@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/mcp/auth/discovery.js

@@ -0,0 +1,399 @@
+/**
+ * OAuth discovery for a third-party MCP server — MCP 2025-06-18, RFC 9728
+ * (protected resource metadata), RFC 8414 (authorization server metadata).
+ *
+ * ─── Why ────────────────────────────────────────────────────────────────────
+ *
+ * A third-party server's OAuth token belongs to whoever obtained it, not to
+ * VibeDefend. There is no shortcut: to talk to an auth-gated server the proxy
+ * has to authenticate as itself. The good news is that the spec makes the
+ * discovery automatic — the server refuses (401, or 403) and says where its
+ * metadata lives, and from there we climb to the endpoints. With no such
+ * pointer, the well-known path is derived from the server URL (RFC 9728
+ * §3.1). The user types nothing: no URL, no client id.
+ *
+ * ─── What is refused ────────────────────────────────────────────────────────
+ *
+ * Everything here is dictated by the server being asked. Four requirements,
+ * or we give up:
+ *   • HTTPS everywhere — a cleartext endpoint would expose the whole
+ *     authorization flow. The single exception is a loopback address, which
+ *     no network attacker can reach and which is how a local authorization
+ *     server (a test one, or a self-hosted gateway) is reachable at all;
+ *   • PKCE S256 advertised — the ONLY protection the authorization code has
+ *     for a public client like ours (see `oauth.ts`); never a silent
+ *     downgrade to `plain`;
+ *   • the protected resource (PRM) and the authorization server's issuer must
+ *     DESIGNATE THE SERVER BEING ASKED (RFC 9728 §3.3, RFC 8414 §3.3) — see
+ *     the mix-up section below;
+ *   • no redirect followed on OUR OWN requests — a 3xx would move the request
+ *     to an origin we did not choose to talk to.
+ *
+ * ─── The mix-up (confused deputy), and why the binding is vital ─────────────
+ *
+ * The server chooses its metadata URL, the issuer they announce and the
+ * resource they name. Unchecked, `evil.example` could return a challenge
+ * pointing at ANOTHER service's metadata (Linear, say): VibeDefend would
+ * climb that third party's AUTHENTIC chain, open its real consent page — which
+ * the user would approve in good faith — exchange the code there, and file a
+ * REAL third-party token under `evil.example`'s identity. The next request
+ * would then present it as `Authorization: Bearer`… to `evil.example`. A
+ * `.mcp.json` in a cloned repository is enough to pick that server, which is
+ * this file's reason to exist.
+ *
+ * Hence: the metadata URL must be on the server's origin, the `resource` they
+ * announce must canonicalise to the server, and the authorization server's
+ * `issuer` must designate itself (RFC 8414 §3.3).
+ *
+ * An accepted limit: a server may legitimately delegate its authorization to
+ * a third-party issuer, so we cannot require the `issuer` to be on the
+ * server's origin. What remains is the `resource` parameter (RFC 8707), which
+ * the exchange (`oauth.ts`) ALWAYS sets to the server being asked: a
+ * conforming issuer refuses a resource that is not its own
+ * (`invalid_target`). That last line of defence depends on the third party,
+ * not on us.
+ *
+ * ─── A check that was tried and removed, deliberately ───────────────────────
+ *
+ * Binding `authorization_endpoint` / `token_endpoint` /
+ * `registration_endpoint` to the issuer's origin looks attractive and is not
+ * done, for two reasons that together condemn it:
+ *
+ *   1. It closes the INSTANCE, not the CLASS — the attacker simply hosts a
+ *      302 on their OWN `authorization_endpoint`: the browser lands on the
+ *      real consent page of a genuine third party, with THEIR `client_id` and
+ *      OUR `code_challenge`. The check structurally cannot see it: that
+ *      endpoint opens in the BROWSER, we never fetch it, and `redirect:
+ *      'manual'` does not apply to it.
+ *   2. It refuses PERFECTLY CONFORMING deployments: AWS Cognito (issuer
+ *      `cognito-idp.<region>.amazonaws.com/<pool>`, endpoints
+ *      `<domain>.auth.<region>.amazoncognito.com` — the pattern AWS
+ *      recommends for MCP) and Google (`accounts.google.com` /
+ *      `oauth2.googleapis.com`) would come back `unusable`. Neither RFC 8414
+ *      nor the MCP spec requires co-origin, and `amazonaws.com` /
+ *      `amazoncognito.com` are two distinct registrable domains — no
+ *      loosening ("same parent domain") saves the rule without emptying it.
+ *
+ * The structural difference with the PRM ↔ server binding, which IS kept: that
+ * one anchors on a TRUSTED value, the URL the USER chose (`serverUrl`). The
+ * removed check anchored on a value CHOSEN BY THE ATTACKER — the issuer they
+ * designate themselves — which they only have to be self-consistent to
+ * satisfy.
+ *
+ * What closes the class: `state` (anti-CSRF) plus `iss` (RFC 9207, the issuer
+ * announced in the authorization response itself, compared to the expected
+ * one), both enforced by `callback.ts` on the BROWSER's response rather than
+ * on a document the attacker controls.
+ */
+import { pkg } from '../../version.js';
+import { canonicalMcpUrl } from './oauth.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+/**
+ * Common options for every discovery request.
+ *
+ * `redirect: 'manual'` is not cosmetic: without it a 3xx would be enough to
+ * have us read metadata on an origin we never chose to ask, and the checks
+ * below would be about the URL REQUESTED rather than the one that answered.
+ */
+function requestInit(signal, extra = {}) {
+    return { redirect: 'manual', signal, ...extra };
+}
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+/**
+ * A usable URL, or `null`.
+ *
+ * https, or http on a loopback address. The loopback exception is RFC 8252's
+ * reasoning applied to the other side of the flow: a listener on 127.0.0.1 is
+ * not reachable by a network attacker, so cleartext buys them nothing, and
+ * refusing it would make a self-hosted or local authorization server
+ * impossible to talk to — including the mock one the tests run against.
+ */
+function usableUrl(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol === 'https:')
+        return value;
+    if (parsed.protocol === 'http:' && LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase())) {
+        return value;
+    }
+    return null;
+}
+/** `scheme//host[:port]` of the server, or `null`. */
+function mcpOrigin(url) {
+    const canonical = canonicalMcpUrl(url);
+    if (!canonical)
+        return null;
+    const pathStart = canonical.indexOf('/', canonical.indexOf('//') + 2);
+    return pathStart === -1 ? canonical : canonical.slice(0, pathStart);
+}
+/** Do two URLs designate the SAME MCP server? */
+function sameMcpServer(a, b) {
+    const ca = canonicalMcpUrl(a);
+    return ca !== null && ca === canonicalMcpUrl(b);
+}
+/** A comparable issuer identifier — RFC 8414 tolerates the trailing slash. */
+function issuerId(value) {
+    const url = usableUrl(value);
+    return url ? url.replace(/\/+$/, '') : null;
+}
+/**
+ * The metadata URL announced by the `WWW-Authenticate` challenge, or `null`.
+ *
+ * The challenge comes from the server being asked, so two requirements:
+ *   • a usable scheme — following an `http://` on a public host would expose
+ *     the rest of the flow to anyone on the path;
+ *   • the SAME ORIGIN as `serverUrl` — a protected resource's metadata is read
+ *     from IT (RFC 9728 §3). A server pointing them at a third party is
+ *     trying to make us go looking for that third party's token; see the
+ *     mix-up section at the top of this file.
+ *
+ * `serverUrl` is not optional: without it a caller could forget the binding,
+ * which is exactly what made the mix-up possible.
+ */
+export function parseResourceMetadataUrl(header, serverUrl) {
+    if (!header)
+        return null;
+    const m = /resource_metadata\s*=\s*"?([^",\s]+)"?/i.exec(header);
+    const url = m ? usableUrl(m[1]) : null;
+    if (!url)
+        return null;
+    const expected = mcpOrigin(serverUrl);
+    return expected && mcpOrigin(url) === expected ? url : null;
+}
+/**
+ * The well-known path derived from the server URL (RFC 9728 §3.1), or `null`.
+ *
+ * A server may refuse without carrying a `WWW-Authenticate`; no RFC makes it
+ * mandatory. This path is derived from the server ASKED, so it is bound to it
+ * by construction and does not reopen the door the origin check just closed.
+ */
+function derivedResourceMetadataUrl(serverUrl) {
+    const canonical = canonicalMcpUrl(serverUrl);
+    const origin = mcpOrigin(serverUrl);
+    if (!canonical || !origin || !usableUrl(origin))
+        return null;
+    // `https://host/mcp` → `https://host/.well-known/oauth-protected-resource/mcp`
+    return `${origin}/.well-known/oauth-protected-resource${canonical.slice(origin.length)}`;
+}
+/**
+ * Every place an authorization server may publish its metadata, in the order
+ * they are tried.
+ *
+ * RFC 8414 §3.1 inserts the well-known segment BETWEEN the host and the
+ * issuer's path (`https://host/.well-known/oauth-authorization-server/tenant`),
+ * while OpenID Connect Discovery appends it (`https://host/tenant/.well-known/
+ * openid-configuration`). Real deployments implement one, the other, or both:
+ * Auth0 and Okta answer the OIDC form, Keycloak answers the RFC 8414 form
+ * under its realm path, and an AS with no path at all answers either. Trying
+ * a single shape is why a conforming tenant-scoped issuer came back
+ * `unusable`.
+ */
+export function authorizationServerMetadataUrls(issuer) {
+    let parsed;
+    try {
+        parsed = new URL(issuer);
+    }
+    catch {
+        return [];
+    }
+    const origin = `${parsed.protocol}//${parsed.host}`;
+    const path = parsed.pathname.replace(/\/+$/, '');
+    if (path === '') {
+        return [
+            `${origin}/.well-known/oauth-authorization-server`,
+            `${origin}/.well-known/openid-configuration`,
+        ];
+    }
+    return [
+        `${origin}/.well-known/oauth-authorization-server${path}`,
+        // The appended form is not in RFC 8414, but it is what earlier clients
+        // asked for and what a great many deployments still serve — AWS Cognito
+        // among them. Dropping it turns a working tenant-scoped issuer into
+        // `unusable`, which is a regression dressed as strictness.
+        `${origin}${path}/.well-known/oauth-authorization-server`,
+        `${origin}/.well-known/openid-configuration${path}`,
+        `${origin}${path}/.well-known/openid-configuration`,
+    ];
+}
+/**
+ * Climbs the discovery chain to the endpoints. NEVER throws: a silent server,
+ * a 404 on the metadata or a dead network are ordinary outcomes, not
+ * exceptions. `reason` tells the caller what to do next — "leave this server
+ * alone" (`no-oauth`) is not the same decision as "report a problem"
+ * (`unusable`, `closed-door`, `unreachable`).
+ */
+export async function discoverMcpOAuthOutcome(serverUrl, deps = {}) {
+    const fail = (reason) => ({
+        endpoints: null,
+        reason,
+    });
+    const f = deps.fetchImpl ?? globalThis.fetch;
+    const timeout = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const signal = () => AbortSignal.timeout(timeout);
+    try {
+        // 1. Get the challenge, unless the caller already has one.
+        let status;
+        let header;
+        if (deps.knownChallenge) {
+            status = deps.knownChallenge.status;
+            header = deps.knownChallenge.wwwAuthenticate;
+        }
+        else {
+            // An unauthenticated request is enough, and it has the same shape as
+            // the real handshake so that a server inspecting `clientInfo` sees the
+            // same identity in both places.
+            const challenge = await f(serverUrl, requestInit(signal(), {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json, text/event-stream',
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: 1,
+                    method: 'initialize',
+                    params: {
+                        protocolVersion: '2025-06-18',
+                        capabilities: {},
+                        clientInfo: { name: pkg.name, version: pkg.version },
+                    },
+                }),
+            }));
+            status = challenge.status;
+            header = challenge.headers.get('www-authenticate');
+        }
+        // Neither 401 nor 403: this server refuses nothing, there is no OAuth to
+        // discover. The 403 counts — a real MCP server was measured closing its
+        // door that way, and reading only the 401 would condemn it to never being
+        // authorized.
+        if (status !== 401 && status !== 403)
+            return fail('no-oauth');
+        // Bound to the origin of the server being asked, see the module header.
+        const announced = parseResourceMetadataUrl(header, serverUrl);
+        // A challenge that POINTS AT metadata we refuse is a hostile signal, not
+        // an oversight: we do not go looking elsewhere to be accommodating.
+        if (!announced && header && /resource_metadata/i.test(header))
+            return fail('unusable');
+        const resource = usableUrl(canonicalMcpUrl(serverUrl));
+        // Never the URL as received: `httpsUrl(serverUrl)` returned the string
+        // VERBATIM, query string included, so a hosted server's identifier
+        // (`?api_key=`) travelled as the `resource=` parameter of the
+        // authorization URL — into the user's BROWSER, their history, and the
+        // access logs of a THIRD-PARTY authorization server named by the MCP
+        // server itself — then into the POST to the token endpoint, then
+        // persisted. `canonicalMcpUrl` is also exactly what RFC 8707 expects of a
+        // resource identifier (scheme, host, path; neither query nor fragment),
+        // so closing the leak and conforming are the same gesture here.
+        if (!resource)
+            return fail('unusable');
+        // 2. Protected resource metadata (RFC 9728).
+        const prmUrl = announced ?? derivedResourceMetadataUrl(serverUrl);
+        const prm = prmUrl ? await readJson(f, prmUrl, signal()) : null;
+        let issuer;
+        let scopesSupported;
+        if (prm) {
+            // The resource announced must be THE ONE WE ARE ASKING (RFC 9728 §3.3).
+            // Otherwise we would go and negotiate a token at a third party and bring
+            // it back here — the heart of the mix-up.
+            const declared = typeof prm.resource === 'string' ? prm.resource : null;
+            if (declared && !sameMcpServer(declared, serverUrl))
+                return fail('unusable');
+            // "Nothing announced" (`closed-door`, no advice beyond "this server is
+            // shut") and "something IS announced but we refuse it" (`unusable`) are
+            // different outcomes; merging them would have the caller give the wrong
+            // advice.
+            const servers = Array.isArray(prm.authorization_servers) ? prm.authorization_servers : [];
+            if (servers.length === 0)
+                return fail('closed-door');
+            issuer = issuerId(servers[0]);
+            if (!issuer)
+                return fail('unusable');
+            scopesSupported = readScopes(prm.scopes_supported);
+        }
+        else {
+            // No PRM. Plenty of MCP servers publish RFC 8414 metadata on their own
+            // origin and skip RFC 9728 entirely; treating that as a closed door
+            // would refuse to log into servers that are perfectly usable. The
+            // fallback issuer is the server's OWN origin, which is a trusted value
+            // — the URL the user chose — so it does not reopen the mix-up.
+            issuer = issuerId(mcpOrigin(serverUrl));
+            if (!issuer)
+                return fail('closed-door');
+            scopesSupported = [];
+        }
+        // 3. Authorization server metadata (RFC 8414), at whichever of the
+        // standard locations this deployment uses.
+        let as = null;
+        for (const candidate of authorizationServerMetadataUrls(issuer)) {
+            as = await readJson(f, candidate, signal());
+            if (as)
+                break;
+        }
+        if (!as)
+            return fail(prm ? 'unusable' : 'closed-door');
+        // RFC 8414 §3.3: the `issuer` returned must be identical to the one we
+        // inserted the well-known path into. Second link of the anti mix-up chain:
+        // without it, a document served by another issuer would pass for the one
+        // we aimed at.
+        if (issuerId(as.issuer) !== issuer)
+            return fail('unusable');
+        const authorizationEndpoint = usableUrl(as.authorization_endpoint);
+        const tokenEndpoint = usableUrl(as.token_endpoint);
+        if (!authorizationEndpoint || !tokenEndpoint)
+            return fail('unusable');
+        // Treated uniformly with the two above: usable or absent, nothing else,
+        // never a special case for this optional field.
+        const registrationEndpoint = usableUrl(as.registration_endpoint);
+        // PKCE S256 required. Never `plain`: a public client without S256 has NO
+        // protection left on the code exchange.
+        const methods = Array.isArray(as.code_challenge_methods_supported)
+            ? as.code_challenge_methods_supported
+            : [];
+        if (!methods.includes('S256'))
+            return fail('unusable');
+        return {
+            endpoints: {
+                authorizationEndpoint,
+                tokenEndpoint,
+                registrationEndpoint,
+                resource,
+                issuer,
+                issParameterSupported: as.authorization_response_iss_parameter_supported === true,
+                scopesSupported,
+            },
+            reason: 'ok',
+        };
+    }
+    catch {
+        return fail('unreachable');
+    }
+}
+/** A metadata document, or `null` when it is absent or unreadable. */
+async function readJson(f, url, signal) {
+    try {
+        const res = await f(url, requestInit(signal));
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The scopes the PRM advertises, filtered to non-empty strings. An absent or
+ * malformed value means "none", never an exception.
+ */
+function readScopes(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === 'string' && v.trim().length > 0);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/mcp/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/auth/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA0D7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,MAAmB,EAAE,QAAqB,EAAE;IAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACtE,CAAC;AAED,iDAAiD;AACjD,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAqB,EAAE,SAAiB;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,SAAiB;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,+EAA+E;IAC/E,OAAO,GAAG,MAAM,wCAAwC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,GAAG,MAAM,yCAAyC;YAClD,GAAG,MAAM,mCAAmC;SAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM,0CAA0C,IAAI,EAAE;QACzD,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,2DAA2D;QAC3D,GAAG,MAAM,GAAG,IAAI,yCAAyC;QACzD,GAAG,MAAM,oCAAoC,IAAI,EAAE;QACnD,GAAG,MAAM,GAAG,IAAI,mCAAmC;KACpD,CAAC;AACJ,CAAC;AAoBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,OAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,CAAC,MAA+B,EAA4B,EAAE,CAAC,CAAC;QAC3E,SAAS,EAAE,IAAI;QACf,MAAM;KACP,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,2DAA2D;QAC3D,IAAI,MAAc,CAAC;QACnB,IAAI,MAAqB,CAAC;QAC1B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YACpC,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,CAAC,CACvB,SAAS,EACT,WAAW,CAAC,MAAM,EAAE,EAAE;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,qCAAqC;iBAC9C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,YAAY,EAAE,EAAE;wBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;qBACrD;iBACF,CAAC;aACH,CAAC,CACH,CAAC;YACF,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;YAC1B,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACrD,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,cAAc;QACd,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAE9D,wEAAwE;QACxE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvF,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,uEAAuE;QACvE,mEAAmE;QACnE,8DAA8D;QAC9D,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,0EAA0E;QAC1E,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvC,6CAA6C;QAC7C,MAAM,MAAM,GAAG,SAAS,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhE,IAAI,MAAqB,CAAC;QAC1B,IAAI,eAAyB,CAAC;QAE9B,IAAI,GAAG,EAAE,CAAC;YACR,wEAAwE;YACxE,yEAAyE;YACzE,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,IAAI,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;YAE7E,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,UAAU;YACV,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;YACrC,eAAe,GAAG,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,eAAe,GAAG,EAAE,CAAC;QACvB,CAAC;QAED,mEAAmE;QACnE,2CAA2C;QAC3C,IAAI,EAAE,GAAmC,IAAI,CAAC;QAC9C,KAAK,MAAM,SAAS,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE;gBAAE,MAAM;QAChB,CAAC;QACD,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAEvD,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,eAAe;QACf,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAE5D,MAAM,qBAAqB,GAAG,SAAS,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC;QACnE,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,qBAAqB,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,oBAAoB,GAAG,SAAS,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;QAEjE,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,gCAAgC,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC,gCAAgC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvD,OAAO;YACL,SAAS,EAAE;gBACT,qBAAqB;gBACrB,aAAa;gBACb,oBAAoB;gBACpB,QAAQ;gBACR,MAAM;gBACN,qBAAqB,EAAE,EAAE,CAAC,8CAA8C,KAAK,IAAI;gBACjF,eAAe;aAChB;YACD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,QAAQ,CACrB,CAA0B,EAC1B,GAAW,EACX,MAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACxF,CAAC"}