client which authorization server(s) issue tokens for\n * that slot and which bearer methods it accepts. Served (unauthenticated, it is\n * public discovery data) at\n * `<publicBaseUrl>/.well-known/oauth-protected-resource/<slot>/<mcp>`.\n */\n\nimport { buildProtectedResourceMetadata, type IProtectedResourceMetadata } from \"@cyanmycelium/mcp-core\";\n\n/** The RFC 9728 metadata document for a single protected resource. */\nexport type { IProtectedResourceMetadata } from \"@cyanmycelium/mcp-core\";\n\n/**\n * Builds the RFC 9728 metadata document for one slot.\n *\n * The document itself is shaped by `mcp-core`: it is defined by the MCP\n * specification, identically for every server. What is broker-specific is only\n * which resource a slot maps to, and that is decided by the caller.\n * `bearer_methods_supported` comes out fixed to `[\"header\"]`, matching the\n * broker's refusal to read a token from anywhere but the header (OAuth 2.1 §5).\n */\nexport function buildResourceMetadata(params: { resource: string; authorizationServers: string[]; scopesSupported?: string[] }): IProtectedResourceMetadata {\n    return buildProtectedResourceMetadata({\n        resource: params.resource,\n        authorizationServers: params.authorizationServers,\n        scopesSupported: params.scopesSupported,\n    });\n}\n\n/** @deprecated Use {@link IProtectedResourceMetadata}. */\nexport type ProtectedResourceMetadata = IProtectedResourceMetadata;\n","import type { IncomingMessage, ServerResponse } from \"http\";\nimport { bearerToken, buildChallengeHeader, PROTECTED_RESOURCE_METADATA_PREFIX } from \"@cyanmycelium/mcp-core\";\nimport { AuthError, scopesOf, type IPrincipal, type IResolvedAuth } from \"./auth.types\";\nimport { buildResourceMetadata, type IProtectedResourceMetadata } from \"./resource.metadata\";\nimport { SubjectMappingError } from \"../authorization/index\";\n\n/**\n * Well-known prefix under which per-slot Protected Resource Metadata is served.\n *\n * Carries a trailing slash because every use here splits a slot off it, while\n * `mcp-core` exports the bare RFC 9728 prefix.\n */\nconst PRM_PREFIX = `${PROTECTED_RESOURCE_METADATA_PREFIX}/`;\n\n/**\n * The HTTP enforcement point for the resource-server layer. Wraps a\n * {@link IResolvedAuth} plus the configured `/mcp` path suffix and turns it into\n * the three operations the transport needs: serve Protected Resource Metadata,\n * authorize a request, and write an RFC 9728 `401`/`403` challenge.\n *\n * A slot's **canonical resource URI** is `<publicBaseUrl>/<slot>/<mcp>` and is\n * used uniformly across all of that slot's HTTP endpoints (`/mcp`, `/sse`,\n * `/messages`) so a single token audience covers the whole slot.\n */\nexport class HttpAuthGuard {\n    private readonly _auth: IResolvedAuth;\n    /** The `/mcp` suffix without a leading slash, e.g. `\"mcp\"`. */\n    private readonly _mcpSuffix: string;\n\n    constructor(auth: IResolvedAuth, mcpSuffix: string) {\n        this._auth = auth;\n        this._mcpSuffix = mcpSuffix.replace(/^\\//, \"\");\n    }\n\n    /** Canonical resource identifier for a slot (RFC 8707 §2). */\n    resourceFor(slot: string): string {\n        return `${this._auth.publicBaseUrl}/${encodeURIComponent(slot)}/${this._mcpSuffix}`;\n    }\n\n    /** RFC 9728 metadata URL for a slot, advertised in the `401` challenge. */\n    metadataUrlFor(slot: string): string {\n        return `${this._auth.publicBaseUrl}${PRM_PREFIX}${encodeURIComponent(slot)}/${this._mcpSuffix}`;\n    }\n\n    /** Required scope(s) for a slot: per-slot override, else the baseline. */\n    requiredScopesFor(slot: string): string[] {\n        return this._auth.perSlotScopes?.[slot] ?? this._auth.requiredScopes ?? [];\n    }\n\n    /** The RFC 9728 metadata document for a slot. */\n    metadataFor(slot: string): IProtectedResourceMetadata {\n        return buildResourceMetadata({\n            resource: this.resourceFor(slot),\n            authorizationServers: this._auth.authorizationServers,\n            scopesSupported: this._auth.scopesSupported,\n        });\n    }\n\n    /**\n     * If `rawUrl` is a Protected Resource Metadata request\n     * (`/.well-known/oauth-protected-resource/<slot>/<mcp>`), returns the slot;\n     * otherwise `null`.\n     */\n    matchMetadataRequest(rawUrl: string): string | null {\n        if (!rawUrl.startsWith(PRM_PREFIX)) return null;\n        const parts = rawUrl.slice(PRM_PREFIX.length).split(\"/\").filter(Boolean);\n        if (parts.length !== 2 || parts[1] !== this._mcpSuffix) return null;\n        return decodeURIComponent(parts[0]);\n    }\n\n    /**\n     * Validates the request's bearer token against the slot's canonical resource\n     * and enforces the slot's required scopes. Resolves to the {@link IPrincipal}\n     * on success; rejects with an {@link AuthError} (`401` missing/invalid token,\n     * `403` insufficient scope) otherwise.\n     */\n    async authorize(req: IncomingMessage, slot: string): Promise<IPrincipal> {\n        const token = bearerToken(req.headers[\"authorization\"]);\n        if (!token) {\n            throw new AuthError(401, \"invalid_token\", \"Missing bearer token\");\n        }\n\n        const claims = await this._auth.validator.validate(token, this.resourceFor(slot));\n        const scopes = scopesOf(claims);\n\n        const required = this.requiredScopesFor(slot);\n        const missing = required.filter((s) => !scopes.has(s));\n        if (missing.length > 0) {\n            throw new AuthError(403, \"insufficient_scope\", `Missing required scope(s): ${missing.join(\" \")}`, required.join(\" \"));\n        }\n\n        let subject: IPrincipal[\"subject\"];\n        try {\n            subject = this._auth.authorization?.subjectMapper.map(claims);\n        } catch (error) {\n            if (error instanceof SubjectMappingError) {\n                throw new AuthError(403, \"insufficient_scope\", \"Malformed configured JWT subject claim\");\n            }\n            throw error;\n        }\n\n        return subject ? { claims, scopes, subject } : { claims, scopes };\n    }\n\n    /**\n     * Builds the RFC 9728 §5.1 `WWW-Authenticate` header value for a challenge.\n     * Always points the client at the slot's metadata URL so it can discover the\n     * authorization server and retry. Shared by the HTTP and WebSocket paths.\n     */\n    challengeHeader(slot: string, err: AuthError): string {\n        return buildChallengeHeader({\n            resourceMetadata: this.metadataUrlFor(slot),\n            error: err.code,\n            errorDescription: err.description,\n            scope: err.scope,\n        });\n    }\n\n    /**\n     * Writes an RFC 9728 §5.1 `WWW-Authenticate` challenge and the matching\n     * status to an HTTP response.\n     */\n    writeChallenge(res: ServerResponse, slot: string, err: AuthError): void {\n        res.setHeader(\"WWW-Authenticate\", this.challengeHeader(slot, err));\n        res.writeHead(err.status, { \"Content-Type\": \"application/json; charset=utf-8\" });\n        res.end(JSON.stringify({ error: err.code, error_description: err.description }));\n    }\n}\n","import { JwtTokenValidator } from \"./jwt.validator\";\nimport type { AggregateScopeFilter, IResolvedAuth } from \"./auth.types\";\nimport { compileAuthorizationPolicy, DefaultSlotResourceResolver, hasAuthorizationPolicies, type IAuthorizationPolicyConfig } from \"../authorization/index\";\n\n/**\n * High-level options for the default JWT/JWKS resource-server setup. Mirrors the\n * `auth` block of the broker JSON config and is turned into a fully\n * {@link IResolvedAuth} (with a {@link JwtTokenValidator}) by {@link buildJwtAuth}.\n */\nexport interface IJwtAuthOptions extends IAuthorizationPolicyConfig {\n    /** Public origin the broker is reached at (e.g. `https://mcp.example.com`). */\n    publicBaseUrl: string;\n    /** Authorization server issuer URL(s) advertised in the PRM. At least one. */\n    authorizationServers: string[];\n    /** URL of the authorization server's JWKS document. */\n    jwksUri: string;\n    /** Expected token issuer(s). Defaults to the sole authorization server. */\n    issuer?: string | string[];\n    /** Scopes advertised in the PRM `scopes_supported`. */\n    scopesSupported?: string[];\n    /** Baseline scope(s) required to reach any slot. */\n    requiredScopes?: string[];\n    /** Per-slot required-scope overrides (e.g. an admin scope for `_broker`). */\n    perSlotScopes?: Record<string, string[]>;\n    /**\n     * Per-provider scope requirements for the `_all` aggregate. A caller sees a\n     * provider in `_all` only if it holds at least one of the listed scopes.\n     * Providers not listed here stay visible to every authenticated caller.\n     * Turned into an {@link AggregateScopeFilter} automatically.\n     */\n    providerScopes?: Record<string, string[]>;\n    /** Leeway in seconds for token `exp`/`nbf` checks. */\n    clockToleranceSec?: number;\n}\n\n/** Builds the default aggregate filter from a per-provider scope map. */\nfunction makeProviderScopeFilter(providerScopes: Record<string, string[]>): AggregateScopeFilter {\n    return (principal, providerName) => {\n        const required = providerScopes[providerName];\n        if (!required || required.length === 0) return true; // unlisted ⇒ visible to all\n        return required.some((scope) => principal.scopes.has(scope));\n    };\n}\n\n/** Removes a single trailing slash so resource URIs concatenate cleanly. */\nfunction stripTrailingSlash(url: string): string {\n    return url.endsWith(\"/\") ? url.slice(0, -1) : url;\n}\n\n/**\n * Builds an {@link IResolvedAuth} backed by a {@link JwtTokenValidator}. Validates\n * the required inputs up front and throws a descriptive error on misconfig, so\n * an operator sees the problem at boot rather than as opaque `401`s later.\n */\nexport function buildJwtAuth(options: IJwtAuthOptions): IResolvedAuth {\n    if (!options.publicBaseUrl) {\n        throw new Error(\"auth: publicBaseUrl is required.\");\n    }\n    if (!options.authorizationServers || options.authorizationServers.length === 0) {\n        throw new Error(\"auth: at least one authorizationServers entry is required.\");\n    }\n    if (!options.jwksUri) {\n        throw new Error(\"auth: jwksUri is required.\");\n    }\n\n    const publicBaseUrl = stripTrailingSlash(options.publicBaseUrl);\n    const issuer = options.issuer ?? (options.authorizationServers.length === 1 ? options.authorizationServers[0] : undefined);\n\n    const validator = new JwtTokenValidator({\n        jwksUri: options.jwksUri,\n        issuer,\n        clockToleranceSec: options.clockToleranceSec,\n    });\n\n    const resolved: IResolvedAuth = {\n        publicBaseUrl,\n        authorizationServers: options.authorizationServers,\n        validator,\n    };\n    if (options.scopesSupported) resolved.scopesSupported = options.scopesSupported;\n    if (options.requiredScopes) resolved.requiredScopes = options.requiredScopes;\n    if (options.perSlotScopes) resolved.perSlotScopes = options.perSlotScopes;\n    if (options.providerScopes && Object.keys(options.providerScopes).length > 0) {\n        console.warn(\"[mcp-broker] auth.providerScopes is deprecated; migrate to roles and hierarchical assignments.\");\n        resolved.aggregateScopeFilter = makeProviderScopeFilter(options.providerScopes);\n    }\n    if (options.slotResources && Object.keys(options.slotResources).length > 0) {\n        resolved.slotResourceResolver = new DefaultSlotResourceResolver(options.slotResources);\n    }\n    if (hasAuthorizationPolicies(options)) {\n        resolved.authorization = compileAuthorizationPolicy(options);\n        resolved.slotResourceResolver = resolved.authorization.slotResourceResolver;\n    }\n    return resolved;\n}\n\n/** @deprecated Use {@link IJwtAuthOptions}. */\nexport type JwtAuthOptions = IJwtAuthOptions;\n","import { timingSafeEqual } from \"crypto\";\nimport type { IncomingMessage } from \"http\";\nimport { ResourcePath, ResourcePathPattern } from \"../authorization/index\";\n\nexport interface IProviderPrincipal {\n    readonly id: string;\n    readonly subjects?: readonly string[];\n    readonly allowedResources?: readonly string[];\n    readonly metadata?: Readonly<Record<string, unknown>>;\n}\n\nexport type ProviderAuthenticationResult = { readonly authenticated: true; readonly principal: IProviderPrincipal } | { readonly authenticated: false; readonly reason?: string };\n\nexport type ProviderAuthenticatorReturn = boolean | ProviderAuthenticationResult;\n\n/**\n * Authenticates a **provider** (the engine that connects _into_ the broker to\n * serve a slot) at the WebSocket upgrade handshake. This is a distinct concern\n * from the OAuth 2.1 resource-server layer that guards *clients*: a provider is\n * not an OAuth client acting for a resource owner, it is the backend claiming a\n * slot. Authenticating it is what stops a stranger from occupying a free slot\n * (`ws://host/provider/<slot>`) and impersonating the real engine.\n */\nexport interface IProviderAuthenticator {\n    /**\n     * Returns a structured result, or a legacy boolean for backward\n     * compatibility. `slot` is the dedicated slot name for\n     * `/provider/<slot>`, or `undefined` for the multiplexed `/providers`\n     * socket, which is authenticated before any provider name is known.\n     */\n    authenticate(req: IncomingMessage, slot: string | undefined): ProviderAuthenticatorReturn | Promise<ProviderAuthenticatorReturn>;\n}\n\nexport function normalizeProviderAuthentication(result: ProviderAuthenticatorReturn, fallbackId = \"legacy-provider\"): ProviderAuthenticationResult {\n    if (typeof result === \"boolean\") {\n        return result ? { authenticated: true, principal: { id: fallbackId, allowedResources: [\"**\"] } } : { authenticated: false };\n    }\n    if (!result.authenticated) return result;\n    if (!result.principal.id) return { authenticated: false, reason: \"provider principal id is empty\" };\n    return result;\n}\n\nexport function providerMayPublish(principal: IProviderPrincipal, resource: ResourcePath): boolean {\n    const allowed = principal.allowedResources;\n    if (allowed === undefined) return true;\n    if (allowed.length === 0) return false;\n    try {\n        const patterns = allowed.map((pattern) => ResourcePathPattern.parse(pattern));\n        return patterns.some((pattern) => pattern.matches(resource));\n    } catch {\n        return false;\n    }\n}\n\n/** Constant-time string comparison; `false` on any length mismatch. */\nfunction safeEqual(a: string, b: string): boolean {\n    const ab = Buffer.from(a);\n    const bb = Buffer.from(b);\n    if (ab.length !== bb.length) return false;\n    return timingSafeEqual(ab, bb);\n}\n\n/**\n * Reads the secret a provider presents, from either the `X-Provider-Token`\n * header or an `Authorization: Bearer <secret>` header.\n */\nfunction presentedSecret(req: IncomingMessage): string | null {\n    const xheader = req.headers[\"x-provider-token\"];\n    if (typeof xheader === \"string\" && xheader.trim()) return xheader.trim();\n\n    const auth = req.headers[\"authorization\"];\n    if (typeof auth === \"string\") {\n        const match = /^Bearer\\s+(.+)$/i.exec(auth.trim());\n        if (match) return match[1].trim();\n    }\n    return null;\n}\n\n/**\n * The default {@link IProviderAuthenticator}: every provider connection must\n * present a single shared secret (via `X-Provider-Token` or `Authorization:\n * Bearer`). Compared in constant time. Suitable when the broker and its\n * providers are operated by the same party; swap in a custom authenticator for\n * per-slot secrets, mTLS, or a signed handshake.\n */\nexport class SharedSecretProviderAuthenticator implements IProviderAuthenticator {\n    private readonly _secret: string;\n\n    constructor(secret: string) {\n        if (!secret) {\n            throw new Error(\"provider auth: a non-empty shared secret is required.\");\n        }\n        this._secret = secret;\n    }\n\n    authenticate(req: IncomingMessage): ProviderAuthenticationResult {\n        const presented = presentedSecret(req);\n        if (!presented || !safeEqual(presented, this._secret)) {\n            return { authenticated: false };\n        }\n        return {\n            authenticated: true,\n            principal: {\n                id: \"shared-secret\",\n                allowedResources: [\"**\"],\n            },\n        };\n    }\n}\n\n/** @deprecated Use {@link IProviderPrincipal}. */\nexport type ProviderPrincipal = IProviderPrincipal;\n/** @deprecated Use {@link IProviderAuthenticator}. */\nexport type ProviderAuthenticator = IProviderAuthenticator;\n","import { createRequire } from \"module\";\n\n// Resolves the package's own version from package.json without bundler help.\n// Works both for the compiled dist/version.js (one level below package.json)\n// and for tsc's source-level resolution from src/version.ts.\nconst require = createRequire(import.meta.url);\nconst pkg = require(\"../package.json\") as { version: string; name: string };\n\nexport const VERSION: string = pkg.version;\nexport const PACKAGE_NAME: string = pkg.name;\n","import * as fs from \"fs\";\nimport * as http from \"http\";\nimport * as https from \"https\";\nimport * as nodePath from \"path\";\nimport { randomUUID } from \"crypto\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { WebSocket, WebSocketServer, type VerifyClientCallbackAsync } from \"ws\";\nimport type { IMessageTransport, IMcpServer } from \"@cyanmycelium/mcp-core\";\nimport { StdioTransport, StreamableHttpEndpoint } from \"@cyanmycelium/mcp-core/node\";\n// The broker is itself a provider: it publishes its own `_broker` and `_all`\n// slots: so sharing the provider package's wire contract is the natural way to\n// keep one definition of the envelope rather than two that drift.\nimport { decodeEnvelope, encodeEnvelope, encodeErrorEnvelope, envelopeFrame, TunnelErrorCodes } from \"@cyanmycelium/mcp-broker-provider/protocol\";\nimport { StdioUpstream } from \"../stdio.upstream\";\nimport { RemoteUpstream } from \"../remote.upstream\";\nimport type { IUpstream } from \"../upstream\";\nimport { startBrokerServer, BROKER_PROVIDER_NAME } from \"../broker/index\";\nimport type { IBrokerContext, IBrokerProviderInfo, BrokerProviderTransport } from \"../broker/index\";\nimport { AggregateServer } from \"../broker/aggregate/aggregate.server\";\nimport {\n    HttpAuthGuard,\n    AuthError,\n    normalizeProviderAuthentication,\n    providerMayPublish,\n    type IProviderAuthenticator,\n    type IPrincipal,\n    type IProviderPrincipal,\n} from \"../auth/index\";\nimport {\n    DefaultSlotResourceResolver,\n    SubjectMappingError,\n    makeAuthorizationAuditEvent,\n    writeAuthorizationAuditEvent,\n    type IAuthorizationDecision,\n    type IAuthorizationSubject,\n    type IPolicyAuthorization,\n    type ResourcePath,\n    type ISlotResourceResolver,\n} from \"../authorization/index\";\nimport { VERSION, PACKAGE_NAME } from \"../version\";\nimport type { AllowedOrigins, IHttpSession, IInternalClient, IProviderState, IWsTunnelOptions, McpEndpointKind } from \"./ws.interfaces\";\n\n// ---------------------------------------------------------------------------\n// Static-file helpers\n// ---------------------------------------------------------------------------\n\n/** Maps file extensions to their HTTP Content-Type values. */\nconst MIME: Readonly<Record<string, string>> = {\n    \".html\": \"text/html; charset=utf-8\",\n    \".js\": \"application/javascript; charset=utf-8\",\n    \".mjs\": \"application/javascript; charset=utf-8\",\n    \".css\": \"text/css; charset=utf-8\",\n    \".json\": \"application/json; charset=utf-8\",\n    \".map\": \"application/json; charset=utf-8\",\n    \".svg\": \"image/svg+xml\",\n    \".png\": \"image/png\",\n    \".ico\": \"image/x-icon\",\n    \".woff2\": \"font/woff2\",\n    \".woff\": \"font/woff\",\n};\n\n// ---------------------------------------------------------------------------\n// JSON-RPC helpers\n// ---------------------------------------------------------------------------\n\n/**\n * The JSON-RPC id a frame is waiting on, or `undefined` when nothing will come\n * back for it: a notification, or something that did not parse.\n *\n * `null` is a legal id in an error response, so absence cannot be signalled\n * with it, hence `undefined`.\n */\nfunction requestIdOf(frame: string): string | number | undefined {\n    try {\n        const parsed = JSON.parse(frame) as { id?: unknown };\n        if (typeof parsed?.id === \"string\" || typeof parsed?.id === \"number\") return parsed.id;\n    } catch {\n        /* not JSON: nothing to route by */\n    }\n    return undefined;\n}\n\n/**\n * Turns the three shapes an operator may configure into the single predicate\n * the Streamable HTTP endpoint expects.\n *\n * Absent means closed, not open: a browser origin is refused unless it was\n * named. A `RegExp` is reset before each test, because one carrying the `g`\n * flag keeps `lastIndex` between calls and would otherwise accept and refuse\n * the same origin in turn.\n */\nfunction originPredicate(allowed: AllowedOrigins | undefined): (origin: string) => boolean {\n    if (!allowed) return () => false;\n    if (typeof allowed === \"function\") return allowed;\n    if (allowed instanceof RegExp) {\n        return (origin) => {\n            allowed.lastIndex = 0;\n            return allowed.test(origin);\n        };\n    }\n    const exact = new Set(allowed);\n    return (origin) => exact.has(origin);\n}\n\n/**\n * Opens a transport that was handed over closed.\n *\n * `connect` is not part of `IMessageTransport`, because some transports arrive\n * already open, so it is probed for rather than required. This is the same\n * check `McpServer` makes on the transport it is given, and for the same\n * reason: testing for a concrete class would tie the caller to one\n * implementation.\n */\nfunction openTransport(transport: IMessageTransport): void {\n    if (\"connect\" in transport && typeof (transport as { connect: unknown }).connect === \"function\") {\n        (transport as { connect(): void }).connect();\n    }\n}\n\n// ---------------------------------------------------------------------------\n// WsTunnel\n// ---------------------------------------------------------------------------\n\n/**\n * A multi-provider relay that bridges any number of MCP server instances\n * (the **providers**) with their respective MCP clients.\n *\n * ## Transport overview\n * ```\n * Provider \"<name>\"\n *   ws://host/provider/<name>           ← WebSocket registration\n *\n * MCP Inspector (Streamable HTTP, 2025-03-26)\n *   GET  http://host/<name>/mcp         ← persistent SSE notification stream\n *   POST http://host/<name>/mcp         → JSON-RPC requests\n *\n * Claude (legacy SSE transport)\n *   GET  http://host/<name>/sse              ← SSE notification stream\n *   POST http://host/<name>/messages         → JSON-RPC requests\n * ```\n *\n * Each provider gets its own isolated set of sessions, pending requests, and\n * notification streams. Multiple providers can be connected simultaneously.\n */\nexport class WsTunnel implements IBrokerContext {\n    private readonly _options: IWsTunnelOptions;\n    private _httpServer: http.Server | https.Server | null = null;\n    private _wss: WebSocketServer | null = null;\n\n    /**\n     * Per-provider state, keyed by provider name.\n     * Created lazily: a slot is allocated the first time any client references\n     * a provider name, even before the provider WebSocket connects.\n     */\n    private readonly _providers = new Map<string, IProviderState>();\n\n    /** Maps a multiplexed WebSocket to the set of provider names it feeds. */\n    private readonly _multiplexSockets = new Map<WebSocket, Set<string>>();\n\n    /** Upstream providers (stdio child processes and remote URL servers), keyed by name. */\n    private readonly _upstreams = new Map<string, IUpstream>();\n\n    /**\n     * In-process loopback transports registered as provider slots.\n     * Used by the embedded broker server (`_broker`) and any other component\n     * that wants to expose itself as a provider without going through a network.\n     */\n    private readonly _loopbackProviders = new Map<string, IMessageTransport>();\n\n    /** The embedded broker MCP server, when {@link IWsTunnelOptions.enableBrokerProvider} is on. */\n    private _brokerServer: IMcpServer | null = null;\n\n    /** The aggregate MCP server (`_all` slot), when {@link IWsTunnelOptions.enableAggregateProvider} is on. */\n    private _aggregateServer: AggregateServer | null = null;\n\n    /** Provider name that the stdio client transport is bridged to, or null when disabled. */\n    private _stdioClientProvider: string | null = null;\n\n    /** mcp-core transport connected to the broker process stdin/stdout. */\n    private _stdioClientTransport: StdioTransport | null = null;\n\n    /** Timestamp of the most recent successful `start()`. */\n    private _startedAt: Date | null = null;\n\n    /** HTTP resource-server enforcement point, or `null` when auth is disabled. */\n    private readonly _authGuard: HttpAuthGuard | null;\n\n    /** Provider (engine) authenticator, or `null` when provider auth is disabled. */\n    private readonly _providerAuth: IProviderAuthenticator | null;\n\n    /** Compiled hierarchical authorization, or `null` for legacy behavior. */\n    private readonly _authorization: IPolicyAuthorization | null;\n\n    /** Stable technical-slot to hierarchical-resource mapping. */\n    private readonly _slotResourceResolver: ISlotResourceResolver;\n\n    /** Origin check applied by every slot's Streamable HTTP endpoint. */\n    private readonly _allowedOrigins: (origin: string) => boolean;\n\n    /** Principal captured at a client's WS upgrade, keyed by the upgrade request. */\n    private readonly _pendingClientPrincipals = new WeakMap<IncomingMessage, IPrincipal>();\n\n    /** Authenticated principal per raw WS client socket, for `_all` scope filtering. */\n    private readonly _clientPrincipals = new WeakMap<WebSocket, IPrincipal>();\n\n    /** Authenticated principal attached to long-lived HTTP/SSE streams. */\n    private readonly _streamPrincipals = new WeakMap<ServerResponse, IPrincipal>();\n\n    /** Provider principals captured during successful WebSocket upgrades. */\n    private readonly _pendingProviderPrincipals = new WeakMap<IncomingMessage, IProviderPrincipal>();\n    private readonly _providerPrincipals = new WeakMap<WebSocket, IProviderPrincipal>();\n\n    constructor(options: IWsTunnelOptions) {\n        this._options = options;\n        this._authGuard = options.auth ? new HttpAuthGuard(options.auth, options.mcpPath ?? \"/mcp\") : null;\n        this._providerAuth = options.providerAuth ?? null;\n        this._allowedOrigins = originPredicate(options.allowedOrigins);\n        this._authorization = options.authorization ?? options.auth?.authorization ?? null;\n        this._slotResourceResolver =\n            options.slotResourceResolver ?? this._authorization?.slotResourceResolver ?? options.auth?.slotResourceResolver ?? new DefaultSlotResourceResolver();\n    }\n\n    // -------------------------------------------------------------------------\n    // IBrokerContext implementation\n    // -------------------------------------------------------------------------\n\n    get version(): string {\n        return VERSION;\n    }\n\n    get name(): string {\n        return this._options.brokerName ?? PACKAGE_NAME;\n    }\n\n    get startedAt(): Date | null {\n        return this._startedAt;\n    }\n\n    get uptimeSeconds(): number {\n        if (!this._startedAt) return 0;\n        return Math.floor((Date.now() - this._startedAt.getTime()) / 1000);\n    }\n\n    get host(): string | undefined {\n        return this._options.host;\n    }\n\n    get port(): number {\n        return this._options.port;\n    }\n\n    get tls(): boolean {\n        return !!this._options.tls;\n    }\n\n    get paths(): IBrokerContext[\"paths\"] {\n        const o = this._options;\n        return {\n            provider: o.providerPath ?? \"/provider\",\n            providers: o.providersPath ?? \"/providers\",\n            client: o.clientPath ?? \"/\",\n            mcp: o.mcpPath ?? \"/mcp\",\n            sse: o.ssePath ?? \"/sse\",\n            messages: o.messagesPath ?? \"/messages\",\n        };\n    }\n\n    public getProvidersInfo(): IBrokerProviderInfo[] {\n        const out: IBrokerProviderInfo[] = [];\n        for (const [name, state] of this._providers) {\n            out.push(this._buildProviderInfo(name, state));\n        }\n        return out;\n    }\n\n    public getProviderInfo(name: string): IBrokerProviderInfo | undefined {\n        const state = this._providers.get(name);\n        if (!state) return undefined;\n        return this._buildProviderInfo(name, state);\n    }\n\n    private _buildProviderInfo(name: string, state: IProviderState): IBrokerProviderInfo {\n        let transport: BrokerProviderTransport;\n        let connected: boolean;\n\n        if (this._loopbackProviders.get(name)?.isOpen) {\n            transport = \"loopback\";\n            connected = true;\n        } else if (this._upstreams.get(name)?.isOpen) {\n            transport = \"stdio\";\n            connected = true;\n        } else if (state.ws?.readyState === WebSocket.OPEN) {\n            transport = this._multiplexSockets.has(state.ws) ? \"ws-multiplex\" : \"ws\";\n            connected = true;\n        } else {\n            transport = \"none\";\n            connected = false;\n        }\n\n        return {\n            name,\n            transport,\n            connected,\n            clientCount: state.wsClients.size,\n            sessionCount: state.sseSessions.size + state.httpSessions.size,\n            pendingCount: state.pending.size,\n        };\n    }\n\n    // -------------------------------------------------------------------------\n    // Loopback provider registration (in-process transports)\n    // -------------------------------------------------------------------------\n\n    /**\n     * Registers an in-process transport as a provider slot. Used by the embedded\n     * broker server and may be used by application code that wants to host an\n     * MCP server inside the same process without opening a real WebSocket.\n     *\n     * @throws if the name is already used by a stdio upstream or another loopback.\n     */\n    public registerLoopbackProvider(name: string, transport: IMessageTransport): void {\n        if (this._loopbackProviders.has(name)) {\n            throw new Error(`Loopback provider \"${name}\" is already registered.`);\n        }\n        if (this._upstreams.has(name)) {\n            throw new Error(`Cannot register loopback \"${name}\": a stdio upstream with the same name already exists.`);\n        }\n\n        const state = this._getOrCreateProviderState(name);\n        this._loopbackProviders.set(name, transport);\n\n        transport.onMessage = (data: string) => this._routeFromProvider(state, name, data);\n        transport.onClose = () => {\n            this._loopbackProviders.delete(name);\n            this._failProviderDisconnected(state, name);\n        };\n    }\n\n    /**\n     * Opens an in-process client to a provider slot. The returned handle can\n     * issue MCP requests and receives both the responses and the provider's\n     * broadcast notifications. Used by the aggregate server to fan a single\n     * in-process client out to every aggregated provider.\n     *\n     * The slot does not need a provider attached yet, `send` returns a\n     * JSON-RPC error while the provider is disconnected.\n     */\n    public openInternalClient(providerName: string): IInternalClient {\n        const state = this._getOrCreateProviderState(providerName);\n        let closed = false;\n\n        const client: IInternalClient = {\n            onMessage: null,\n            onClose: null,\n            send: (message: string): void => {\n                if (closed) return;\n                let id: string | number | null = null;\n                try {\n                    const parsed = JSON.parse(message) as { id?: string | number };\n                    if (parsed?.id != null) id = parsed.id;\n                } catch {\n                    /* forward as-is */\n                }\n                if (this._isProviderConnected(providerName, state)) {\n                    if (id != null) state.pending.set(id, { type: \"internal\", client });\n                    this._sendToProvider(state, providerName, message);\n                } else if (id != null) {\n                    client.onMessage?.(\n                        JSON.stringify({\n                            jsonrpc: \"2.0\",\n                            id,\n                            error: { code: -32000, message: `Provider \"${providerName}\" not connected` },\n                        })\n                    );\n                }\n            },\n            close: (): void => {\n                if (closed) return;\n                closed = true;\n                state.internalClients.delete(client);\n                for (const [id, sink] of state.pending) {\n                    if (sink.type === \"internal\" && sink.client === client) state.pending.delete(id);\n                }\n            },\n        };\n\n        state.internalClients.add(client);\n        return client;\n    }\n\n    // -------------------------------------------------------------------------\n    // Public state\n    // -------------------------------------------------------------------------\n\n    get isListening(): boolean {\n        return this._httpServer?.listening ?? false;\n    }\n\n    /** Total number of connected MCP clients across all providers. */\n    get clientCount(): number {\n        let n = 0;\n        for (const s of this._providers.values()) {\n            n += s.wsClients.size + s.sseSessions.size + s.httpSessions.size;\n        }\n        return n;\n    }\n\n    /** Names of all providers that currently have an active connection. */\n    get providerNames(): readonly string[] {\n        return [...this._providers.entries()].filter(([name, s]) => this._isProviderConnected(name, s)).map(([name]) => name);\n    }\n\n    /** @deprecated Check `providerNames.length > 0` instead. */\n    get hasProvider(): boolean {\n        return this.providerNames.length > 0;\n    }\n\n    // -------------------------------------------------------------------------\n    // Lifecycle\n    // -------------------------------------------------------------------------\n\n    /**\n     * Starts the broker. Resolves once the HTTP server is listening.\n     */\n    start(): Promise<void> {\n        return new Promise((resolve) => {\n            const handler = (req: IncomingMessage, res: ServerResponse) => this._handleHttp(req, res);\n            this._httpServer = this._options.tls ? https.createServer({ cert: this._options.tls.cert, key: this._options.tls.key }, handler) : http.createServer(handler);\n            // Disable perMessageDeflate: payloads may be large base64-encoded blobs\n            // (snapshots, images) that are already compressed. Deflating them wastes\n            // CPU without reducing size, and caused multi-second stalls in practice.\n            this._wss = new WebSocketServer({ server: this._httpServer, perMessageDeflate: false, verifyClient: this._makeVerifyClient() });\n\n            this._wss.on(\"connection\", (ws: WebSocket, req: IncomingMessage) => {\n                const url = req.url ?? \"/\";\n                const providerPath = this._options.providerPath ?? \"/provider\";\n                const providersPath = this._options.providersPath ?? \"/providers\";\n\n                if (url === providersPath || url.startsWith(providersPath + \"?\")) {\n                    // Multiplexed provider: one WebSocket carries N providers via envelopes.\n                    this._onMultiplexProviderConnect(ws, req);\n                } else if (url.startsWith(providerPath + \"/\") || url === providerPath) {\n                    // Extract name: everything after \"<providerPath>/\"\n                    const raw = url.slice(providerPath.length).replace(/^\\//, \"\");\n                    const name = decodeURIComponent(raw.split(\"?\")[0]) || \"(unnamed)\";\n                    this._onProviderConnect(ws, name, req);\n                } else {\n                    // Raw WS MCP client: URL is \"/<providerName>\" or \"/\"\n                    const raw = url.replace(/^\\//, \"\").split(\"?\")[0];\n                    const name = decodeURIComponent(raw) || \"\";\n                    this._onClientConnect(ws, name, req);\n                }\n            });\n\n            this._httpServer.listen(this._options.port, this._options.host ?? \"0.0.0.0\", () => {\n                // Bring the aggregate `_all` slot up before any upstream connects\n                // (a Streamable HTTP upstream opens synchronously on connect()).\n                this._maybeStartAggregateServer();\n\n                // Attach configured upstreams (stdio child processes + remote URL\n                // servers). Both implement the Upstream contract, so the wiring\n                // into a provider slot is identical.\n                const wireUpstream = (cfg: { name: string; aggregate?: boolean }, upstream: IUpstream): void => {\n                    upstream.onMessage = (data) => {\n                        const state = this._getOrCreateProviderState(cfg.name);\n                        this._routeFromProvider(state, cfg.name, data);\n                    };\n                    upstream.onError = (err) => {\n                        console.error(`[broker] ${err.message}`);\n                    };\n                    upstream.onClose = () => {\n                        const state = this._providers.get(cfg.name);\n                        if (state) this._failProviderDisconnected(state, cfg.name);\n                    };\n                    if (cfg.aggregate) {\n                        upstream.onOpen = () => void this._aggregateServer?.addProvider(cfg.name);\n                    }\n                    this._upstreams.set(cfg.name, upstream);\n                    upstream.connect();\n                };\n                for (const cfg of this._options.stdioUpstreams ?? []) wireUpstream(cfg, new StdioUpstream(cfg));\n                for (const cfg of this._options.remoteUpstreams ?? []) wireUpstream(cfg, new RemoteUpstream(cfg));\n\n                // Attach stdio client transport if configured.\n                // stdin carries Claude Desktop's JSON-RPC requests; stdout carries responses.\n                if (this._options.stdioClient) {\n                    this._stdioClientProvider = this._options.stdioClient.providerName;\n                    const transport = new StdioTransport();\n                    this._stdioClientTransport = transport;\n                    transport.onMessage = (data: string): void => {\n                        const state = this._getOrCreateProviderState(this._stdioClientProvider!);\n                        this._routeFromStdioClient(state, data);\n                    };\n                    transport.onError = (err: Error): void => {\n                        console.error(`[broker] stdio client transport: ${err.message}`);\n                    };\n                    transport.onClose = (): void => {\n                        // Client disconnected: nothing to clean up; pending sinks will time out.\n                    };\n                    transport.connect();\n                }\n\n                this._startedAt = new Date();\n\n                // Spawn the embedded broker server last so it can already report\n                // accurate state in its first `broker_info` call.\n                void this._maybeStartBrokerServer().then(\n                    () => resolve(),\n                    (err: unknown) => {\n                        console.error(\"[broker] embedded broker server failed to start:\", err);\n                        // Keep the tunnel up even if the introspection server fails.\n                        resolve();\n                    }\n                );\n            });\n        });\n    }\n\n    /**\n     * Starts the in-process MCP server that exposes the broker's own behaviors\n     * (`broker_info`, `providers_list`, `provider_status`) under the reserved\n     * provider slot `_broker`. No-op when {@link IWsTunnelOptions.enableBrokerProvider}\n     * is `false`.\n     */\n    private async _maybeStartBrokerServer(): Promise<void> {\n        if (this._options.enableBrokerProvider === false) return;\n        const { server, clientTransport } = await startBrokerServer(this, {\n            grammarResolverOptions: this._options.brokerGrammarResolverOptions,\n            localGrammarsDir: this._options.brokerLocalGrammarsDir,\n        });\n        this._brokerServer = server;\n        this.registerLoopbackProvider(BROKER_PROVIDER_NAME, clientTransport);\n\n        // Aggregate the broker's own introspection tools into `_all`, so a stdio\n        // host pinned to `_all` still reaches broker_info / providers_list /\n        // provider_status alongside the other aggregated providers.\n        void this._aggregateServer?.addProvider(BROKER_PROVIDER_NAME);\n    }\n\n    /**\n     * Starts the aggregate MCP server and registers it on the reserved `_all`\n     * slot. No-op when {@link IWsTunnelOptions.enableAggregateProvider} is `false`.\n     */\n    private _maybeStartAggregateServer(): void {\n        if (this._options.enableAggregateProvider === false) return;\n        try {\n            const server = new AggregateServer((providerName) => this.openInternalClient(providerName));\n            server.setScopeFilter(this._options.auth?.aggregateScopeFilter ?? null);\n            server.setPolicyAuthorization(this._authorization);\n            server.start();\n            this.registerLoopbackProvider(AggregateServer.SLOT, server);\n            this._aggregateServer = server;\n        } catch (err) {\n            console.error(`[broker] aggregate server failed to start: ${(err as Error).message}`);\n        }\n    }\n\n    /**\n     * Gracefully closes all connections and stops the HTTP server.\n     */\n    async stop(): Promise<void> {\n        // Stop the embedded broker first so it does not see its loopback close\n        // as an unexpected disconnect (and to flush any pending broker responses).\n        const brokerServer = this._brokerServer;\n        this._brokerServer = null;\n        if (brokerServer) {\n            try {\n                await brokerServer.stop();\n            } catch {\n                /* best-effort; continue tearing down */\n            }\n        }\n\n        // Close the aggregate server so its provider sessions and internal\n        // clients detach before the provider slots are torn down.\n        const aggregateServer = this._aggregateServer;\n        this._aggregateServer = null;\n        if (aggregateServer) {\n            try {\n                aggregateServer.close();\n            } catch {\n                /* best-effort; continue tearing down */\n            }\n        }\n\n        this._stdioClientTransport?.close();\n        this._stdioClientTransport = null;\n        this._stdioClientProvider = null;\n\n        // Streamable HTTP sessions are torn down by the endpoint that owns them,\n        // not by ending their responses here: `closeAll` runs each session's\n        // `stop`, which is what empties `httpSessions`.\n        await Promise.all([...this._providers.values()].map((state) => state.httpEndpoint?.closeAll() ?? Promise.resolve()));\n\n        return new Promise((resolve, reject) => {\n            for (const state of this._providers.values()) {\n                for (const res of state.sseSessions.values()) res.end();\n                state.sseSessions.clear();\n                state.httpSessions.clear();\n                state.httpEndpoint = null;\n                for (const client of state.wsClients) client.close();\n                state.wsClients.clear();\n                state.ws?.close();\n            }\n            this._providers.clear();\n            this._multiplexSockets.clear();\n            for (const upstream of this._upstreams.values()) upstream.close();\n            this._upstreams.clear();\n            for (const loopback of this._loopbackProviders.values()) loopback.close();\n            this._loopbackProviders.clear();\n            this._startedAt = null;\n            this._wss?.close();\n            this._httpServer?.close((err) => (err ? reject(err) : resolve()));\n        });\n    }\n\n    private _authorizationSubject(principal: IPrincipal | null): IAuthorizationSubject {\n        if (principal?.subject) return principal.subject;\n        if (!principal) return { ids: [] };\n        try {\n            return (\n                this._authorization?.subjectMapper.map(principal.claims) ?? {\n                    ids: [],\n                    claims: principal.claims,\n                }\n            );\n        } catch (error) {\n            if (!(error instanceof SubjectMappingError)) {\n                console.error(\"[broker] authorization subject mapping failed.\");\n            }\n            return { ids: [], claims: principal.claims };\n        }\n    }\n\n    private _auditDecision(\n        subject: IAuthorizationSubject,\n        slot: string,\n        resource: ResourcePath | undefined,\n        capability: string | undefined,\n        tool: string | undefined,\n        decision: IAuthorizationDecision\n    ): void {\n        const authorization = this._authorization;\n        if (!authorization || (decision.allowed && !authorization.audit.logAllowed)) return;\n        writeAuthorizationAuditEvent(\n            makeAuthorizationAuditEvent(\n                {\n                    subject,\n                    slot,\n                    resource,\n                    capability,\n                    provider: slot,\n                    tool,\n                },\n                decision\n            )\n        );\n    }\n\n    /**\n     * Applies hierarchical policy to the MCP operations carried in one\n     * JSON-RPC frame. `_all` performs provider-specific checks internally.\n     */\n    private _authorizeMcpFrame(providerName: string, data: string, principal: IPrincipal | null): boolean {\n        const authorization = this._authorization;\n        if (!authorization || providerName === AggregateServer.SLOT) return true;\n\n        const subject = this._authorizationSubject(principal);\n        const resource = this._slotResourceResolver.resolve(providerName);\n        if (!resource) {\n            const decision: IAuthorizationDecision = { allowed: false, reason: \"unknown-resource\" };\n            this._auditDecision(subject, providerName, undefined, undefined, undefined, decision);\n            return false;\n        }\n\n        let parsed: unknown;\n        try {\n            parsed = JSON.parse(data) as unknown;\n        } catch {\n            return true;\n        }\n        const operations = Array.isArray(parsed) ? parsed : [parsed];\n        for (const value of operations) {\n            if (typeof value !== \"object\" || value === null || Array.isArray(value)) continue;\n            const operation = value as Readonly<{ method?: string; params?: unknown }>;\n            try {\n                const classified = authorization.capabilityClassifier.classify(operation, resource, providerName);\n                if (!classified) continue;\n                const decision = authorization.engine.authorize({\n                    subject,\n                    capability: classified.capability,\n                    resource,\n                    provider: providerName,\n                    tool: classified.tool,\n                });\n                this._auditDecision(subject, providerName, resource, classified.capability, classified.tool, decision);\n                if (!decision.allowed) return false;\n            } catch {\n                console.error(\"[broker] policy evaluation failed.\");\n                const decision: IAuthorizationDecision = { allowed: false, reason: \"no-matching-grant\" };\n                this._auditDecision(subject, providerName, resource, undefined, undefined, decision);\n                return false;\n            }\n        }\n        return true;\n    }\n\n    private _policyDeniedPayload(data: string): string {\n        let id: string | number | null = null;\n        try {\n            const parsed = JSON.parse(data) as { id?: unknown };\n            if (typeof parsed.id === \"string\" || typeof parsed.id === \"number\" || parsed.id === null) {\n                id = parsed.id;\n            }\n        } catch {\n            // A malformed frame has no usable request id.\n        }\n        return JSON.stringify({\n            jsonrpc: \"2.0\",\n            id,\n            error: { code: -32001, message: \"Forbidden\" },\n        });\n    }\n\n    /** The JSON-RPC error returned when the slot has nobody behind it. */\n    private _notConnectedPayload(providerName: string, frame: string): string {\n        return JSON.stringify({\n            jsonrpc: \"2.0\",\n            id: requestIdOf(frame) ?? null,\n            error: { code: -32000, message: `Provider \"${providerName}\" not connected` },\n        });\n    }\n\n    // -------------------------------------------------------------------------\n    // HTTP dispatcher\n    // -------------------------------------------------------------------------\n\n    private _handleHttp(req: IncomingMessage, res: ServerResponse): void {\n        const method = req.method ?? \"GET\";\n        const rawUrl = (req.url ?? \"/\").split(\"?\")[0];\n\n        // CORS\n        res.setHeader(\"Access-Control-Allow-Origin\", \"*\");\n        res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, DELETE, OPTIONS\");\n        res.setHeader(\"Access-Control-Allow-Headers\", req.headers[\"access-control-request-headers\"] ?? \"Content-Type, Accept, Mcp-Session-Id\");\n        res.setHeader(\"Access-Control-Expose-Headers\", \"Mcp-Session-Id\");\n\n        if (method === \"OPTIONS\") {\n            res.writeHead(204);\n            res.end();\n            return;\n        }\n\n        // Samples index (no provider prefix)\n        const samplesIndexPath = this._options.samplesIndexPath ?? \"/__samples_index__\";\n        if (method === \"GET\" && rawUrl === samplesIndexPath) {\n            this._handleSamplesIndex(res);\n            return;\n        }\n\n        // Protected Resource Metadata (RFC 9728), public discovery data, served\n        // unauthenticated so a client can find the authorization server after a 401.\n        if (this._authGuard && method === \"GET\") {\n            const metaSlot = this._authGuard.matchMetadataRequest(rawUrl);\n            if (metaSlot) {\n                res.writeHead(200, { \"Content-Type\": \"application/json; charset=utf-8\" });\n                res.end(JSON.stringify(this._authGuard.metadataFor(metaSlot)));\n                return;\n            }\n        }\n\n        // Route /<providerName>/<endpoint>\n        const route = this._parseProviderRoute(rawUrl);\n        if (route) {\n            const { providerName, endpoint } = route;\n            const kind = this._mcpEndpointKind(endpoint, method);\n            if (kind) {\n                if (this._authGuard) {\n                    // Gate on a valid bearer token issued for this slot before touching\n                    // the provider. On failure, emit an RFC 9728 challenge / 500.\n                    const guard = this._authGuard;\n                    void guard.authorize(req, providerName).then(\n                        (principal) => this._dispatchMcpEndpoint(kind, req, res, providerName, principal),\n                        (err: unknown) => this._handleAuthFailure(guard, res, providerName, err)\n                    );\n                } else {\n                    this._dispatchMcpEndpoint(kind, req, res, providerName, null);\n                }\n                return;\n            }\n        }\n\n        // Static files\n        if (this._options.staticMounts?.length) {\n            this._serveStatic(req, res);\n        } else {\n            res.writeHead(404);\n            res.end();\n        }\n    }\n\n    /**\n     * Parses `/<providerName>/<endpoint>` from a URL path.\n     * Returns `null` if the URL does not match this two-segment pattern.\n     */\n    private _parseProviderRoute(rawUrl: string): { providerName: string; endpoint: string } | null {\n        const parts = rawUrl.split(\"/\").filter(Boolean);\n        if (parts.length !== 2) return null;\n        const providerName = decodeURIComponent(parts[0]);\n        const endpoint = decodeURIComponent(parts[1]);\n        if (!providerName || !endpoint) return null;\n        return { providerName, endpoint };\n    }\n\n    /**\n     * Classifies a `(endpoint, method)` pair as one of the four MCP/SSE client\n     * handlers, or `null` when it is not a client transport request (the caller\n     * then falls through to static-file serving, preserving prior behavior).\n     */\n    private _mcpEndpointKind(endpoint: string, method: string): McpEndpointKind | null {\n        const mcpSuffix = (this._options.mcpPath ?? \"/mcp\").replace(/^\\//, \"\");\n        const sseSuffix = (this._options.ssePath ?? \"/sse\").replace(/^\\//, \"\");\n        const messagesSuffix = (this._options.messagesPath ?? \"/messages\").replace(/^\\//, \"\");\n        // GET, POST and DELETE all belong to the Streamable HTTP state machine.\n        if (endpoint === mcpSuffix) return \"mcp\";\n        if (endpoint === sseSuffix && method === \"GET\") return \"sse-connect\";\n        if (endpoint === messagesSuffix && method === \"POST\") return \"sse-message\";\n        return null;\n    }\n\n    /** Routes an already-authorized (or auth-disabled) request to its handler. */\n    private _dispatchMcpEndpoint(kind: McpEndpointKind, req: IncomingMessage, res: ServerResponse, providerName: string, principal: IPrincipal | null): void {\n        switch (kind) {\n            case \"mcp\":\n                this._handleStreamableHttp(req, res, providerName, principal);\n                return;\n            case \"sse-connect\":\n                this._handleSseConnect(req, res, providerName, principal);\n                return;\n            case \"sse-message\":\n                this._handleSseMessage(req, res, providerName, principal);\n                return;\n        }\n    }\n\n    /** Turns a rejected {@link HttpAuthGuard.authorize} into an HTTP response. */\n    private _handleAuthFailure(guard: HttpAuthGuard, res: ServerResponse, providerName: string, err: unknown): void {\n        if (err instanceof AuthError) {\n            guard.writeChallenge(res, providerName, err);\n            return;\n        }\n        // Not a token failure (e.g. the JWKS endpoint is unreachable), surface a\n        // 500 rather than a misleading 401.\n        console.error(`[broker] token validation error for \"${providerName}\":`, err);\n        res.writeHead(500, { \"Content-Type\": \"application/json; charset=utf-8\" });\n        res.end(JSON.stringify({ error: \"server_error\" }));\n    }\n\n    /**\n     * Builds the `ws` verifyClient hook that authenticates every WebSocket\n     * upgrade before the connection is accepted, returning a real `401`/`403`\n     * during the handshake rather than a post-handshake close:\n     *\n     * - **Raw MCP clients** (`/<slot>`) are gated by the OAuth 2.1 resource\n     *   server ({@link _authGuard}) with the RFC 9728 `WWW-Authenticate` challenge.\n     * - **Providers** (`/provider/<slot>`, `/providers`) are gated by the\n     *   {@link _providerAuth} shared-secret / custom authenticator.\n     *\n     * Each side is independent: a branch with no authenticator configured is let\n     * through unchanged. Returns `undefined` (no hook) when neither is set.\n     */\n    private _makeVerifyClient(): VerifyClientCallbackAsync | undefined {\n        const guard = this._authGuard;\n        const providerAuth = this._providerAuth;\n        if (!guard && !providerAuth) return undefined;\n\n        const providerPath = this._options.providerPath ?? \"/provider\";\n        const providersPath = this._options.providersPath ?? \"/providers\";\n\n        return (info, cb) => {\n            const url = info.req.url ?? \"/\";\n            const isMultiplex = url === providersPath || url.startsWith(providersPath + \"?\");\n            const isDedicated = url.startsWith(providerPath + \"/\") || url === providerPath;\n\n            if (isMultiplex || isDedicated) {\n                // Provider (engine) upgrade, shared-secret / custom authenticator.\n                if (!providerAuth) {\n                    cb(true);\n                    return;\n                }\n                const slot = isDedicated ? decodeURIComponent(url.slice(providerPath.length).replace(/^\\//, \"\").split(\"?\")[0]) || undefined : undefined;\n                Promise.resolve(providerAuth.authenticate(info.req, slot)).then(\n                    (rawResult) => {\n                        const result = normalizeProviderAuthentication(rawResult);\n                        if (!result.authenticated) {\n                            cb(false, 401, \"Unauthorized\", { \"WWW-Authenticate\": 'Bearer realm=\"provider\"' });\n                            return;\n                        }\n                        if (slot !== undefined) {\n                            const resource = this._slotResourceResolver.resolve(slot);\n                            if (!resource || !providerMayPublish(result.principal, resource)) {\n                                this._logProviderRegistration(result.principal, slot, resource, false);\n                                cb(false, 403, \"Forbidden\");\n                                return;\n                            }\n                        }\n                        this._pendingProviderPrincipals.set(info.req, result.principal);\n                        cb(true);\n                    },\n                    () => {\n                        console.error(`[broker] provider authentication error for \"${slot ?? \"(multiplex)\"}\".`);\n                        cb(false, 500, \"server_error\");\n                    }\n                );\n                return;\n            }\n\n            // Raw WS MCP client upgrade, OAuth 2.1 resource server.\n            if (!guard) {\n                cb(true);\n                return;\n            }\n            const slot = decodeURIComponent(url.replace(/^\\//, \"\").split(\"?\")[0]);\n            void guard.authorize(info.req, slot).then(\n                (principal) => {\n                    // Stash the principal so _onClientConnect can bind it to the socket.\n                    this._pendingClientPrincipals.set(info.req, principal);\n                    cb(true);\n                },\n                (err: unknown) => {\n                    if (err instanceof AuthError) {\n                        cb(false, err.status, err.code, { \"WWW-Authenticate\": guard.challengeHeader(slot, err) });\n                    } else {\n                        console.error(`[broker] token validation error for WS client \"${slot}\":`, err);\n                        cb(false, 500, \"server_error\");\n                    }\n                }\n            );\n        };\n    }\n\n    // -------------------------------------------------------------------------\n    // MCP / SSE transport (per provider)\n    // -------------------------------------------------------------------------\n\n    /**\n     * Handles `GET /<providerName>/sse`, opens a long-lived SSE stream for Claude.\n     * Sends an `endpoint` event so Claude knows where to POST its requests.\n     */\n    private _handleSseConnect(req: IncomingMessage, res: ServerResponse, providerName: string, principal: IPrincipal | null): void {\n        const sessionId = randomUUID();\n        const messagesSuffix = (this._options.messagesPath ?? \"/messages\").replace(/^\\//, \"\");\n        const messagesUrl = `/${encodeURIComponent(providerName)}/${messagesSuffix}`;\n\n        res.writeHead(200, {\n            \"Content-Type\": \"text/event-stream\",\n            \"Cache-Control\": \"no-cache, no-transform\",\n            Connection: \"keep-alive\",\n        });\n        res.write(`event: endpoint\\ndata: ${messagesUrl}?sessionId=${sessionId}\\n\\n`);\n\n        const state = this._getOrCreateProviderState(providerName);\n        state.sseSessions.set(sessionId, res);\n        if (principal) this._streamPrincipals.set(res, principal);\n\n        req.on(\"close\", () => {\n            state.sseSessions.delete(sessionId);\n            for (const [id, sink] of state.pending) {\n                if (sink.type === \"sse\" && sink.sessionId === sessionId) state.pending.delete(id);\n            }\n        });\n    }\n\n    /**\n     * Handles `POST /<providerName>/messages?sessionId=…`, receives a JSON-RPC\n     * request from Claude and forwards it to the provider.\n     * Always responds 202 Accepted; the real response arrives over SSE.\n     */\n    private _handleSseMessage(req: IncomingMessage, res: ServerResponse, providerName: string, principal: IPrincipal | null): void {\n        const params = new URL(req.url ?? \"\", \"http://localhost\").searchParams;\n        const sessionId = params.get(\"sessionId\") ?? \"\";\n        const state = this._getOrCreateProviderState(providerName);\n\n        if (!state.sseSessions.has(sessionId)) {\n            res.writeHead(400, { \"Content-Type\": \"text/plain\" });\n            res.end(\"Unknown or expired session\");\n            return;\n        }\n\n        let body = \"\";\n        req.on(\"data\", (chunk: Buffer) => {\n            body += chunk.toString();\n        });\n        req.on(\"end\", () => {\n            if (!this._authorizeMcpFrame(providerName, body, principal)) {\n                res.writeHead(403, { \"Content-Type\": \"application/json; charset=utf-8\" });\n                res.end(this._policyDeniedPayload(body));\n                return;\n            }\n            try {\n                const msg = JSON.parse(body) as { id?: string | number };\n                if (msg.id != null) state.pending.set(msg.id, { type: \"sse\", sessionId });\n            } catch {\n                /* malformed, forward anyway */\n            }\n\n            if (this._isProviderConnected(providerName, state)) {\n                this._sendToProvider(state, providerName, body, principal);\n            } else {\n                const sseRes = state.sseSessions.get(sessionId);\n                if (sseRes) {\n                    let errId: string | number | null = null;\n                    try {\n                        errId = (JSON.parse(body) as { id?: string | number }).id ?? null;\n                    } catch {\n                        /* */\n                    }\n                    this._sendSseEvent(\n                        sseRes,\n                        JSON.stringify({\n                            jsonrpc: \"2.0\",\n                            id: errId,\n                            error: { code: -32000, message: `Provider \"${providerName}\" not connected` },\n                        })\n                    );\n                }\n            }\n\n            res.writeHead(202);\n            res.end();\n        });\n    }\n\n    /**\n     * Serves `/<providerName>/mcp` by handing the request to the slot's\n     * Streamable HTTP endpoint.\n     *\n     * Everything protocol-shaped, sessions, `Mcp-Session-Id`, `DELETE`, the\n     * `404` on a terminated session, `Origin` and `MCP-Protocol-Version`\n     * validation, `202` on a notification, belongs to `mcp-core` and is no\n     * longer reimplemented here. What stays is the broker's own business:\n     * deciding who may speak (already done upstream by the auth guard) and\n     * relaying frames to a provider that lives somewhere else entirely.\n     */\n    private _handleStreamableHttp(req: IncomingMessage, res: ServerResponse, providerName: string, principal: IPrincipal | null): void {\n        const state = this._getOrCreateProviderState(providerName);\n\n        // The endpoint authenticates nothing: this broker has its own guard,\n        // richer than the spec's (per-slot scopes, subject mapping into the\n        // policy engine). So the principal is attached to the session here,\n        // refreshed on every request, and read back when a frame is checked.\n        const sessionId = req.headers[\"mcp-session-id\"];\n        if (typeof sessionId === \"string\") {\n            const session = state.httpSessions.get(sessionId);\n            if (session) session.principal = principal;\n        }\n\n        void this._endpointFor(providerName, state).handleRequest(req, res);\n    }\n\n    /**\n     * The slot's Streamable HTTP endpoint, built on first use.\n     *\n     * Its factory does not create an MCP server: the server is the provider,\n     * reachable only through the tunnel. It creates a bridge instead: frames the\n     * client sends go out to the provider, and frames coming back are addressed\n     * to this session by id.\n     */\n    private _endpointFor(providerName: string, state: IProviderState): StreamableHttpEndpoint {\n        if (state.httpEndpoint) return state.httpEndpoint;\n\n        state.httpEndpoint = new StreamableHttpEndpoint({\n            allowedOrigins: this._allowedOrigins,\n\n            createServer: (transport, sessionId, _principal) => {\n                const session: IHttpSession = { transport, principal: null };\n                state.httpSessions.set(sessionId, session);\n\n                transport.onMessage = (frame: string) => this._fromHttpSession(state, providerName, sessionId, session, frame);\n\n                return {\n                    // No server to launch: the one serving this session is the\n                    // provider, at the far end of the tunnel. What `start` still\n                    // owes is opening the transport, since a closed one drops\n                    // every frame it is handed.\n                    start: () => openTransport(transport),\n                    stop: () => {\n                        state.httpSessions.delete(sessionId);\n                        // Nothing can answer the requests this session had in\n                        // flight; leaving them would pin the ids forever.\n                        for (const [id, sink] of state.pending) {\n                            if (sink.type === \"http-session\" && sink.sessionId === sessionId) state.pending.delete(id);\n                        }\n                    },\n                };\n            },\n        });\n\n        return state.httpEndpoint;\n    }\n\n    /** Relays one frame from an HTTP session to the provider behind the slot. */\n    private _fromHttpSession(state: IProviderState, providerName: string, sessionId: string, session: IHttpSession, frame: string): void {\n        if (!this._authorizeMcpFrame(providerName, frame, session.principal)) {\n            session.transport.send(this._policyDeniedPayload(frame));\n            return;\n        }\n\n        if (!this._isProviderConnected(providerName, state)) {\n            session.transport.send(this._notConnectedPayload(providerName, frame));\n            return;\n        }\n\n        const id = requestIdOf(frame);\n        if (id !== undefined) state.pending.set(id, { type: \"http-session\", sessionId });\n\n        this._sendToProvider(state, providerName, frame, session.principal);\n    }\n\n    /** Writes one JSON-RPC message as an SSE `message` event. */\n    private _sendSseEvent(res: ServerResponse, data: string): void {\n        // data is already a compact JSON string: no need to parse+re-serialize.\n        res.write(`event: message\\ndata: ${data}\\n\\n`);\n    }\n\n    // -------------------------------------------------------------------------\n    // WebSocket connection handlers\n    // -------------------------------------------------------------------------\n\n    private _logProviderRegistration(principal: IProviderPrincipal, slot: string, resource: ResourcePath | undefined, allowed: boolean): void {\n        const event = {\n            timestamp: new Date().toISOString(),\n            providerId: principal.id,\n            slot,\n            resource: resource?.value,\n            allowed,\n        };\n        const line = `[broker] provider-registration ${JSON.stringify(event)}`;\n        if (allowed) console.info(line);\n        else console.warn(line);\n    }\n\n    private _onProviderConnect(ws: WebSocket, name: string, req: IncomingMessage): void {\n        const providerPrincipal = this._pendingProviderPrincipals.get(req);\n        if (providerPrincipal) {\n            this._pendingProviderPrincipals.delete(req);\n            this._providerPrincipals.set(ws, providerPrincipal);\n        }\n        if (this._upstreams.has(name)) {\n            console.warn(\n                `[broker] WARNING: WebSocket provider \"${name}\" rejected: a stdio upstream with the same name is already configured. ` + `Rename one of them to avoid the conflict.`\n            );\n            ws.close(1008, `Provider \"${name}\" is managed by a stdio upstream`);\n            return;\n        }\n\n        if (this._loopbackProviders.has(name)) {\n            console.warn(`[broker] WARNING: WebSocket provider \"${name}\" rejected: the slot is held by an in-process loopback (reserved system slot).`);\n            ws.close(1008, `Provider \"${name}\" is reserved by the broker`);\n            return;\n        }\n\n        const existing = this._providers.get(name);\n        if (existing?.ws?.readyState === WebSocket.OPEN) {\n            ws.close(1008, `Provider \"${name}\" is already connected`);\n            return;\n        }\n\n        const state = this._getOrCreateProviderState(name);\n        state.ws = ws;\n        if (providerPrincipal) {\n            this._logProviderRegistration(providerPrincipal, name, this._slotResourceResolver.resolve(name), true);\n        }\n\n        // A provider MAY send a registration control frame as its very first\n        // message (see _tryHandleRegistration). Any other first message ,\n        // including a normal MCP frame, is routed and leaves the provider\n        // non-aggregated, so every pre-existing provider keeps working.\n        let registrationChecked = false;\n        ws.on(\"message\", (data: Buffer) => {\n            const text = data.toString();\n            if (!registrationChecked) {\n                registrationChecked = true;\n                if (this._tryHandleRegistration(name, text)) return;\n            }\n            this._routeFromProvider(state, name, text);\n        });\n\n        ws.on(\"close\", () => {\n            state.ws = null;\n            this._failProviderDisconnected(state, name);\n        });\n    }\n\n    /**\n     * Inspects a provider's first WebSocket message for an optional registration\n     * control frame `{ \"type\": \"register\", \"aggregate\": boolean }`. Returns\n     * `true` when the message was a registration frame: and thus consumed, not\n     * routed as MCP traffic. A normal MCP frame always carries `jsonrpc`, so it\n     * returns `false` and the provider stays non-aggregated.\n     */\n    private _tryHandleRegistration(name: string, text: string): boolean {\n        let frame: { type?: unknown; jsonrpc?: unknown; aggregate?: unknown };\n        try {\n            frame = JSON.parse(text) as typeof frame;\n        } catch {\n            return false;\n        }\n        if (frame.jsonrpc !== undefined || frame.type !== \"register\") return false;\n        if (frame.aggregate === true) {\n            void this._aggregateServer?.addProvider(name);\n        }\n        return true;\n    }\n\n    private _onClientConnect(ws: WebSocket, providerName: string, req: IncomingMessage): void {\n        const state = this._getOrCreateProviderState(providerName);\n        state.wsClients.add(ws);\n\n        // Carry the principal captured at the upgrade onto the socket, so requests\n        // this client makes to `_all` can be scope-filtered.\n        const principal = this._pendingClientPrincipals.get(req);\n        if (principal) {\n            this._clientPrincipals.set(ws, principal);\n            this._pendingClientPrincipals.delete(req);\n        }\n\n        ws.on(\"message\", (data: Buffer) => this._routeFromClient(ws, state, providerName, data.toString()));\n\n        ws.on(\"close\", () => {\n            state.wsClients.delete(ws);\n            for (const [id, sink] of state.pending) {\n                if (sink.type === \"ws\" && sink.socket === ws) state.pending.delete(id);\n            }\n        });\n    }\n\n    /**\n     * Handles a multiplexed provider WebSocket (`/providers`).\n     * A single socket carries traffic for multiple providers using the\n     * envelope format `{ provider: string, payload: object }`.\n     * Provider names are registered lazily on first message.\n     */\n    private _onMultiplexProviderConnect(ws: WebSocket, req: IncomingMessage): void {\n        const providerNames = new Set<string>();\n        this._multiplexSockets.set(ws, providerNames);\n        const providerPrincipal = this._pendingProviderPrincipals.get(req);\n        if (providerPrincipal) {\n            this._pendingProviderPrincipals.delete(req);\n            this._providerPrincipals.set(ws, providerPrincipal);\n        }\n\n        ws.on(\"message\", (data: Buffer) => {\n            const envelope = decodeEnvelope(data.toString());\n            if (!envelope) return; // malformed, drop\n\n            const name = envelope.provider;\n\n            // Register provider name lazily on first encounter.\n            if (!providerNames.has(name)) {\n                if (providerPrincipal) {\n                    const resource = this._slotResourceResolver.resolve(name);\n                    if (!resource || !providerMayPublish(providerPrincipal, resource)) {\n                        this._logProviderRegistration(providerPrincipal, name, resource, false);\n                        ws.send(encodeErrorEnvelope(name, TunnelErrorCodes.RegistrationForbidden, \"Provider registration forbidden\"));\n                        return;\n                    }\n                }\n                if (this._upstreams.has(name)) {\n                    console.warn(\n                        `[broker] WARNING: Multiplexed WebSocket provider \"${name}\" rejected: a stdio upstream with the same name is already configured. ` +\n                            `Rename one of them to avoid the conflict.`\n                    );\n                    ws.send(encodeErrorEnvelope(name, TunnelErrorCodes.ProviderUnavailable, `Provider \"${name}\" is managed by a stdio upstream`));\n                    return;\n                }\n\n                if (this._loopbackProviders.has(name)) {\n                    ws.send(encodeErrorEnvelope(name, TunnelErrorCodes.ProviderUnavailable, `Provider \"${name}\" is reserved by the broker`));\n                    return;\n                }\n\n                const existing = this._providers.get(name);\n                if (existing?.ws?.readyState === WebSocket.OPEN) {\n                    // Provider already connected via another socket, reject this name.\n                    ws.send(encodeErrorEnvelope(name, TunnelErrorCodes.ProviderUnavailable, `Provider \"${name}\" is already connected`));\n                    return;\n                }\n                providerNames.add(name);\n                const state = this._getOrCreateProviderState(name);\n                state.ws = ws;\n                if (providerPrincipal) {\n                    this._logProviderRegistration(providerPrincipal, name, this._slotResourceResolver.resolve(name), true);\n                }\n            }\n\n            const state = this._providers.get(name)!;\n            this._routeFromProvider(state, name, envelopeFrame(envelope));\n        });\n\n        ws.on(\"close\", () => {\n            for (const name of providerNames) {\n                const state = this._providers.get(name);\n                if (state && state.ws === ws) {\n                    state.ws = null;\n                    this._failProviderDisconnected(state, name);\n                }\n            }\n            this._multiplexSockets.delete(ws);\n        });\n    }\n\n    // -------------------------------------------------------------------------\n    // Message routing\n    // -------------------------------------------------------------------------\n\n    /**\n     * Sends a raw JSON-RPC message to a provider, wrapping it in a multiplex\n     * envelope when the provider's WebSocket is a multiplexed connection.\n     */\n    private _sendToProvider(state: IProviderState, providerName: string, data: string, principal: IPrincipal | null = null): void {\n        // The `_all` aggregate is a loopback, but it needs the caller's principal\n        // to scope its catalog/routing, hand it off directly rather than through\n        // the generic transport, which would drop the context.\n        if (providerName === AggregateServer.SLOT && this._aggregateServer) {\n            this._aggregateServer.sendAs(data, principal);\n            return;\n        }\n\n        // Upstreams (stdio child processes and remote URL servers) take priority.\n        const upstream = this._upstreams.get(providerName);\n        if (upstream?.isOpen) {\n            upstream.send(data);\n            return;\n        }\n\n        // In-process loopback (e.g. the embedded `_broker`) takes the same priority.\n        const loopback = this._loopbackProviders.get(providerName);\n        if (loopback?.isOpen) {\n            loopback.send(data);\n            return;\n        }\n\n        if (!state.ws || state.ws.readyState !== WebSocket.OPEN) return;\n\n        if (this._multiplexSockets.has(state.ws)) {\n            // Wrap in envelope for the multiplexed socket.\n            state.ws.send(encodeEnvelope(providerName, data));\n        } else {\n            state.ws.send(data);\n        }\n    }\n\n    private _routeFromStdioClient(state: IProviderState, data: string): void {\n        try {\n            const msg = JSON.parse(data) as { id?: string | number };\n            if (msg?.id != null) state.pending.set(msg.id, { type: \"stdio\" });\n        } catch {\n            /* forward as-is */\n        }\n\n        if (this._isProviderConnected(this._stdioClientProvider!, state)) {\n            this._sendToProvider(state, this._stdioClientProvider!, data);\n        } else {\n            let errId: string | number | null = null;\n            try {\n                errId = (JSON.parse(data) as { id?: string | number }).id ?? null;\n            } catch {\n                /* */\n            }\n            if (errId != null) {\n                this._stdioClientTransport?.send(\n                    JSON.stringify({\n                        jsonrpc: \"2.0\",\n                        id: errId,\n                        error: { code: -32000, message: `Provider \"${this._stdioClientProvider}\" not connected` },\n                    })\n                );\n            }\n        }\n    }\n\n    private _routeFromClient(client: WebSocket, state: IProviderState, providerName: string, data: string): void {\n        const principal = this._clientPrincipals.get(client) ?? null;\n        if (!this._authorizeMcpFrame(providerName, data, principal)) {\n            client.send(this._policyDeniedPayload(data));\n            return;\n        }\n\n        try {\n            const msg = JSON.parse(data) as { id?: string | number };\n            if (msg?.id != null) state.pending.set(msg.id, { type: \"ws\", socket: client });\n        } catch {\n            /* forward as-is */\n        }\n\n        if (this._isProviderConnected(providerName, state)) {\n            this._sendToProvider(state, providerName, data, principal);\n        } else {\n            client.send(\n                JSON.stringify({\n                    jsonrpc: \"2.0\",\n                    id: null,\n                    error: { code: -32000, message: \"No provider connected\" },\n                })\n            );\n        }\n    }\n\n    private _routeFromProvider(state: IProviderState, providerName: string, data: string): void {\n        try {\n            const msg = JSON.parse(data) as { id?: string | number };\n\n            if (msg.id != null) {\n                // Response: route to the specific sink that made the request.\n                const sink = state.pending.get(msg.id);\n                if (sink?.type === \"ws\" && sink.socket.readyState === WebSocket.OPEN) {\n                    sink.socket.send(data);\n                } else if (sink?.type === \"sse\") {\n                    const sseRes = state.sseSessions.get(sink.sessionId);\n                    if (sseRes) this._sendSseEvent(sseRes, data);\n                } else if (sink?.type === \"http-session\") {\n                    // The session transport decides whether this answers a held-open\n                    // POST or travels on the GET stream: it correlates by id.\n                    state.httpSessions.get(sink.sessionId)?.transport.send(data);\n                } else if (sink?.type === \"stdio\") {\n                    this._stdioClientTransport?.send(data);\n                } else if (sink?.type === \"internal\") {\n                    sink.client.onMessage?.(data);\n                }\n                state.pending.delete(msg.id);\n            } else {\n                // Notification (no id): broadcast to all clients of this provider.\n                this._broadcast(state, providerName, data);\n            }\n        } catch {\n            this._broadcast(state, providerName, data);\n        }\n    }\n\n    /** Sends a message to all clients connected to one provider. */\n    private _broadcast(state: IProviderState, providerName: string, data: string): void {\n        for (const client of state.wsClients) {\n            const principal = this._clientPrincipals.get(client) ?? null;\n            if (client.readyState === WebSocket.OPEN && this._authorizeMcpFrame(providerName, data, principal)) {\n                client.send(data);\n            }\n        }\n        for (const sseRes of state.sseSessions.values()) {\n            const principal = this._streamPrincipals.get(sseRes) ?? null;\n            if (this._authorizeMcpFrame(providerName, data, principal)) {\n                this._sendSseEvent(sseRes, data);\n            }\n        }\n        for (const session of state.httpSessions.values()) {\n            // The principal rides on the session here rather than in a WeakMap\n            // keyed by the response: a Streamable HTTP session spans many HTTP\n            // exchanges, so there is no single response to hang it on.\n            if (this._authorizeMcpFrame(providerName, data, session.principal)) {\n                session.transport.send(data);\n            }\n        }\n        for (const ic of state.internalClients) {\n            ic.onMessage?.(data);\n        }\n        // Forward notifications to the stdio client if it is watching this provider.\n        if (this._stdioClientProvider && this._providers.get(this._stdioClientProvider) === state) {\n            this._stdioClientTransport?.send(data);\n        }\n    }\n\n    /**\n     * Notifies every pending sink and internal client that the provider slot\n     * has disconnected, then clears the pending map. Shared by all provider\n     * close handlers (dedicated WS, multiplexed WS, loopback).\n     */\n    private _failProviderDisconnected(state: IProviderState, name: string): void {\n        // Echoing the pending id rather than `null`: a Streamable HTTP session\n        // matches the answer to its held-open POST by id, so an unaddressed\n        // error would leave that request hanging until it times out.\n        for (const [id, sink] of state.pending) {\n            const error = JSON.stringify({\n                jsonrpc: \"2.0\",\n                id,\n                error: { code: -32000, message: `Provider \"${name}\" disconnected` },\n            });\n            if (sink.type === \"ws\" && sink.socket.readyState === WebSocket.OPEN) {\n                sink.socket.send(error);\n            } else if (sink.type === \"sse\") {\n                const sseRes = state.sseSessions.get(sink.sessionId);\n                if (sseRes) this._sendSseEvent(sseRes, error);\n            } else if (sink.type === \"http-session\") {\n                state.httpSessions.get(sink.sessionId)?.transport.send(error);\n            } else if (sink.type === \"stdio\") {\n                this._stdioClientTransport?.send(error);\n            } else if (sink.type === \"internal\") {\n                sink.client.onMessage?.(error);\n            }\n        }\n        state.pending.clear();\n        for (const ic of state.internalClients) ic.onClose?.();\n    }\n\n    // -------------------------------------------------------------------------\n    // Provider state helpers\n    // -------------------------------------------------------------------------\n\n    /**\n     * Returns `true` if the provider is reachable, via a WebSocket connection,\n     * a stdio upstream, or an in-process loopback transport.\n     */\n    private _isProviderConnected(providerName: string, state: IProviderState): boolean {\n        if (this._upstreams.get(providerName)?.isOpen) return true;\n        if (this._loopbackProviders.get(providerName)?.isOpen) return true;\n        if (state.ws?.readyState === WebSocket.OPEN) return true;\n        return false;\n    }\n\n    /** Returns the state for `name`, creating it lazily if it doesn't exist yet. */\n    private _getOrCreateProviderState(name: string): IProviderState {\n        let state = this._providers.get(name);\n        if (!state) {\n            state = {\n                ws: null,\n                pending: new Map(),\n                sseSessions: new Map(),\n                httpSessions: new Map(),\n                wsClients: new Set(),\n                internalClients: new Set(),\n                httpEndpoint: null,\n            };\n            this._providers.set(name, state);\n        }\n        return state;\n    }\n\n    // -------------------------------------------------------------------------\n    // Samples index\n    // -------------------------------------------------------------------------\n\n    private _handleSamplesIndex(res: ServerResponse): void {\n        const rootMount = (this._options.staticMounts ?? []).find((m) => m.urlPrefix === \"/\");\n\n        let files: string[] = [];\n        if (rootMount) {\n            const samplesDir = nodePath.join(rootMount.dir, \"samples\");\n            try {\n                if (fs.existsSync(samplesDir) && fs.statSync(samplesDir).isDirectory()) {\n                    files = fs.readdirSync(samplesDir).filter((name) => fs.statSync(nodePath.join(samplesDir, name)).isFile());\n                }\n            } catch {\n                /* return empty list on any I/O error */\n            }\n        }\n\n        res.writeHead(200, { \"Content-Type\": \"application/json; charset=utf-8\" });\n        res.end(JSON.stringify({ files }));\n    }\n\n    // -------------------------------------------------------------------------\n    // Static file serving\n    // -------------------------------------------------------------------------\n\n    private _serveStatic(req: IncomingMessage, res: ServerResponse): void {\n        const rawUrl = (req.url ?? \"/\").split(\"?\")[0].split(\"#\")[0];\n        const mounts = this._options.staticMounts ?? [];\n\n        const mount = [...mounts]\n            .filter((m) => {\n                const prefix = m.urlPrefix.endsWith(\"/\") ? m.urlPrefix : m.urlPrefix + \"/\";\n                return rawUrl === m.urlPrefix || rawUrl.startsWith(prefix);\n            })\n            .sort((a, b) => b.urlPrefix.length - a.urlPrefix.length)[0];\n\n        if (!mount) {\n            res.writeHead(404, { \"Content-Type\": \"text/plain\" });\n            res.end(\"Not found\");\n            return;\n        }\n\n        const relative = rawUrl.slice(mount.urlPrefix.length) || \"/\";\n        const normalized = nodePath.normalize(relative);\n\n        if (normalized.startsWith(\"..\")) {\n            res.writeHead(403);\n            res.end(\"Forbidden\");\n            return;\n        }\n\n        const mountAbs = nodePath.resolve(mount.dir);\n        let filePath = nodePath.join(mountAbs, normalized);\n\n        if (!filePath.startsWith(mountAbs + nodePath.sep) && filePath !== mountAbs) {\n            res.writeHead(403);\n            res.end(\"Forbidden\");\n            return;\n        }\n\n        try {\n            if (fs.statSync(filePath).isDirectory()) filePath = nodePath.join(filePath, \"index.html\");\n        } catch {\n            res.writeHead(404);\n            res.end(\"Not found\");\n            return;\n        }\n\n        if (!fs.existsSync(filePath)) {\n            res.writeHead(404);\n            res.end(\"Not found\");\n            return;\n        }\n\n        const ext = nodePath.extname(filePath).toLowerCase();\n        res.writeHead(200, { \"Content-Type\": MIME[ext] ?? \"application/octet-stream\" });\n        fs.createReadStream(filePath).pipe(res);\n    }\n}\n","import * as fs from \"fs\";\nimport { WsTunnel } from \"./ws.tunnel\";\nimport type { AllowedOrigins, IStaticMount, IWsTunnelOptions } from \"./ws.interfaces\";\nimport type { IStdioUpstreamConfig } from \"../stdio.upstream\";\nimport type { IRemoteUpstreamConfig } from \"../remote.upstream\";\nimport { buildJwtAuth, SharedSecretProviderAuthenticator, type IJwtAuthOptions, type IResolvedAuth, type IProviderAuthenticator } from \"../auth/index\";\nimport {\n    authorizationWithEngine,\n    compileAuthorizationPolicy,\n    type IAuthorizationPolicyConfig,\n    type IPolicyAuthorization,\n    type IPolicyEngine,\n    type ISlotResourceResolver,\n} from \"../authorization/index\";\n\n/**\n * Fluent builder that constructs a configured {@link WsTunnel}.\n *\n * @example\n * ```typescript\n * const tunnel = new WsTunnelBuilder()\n *     .withPort(3000)\n *     .withHost(\"localhost\")\n *     .withStaticMount(\"/\", \"/abs/path/to/www\")\n *     .build();\n *\n * await tunnel.start();\n * console.log(\"Broker listening on ws://localhost:3000\");\n * console.log(\"  Provider connects to: ws://localhost:3000/provider/<name>\");\n * console.log(\"  Clients  connect to:  ws://localhost:3000/<name>\");\n * ```\n */\nexport class WsTunnelBuilder {\n    private _port = 3000;\n    private _host: string | undefined;\n    private _providerPath = \"/provider\";\n    private _providersPath = \"/providers\";\n    private _clientPath = \"/\";\n    private _ssePath = \"/sse\";\n    private _messagesPath = \"/messages\";\n    private _mcpPath = \"/mcp\";\n    private _samplesIndexPath = \"/__samples_index__\";\n    private _allowedOrigins: AllowedOrigins | undefined = undefined;\n    private _staticMounts: IStaticMount[] = [];\n    private _stdioUpstreams: IStdioUpstreamConfig[] = [];\n    private _remoteUpstreams: IRemoteUpstreamConfig[] = [];\n    private _stdioClient: { providerName: string } | undefined = undefined;\n    private _tls: { cert: string; key: string } | undefined = undefined;\n    private _brokerLocalGrammarsDir: string | undefined = undefined;\n    private _auth: IResolvedAuth | undefined = undefined;\n    private _providerAuth: IProviderAuthenticator | undefined = undefined;\n    private _authorization: IPolicyAuthorization | undefined = undefined;\n    private _slotResourceResolver: ISlotResourceResolver | undefined = undefined;\n\n    /** Sets the TCP port the broker listens on. */\n    withPort(port: number): this {\n        this._port = port;\n        return this;\n    }\n\n    /**\n     * Sets the host/interface to bind to.\n     * @default \"0.0.0.0\" (all interfaces)\n     */\n    withHost(host: string): this {\n        this._host = host;\n        return this;\n    }\n\n    /**\n     * Sets the URL path the MCP provider connects to.\n     * @default \"/provider\"\n     */\n    withProviderPath(path: string): this {\n        this._providerPath = path;\n        return this;\n    }\n\n    /**\n     * Sets the URL path for multiplexed provider connections.\n     * Multiple providers share a single WebSocket using the envelope protocol.\n     * @default \"/providers\"\n     */\n    withProvidersPath(path: string): this {\n        this._providersPath = path;\n        return this;\n    }\n\n    /**\n     * Sets the URL path MCP clients connect to.\n     * @default \"/\"\n     */\n    withClientPath(path: string): this {\n        this._clientPath = path;\n        return this;\n    }\n\n    /**\n     * Sets the URL path for the SSE stream (legacy Claude transport, GET).\n     * @default \"/sse\"\n     */\n    withSsePath(path: string): this {\n        this._ssePath = path;\n        return this;\n    }\n\n    /**\n     * Sets the URL path for JSON-RPC POST requests (legacy Claude transport).\n     * @default \"/messages\"\n     */\n    withMessagesPath(path: string): this {\n        this._messagesPath = path;\n        return this;\n    }\n\n    /**\n     * Sets the URL path for the Streamable HTTP transport (MCP 2025-03-26).\n     * MCP Inspector and other 2025+ clients POST JSON-RPC here.\n     * @default \"/mcp\"\n     */\n    withMcpPath(path: string): this {\n        this._mcpPath = path;\n        return this;\n    }\n\n    /**\n     * Sets the URL path that returns a `{ files: string[] }` listing of the\n     * `samples/` subdirectory under the root static mount.\n     * @default \"/__samples_index__\"\n     */\n    withSamplesIndexPath(path: string): this {\n        this._samplesIndexPath = path;\n        return this;\n    }\n\n    /**\n     * Allows browser origins to reach `/<slot>/mcp`.\n     *\n     * Without this call no browser origin is accepted, which is the safe\n     * default: a request carrying an `Origin` is refused with `403`, while one\n     * carrying none (any non-browser client) always passes. Call it only when a\n     * web page really has to talk to the broker over HTTP.\n     *\n     * @example\n     * ```typescript\n     * builder.withAllowedOrigins([\"https://app.example.com\"]);\n     * builder.withAllowedOrigins(/^https:\\/\\/[a-z0-9-]+\\.example\\.com$/);\n     * builder.withAllowedOrigins((origin) => origin.endsWith(\".example.com\"));\n     * ```\n     */\n    withAllowedOrigins(allowed: AllowedOrigins): this {\n        this._allowedOrigins = allowed;\n        return this;\n    }\n\n    /**\n     * Adds a static-file mount served over plain HTTP.\n     * Can be called multiple times; longest-prefix match wins at runtime.\n     *\n     * @param urlPrefix  URL prefix that triggers this mount (e.g. `\"/\"` or `\"/bundle\"`).\n     * @param dir        Absolute path to the directory to serve.\n     */\n    withStaticMount(urlPrefix: string, dir: string): this {\n        this._staticMounts.push({ urlPrefix, dir });\n        return this;\n    }\n\n    /**\n     * Registers a stdio upstream provider. The broker spawns the configured\n     * command and bridges its stdin/stdout as an MCP transport. Clients reach\n     * it using `config.name` directly (e.g. `/<name>/mcp`).\n     *\n     * Can be called multiple times to register multiple providers.\n     */\n    withStdioUpstream(config: IStdioUpstreamConfig): this {\n        this._stdioUpstreams.push(config);\n        return this;\n    }\n\n    /**\n     * Registers a remote MCP server reached by URL. The broker connects out to\n     * it and exposes it as a provider slot named `config.name`, bridging the\n     * Streamable HTTP / SSE / WebSocket transport for the slot's clients.\n     *\n     * Can be called multiple times to register multiple servers.\n     */\n    withRemoteUpstream(config: IRemoteUpstreamConfig): this {\n        this._remoteUpstreams.push(config);\n        return this;\n    }\n\n    /**\n     * Enables the stdio client transport. The broker will read JSON-RPC from\n     * `process.stdin` and write responses to `process.stdout`, bridging Claude\n     * Desktop (or any stdio MCP client) to the named provider.\n     *\n     * All console output is automatically redirected to stderr in this mode so\n     * stdout stays clean for the JSON-RPC stream.\n     *\n     * @param providerName  The provider the stdio client maps to.\n     */\n    withStdioClient(providerName: string): this {\n        this._stdioClient = { providerName };\n        return this;\n    }\n\n    /**\n     * Enables HTTPS/WSS mode by supplying PEM-encoded certificate and key strings directly.\n     * Call this when you already have the PEM content in memory.\n     */\n    withTls(cert: string, key: string): this {\n        this._tls = { cert, key };\n        return this;\n    }\n\n    /**\n     * Enables HTTPS/WSS mode by reading the certificate and key from the given file paths.\n     * Files are read synchronously at call time.\n     *\n     * @param certPath  Path to the PEM certificate file (e.g. `fullchain.pem`).\n     * @param keyPath   Path to the PEM private-key file (e.g. `privkey.pem`).\n     */\n    withTlsFiles(certPath: string, keyPath: string): this {\n        return this.withTls(fs.readFileSync(certPath, \"utf8\"), fs.readFileSync(keyPath, \"utf8\"));\n    }\n\n    /**\n     * Sets the path to a user-supplied grammars directory whose\n     * `<userAgent>/<locale>.json` files are merged on top of the packaged\n     * grammars used by the embedded broker server (the reserved `_broker`\n     * provider slot). Typically pointed at `.mcp-broker/grammars/`.\n     */\n    withBrokerLocalGrammarsDir(dir: string): this {\n        this._brokerLocalGrammarsDir = dir;\n        return this;\n    }\n\n    /**\n     * Enables OAuth 2.1 resource-server authorization with a pre-resolved config\n     * (e.g. a custom {@link IResolvedAuth} carrying your own `ITokenValidator`).\n     * Prefer {@link withJwtAuth} for the standard JWKS-backed setup.\n     */\n    withAuth(auth: IResolvedAuth): this {\n        this._auth = auth;\n        return this;\n    }\n\n    /**\n     * Enables OAuth 2.1 authorization with the default stateless JWT validator:\n     * the broker verifies each bearer token's signature against the authorization\n     * server's JWKS and its audience against the slot's canonical resource URI.\n     *\n     * @throws if `publicBaseUrl`, `authorizationServers`, or `jwksUri` are missing.\n     */\n    withJwtAuth(options: IJwtAuthOptions): this {\n        this._auth = buildJwtAuth(options);\n        return this;\n    }\n\n    /** Installs a custom policy engine behind the broker's transport-neutral API. */\n    withPolicyEngine(engine: IPolicyEngine): this {\n        this._authorization = authorizationWithEngine(engine, {\n            slotResourceResolver: this._slotResourceResolver,\n        });\n        return this;\n    }\n\n    /** Compiles and validates roles, assignments, denies, mappings, and paths. */\n    withAuthorizationPolicy(config: IAuthorizationPolicyConfig): this {\n        this._authorization = compileAuthorizationPolicy(config);\n        return this;\n    }\n\n    /** Overrides the technical slot to hierarchical resource resolution strategy. */\n    withSlotResourceResolver(resolver: ISlotResourceResolver): this {\n        this._slotResourceResolver = resolver;\n        return this;\n    }\n\n    /**\n     * Authenticates providers (engines) with a custom {@link IProviderAuthenticator}.\n     * Prefer {@link withProviderSecret} for the standard shared-secret setup.\n     */\n    withProviderAuth(authenticator: IProviderAuthenticator): this {\n        this._providerAuth = authenticator;\n        return this;\n    }\n\n    /**\n     * Requires every provider connecting to `/provider/<slot>` or `/providers` to\n     * present the given shared secret (via `X-Provider-Token` or `Authorization:\n     * Bearer`). Closes off slot occupation by strangers.\n     */\n    withProviderSecret(secret: string): this {\n        this._providerAuth = new SharedSecretProviderAuthenticator(secret);\n        return this;\n    }\n\n    /** Constructs and returns a configured {@link WsTunnel}. */\n    build(): WsTunnel {\n        const baseAuthorization = this._authorization ?? this._auth?.authorization;\n        const authorization = baseAuthorization && this._slotResourceResolver ? { ...baseAuthorization, slotResourceResolver: this._slotResourceResolver } : baseAuthorization;\n        const options: IWsTunnelOptions = {\n            port: this._port,\n            host: this._host,\n            providerPath: this._providerPath,\n            providersPath: this._providersPath,\n            clientPath: this._clientPath,\n            ssePath: this._ssePath,\n            messagesPath: this._messagesPath,\n            mcpPath: this._mcpPath,\n            samplesIndexPath: this._samplesIndexPath,\n            allowedOrigins: this._allowedOrigins,\n            staticMounts: this._staticMounts.length > 0 ? [...this._staticMounts] : undefined,\n            stdioUpstreams: this._stdioUpstreams.length > 0 ? [...this._stdioUpstreams] : undefined,\n            remoteUpstreams: this._remoteUpstreams.length > 0 ? [...this._remoteUpstreams] : undefined,\n            stdioClient: this._stdioClient,\n            tls: this._tls,\n            brokerLocalGrammarsDir: this._brokerLocalGrammarsDir,\n            auth: this._auth,\n            providerAuth: this._providerAuth,\n            authorization,\n            slotResourceResolver: this._slotResourceResolver ?? authorization?.slotResourceResolver ?? this._auth?.slotResourceResolver,\n        };\n        return new WsTunnel(options);\n    }\n}\n","/**\n * Minimal ZIP extractor for `.mcpb` bundles, built on `node:zlib` only.\n *\n * A `.mcpb` bundle is an ordinary ZIP archive. The broker deliberately avoids\n * the `@anthropic-ai/mcpb` package so it stays compatible with the format\n * without being coupled to Anthropic's tooling, hence this small reader.\n *\n * Supports the two compression methods used in practice: stored (0) and\n * deflate (8). ZIP64 archives are rejected with a clear error (`.mcpb` bundles\n * are small and never need it). Any trailing bytes after the End Of Central\n * Directory record (e.g. a native PKCS#7 signature block) are ignored, since\n * extraction is driven entirely by the central directory.\n */\nimport { mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport { inflateRawSync } from \"node:zlib\";\n\nconst EOCD_SIGNATURE = 0x06054b50;\nconst CENTRAL_HEADER_SIGNATURE = 0x02014b50;\nconst LOCAL_HEADER_SIGNATURE = 0x04034b50;\n\n/** Locates the End Of Central Directory record by scanning backwards. */\nfunction findEocd(buf: Buffer): number {\n    // The EOCD is 22 bytes plus a comment of up to 65535 bytes.\n    const minPos = Math.max(0, buf.length - 22 - 0xffff);\n    for (let pos = buf.length - 22; pos >= minPos; pos--) {\n        if (buf.readUInt32LE(pos) === EOCD_SIGNATURE) return pos;\n    }\n    throw new Error(\"not a ZIP archive (no End Of Central Directory record found)\");\n}\n\n/**\n * Extracts every entry of the `.mcpb` archive at `mcpbPath` into `destDir`.\n * `destDir` is created if missing. Entries whose resolved path would escape\n * `destDir` (zip-slip) are rejected.\n */\nexport function unzipMcpb(mcpbPath: string, destDir: string): void {\n    const buf = readFileSync(mcpbPath);\n    const eocd = findEocd(buf);\n\n    const totalEntries = buf.readUInt16LE(eocd + 10);\n    const centralDirOffset = buf.readUInt32LE(eocd + 16);\n    if (centralDirOffset === 0xffffffff || totalEntries === 0xffff) {\n        throw new Error(\"ZIP64 archives are not supported\");\n    }\n\n    const absDest = resolve(destDir);\n    mkdirSync(absDest, { recursive: true });\n\n    let pos = centralDirOffset;\n    for (let i = 0; i < totalEntries; i++) {\n        if (buf.readUInt32LE(pos) !== CENTRAL_HEADER_SIGNATURE) {\n            throw new Error(`corrupt ZIP: bad central directory header at offset ${pos}`);\n        }\n        const method = buf.readUInt16LE(pos + 10);\n        const compressedSize = buf.readUInt32LE(pos + 20);\n        const uncompressedSize = buf.readUInt32LE(pos + 24);\n        const nameLen = buf.readUInt16LE(pos + 28);\n        const extraLen = buf.readUInt16LE(pos + 30);\n        const commentLen = buf.readUInt16LE(pos + 32);\n        const localHeaderOffset = buf.readUInt32LE(pos + 42);\n        const name = buf.toString(\"utf8\", pos + 46, pos + 46 + nameLen);\n        pos += 46 + nameLen + extraLen + commentLen;\n\n        if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff || localHeaderOffset === 0xffffffff) {\n            throw new Error(\"ZIP64 archives are not supported\");\n        }\n\n        // Resolve the destination path and reject zip-slip escapes.\n        const target = resolve(absDest, name);\n        const rel = relative(absDest, target);\n        if (rel.startsWith(\"..\") || isAbsolute(rel)) {\n            throw new Error(`unsafe ZIP entry path (zip-slip): ${name}`);\n        }\n\n        // Directory entry.\n        if (name.endsWith(\"/\")) {\n            mkdirSync(target, { recursive: true });\n            continue;\n        }\n\n        // Parse the local header to locate the entry's data.\n        if (buf.readUInt32LE(localHeaderOffset) !== LOCAL_HEADER_SIGNATURE) {\n            throw new Error(`corrupt ZIP: bad local header for \"${name}\"`);\n        }\n        const localNameLen = buf.readUInt16LE(localHeaderOffset + 26);\n        const localExtraLen = buf.readUInt16LE(localHeaderOffset + 28);\n        const dataStart = localHeaderOffset + 30 + localNameLen + localExtraLen;\n        const compressed = buf.subarray(dataStart, dataStart + compressedSize);\n\n        let data: Buffer;\n        if (method === 0) {\n            data = compressed;\n        } else if (method === 8) {\n            data = inflateRawSync(compressed);\n        } else {\n            throw new Error(`unsupported ZIP compression method ${method} for \"${name}\"`);\n        }\n\n        mkdirSync(dirname(target), { recursive: true });\n        writeFileSync(target, data);\n    }\n}\n","/**\n * Loads a local `.mcpb` bundle into an {@link IStdioUpstreamConfig}.\n *\n * A `.mcpb` bundle is a ZIP holding a `manifest.json` whose `server.mcp_config`\n * describes a stdio MCP server process. The broker:\n *\n * 1. verifies a **detached signature** of the `.mcpb` file against a trusted\n *    public key (PEM), integrity *and* provenance, using `node:crypto` only;\n * 2. unpacks the archive;\n * 3. reads the manifest, expands the `mcp_config` placeholders, and produces a\n *    `IStdioUpstreamConfig` that the existing upstream wiring spawns.\n *\n * The broker stays compatible with the `.mcpb` format without depending on the\n * `@anthropic-ai/mcpb` package: the bundle's *own* (native PKCS#7) signature is\n * never parsed: the detached signature layer is the broker's trust anchor.\n *\n * Any failure (missing files, bad signature, malformed manifest, missing\n * `user_config` value) is logged and yields `null`: the bundle is refused and\n * no process is ever spawned. Never auto-runs an unverified bundle.\n */\nimport { createPublicKey, verify, X509Certificate, type KeyObject } from \"node:crypto\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve, sep } from \"node:path\";\nimport { unzipMcpb } from \"./mcpb.unzip\";\nimport type { IStdioUpstreamConfig } from \"../stdio.upstream\";\n\n/** A `.mcpb` bundle entry from the broker config file. */\nexport interface IMcpbBundleConfig {\n    /** Provider slot name the bundle is bound to. */\n    name: string;\n    /** Path to the `.mcpb` file. */\n    path: string;\n    /** Path to the trusted public key (PEM) verifying the detached signature. */\n    publicKey: string;\n    /** Path to the detached signature file. Defaults to `<path>.sig`. */\n    signature?: string;\n    /** Values substituted into the manifest's `${user_config.*}` placeholders. */\n    userConfig?: Record<string, string | number | boolean | Array<string | number>>;\n    /** When `false`, the bundle stays out of the `_all` aggregate slot. Defaults to `true`. */\n    aggregate?: boolean;\n}\n\ninterface IMcpConfig {\n    command?: string;\n    args?: string[];\n    env?: Record<string, string>;\n    platform_overrides?: Record<string, { command?: string; args?: string[]; env?: Record<string, string> }>;\n}\n\n/** Loads a PEM that holds either an X.509 certificate or a bare public key. */\nfunction loadPublicKey(pem: string): KeyObject {\n    if (pem.includes(\"BEGIN CERTIFICATE\")) {\n        return new X509Certificate(pem).publicKey;\n    }\n    return createPublicKey(pem);\n}\n\n/** Verifies the detached `signature` of `data` against `publicKey`. */\nfunction verifyDetachedSignature(data: Buffer, signature: Buffer, publicKey: KeyObject): boolean {\n    // Ed25519/Ed448 are used without a separate hash algorithm; RSA/EC need one.\n    const keyType = publicKey.asymmetricKeyType;\n    const algorithm = keyType === \"ed25519\" || keyType === \"ed448\" ? null : \"sha256\";\n    return verify(algorithm, data, publicKey, signature);\n}\n\n/** Resolves a single `${...}` placeholder key, or `undefined` when unknown. */\nfunction resolvePlaceholder(key: string, dirname: string, userConfig: IMcpbBundleConfig[\"userConfig\"]): string | number | boolean | Array<string | number> | undefined {\n    if (key === \"__dirname\") return dirname;\n    if (key === \"HOME\") return homedir();\n    if (key === \"DESKTOP\") return join(homedir(), \"Desktop\");\n    if (key === \"DOCUMENTS\") return join(homedir(), \"Documents\");\n    if (key === \"DOWNLOADS\") return join(homedir(), \"Downloads\");\n    if (key === \"pathSeparator\" || key === \"/\") return sep;\n    if (key.startsWith(\"user_config.\")) {\n        const name = key.slice(\"user_config.\".length);\n        const value = userConfig?.[name];\n        if (value === undefined) throw new Error(`missing user_config value: \"${name}\"`);\n        return value;\n    }\n    return undefined;\n}\n\n/** Expands placeholders in a scalar string (command, env value). */\nfunction expandScalar(input: string, dirname: string, userConfig: IMcpbBundleConfig[\"userConfig\"]): string {\n    return input.replace(/\\$\\{([^}]+)\\}/g, (match, key: string) => {\n        const value = resolvePlaceholder(key, dirname, userConfig);\n        if (value === undefined) return match; // unknown placeholder, leave verbatim\n        if (Array.isArray(value)) throw new Error(`placeholder \"\\${${key}}\" is multi-valued and cannot be used here`);\n        return String(value);\n    });\n}\n\n/** Expands one manifest argument; a standalone multi-valued placeholder spreads. */\nfunction expandArg(arg: string, dirname: string, userConfig: IMcpbBundleConfig[\"userConfig\"]): string[] {\n    const standalone = /^\\$\\{(user_config\\.[^}]+)\\}$/.exec(arg);\n    if (standalone) {\n        const value = resolvePlaceholder(standalone[1], dirname, userConfig);\n        if (Array.isArray(value)) return value.map(String);\n        return [String(value)];\n    }\n    return [expandScalar(arg, dirname, userConfig)];\n}\n\n/**\n * Verifies, unpacks and resolves a `.mcpb` bundle into an `IStdioUpstreamConfig`.\n *\n * @param cfg      The bundle entry from the broker config.\n * @param baseDir  Directory the bundle paths are resolved against.\n * @returns        A ready upstream config, or `null` when the bundle is refused.\n */\nexport async function loadMcpbBundle(cfg: IMcpbBundleConfig, baseDir: string): Promise<IStdioUpstreamConfig | null> {\n    const tag = `[mcp-broker] mcpb bundle \"${cfg.name}\"`;\n    try {\n        const mcpbPath = resolve(baseDir, cfg.path);\n        const publicKeyPath = resolve(baseDir, cfg.publicKey);\n        const signaturePath = cfg.signature ? resolve(baseDir, cfg.signature) : `${mcpbPath}.sig`;\n\n        for (const [label, file] of [\n            [\"bundle\", mcpbPath],\n            [\"public key\", publicKeyPath],\n            [\"signature\", signaturePath],\n        ] as const) {\n            if (!existsSync(file)) {\n                console.error(`${tag}: ${label} file not found at ${file}, bundle refused.`);\n                return null;\n            }\n        }\n\n        // ── Signature verification (mandatory) ──────────────────────────────\n        const bundleBytes = readFileSync(mcpbPath);\n        const signatureBytes = readFileSync(signaturePath);\n        const publicKey = loadPublicKey(readFileSync(publicKeyPath, \"utf8\"));\n        if (!verifyDetachedSignature(bundleBytes, signatureBytes, publicKey)) {\n            console.error(`${tag}: detached signature is invalid for the configured public key, bundle refused.`);\n            return null;\n        }\n\n        // ── Unpack ──────────────────────────────────────────────────────────\n        const outputDir = resolve(baseDir, \".cache\", \"mcpb\", cfg.name);\n        rmSync(outputDir, { recursive: true, force: true });\n        unzipMcpb(mcpbPath, outputDir);\n\n        // ── Manifest → mcp_config ───────────────────────────────────────────\n        const manifestPath = join(outputDir, \"manifest.json\");\n        if (!existsSync(manifestPath)) {\n            console.error(`${tag}: manifest.json missing inside the bundle, bundle refused.`);\n            return null;\n        }\n        const manifest = JSON.parse(readFileSync(manifestPath, \"utf8\")) as { server?: { mcp_config?: IMcpConfig } };\n        const mcpConfig = manifest.server?.mcp_config;\n        if (!mcpConfig) {\n            console.error(`${tag}: manifest has no server.mcp_config, bundle refused.`);\n            return null;\n        }\n\n        // Platform-specific overrides replace the base fields when present.\n        const override = mcpConfig.platform_overrides?.[process.platform];\n        const command = override?.command ?? mcpConfig.command;\n        const rawArgs = override?.args ?? mcpConfig.args ?? [];\n        const rawEnv = { ...mcpConfig.env, ...override?.env };\n        if (!command) {\n            console.error(`${tag}: manifest mcp_config has no command, bundle refused.`);\n            return null;\n        }\n\n        // ── Placeholder expansion ───────────────────────────────────────────\n        const expandedCommand = expandScalar(command, outputDir, cfg.userConfig);\n        const expandedArgs = rawArgs.flatMap((arg) => expandArg(arg, outputDir, cfg.userConfig));\n        const expandedEnv: Record<string, string> = {};\n        for (const [key, value] of Object.entries(rawEnv)) {\n            expandedEnv[key] = expandScalar(value, outputDir, cfg.userConfig);\n        }\n\n        return {\n            name: cfg.name,\n            command: expandedCommand,\n            args: expandedArgs,\n            env: Object.keys(expandedEnv).length > 0 ? expandedEnv : undefined,\n            aggregate: cfg.aggregate ?? true,\n        };\n    } catch (err) {\n        console.error(`${tag}: ${(err as Error).message}, bundle refused.`);\n        return null;\n    }\n}\n\n/** @deprecated Use {@link IMcpbBundleConfig}. */\nexport type McpbBundleConfig = IMcpbBundleConfig;\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport type { IAuthorizationPolicyConfig } from \"./authorization/index\";\n\nexport interface IBrokerAuthConfig extends IAuthorizationPolicyConfig {\n    /** Master switch. Absent/`false` keeps the broker unauthenticated. */\n    enabled?: boolean;\n    /** Public origin the broker is reached at (e.g. `https://mcp.example.com`). */\n    publicBaseUrl?: string;\n    /** Authorization server issuer URL(s) advertised in the metadata. */\n    authorizationServers?: string[];\n    /** URL of the authorization server's JWKS document. */\n    jwks?: string;\n    /** Expected token issuer. Defaults to the sole `authorizationServers` entry. */\n    issuer?: string;\n    /** Scopes advertised in the metadata `scopes_supported`. */\n    scopesSupported?: string[];\n    /** Baseline scope(s) required to reach any slot. */\n    requiredScopes?: string[];\n    /** Per-slot required-scope overrides (e.g. an admin scope for `_broker`). */\n    perSlotScopes?: Record<string, string[]>;\n    /**\n     * Per-provider scope requirements for the `_all` aggregate. Deprecated in\n     * favor of hierarchical policy assignments.\n     */\n    providerScopes?: Record<string, string[]>;\n    /**\n     * Shared secret every provider must present to occupy a slot. Independent\n     * of client authorization.\n     */\n    providerSecret?: string;\n}\n\n/**\n * Shape of the optional JSON config file consumed by `bin.ts` at startup.\n * Every field is optional. Environment variables (`MCP_BROKER_*`) always win\n * over file values, and file values win over the built-in defaults.\n *\n * @example\n * ```json\n * {\n *     \"port\": 3001,\n *     \"locale\": \"fr\",\n *     \"tls\": { \"cert\": \"certs/cert.pem\", \"key\": \"certs/key.pem\" },\n *     \"stdioUpstreams\": [\n *         { \"name\": \"fs\", \"command\": \"npx\", \"args\": [\"-y\", \"@modelcontextprotocol/server-filesystem\", \"/data\"] }\n *     ]\n * }\n * ```\n */\nexport interface IBrokerConfig {\n    /** TCP port. Maps to `MCP_BROKER_PORT`. */\n    port?: number;\n\n    /** Bind host. Maps to `MCP_BROKER_HOST`. */\n    host?: string;\n\n    /** Force protocol (`http`/`https`) regardless of cert presence. Maps to `MCP_BROKER_PROTOCOL`. */\n    protocol?: \"http\" | \"https\";\n\n    /** Locale fed to the broker grammar resolver. Maps to `MCP_BROKER_LOCALE`. */\n    locale?: string;\n\n    /** Bridge stdin/stdout for a Claude-Desktop-style client. Maps to `MCP_BROKER_STDIO_PROVIDER`. */\n    stdioProvider?: string;\n\n    /** Logical broker name reported by `broker_info`. */\n    brokerName?: string;\n\n    /**\n     * Browser origins allowed to reach `/<slot>/mcp`.\n     *\n     * Absent means no browser origin is accepted: a request carrying an\n     * `Origin` header gets `403`, one carrying none (Claude Desktop, MCP\n     * Inspector, any server-side SDK) always passes. The MCP specification asks\n     * for this check, since without it any web page loaded in a browser that\n     * can reach the broker could drive it.\n     *\n     * An array lists origins matched **exactly**. An object supplies a regular\n     * expression tested against the whole `Origin` header. Also maps to\n     * `MCP_BROKER_ALLOWED_ORIGINS` (comma-separated list form only; a pattern\n     * needs the config file).\n     *\n     * @example\n     * ```json\n     * { \"allowedOrigins\": [\"https://app.example.com\", \"http://localhost:5173\"] }\n     * { \"allowedOrigins\": { \"pattern\": \"^https://[a-z0-9-]+\\\\.example\\\\.com$\" } }\n     * ```\n     */\n    allowedOrigins?: string[] | { pattern: string; flags?: string };\n\n    /**\n     * OAuth 2.1 resource-server authorization. When `enabled` is `true`, every\n     * HTTP client request to a slot must carry a valid `Authorization: Bearer`\n     * token issued for that slot, and the broker publishes Protected Resource\n     * Metadata (RFC 9728). Absent/`false` ⇒ no authentication (trusted-network\n     * mode, the historical behavior).\n     *\n     * Scalars also map to env vars (which win): `MCP_BROKER_AUTH_ENABLED`,\n     * `MCP_BROKER_PUBLIC_BASE_URL`, `MCP_BROKER_JWKS`, `MCP_BROKER_ISSUER`.\n     */\n    auth?: IBrokerAuthConfig;\n\n    /** URL paths (override the defaults). */\n    paths?: {\n        provider?: string;\n        providers?: string;\n        client?: string;\n        mcp?: string;\n        sse?: string;\n        messages?: string;\n    };\n\n    /** TLS material as paths on disk. Resolved against the config file's directory. */\n    tls?: {\n        cert: string;\n        key: string;\n    };\n\n    /**\n     * Static-file serving alongside the JSON-RPC endpoints. JSON-RPC routes\n     * always take precedence.\n     */\n    www?: {\n        /** Auto-launch the default browser at the root URL on startup. */\n        open?: boolean;\n        /** URL-prefix → directory mappings. Longest-prefix match wins. */\n        mounts?: Array<{\n            urlPrefix: string;\n            dir: string;\n        }>;\n    };\n\n    /** Stdio upstream providers spawned by the broker at startup. */\n    stdioUpstreams?: Array<{\n        name: string;\n        command: string;\n        args?: string[];\n        env?: Record<string, string>;\n        /** When `true`, the upstream joins the `_all` aggregate slot once connected. */\n        aggregate?: boolean;\n    }>;\n\n    /**\n     * Remote MCP servers the broker connects out to and exposes as provider\n     * slots. Each entry is reached by URL (Streamable HTTP / SSE / WebSocket);\n     * local servers should be shipped as `.mcpb` bundles instead.\n     */\n    mcpServers?: Array<{\n        name: string;\n        url: string;\n        transport?: \"streamable-http\" | \"sse\" | \"websocket\";\n        headers?: Record<string, string>;\n        /** Defaults to `true`; set to `false` to exclude this upstream from the `_all` aggregate slot. */\n        aggregate?: boolean;\n    }>;\n\n    /**\n     * Local `.mcpb` bundles the broker loads at startup and runs as stdio\n     * provider slots. A bundle is a ZIP with a `manifest.json`; the broker\n     * verifies a detached signature against a trusted public key before\n     * unpacking and spawning it.\n     */\n    mcpbBundles?: Array<{\n        /** Provider slot name the bundle is bound to. */\n        name: string;\n        /** Path to the `.mcpb` file (resolved against the config file's directory). */\n        path: string;\n        /** Path to the trusted public key (PEM) used to verify the detached signature. */\n        publicKey: string;\n        /** Path to the detached signature file. Defaults to `<path>.sig`. */\n        signature?: string;\n        /** Values substituted into the manifest's `${user_config.*}` placeholders. */\n        userConfig?: Record<string, string | number | boolean | Array<string | number>>;\n        /** Defaults to `true`; set to `false` to exclude this bundle from the `_all` aggregate slot. */\n        aggregate?: boolean;\n    }>;\n}\n\n/**\n * Returned by {@link loadBrokerConfig}. The {@link config} is the parsed JSON;\n * {@link baseDir} is the directory used to resolve relative paths inside it\n * (the directory containing the config file when one was found, otherwise\n * `process.cwd()`).\n */\nexport interface ILoadedBrokerConfig {\n    config: IBrokerConfig;\n    baseDir: string;\n    /** Absolute path of the config file that was loaded, or `null` if none. */\n    sourcePath: string | null;\n}\n\n/** Default folder name (relative to `process.cwd()`) holding broker-local files. */\nexport const DEFAULT_CONFIG_DIR = \".mcp-broker\";\n\n/** Default config filename inside {@link DEFAULT_CONFIG_DIR}. */\nexport const DEFAULT_CONFIG_FILENAME = \"config.json\";\n\n/** Legacy flat config filename at the cwd root (pre-`.mcp-broker/` layout). */\nexport const LEGACY_CONFIG_FILENAME = \"mcp-broker.config.json\";\n\n/**\n * Loads the broker config from a JSON file.\n *\n * Discovery order:\n * 1. The `path` argument when provided (explicit override).\n * 2. The `MCP_BROKER_CONFIG` env var.\n * 3. `./.mcp-broker/config.json` relative to `process.cwd()`.\n * 4. `./mcp-broker.config.json` relative to `process.cwd()` (legacy layout ,\n *    a deprecation warning is written to stderr).\n *\n * When no file is found, returns the built-in empty config with\n * `baseDir = process.cwd()`. On invalid JSON, logs a warning to stderr and\n * returns the same empty config, never throws.\n *\n * Paths inside the config file are intended to be resolved against\n * {@link ILoadedBrokerConfig.baseDir} by the consumer.\n */\nexport function loadBrokerConfig(path?: string): ILoadedBrokerConfig {\n    const cwd = process.cwd();\n    const envPath = process.env[\"MCP_BROKER_CONFIG\"];\n\n    let sourcePath: string | null = null;\n\n    if (path) {\n        sourcePath = resolve(cwd, path);\n    } else if (envPath) {\n        sourcePath = resolve(cwd, envPath);\n    } else {\n        const modern = resolve(cwd, DEFAULT_CONFIG_DIR, DEFAULT_CONFIG_FILENAME);\n        const legacy = resolve(cwd, LEGACY_CONFIG_FILENAME);\n        if (existsSync(modern)) {\n            sourcePath = modern;\n        } else if (existsSync(legacy)) {\n            sourcePath = legacy;\n            process.stderr.write(\n                `[mcp-broker] Using legacy config at ${legacy}. ` + `Move it to ${resolve(cwd, DEFAULT_CONFIG_DIR, DEFAULT_CONFIG_FILENAME)} ` + `to silence this warning.\\n`\n            );\n        }\n    }\n\n    if (!sourcePath || !existsSync(sourcePath)) {\n        return { config: {}, baseDir: cwd, sourcePath: null };\n    }\n\n    const baseDir = dirname(sourcePath);\n\n    try {\n        const raw = readFileSync(sourcePath, \"utf-8\");\n        const config = JSON.parse(raw) as IBrokerConfig;\n        return { config, baseDir, sourcePath };\n    } catch (err) {\n        process.stderr.write(`[mcp-broker] Failed to parse config file at ${sourcePath}: ${(err as Error).message}\\n`);\n        return { config: {}, baseDir: cwd, sourcePath: null };\n    }\n}\n\n/** @deprecated Use {@link IBrokerAuthConfig}. */\nexport type BrokerAuthConfig = IBrokerAuthConfig;\n\n/** @deprecated Use {@link IBrokerConfig}. */\nexport type BrokerConfig = IBrokerConfig;\n\n/** @deprecated Use {@link ILoadedBrokerConfig}. */\nexport type LoadedBrokerConfig = ILoadedBrokerConfig;\n"]}