@grackle-ai/web-server 0.75.1

package/README.md

@@ -0,0 +1,45 @@
+# @grackle-ai/web-server
+
+HTTP web server for [Grackle](https://github.com/nick-pape/grackle) — static file serving, device pairing, OAuth authorization, and ConnectRPC proxy.
+
+## Overview
+
+`createWebServer(options)` returns an `http.Server` that handles:
+
+- **Static file serving** — serves the `@grackle-ai/web` SPA with path traversal protection and SPA fallback
+- **Device pairing** — `/pair` endpoint for pairing code entry and session cookie creation
+- **OAuth 2.1** — `/.well-known/oauth-authorization-server`, `/register`, `/authorize`, `/token` endpoints
+- **ConnectRPC proxy** — forwards `/grackle.Grackle/*` requests to injected ConnectRPC routes (Connect protocol over HTTP/1.1)
+- **Session auth gate** — unauthenticated requests redirect to `/pair`
+
+## Usage
+
+```typescript
+import { createWebServer } from "@grackle-ai/web-server";
+import { registerGrackleRoutes } from "./grpc-service.js";
+
+const webServer = createWebServer({
+  apiKey,
+  webPort: 3000,
+  bindHost: "127.0.0.1",
+  connectRoutes: registerGrackleRoutes,
+});
+
+webServer.listen(3000, "127.0.0.1");
+```
+
+## API
+
+### `createWebServer(options: WebServerOptions): http.Server`
+
+| Option | Type | Required | Description |
+|--------|------|----------|-------------|
+| `apiKey` | `string` | yes | API key for session/bearer auth |
+| `webPort` | `number` | yes | Port (used for OAuth URL generation) |
+| `bindHost` | `string` | yes | Bind host (`127.0.0.1` or `0.0.0.0`) |
+| `connectRoutes` | `(router) => void` | no | ConnectRPC route registration function |
+| `webDistDir` | `string` | no | Override web UI dist directory |
+
+### `isWildcardAddress(host: string): boolean`
+
+Returns `true` if the host is a wildcard bind address (`0.0.0.0`, `::`, etc.).

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { createWebServer } from "./web-server.js";
+export type { WebServerOptions } from "./web-server.js";
+export { isWildcardAddress } from "./web-server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createWebServer } from "./web-server.js";
+export { isWildcardAddress } from "./web-server.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/tsdoc-metadata.json

@@ -0,0 +1,11 @@
+// This file is read by tools that parse documentation comments conforming to the TSDoc standard.
+// It should be published with your NPM package.  It should not be tracked by Git.
+{
+  "tsdocVersion": "0.12",
+  "toolPackages": [
+    {
+      "packageName": "@microsoft/api-extractor",
+      "packageVersion": "7.57.7"
+    }
+  ]
+}

package/dist/web-server.d.ts

@@ -0,0 +1,26 @@
+import http from "node:http";
+import type { ConnectRouter } from "@connectrpc/connect";
+/** Options for creating a Grackle web server. */
+export interface WebServerOptions {
+    /** API key for session/bearer auth. */
+    apiKey: string;
+    /** Port the web server will listen on (used for OAuth URL generation). */
+    webPort: number;
+    /** Bind host (e.g. "127.0.0.1" or "0.0.0.0"). */
+    bindHost: string;
+    /** ConnectRPC route registration function (injected from grpc-service). */
+    connectRoutes?: (router: ConnectRouter) => void;
+    /** Override the web UI dist directory (default: resolve from `grackle-ai/web`). */
+    webDistDir?: string;
+}
+/** Whether a bind address is a wildcard (binds all interfaces). */
+export declare function isWildcardAddress(host: string): boolean;
+/**
+ * Create an HTTP server that serves the Grackle web UI, pairing flow,
+ * OAuth authorization server, and optionally proxies ConnectRPC requests.
+ *
+ * @param options - Server configuration.
+ * @returns An `http.Server` ready to `.listen()`.
+ */
+export declare function createWebServer(options: WebServerOptions): http.Server;
+//# sourceMappingURL=web-server.d.ts.map

package/dist/web-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-server.d.ts","sourceRoot":"","sources":["../src/web-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA4ND,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAwXtE"}

package/dist/web-server.js

@@ -0,0 +1,536 @@
+import http from "node:http";
+import { readFileSync, existsSync } from "node:fs";
+import { join, dirname, extname, normalize, resolve, relative } from "node:path";
+import { createRequire } from "node:module";
+import { connectNodeAdapter } from "@connectrpc/connect-node";
+import { setSecurityHeaders, createSession, validateSessionCookie, verifyApiKey, redeemPairingCode, registerClient, getClient, createAuthorizationCode, consumeAuthorizationCode, createRefreshToken, consumeRefreshToken, createOAuthAccessToken, OAUTH_ACCESS_TOKEN_TTL_MS, } from "@grackle-ai/auth";
+// ─── Static File Config ─────────────────────────────────────
+const MIME_TYPES = {
+    ".html": "text/html",
+    ".js": "application/javascript",
+    ".css": "text/css",
+    ".json": "application/json",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+};
+/** Resolve the web UI dist directory. */
+function resolveWebDistDir() {
+    const esmRequire = createRequire(import.meta.url);
+    return resolve(process.env.GRACKLE_WEB_DIR
+        || join(dirname(esmRequire.resolve("@grackle-ai/web/package.json")), "dist"));
+}
+// ─── HTML Pages ─────────────────────────────────────────────
+/** Escape HTML special characters for safe embedding in attributes and text content. */
+function escapeHtml(str) {
+    return str
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#x27;");
+}
+/** Minimal HTML page shown when the user needs to enter a pairing code. */
+function renderPairingPage(error) {
+    const errorHtml = error ? `<p style="color:#e74c3c;margin-bottom:1rem">${escapeHtml(error)}</p>` : "";
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Grackle — Pair Device</title>
+<style>
+  *{box-sizing:border-box;margin:0;padding:0}
+  body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;background:#0f172a;color:#e2e8f0}
+  .card{background:#1e293b;border-radius:12px;padding:2.5rem;max-width:400px;width:100%;text-align:center;box-shadow:0 4px 24px rgba(0,0,0,.3)}
+  h1{font-size:1.5rem;margin-bottom:.5rem}
+  p{color:#94a3b8;margin-bottom:1.5rem;font-size:.95rem}
+  input{width:100%;padding:.75rem 1rem;font-size:1.25rem;letter-spacing:.3em;text-align:center;border:2px solid #334155;border-radius:8px;background:#0f172a;color:#e2e8f0;text-transform:uppercase;font-family:monospace}
+  input:focus{outline:none;border-color:#3b82f6}
+  button{margin-top:1rem;width:100%;padding:.75rem;font-size:1rem;border:none;border-radius:8px;background:#3b82f6;color:#fff;cursor:pointer;font-weight:600}
+  button:hover{background:#2563eb}
+</style></head><body>
+<div class="card">
+  <h1>Grackle</h1>
+  <p>Enter the pairing code shown in your terminal.</p>
+  ${errorHtml}
+  <form method="GET" action="/pair">
+    <input name="code" type="text" maxlength="6" pattern="[A-Za-z0-9]{6}" autocomplete="off" autofocus placeholder="ABC123" required>
+    <button type="submit">Pair</button>
+  </form>
+</div></body></html>`;
+}
+/** Shared card styles used by both pairing and authorize pages. */
+const CARD_STYLES = `*{box-sizing:border-box;margin:0;padding:0}
+  body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;background:#0f172a;color:#e2e8f0}
+  .card{background:#1e293b;border-radius:12px;padding:2.5rem;max-width:400px;width:100%;text-align:center;box-shadow:0 4px 24px rgba(0,0,0,.3)}
+  h1{font-size:1.5rem;margin-bottom:.5rem}
+  p{color:#94a3b8;margin-bottom:1.5rem;font-size:.95rem}
+  input{width:100%;padding:.75rem 1rem;font-size:1.25rem;letter-spacing:.3em;text-align:center;border:2px solid #334155;border-radius:8px;background:#0f172a;color:#e2e8f0;text-transform:uppercase;font-family:monospace;margin-bottom:.5rem}
+  input:focus{outline:none;border-color:#3b82f6}
+  button{margin-top:1rem;width:100%;padding:.75rem;font-size:1rem;border:none;border-radius:8px;background:#3b82f6;color:#fff;cursor:pointer;font-weight:600}
+  button:hover{background:#2563eb}
+  .btn-deny{background:#475569;margin-top:.5rem}
+  .btn-deny:hover{background:#334155}
+  .client-name{color:#3b82f6;font-weight:600}`;
+/**
+ * Render the OAuth authorize page.
+ *
+ * If the user has a valid session, shows a simple "Authorize" / "Deny" form.
+ * If not paired, adds a pairing code input so the user can pair and authorize in one step.
+ */
+function renderAuthorizePage(clientName, oauthParams, hasPairedSession, error) {
+    const errorHtml = error ? `<p style="color:#e74c3c;margin-bottom:1rem">${escapeHtml(error)}</p>` : "";
+    const pairingField = hasPairedSession
+        ? ""
+        : `<p>Enter the pairing code shown in your terminal to pair and authorize.</p>
+       <input name="pairing_code" type="text" maxlength="6" pattern="[A-Za-z0-9]{6}" autocomplete="off" autofocus placeholder="ABC123" required>`;
+    const buttonLabel = hasPairedSession ? "Authorize" : "Pair &amp; Authorize";
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Grackle — Authorize MCP Client</title>
+<style>${CARD_STYLES}</style></head><body>
+<div class="card">
+  <h1>Authorize MCP Client</h1>
+  <p><span class="client-name">${escapeHtml(clientName)}</span> wants to connect to Grackle.</p>
+  ${errorHtml}
+  <form method="POST" action="/authorize">
+    ${pairingField}
+    <input type="hidden" name="oauth_params" value="${escapeHtml(oauthParams)}">
+    <button type="submit" name="action" value="approve">${buttonLabel}</button>
+    <button type="submit" name="action" value="deny" class="btn-deny">Deny</button>
+  </form>
+</div></body></html>`;
+}
+// ─── HTTP Helpers ───────────────────────────────────────────
+/** Maximum size for form/JSON request bodies: 16 KB. */
+const MAX_BODY_SIZE = 16_384;
+/**
+ * Read the raw body string from an HTTP request with size limit enforcement.
+ *
+ * @param req - The incoming HTTP request.
+ * @returns The raw body as a UTF-8 string.
+ */
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let totalSize = 0;
+        req.on("data", (chunk) => {
+            totalSize += chunk.length;
+            if (totalSize > MAX_BODY_SIZE) {
+                req.destroy();
+                reject(new Error("Body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            resolve(Buffer.concat(chunks).toString("utf8"));
+        });
+        req.on("error", reject);
+    });
+}
+/**
+ * Parse a URL-encoded form body from an HTTP request.
+ *
+ * @param req - The incoming HTTP request.
+ * @returns Parsed key-value pairs from the form body.
+ */
+async function parseFormBody(req) {
+    const raw = await readBody(req);
+    return new URLSearchParams(raw);
+}
+/**
+ * Serve a static file from the web dist directory.
+ * Always writes a response (200, 403, 404, or 500).
+ */
+function serveStaticFile(res, rawPath, distDir) {
+    const isRoot = rawPath === "/" || rawPath === "";
+    let filePath = isRoot
+        ? join(distDir, "index.html")
+        : resolve(distDir, normalize(`.${rawPath}`));
+    // Prevent path traversal — resolved path must stay within the dist directory
+    const rel = relative(distDir, filePath);
+    if (rel.startsWith("..") || resolve(distDir, rel) !== filePath) {
+        res.writeHead(403);
+        res.end("Forbidden");
+        return;
+    }
+    // After path traversal validation, filePath is safe to use with fs operations.
+    // CodeQL flags these as "uncontrolled data in path expression" but the check
+    // above guarantees the path is within distDir.
+    const safeFilePath = existsSync(filePath) ? filePath : join(distDir, "index.html"); // SPA fallback
+    if (!existsSync(safeFilePath)) {
+        res.writeHead(404);
+        res.end("Not found");
+        return;
+    }
+    const ext = extname(safeFilePath);
+    const contentType = MIME_TYPES[ext] || "application/octet-stream";
+    try {
+        const content = readFileSync(safeFilePath);
+        res.writeHead(200, { "Content-Type": contentType });
+        res.end(content);
+    }
+    catch {
+        res.writeHead(500);
+        res.end("Server error");
+    }
+}
+/** Extract the remote IP from an incoming request. */
+function getRemoteIp(req) {
+    return req.socket.remoteAddress || "unknown";
+}
+/** Static assets served without session authentication (favicons, manifest, logo). */
+const PUBLIC_ASSETS = new Set([
+    "/favicon.ico",
+    "/favicon-16x16.png",
+    "/favicon-32x32.png",
+    "/apple-touch-icon.png",
+    "/manifest.json",
+    "/icon-192x192.png",
+    "/icon-512x512.png",
+    "/grackle-logo.png",
+]);
+// ─── Utilities ──────────────────────────────────────────────
+/** Whether a bind address is a wildcard (binds all interfaces). */
+export function isWildcardAddress(host) {
+    return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0";
+}
+// ─── Factory ────────────────────────────────────────────────
+/**
+ * Create an HTTP server that serves the Grackle web UI, pairing flow,
+ * OAuth authorization server, and optionally proxies ConnectRPC requests.
+ *
+ * @param options - Server configuration.
+ * @returns An `http.Server` ready to `.listen()`.
+ */
+export function createWebServer(options) {
+    const { apiKey, webPort, bindHost, connectRoutes, webDistDir } = options;
+    const distDir = webDistDir ?? resolveWebDistDir();
+    const allowNetwork = isWildcardAddress(bindHost);
+    const dialableHost = allowNetwork ? "127.0.0.1" : bindHost;
+    const urlHost = dialableHost.includes(":") ? `[${dialableHost}]` : dialableHost;
+    const webBaseUrl = `http://${urlHost}:${webPort}`;
+    /** ConnectRPC handler for browser gRPC calls (Connect protocol over HTTP/1.1). */
+    const webConnectHandler = connectRoutes
+        ? connectNodeAdapter({ routes: connectRoutes })
+        : undefined;
+    // eslint-disable-next-line @typescript-eslint/no-misused-promises
+    const handler = async (req, res) => {
+        setSecurityHeaders(res);
+        let rawPath;
+        let queryString = "";
+        try {
+            const urlParts = (req.url || "/").split("?");
+            rawPath = decodeURIComponent(urlParts[0]);
+            queryString = urlParts[1] || "";
+        }
+        catch {
+            res.writeHead(400);
+            res.end("Bad Request");
+            return;
+        }
+        // --- OAuth Authorization Server Metadata (no auth) ---
+        if (rawPath === "/.well-known/oauth-authorization-server") {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                issuer: webBaseUrl,
+                authorization_endpoint: `${webBaseUrl}/authorize`,
+                token_endpoint: `${webBaseUrl}/token`,
+                registration_endpoint: `${webBaseUrl}/register`,
+                response_types_supported: ["code"],
+                grant_types_supported: ["authorization_code", "refresh_token"],
+                code_challenge_methods_supported: ["S256"],
+                token_endpoint_auth_methods_supported: ["none"],
+            }));
+            return;
+        }
+        // --- Dynamic Client Registration (no auth, JSON body) ---
+        if (rawPath === "/register" && req.method === "POST") {
+            try {
+                const raw = await readBody(req);
+                const parsed = JSON.parse(raw);
+                const redirectUris = parsed.redirect_uris;
+                const clientName = parsed.client_name;
+                if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "invalid_request", error_description: "redirect_uris is required" }));
+                    return;
+                }
+                // Validate each redirect URI — only allow http(s) on loopback to prevent open redirects
+                for (const uri of redirectUris) {
+                    try {
+                        const parsed = new URL(uri);
+                        const isLoopback = parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost" || parsed.hostname === "::1";
+                        const isHttpOrHttps = parsed.protocol === "http:" || parsed.protocol === "https:";
+                        if (!isLoopback || !isHttpOrHttps) {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({ error: "invalid_client_metadata", error_description: "redirect_uris must use http(s) on loopback (127.0.0.1, localhost, or ::1)" }));
+                            return;
+                        }
+                    }
+                    catch {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "invalid_client_metadata", error_description: "Invalid redirect_uri" }));
+                        return;
+                    }
+                }
+                const client = registerClient(redirectUris, clientName);
+                if (!client) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "temporarily_unavailable", error_description: "Too many registered clients" }));
+                    return;
+                }
+                res.writeHead(201, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    client_id: client.clientId,
+                    redirect_uris: client.redirectUris,
+                    client_name: client.clientName,
+                }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
+            return;
+        }
+        // --- OAuth Authorize (GET — render page, no auth required) ---
+        if (rawPath === "/authorize" && req.method === "GET") {
+            const params = new URLSearchParams(queryString);
+            const clientId = params.get("client_id") || "";
+            const responseType = params.get("response_type") || "";
+            const redirectUri = params.get("redirect_uri") || "";
+            const codeChallenge = params.get("code_challenge") || "";
+            const codeChallengeMethod = params.get("code_challenge_method") || "";
+            const state = params.get("state") || "";
+            const resource = params.get("resource") || "";
+            // Validate required params
+            if (responseType !== "code") {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "unsupported_response_type" }));
+                return;
+            }
+            if (!clientId || !redirectUri || !codeChallenge) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request", error_description: "Missing required parameters" }));
+                return;
+            }
+            if (codeChallengeMethod && codeChallengeMethod !== "S256") {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request", error_description: "Only S256 code challenge method is supported" }));
+                return;
+            }
+            const client = getClient(clientId);
+            if (!client) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request", error_description: "Unknown client_id" }));
+                return;
+            }
+            if (!client.redirectUris.includes(redirectUri)) {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request", error_description: "redirect_uri not registered" }));
+                return;
+            }
+            // Serialize OAuth params for the hidden form field
+            const oauthParams = new URLSearchParams({
+                client_id: clientId,
+                redirect_uri: redirectUri,
+                code_challenge: codeChallenge,
+                state,
+                resource,
+            }).toString();
+            const cookieHeader = req.headers.cookie || "";
+            const hasPairedSession = validateSessionCookie(cookieHeader, apiKey);
+            const html = renderAuthorizePage(client.clientName, oauthParams, hasPairedSession);
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(html);
+            return;
+        }
+        // --- OAuth Authorize (POST — process approval/denial) ---
+        if (rawPath === "/authorize" && req.method === "POST") {
+            try {
+                const formData = await parseFormBody(req);
+                const action = formData.get("action") || "";
+                const oauthParamsStr = formData.get("oauth_params") || "";
+                const pairingCode = formData.get("pairing_code") || "";
+                const oauthParams = new URLSearchParams(oauthParamsStr);
+                const clientId = oauthParams.get("client_id") || "";
+                const redirectUri = oauthParams.get("redirect_uri") || "";
+                const codeChallenge = oauthParams.get("code_challenge") || "";
+                const state = oauthParams.get("state") || "";
+                const resource = oauthParams.get("resource") || "";
+                // Validate client and redirect URI before any redirect to prevent open redirect
+                const client = getClient(clientId);
+                if (!client?.redirectUris.includes(redirectUri)) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "invalid_request" }));
+                    return;
+                }
+                // Build redirect URL using URL API to safely merge query params
+                const buildRedirect = (params) => {
+                    const url = new URL(redirectUri);
+                    for (const [key, value] of Object.entries(params)) {
+                        url.searchParams.set(key, value);
+                    }
+                    if (state) {
+                        url.searchParams.set("state", state);
+                    }
+                    return url.toString();
+                };
+                // Deny action
+                if (action === "deny") {
+                    res.writeHead(302, { Location: buildRedirect({ error: "access_denied" }) });
+                    res.end();
+                    return;
+                }
+                // Check session — if no session, require pairing code
+                const cookieHeader = req.headers.cookie || "";
+                let hasPairedSession = validateSessionCookie(cookieHeader, apiKey);
+                const responseHeaders = {};
+                if (!hasPairedSession) {
+                    if (!pairingCode) {
+                        const html = renderAuthorizePage(client.clientName, oauthParamsStr, false, "Pairing code is required.");
+                        res.writeHead(200, { "Content-Type": "text/html" });
+                        res.end(html);
+                        return;
+                    }
+                    const remoteIp = getRemoteIp(req);
+                    if (!redeemPairingCode(pairingCode, remoteIp)) {
+                        const html = renderAuthorizePage(client.clientName, oauthParamsStr, false, "Invalid or expired pairing code.");
+                        res.writeHead(200, { "Content-Type": "text/html" });
+                        res.end(html);
+                        return;
+                    }
+                    // Pairing succeeded — also create a browser session
+                    const setCookie = createSession(apiKey, { secure: allowNetwork });
+                    responseHeaders["Set-Cookie"] = setCookie;
+                    hasPairedSession = true;
+                }
+                // Approved — create authorization code
+                const authCode = createAuthorizationCode(clientId, redirectUri, codeChallenge, resource);
+                const redirectUrl = buildRedirect({ code: authCode });
+                res.writeHead(302, {
+                    ...responseHeaders,
+                    Location: redirectUrl,
+                });
+                res.end();
+            }
+            catch {
+                res.writeHead(400);
+                res.end("Bad Request");
+            }
+            return;
+        }
+        // --- OAuth Token endpoint ---
+        if (rawPath === "/token" && req.method === "POST") {
+            try {
+                const formData = await parseFormBody(req);
+                const grantType = formData.get("grant_type") || "";
+                if (grantType === "authorization_code") {
+                    const code = formData.get("code") || "";
+                    const clientId = formData.get("client_id") || "";
+                    const redirectUri = formData.get("redirect_uri") || "";
+                    const codeVerifier = formData.get("code_verifier") || "";
+                    const resource = formData.get("resource") || "";
+                    const authCodeRecord = consumeAuthorizationCode(code, clientId, redirectUri, codeVerifier, resource);
+                    if (!authCodeRecord) {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "invalid_grant" }));
+                        return;
+                    }
+                    const accessToken = createOAuthAccessToken(clientId, resource, apiKey);
+                    const refreshToken = createRefreshToken(clientId, resource);
+                    res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                    res.end(JSON.stringify({
+                        access_token: accessToken,
+                        token_type: "Bearer",
+                        expires_in: Math.floor(OAUTH_ACCESS_TOKEN_TTL_MS / 1000),
+                        refresh_token: refreshToken,
+                    }));
+                    return;
+                }
+                if (grantType === "refresh_token") {
+                    const refreshToken = formData.get("refresh_token") || "";
+                    const clientId = formData.get("client_id") || "";
+                    const refreshRecord = consumeRefreshToken(refreshToken, clientId);
+                    if (!refreshRecord) {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "invalid_grant" }));
+                        return;
+                    }
+                    const accessToken = createOAuthAccessToken(clientId, refreshRecord.resource, apiKey);
+                    const newRefreshToken = createRefreshToken(clientId, refreshRecord.resource);
+                    res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                    res.end(JSON.stringify({
+                        access_token: accessToken,
+                        token_type: "Bearer",
+                        expires_in: Math.floor(OAUTH_ACCESS_TOKEN_TTL_MS / 1000),
+                        refresh_token: newRefreshToken,
+                    }));
+                    return;
+                }
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "unsupported_grant_type" }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
+            return;
+        }
+        // --- Pairing endpoint ---
+        if (rawPath === "/pair") {
+            const params = new URLSearchParams(queryString);
+            const code = params.get("code");
+            if (code) {
+                const remoteIp = getRemoteIp(req);
+                if (redeemPairingCode(code, remoteIp)) {
+                    const setCookie = createSession(apiKey, { secure: allowNetwork });
+                    res.writeHead(302, {
+                        Location: "/",
+                        "Set-Cookie": setCookie,
+                    });
+                    res.end();
+                    return;
+                }
+                // Invalid or expired code — show pairing page with error
+                const html = renderPairingPage("Invalid or expired pairing code. Try again.");
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(html);
+                return;
+            }
+            // No code provided — show the pairing form
+            const html = renderPairingPage();
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(html);
+            return;
+        }
+        // --- Public static assets (favicons, manifest) — no session required ---
+        if (PUBLIC_ASSETS.has(rawPath)) {
+            serveStaticFile(res, rawPath, distDir);
+            return;
+        }
+        // --- All other routes require a valid session cookie or Bearer token ---
+        const cookieHeader = req.headers.cookie || "";
+        const authHeader = req.headers.authorization || "";
+        const bearerToken = authHeader.replace(/^Bearer\s+/i, "");
+        const hasValidSession = validateSessionCookie(cookieHeader, apiKey);
+        const hasValidBearer = bearerToken.length > 0 && verifyApiKey(bearerToken);
+        // --- ConnectRPC routes (Connect protocol over HTTP/1.1) ---
+        if (rawPath.startsWith("/grackle.Grackle/") && webConnectHandler) {
+            if (!hasValidSession && !hasValidBearer) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Unauthorized" }));
+                return;
+            }
+            webConnectHandler(req, res);
+            return;
+        }
+        if (!hasValidSession) {
+            res.writeHead(302, { Location: "/pair" });
+            res.end();
+            return;
+        }
+        serveStaticFile(res, rawPath, distDir);
+    };
+    return http.createServer(handler);
+}
+//# sourceMappingURL=web-server.js.map

package/dist/web-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-server.js","sourceRoot":"","sources":["../src/web-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,aAAa,EAAE,qBAAqB,EAAE,YAAY,EAClD,iBAAiB,EACjB,cAAc,EAAE,SAAS,EACzB,uBAAuB,EAAE,wBAAwB,EACjD,kBAAkB,EAAE,mBAAmB,EACvC,sBAAsB,EAAE,yBAAyB,GAClD,MAAM,kBAAkB,CAAC;AAkB1B,+DAA+D;AAE/D,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,wBAAwB;IAC/B,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF,yCAAyC;AACzC,SAAS,iBAAiB;IACxB,MAAM,UAAU,GAAgB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,eAAe;WACtB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,EAAE,MAAM,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,+DAA+D;AAE/D,wFAAwF;AACxF,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,+CAA+C,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,OAAO;;;;;;;;;;;;;;;;;IAiBL,SAAS;;;;;qBAKQ,CAAC;AACtB,CAAC;AAED,mEAAmE;AACnE,MAAM,WAAW,GAAW;;;;;;;;;;;8CAWkB,CAAC;AAE/C;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,WAAmB,EACnB,gBAAyB,EACzB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,+CAA+C,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,YAAY,GAAG,gBAAgB;QACnC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;iJAC2I,CAAC;IAChJ,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE5E,OAAO;;;SAGA,WAAW;;;iCAGa,UAAU,CAAC,UAAU,CAAC;IACnD,SAAS;;MAEP,YAAY;sDACoC,UAAU,CAAC,WAAW,CAAC;0DACnB,WAAW;;;qBAGhD,CAAC;AACtB,CAAC;AAED,+DAA+D;AAE/D,wDAAwD;AACxD,MAAM,aAAa,GAAW,MAAM,CAAC;AAErC;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAyB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,SAAS,GAAW,CAAC,CAAC;QAC1B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,GAAyB;IACpD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAwB,EACxB,OAAe,EACf,OAAe;IAEf,MAAM,MAAM,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE,CAAC;IACjD,IAAI,QAAQ,GAAG,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;IAE/C,6EAA6E;IAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,eAAe;IAEnG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW,CAAC,GAAyB;IAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;AAC/C,CAAC;AAED,sFAAsF;AACtF,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC;IACzC,cAAc;IACd,oBAAoB;IACpB,oBAAoB;IACpB,uBAAuB;IACvB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC,CAAC;AAEH,+DAA+D;AAE/D,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,iBAAiB,CAAC;AAC3E,CAAC;AAED,+DAA+D;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzE,MAAM,OAAO,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IAChF,MAAM,UAAU,GAAG,UAAU,OAAO,IAAI,OAAO,EAAE,CAAC;IAElD,kFAAkF;IAClF,MAAM,iBAAiB,GAAG,aAAa;QACrC,CAAC,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IAEd,kEAAkE;IAClE,MAAM,OAAO,GAAG,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAiB,EAAE;QAC3F,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,OAAe,CAAC;QACpB,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,IAAI,OAAO,KAAK,yCAAyC,EAAE,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrB,MAAM,EAAE,UAAU;gBAClB,sBAAsB,EAAE,GAAG,UAAU,YAAY;gBACjD,cAAc,EAAE,GAAG,UAAU,QAAQ;gBACrC,qBAAqB,EAAE,GAAG,UAAU,WAAW;gBAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;gBAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;aAChD,CAAC,CAAC,CAAC;YACJ,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,IAAI,OAAO,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuD,CAAC;gBACrF,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;gBAEtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;gBAED,wFAAwF;gBACxF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;wBAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC;wBACnH,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;wBAClF,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,EAAE,CAAC;4BAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;4BAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,2EAA2E,EAAE,CAAC,CAAC,CAAC;4BAC9J,OAAO;wBACT,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;wBACzG,OAAO;oBACT,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;gBACxD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;oBAChH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,WAAW,EAAE,MAAM,CAAC,UAAU;iBAC/B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,IAAI,OAAO,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAE9C,2BAA2B;YAC3B,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;YAED,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,8CAA8C,EAAE,CAAC,CAAC,CAAC;gBACzH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;YAED,mDAAmD;YACnD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC;gBACtC,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,cAAc,EAAE,aAAa;gBAC7B,KAAK;gBACL,QAAQ;aACT,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAC9C,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAErE,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;YACnF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,IAAI,OAAO,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC5C,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAEvD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;gBACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;gBACpD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAEnD,gFAAgF;gBAChF,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBAED,gEAAgE;gBAChE,MAAM,aAAa,GAAG,CAAC,MAA8B,EAAU,EAAE;oBAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;oBACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACnC,CAAC;oBACD,IAAI,KAAK,EAAE,CAAC;wBACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACvC,CAAC;oBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACxB,CAAC,CAAC;gBAEF,cAAc;gBACd,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC5E,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBAED,sDAAsD;gBACtD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC9C,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACnE,MAAM,eAAe,GAAsC,EAAE,CAAC;gBAE9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,IAAI,CAAC,WAAW,EAAE,CAAC;wBACjB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,2BAA2B,CACtE,CAAC;wBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAC9C,MAAM,IAAI,GAAG,mBAAmB,CAC9B,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,kCAAkC,CAC7E,CAAC;wBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBAED,oDAAoD;oBACpD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBAClE,eAAe,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;oBAC1C,gBAAgB,GAAG,IAAI,CAAC;gBAC1B,CAAC;gBAED,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;gBACzF,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAEtD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,GAAG,eAAe;oBAClB,QAAQ,EAAE,WAAW;iBACtB,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC;YACD,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;gBAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBAEnD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;oBACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;oBACvD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;oBACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;oBAEhD,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;oBACrG,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;wBACpD,OAAO;oBACT,CAAC;oBAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACvE,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAE5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,YAAY,EAAE,WAAW;wBACzB,UAAU,EAAE,QAAQ;wBACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,yBAAyB,GAAG,IAAI,CAAC;wBACxD,aAAa,EAAE,YAAY;qBAC5B,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;oBAClC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;oBACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;oBAEjD,MAAM,aAAa,GAAG,mBAAmB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;oBAClE,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;wBACpD,OAAO;oBACT,CAAC;oBAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBACrF,MAAM,eAAe,GAAG,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;oBAE7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,YAAY,EAAE,WAAW;wBACzB,UAAU,EAAE,QAAQ;wBACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,yBAAyB,GAAG,IAAI,CAAC;wBACxD,aAAa,EAAE,eAAe;qBAC/B,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACtC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;wBACjB,QAAQ,EAAE,GAAG;wBACb,YAAY,EAAE,SAAS;qBACxB,CAAC,CAAC;oBACH,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,yDAAyD;gBACzD,MAAM,IAAI,GAAG,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;gBAC9E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,CAAC;QAE3E,6DAA6D;QAC7D,IAAI,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACjE,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@grackle-ai/web-server",
+  "version": "0.75.1",
+  "description": "HTTP web server for Grackle — static file serving, pairing, OAuth, and ConnectRPC proxy",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nick-pape/grackle.git",
+    "directory": "packages/web-server"
+  },
+  "keywords": [
+    "grackle",
+    "web-server",
+    "http",
+    "oauth",
+    "pairing"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/"
+  ],
+  "dependencies": {
+    "@connectrpc/connect": "^2.0.0",
+    "@connectrpc/connect-node": "^2.0.0",
+    "@grackle-ai/auth": "0.75.1",
+    "@grackle-ai/web": "0.75.1"
+  },
+  "devDependencies": {
+    "@rushstack/heft": "1.2.7",
+    "@types/node": "^22.0.0",
+    "vitest": "^3.1.1",
+    "@grackle-ai/heft-rig": "0.0.1"
+  },
+  "scripts": {
+    "build": "heft build --clean",
+    "test": "vitest run",
+    "clean": "heft clean",
+    "_phase:build": "heft run --only build -- --clean",
+    "_phase:test": "vitest run"
+  }
+}