@haikit/mcp 0.32.0 → 0.34.0

package/dist/oauth.js

@@ -0,0 +1,558 @@
+import { randomBytes } from "node:crypto";
+import { OAuthError, OAuthErrorCode, assertSecureTokenEndpoint, auth, computeScopeUnion, discoverOAuthServerInfo, exchangeAuthorization, extractWWWAuthenticateParams, refreshAuthorization, selectClientAuthMethod, selectResourceURL, } from "@modelcontextprotocol/client";
+import { LookupFailed, Lookup, Mismatch, NeedsAuth } from "./credential.js";
+import { binding } from "./seal.js";
+/** How long a connect flow lasts: from the connect route to the callback. */
+export const FLOW_MS = 600_000;
+/** A refresh lease lasts this many `timeoutMs`: past the refresh request, which `timeoutMs` bounds, and the write after it. */
+const LEASE_TIMEOUTS = 2;
+/** How often the store is read while another process holds the refresh lease. */
+const LEASE_POLL_MS = 250;
+/** Tries at writing a refreshed credential while the store fails, and the pause between them. */
+const WRITE_TRIES = 3;
+const WRITE_PAUSE_MS = 250;
+/** A wait that doesn't keep the process going. */
+const pause = (ms) => new Promise((resolve) => {
+    setTimeout(resolve, ms).unref();
+});
+/** What a refresh refused for good: the user must connect again. */
+const REFUSED = new Set([OAuthErrorCode.InvalidGrant, OAuthErrorCode.InvalidClient, OAuthErrorCode.UnauthorizedClient]);
+/** Loopback hosts, exempt from https: what the SDK exempts, and RFC 8252 does. */
+export const isLoopback = (host) => host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+/** https, or http on this machine. */
+export const isSecure = (url) => {
+    try {
+        const { protocol, hostname } = new URL(url);
+        return protocol === "https:" || (protocol === "http:" && isLoopback(hostname));
+    }
+    catch {
+        return false;
+    }
+};
+/** The same authorization server: one trailing slash apart at most, as the SDK allows. */
+const sameIssuer = (a, b) => a === b || a === `${b}/` || b === `${a}/`;
+/** The connect flow a `state` names, once: null if there's none, it has expired, or it doesn't open. */
+export async function takeFlow(core, state) {
+    const sealed = await core.store.takeFlow(state);
+    if (sealed === null)
+        return null;
+    const flow = core.sealer.open(sealed, binding.flow(state));
+    if (typeof flow?.user !== "string" ||
+        typeof flow.server !== "string" ||
+        typeof flow.verifier !== "string" ||
+        typeof flow.client?.client_id !== "string" ||
+        typeof flow.discovery?.authorizationServerUrl !== "string" ||
+        typeof flow.expiresAt !== "number" ||
+        flow.expiresAt <= Date.now()) {
+        return null;
+    }
+    return flow;
+}
+/**
+ * One server's OAuth: its connect route and callback, each user's
+ * credential, refreshing, and revoking on disconnect.
+ */
+export class OAuthServer {
+    core;
+    options;
+    name;
+    url;
+    baseFetch;
+    timeoutMs;
+    forget;
+    /** The authorization server, discovered on the first refresh or revocation, or seeded by a callback. */
+    found = null;
+    /** Each user's refresh on its way, which every 401 of theirs shares until it settles. */
+    refreshing = new Map();
+    constructor(core, options, name, url, baseFetch, timeoutMs, 
+    /** Closes the user's connection to this server, so their next call dials with what's stored now. */
+    forget) {
+        this.core = core;
+        this.options = options;
+        this.name = name;
+        this.url = url;
+        this.baseFetch = baseFetch;
+        this.timeoutMs = timeoutMs;
+        this.forget = forget;
+    }
+    /** Every request to the authorization server, bounded by `timeoutMs`. */
+    fetch = (url, init) => {
+        const timeout = AbortSignal.timeout(this.timeoutMs);
+        return this.baseFetch(url, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout });
+    };
+    credential(user) {
+        return new OAuthCredential(this, user);
+    }
+    /** A user's credential as the store holds it, or null if there's none, or none that opens. `known` is given back as it is if the store still holds it. */
+    async read(user, known = null) {
+        const sealed = await this.core.store.get(user, this.name);
+        if (sealed === null)
+            return null;
+        if (sealed === known?.sealed)
+            return known;
+        const kept = this.core.sealer.open(sealed, binding.credential(user, this.name));
+        if (typeof kept?.tokens?.access_token !== "string" ||
+            typeof kept.tokens.issuer !== "string" ||
+            typeof kept.client?.client_id !== "string" ||
+            typeof kept.connectedAt !== "number") {
+            console.error(`@haikit/mcp: ${this.name}: the credential of user ${user} doesn't open: sealed with a secret that's gone, or for another row`);
+            return null;
+        }
+        return { sealed, kept };
+    }
+    seal(user, kept) {
+        return this.core.sealer.seal(kept, binding.credential(user, this.name));
+    }
+    /** The client configured, stamped with the pinned issuer: the SDK refuses it for any other. */
+    configured() {
+        const { client, issuer } = this.options;
+        return client && { client_id: client.id, ...(client.secret === undefined ? {} : { client_secret: client.secret }), issuer: issuer };
+    }
+    /**
+     * The client to connect with at an authorization server: the one
+     * configured, or the one registered for the app. One registered for
+     * another redirect URI or metadata document, or that doesn't open, is no
+     * use, and is registered again.
+     */
+    async client(issuer) {
+        const configured = this.configured();
+        if (configured)
+            return configured;
+        const sealed = await this.core.store.getClient(this.name, issuer);
+        if (sealed === null)
+            return undefined;
+        const info = this.core.sealer.open(sealed, binding.client(this.name, issuer));
+        if (typeof info?.client_id !== "string")
+            return undefined;
+        const fits = "redirect_uris" in info && Array.isArray(info.redirect_uris)
+            ? info.redirect_uris.includes(this.core.redirectUri)
+            : info.client_id === this.core.clientMetadataUrl;
+        return fits ? info : undefined;
+    }
+    /** The client a flow or credential was issued to, as it's sent: the configured one with its secret as configured now. */
+    issuedTo(client) {
+        return this.options.client?.id === client.client_id ? this.configured() : client;
+    }
+    async saveClient(issuer, info) {
+        await this.core.store.putClient(this.name, issuer, this.core.sealer.seal(info, binding.client(this.name, issuer)));
+    }
+    /**
+     * Checks what discovery found: the pinned issuer, and an authorization
+     * endpoint the browser can be sent to. Called by the SDK straight after
+     * discovery, before it looks up or registers a client, so a server that
+     * names another authorization server gets nothing from the app.
+     */
+    async check(state) {
+        const metadata = state.authorizationServerMetadata;
+        const issuer = metadata?.issuer ?? String(state.authorizationServerUrl);
+        const pinned = this.options.issuer;
+        if (pinned !== undefined && !sameIssuer(issuer, pinned)) {
+            throw new Mismatch(`${this.name} names ${JSON.stringify(issuer)} as its authorization server, not ${JSON.stringify(pinned)}`);
+        }
+        const endpoint = metadata?.authorization_endpoint ?? new URL("/authorize", state.authorizationServerUrl).href;
+        if (!isSecure(endpoint))
+            throw new Mismatch(`${this.name}'s authorization server signs users in at ${JSON.stringify(endpoint)}, which isn't https`);
+        // the indicator as the metadata has it, as the SDK's auth() sends it
+        const selected = await selectResourceURL(this.url, {}, state.resourceMetadata);
+        const resource = selected && state.resourceMetadata ? state.resourceMetadata.resource : selected?.href;
+        return { url: String(state.authorizationServerUrl), issuer, metadata, resource };
+    }
+    /**
+     * The authorization server, which must be the one that issued a credential:
+     * found again once if it isn't, in case the server moved since.
+     */
+    async where(issuer, resourceMetadataUrl) {
+        for (let fresh = false;; fresh = true) {
+            this.found ??= discoverOAuthServerInfo(this.url, { fetchFn: this.fetch, ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}) })
+                .then((info) => this.check(info))
+                .catch((err) => {
+                this.found = null;
+                throw err;
+            });
+            const where = await this.found;
+            if (sameIssuer(where.issuer, issuer))
+                return where;
+            this.found = null;
+            if (fresh)
+                throw new Mismatch(`${this.name} now names ${JSON.stringify(where.issuer)} as its authorization server, not ${JSON.stringify(issuer)}, which issued the credential`);
+        }
+    }
+    /**
+     * The connect route: where to send the browser, with the flow stored under
+     * its `state` meanwhile. The SDK's `auth()` discovers the authorization
+     * server, registers a client if none is kept, and makes the PKCE challenge.
+     */
+    async start(user, conversation, asked) {
+        const { core } = this;
+        const state = randomBytes(32).toString("base64url");
+        let discovery;
+        let verifier;
+        let to;
+        // the client the code is issued to: the one auth() is given, or the one it registers
+        let client;
+        const provider = {
+            redirectUrl: core.redirectUri,
+            clientMetadata: core.clientMetadata,
+            ...(core.clientMetadataUrl === undefined ? {} : { clientMetadataUrl: core.clientMetadataUrl }),
+            clientInformation: async (ctx) => (client = await this.client(ctx?.issuer ?? "")),
+            // a configured client is never replaced by one registered on the fly
+            ...(this.options.client
+                ? {}
+                : {
+                    saveClientInformation: async (info, ctx) => {
+                        client = info;
+                        await this.saveClient(ctx?.issuer ?? info.issuer ?? "", info);
+                    },
+                }),
+            state: () => state,
+            // a reconnect starts over, whatever is kept
+            tokens: () => undefined,
+            saveTokens: () => {
+                throw new Error("no tokens are saved before the user comes back");
+            },
+            redirectToAuthorization: (url) => {
+                to = url;
+            },
+            saveCodeVerifier: (v) => {
+                verifier = v;
+            },
+            codeVerifier: () => {
+                throw new Error("no code is exchanged before the user comes back");
+            },
+            saveDiscoveryState: async (found) => {
+                await this.check(found);
+                discovery = found;
+            },
+        };
+        const scope = computeScopeUnion(this.options.scopes?.join(" "), asked);
+        const result = await auth(provider, { serverUrl: this.url, fetchFn: this.fetch, ...(scope ? { scope } : {}) });
+        if (result !== "REDIRECT" || !to || verifier === undefined || !discovery || !client) {
+            throw new Error(`the SDK's auth() answered ${result}, with nowhere to send the user`);
+        }
+        // a configured client's secret isn't kept: it's read from the options when used, so it can be changed
+        if (this.options.client)
+            client = { client_id: client.client_id, ...(client.issuer === undefined ? {} : { issuer: client.issuer }) };
+        const expiresAt = Date.now() + FLOW_MS;
+        const flow = { user, server: this.name, conversation, verifier, client, discovery, scope: to.searchParams.get("scope"), expiresAt };
+        await core.store.putFlow(state, core.sealer.seal(flow, binding.flow(state)), expiresAt);
+        return to;
+    }
+    /**
+     * The callback: exchanges the code with the authorization server and as
+     * the client the flow was started with, which checks `iss` (RFC 9207)
+     * before it asks for any token, stores the credential, and closes the
+     * user's connection.
+     */
+    async finish(flow, code, iss) {
+        const where = await this.check(flow.discovery);
+        const tokens = await exchangeAuthorization(where.url, {
+            metadata: where.metadata,
+            clientInformation: this.issuedTo(flow.client),
+            authorizationCode: code,
+            iss,
+            codeVerifier: flow.verifier,
+            redirectUri: this.core.redirectUri,
+            ...(where.resource ? { resource: where.resource } : {}),
+            fetchFn: this.fetch,
+        });
+        const kept = { tokens: { ...tokens, issuer: where.issuer }, client: flow.client, scope: tokens.scope ?? flow.scope, connectedAt: Date.now() };
+        const sealed = this.seal(flow.user, kept);
+        // the newest connect wins over whatever was kept
+        let written = false;
+        for (let tries = 0; tries < 3 && !written; tries++) {
+            written = await this.core.store.put(flow.user, this.name, sealed, await this.core.store.get(flow.user, this.name));
+        }
+        if (!written)
+            throw new Error("the user's credential kept changing as the new one was written");
+        this.found = Promise.resolve(where);
+        await this.forget(flow.user);
+    }
+    /** Revokes the user's tokens where the authorization server takes it, then deletes them and closes the connection. */
+    async disconnect(user) {
+        const held = await this.read(user);
+        if (held) {
+            try {
+                await this.revoke(held.kept);
+            }
+            catch (err) {
+                console.error(`@haikit/mcp: ${this.name}: the tokens of user ${user} couldn't be revoked, and are deleted anyway:`, err);
+            }
+        }
+        await this.core.store.delete(user, this.name);
+        await this.forget(user);
+    }
+    /** RFC 7009, at the authorization server's revocation endpoint, if it has one. */
+    async revoke(kept) {
+        const { tokens } = kept;
+        const where = await this.where(tokens.issuer);
+        const endpoint = where.metadata?.revocation_endpoint;
+        if (!endpoint)
+            return;
+        const client = this.issuedTo(kept.client);
+        const url = assertSecureTokenEndpoint(endpoint);
+        const body = new URLSearchParams(tokens.refresh_token ? { token: tokens.refresh_token, token_type_hint: "refresh_token" } : { token: tokens.access_token, token_type_hint: "access_token" });
+        const headers = new Headers({ "content-type": "application/x-www-form-urlencoded", accept: "application/json" });
+        const metadata = where.metadata;
+        const method = selectClientAuthMethod(client, metadata.revocation_endpoint_auth_methods_supported ?? metadata.token_endpoint_auth_methods_supported ?? []);
+        if (method === "client_secret_basic" && client.client_secret !== undefined) {
+            // as the SDK's own token requests send it: the authorization server checks the client the same way at both
+            headers.set("authorization", `Basic ${btoa(`${client.client_id}:${client.client_secret}`)}`);
+        }
+        else {
+            body.set("client_id", client.client_id);
+            if (method === "client_secret_post" && client.client_secret !== undefined)
+                body.set("client_secret", client.client_secret);
+        }
+        const response = await this.fetch(url, { method: "POST", headers, body, redirect: "error" });
+        await response.text().catch(() => { });
+        if (!response.ok)
+            throw new Error(`the revocation endpoint answered ${response.status}`);
+    }
+    /**
+     * After a 401: the credential to use instead of `before`. One refresh for
+     * each user at a time, shared until it settles, however long that takes,
+     * on whichever connection of theirs: a second would spend a refresh token
+     * the first may have spent already, and delete the credential when it's
+     * refused. Across processes, the store's lease does the same.
+     */
+    refresh(user, before, resourceMetadataUrl) {
+        let refreshing = this.refreshing.get(user);
+        if (!refreshing) {
+            refreshing = this.renew(user, before, resourceMetadataUrl)
+                .catch((err) => {
+                if (err instanceof Mismatch)
+                    console.error(`@haikit/mcp: ${this.name}: no refresh for user ${user}: ${err.message}`);
+                throw err;
+            })
+                .finally(() => this.refreshing.delete(user));
+            this.refreshing.set(user, refreshing);
+        }
+        return refreshing;
+    }
+    /**
+     * The store's newer credential if another refresh wrote one, else a
+     * refresh of `before`, under the store's lease. A refusal deletes it,
+     * unless another write came first; an outage keeps it.
+     */
+    async renew(user, before, resourceMetadataUrl) {
+        const moved = await this.newer(user, before);
+        if (moved)
+            return moved;
+        const { tokens } = before.kept;
+        if (!tokens.refresh_token) {
+            await this.drop(user, before);
+            throw new NeedsAuth("reconnect");
+        }
+        const where = await this.where(tokens.issuer, resourceMetadataUrl);
+        const holder = randomBytes(16).toString("base64url");
+        const written = await this.lease(user, before, holder);
+        if (written)
+            return written;
+        // given back when this refresh writes nothing; a write or delete ends it anyway
+        const giveBack = () => this.core.store.lease(user, this.name, before.sealed, holder, 0).catch(() => false);
+        let fresh;
+        try {
+            fresh = await refreshAuthorization(where.url, {
+                metadata: where.metadata,
+                clientInformation: this.issuedTo(before.kept.client),
+                refreshToken: tokens.refresh_token,
+                ...(where.resource ? { resource: where.resource } : {}),
+                fetchFn: this.fetch,
+            });
+        }
+        catch (err) {
+            if (err instanceof OAuthError && REFUSED.has(err.code)) {
+                // Refused: unless another refresh spent the token first, after this
+                // one's lease lapsed, and stored what it got, which is then the one
+                // to use.
+                const moved = await this.newer(user, before);
+                if (moved)
+                    return moved;
+                await this.drop(user, before);
+                throw new NeedsAuth("reconnect");
+            }
+            // an outage, or an answer that isn't OAuth's: kept, for the next 401 to try
+            await giveBack();
+            throw new LookupFailed(err);
+        }
+        const kept = { ...before.kept, tokens: { ...fresh, issuer: tokens.issuer }, scope: fresh.scope ?? before.kept.scope };
+        const sealed = this.seal(user, kept);
+        if (await this.write(user, before, sealed))
+            return { sealed, kept };
+        // Another write came first, or a delete, as by a disconnect: the tokens
+        // just issued are no one's, so they're revoked rather than left live.
+        await this.orphaned(user, kept, tokens.refresh_token);
+        const stands = await this.newer(user, before);
+        if (stands)
+            return stands;
+        await giveBack();
+        throw new Error("the store refused a write of what it still holds");
+    }
+    /**
+     * Writes a refresh's credential onto `before`, tried again while the
+     * store fails: the old refresh token is spent, so this is the only copy,
+     * and the lease is still held. False if another write or a delete came
+     * first. A try that landed, though its answer was lost, is written.
+     */
+    async write(user, before, sealed) {
+        for (let tries = 1;; tries++) {
+            try {
+                if (await this.core.store.put(user, this.name, sealed, before.sealed))
+                    return true;
+                return tries > 1 && (await this.core.store.get(user, this.name)) === sealed;
+            }
+            catch (err) {
+                if (tries < WRITE_TRIES) {
+                    await pause(WRITE_PAUSE_MS);
+                    continue;
+                }
+                // the last may have landed too, though its answer was lost
+                if ((await this.core.store.get(user, this.name).catch(() => null)) === sealed)
+                    return true;
+                throw err;
+            }
+        }
+    }
+    /**
+     * Revokes the tokens a refresh got but couldn't store: its refresh token
+     * if the authorization server rotated it, else only its access token, as
+     * the one refresh token may be what the store holds now.
+     */
+    async orphaned(user, kept, spent) {
+        const { refresh_token, ...access } = kept.tokens;
+        try {
+            await this.revoke(refresh_token === spent ? { ...kept, tokens: access } : kept);
+        }
+        catch (err) {
+            console.error(`@haikit/mcp: ${this.name}: the tokens refreshed for user ${user} weren't stored, and couldn't be revoked:`, err);
+        }
+    }
+    /**
+     * Takes the refresh lease of the user's credential, so one process at a
+     * time spends its refresh token. While another holds it: the credential
+     * that one writes, which is then the one to use, or the lease once it
+     * lapses, as it does when that process is gone.
+     */
+    async lease(user, before, holder) {
+        const ms = LEASE_TIMEOUTS * this.timeoutMs;
+        const giveUp = Date.now() + 2 * ms;
+        while (!(await this.core.store.lease(user, this.name, before.sealed, holder, ms))) {
+            const moved = await this.newer(user, before);
+            if (moved)
+                return moved;
+            if (Date.now() >= giveUp)
+                throw new Error(`other processes held the refresh lease for ${2 * ms} ms`);
+            await pause(LEASE_POLL_MS);
+        }
+        return null;
+    }
+    /** The store's credential if it's newer than `before`, or null if it's still `before`. With none, the server's refusal stands. */
+    async newer(user, before) {
+        const now = await this.read(user);
+        if (now === null)
+            throw new NeedsAuth("reconnect");
+        return now.sealed === before.sealed ? null : now;
+    }
+    /** Deletes the credential, if the store still holds `before`: never a newer one. */
+    async drop(user, before) {
+        await this.core.store.delete(user, this.name, before.sealed);
+    }
+}
+/**
+ * One user's OAuth credential for one server. The transport is given an
+ * `AuthProvider` of this package's own, never the SDK's
+ * `OAuthClientProvider`: so a call never starts a sign-in or registers a
+ * client, refreshes once at a time, and tells an outage from a refusal.
+ */
+class OAuthCredential {
+    server;
+    user;
+    /** What the store held when this read or wrote it. Only a lookup, a refresh or the store's newer value sets it. */
+    held = null;
+    /** The lookup on its way, which every caller shares. */
+    looking = null;
+    /** The account, by its `connectedAt`, that the last check found, and the user's connection is made as. */
+    account = null;
+    lookups;
+    refreshes;
+    constructor(server, user) {
+        this.server = server;
+        this.user = user;
+        this.lookups = new Lookup(server.timeoutMs, "credential");
+        this.refreshes = new Lookup(server.timeoutMs, "refresh");
+    }
+    /**
+     * Before every call: the store's credential, since another process may
+     * have refreshed it, connected it again, or deleted it. A refresh is used
+     * as it is; another connect says so, for the connection to be made again.
+     */
+    async ensure() {
+        await this.look();
+        const now = this.held;
+        if (now === null) {
+            this.account = null;
+            throw new NeedsAuth("connect");
+        }
+        const changed = this.account !== null && now.kept.connectedAt !== this.account;
+        this.account = now.kept.connectedAt;
+        return changed;
+    }
+    close() {
+        // A refresh on its way isn't stopped: a provider that rotates refresh
+        // tokens has spent the old one, and what it gives back must be stored.
+        this.lookups.stop();
+    }
+    // The transport asks for the token before every request, and on a 401
+    // calls onUnauthorized, then tries once more with what it finds. Each
+    // connection has its own, bound to the account it was made as: once the
+    // user has connected again, as a refresh can find, nothing more is sent
+    // on it, and the next call makes it again.
+    get provider() {
+        const account = this.account;
+        const mine = (held) => {
+            // gone since this call began, as when another call's 401 was refused
+            if (held === null)
+                throw new NeedsAuth("reconnect");
+            if (held.kept.connectedAt !== account)
+                throw new LookupFailed(new Error("the user connected again since this connection was made"));
+            return held;
+        };
+        return {
+            token: async () => mine(this.held).kept.tokens.access_token,
+            onUnauthorized: async (ctx) => {
+                const before = mine(this.held);
+                // held when the refresh settles, though this 401 gave up waiting for it
+                const refreshing = this.server.refresh(this.user, before, extractWWWAuthenticateParams(ctx.response).resourceMetadataUrl).then((next) => this.take(before, next), (err) => {
+                    if (err instanceof NeedsAuth)
+                        this.take(before, null);
+                    throw err;
+                });
+                try {
+                    await this.refreshes.run(() => refreshing);
+                }
+                catch (err) {
+                    throw err instanceof NeedsAuth || err instanceof Mismatch || err instanceof LookupFailed ? err : new LookupFailed(err);
+                }
+            },
+        };
+    }
+    look() {
+        this.looking ??= this.lookups
+            .run(() => this.server.read(this.user, this.held))
+            .then((found) => {
+            this.held = found;
+        }, (err) => {
+            throw new LookupFailed(err);
+        })
+            .finally(() => {
+            this.looking = null;
+        });
+        return this.looking;
+    }
+    /** Holds `next`, unless something newer than `before` is held already, as by a refresh that outlived its wait. */
+    take(before, next) {
+        if (this.held === before)
+            this.held = next;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,cAAc,EACd,yBAAyB,EACzB,IAAI,EACJ,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,GASlB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAmB,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAe,MAAM,WAAW,CAAC;AAGjD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAC/B,+HAA+H;AAC/H,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,iFAAiF;AACjF,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,iGAAiG;AACjG,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,kDAAkD;AAClD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAC3B,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;IAC5B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AA4EL,oEAAoE;AACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEhI,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CACzC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;AAEpH,sCAAsC;AACtC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAiB,EAAE,EAAE;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC;AAEvF,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAe,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAyB,CAAC;IACnF,IACE,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ;QAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,sBAAsB,KAAK,QAAQ;QAC1D,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IAOX;IACQ;IACR;IACQ;IACA;IACR;IAEA;IAbX,wGAAwG;IAChG,KAAK,GAA0B,IAAI,CAAC;IAC5C,yFAAyF;IACxE,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE/D,YACW,IAAe,EACP,OAA2B,EACnC,IAAY,EACJ,GAAQ,EACR,SAAoB,EAC5B,SAAiB;IAC1B,oGAAoG;IAC3F,MAAyC;QAPzC,SAAI,GAAJ,IAAI,CAAW;QACP,YAAO,GAAP,OAAO,CAAoB;QACnC,SAAI,GAAJ,IAAI,CAAQ;QACJ,QAAG,GAAH,GAAG,CAAK;QACR,cAAS,GAAT,SAAS,CAAW;QAC5B,cAAS,GAAT,SAAS,CAAQ;QAEjB,WAAM,GAAN,MAAM,CAAmC;IACjD,CAAC;IAEJ,yEAAyE;IAChE,KAAK,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,0JAA0J;IAC1J,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,QAAqB,IAAI;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,MAAM,KAAK,KAAK,EAAE,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAgB,CAAC;QAC/F,IACE,OAAO,IAAI,EAAE,MAAM,EAAE,YAAY,KAAK,QAAQ;YAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;YACtC,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ;YAC1C,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,4BAA4B,IAAI,qEAAqE,CAAC,CAAC;YAC9I,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,IAAU;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,+FAA+F;IACvF,UAAU;QAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACxC,OAAO,MAAM,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAO,EAAE,CAAC;IACvI,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,MAAM,CAAC,MAAc;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwC,CAAC;QACrH,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,IAAI,GACR,eAAe,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACrD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,yHAAyH;IACzH,QAAQ,CAAC,MAAoC;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAkC;QACzE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,KAA0B;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,2BAA2B,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,EAAE,sBAAsB,IAAI,IAAI,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,6CAA6C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACpJ,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAyB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC;QACvG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACnF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,mBAAyB;QACnD,KAAK,IAAI,KAAK,GAAG,KAAK,GAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;iBAC/H,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;iBAChC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;YACL,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YAC/B,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,KAAK;gBAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAClL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,YAA2B,EAAE,KAAyB;QAC9E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,SAA0C,CAAC;QAC/C,IAAI,QAA4B,CAAC;QACjC,IAAI,EAAmB,CAAC;QACxB,qFAAqF;QACrF,IAAI,MAAgD,CAAC;QACrD,MAAM,QAAQ,GAAwB;YACpC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9F,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YACjF,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,qBAAqB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;wBACzC,MAAM,GAAG,IAAI,CAAC;wBACd,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;oBAChE,CAAC;iBACF,CAAC;YACN,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;YAClB,4CAA4C;YAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;YACvB,UAAU,EAAE,GAAG,EAAE;gBACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,uBAAuB,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,EAAE,GAAG,GAAG,CAAC;YACX,CAAC;YACD,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;gBACtB,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC;YACD,YAAY,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAClC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;SACF,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,EAAE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,iCAAiC,CAAC,CAAC;QACxF,CAAC;QACD,sGAAsG;QACtG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QACrI,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,IAAI,GAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;QAC1I,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,IAAU,EAAE,IAAY,EAAE,GAAuB;QAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7C,iBAAiB,EAAE,IAAI;YACvB,GAAG;YACH,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAS,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpJ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,iDAAiD;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,sHAAsH;IACtH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,wBAAwB,IAAI,+CAA+C,EAAE,GAAG,CAAC,CAAC;YAC3H,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,MAAM,CAAC,IAAU;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAI,KAAK,CAAC,QAAyD,EAAE,mBAAmB,CAAC;QACvG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,eAAe,CAC9B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAC3J,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAuH,CAAC;QAC/I,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,0CAA0C,IAAI,QAAQ,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC3J,IAAI,MAAM,KAAK,qBAAqB,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC3E,2GAA2G;YAC3G,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,oBAAoB,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAY,EAAE,MAAY,EAAE,mBAAoC;QACtE,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC;iBACvD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,IAAI,GAAG,YAAY,QAAQ;oBAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,yBAAyB,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrH,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAY,EAAE,mBAAoC;QAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,gFAAgF;QAChF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3G,IAAI,KAAuD,CAAC;QAC5D,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACpD,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,oEAAoE;gBACpE,oEAAoE;gBACpE,UAAU;gBACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBACxB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9B,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,4EAA4E;YAC5E,MAAM,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,GAAS,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5H,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAY,EAAE,MAAc;QAC5D,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACnF,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC;YAC9E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,GAAG,WAAW,EAAE,CAAC;oBACxB,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,2DAA2D;gBAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC;gBAC3F,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAAU,EAAE,KAAa;QAC5D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,mCAAmC,IAAI,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAY,EAAE,MAAc;QAC5D,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kIAAkI;IAC1H,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAY;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,CAAC;IAED,oFAAoF;IAC5E,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,MAAY;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,eAAe;IAWA;IACA;IAXnB,mHAAmH;IAC3G,IAAI,GAAgB,IAAI,CAAC;IACjC,wDAAwD;IAChD,OAAO,GAAyB,IAAI,CAAC;IAC7C,0GAA0G;IAClG,OAAO,GAAkB,IAAI,CAAC;IACrB,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,YACmB,MAAmB,EACnB,IAAY;QADZ,WAAM,GAAN,MAAM,CAAa;QACnB,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC;QAC/E,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,2CAA2C;IAC3C,IAAI,QAAQ;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,IAAiB,EAAQ,EAAE;YACvC,qEAAqE;YACrE,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;YACpI,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,OAAO;YACL,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;YAC3D,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,wEAAwE;gBACxE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAC5H,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EACjC,CAAC,GAAG,EAAE,EAAE;oBACN,IAAI,GAAG,YAAY,SAAS;wBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACtD,MAAM,GAAG,CAAC;gBACZ,CAAC,CACF,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;gBAC7C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,YAAY,SAAS,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;aAC1B,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;aACjD,IAAI,CACH,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QACpB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC,CACF;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,kHAAkH;IAC1G,IAAI,CAAC,MAAY,EAAE,IAAiB;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7C,CAAC;CACF"}

package/dist/postgres.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @haikit/mcp/postgres — each user's credentials in Postgres, shared by every
+ * server. As in @haikit/postgres, every method is one statement, and the
+ * driver is yours.
+ */
+import type { CredentialStore } from "./store.js";
+/**
+ * Anything that runs a parameterised statement and returns rows: a `pg.Pool`,
+ * a `pg.Client` and PGlite all fit as they are. The same shape as
+ * @haikit/postgres's and @haikit/auth/postgres's `Queryable`, so one pool
+ * serves all three.
+ */
+export interface Queryable {
+    query(text: string, params?: unknown[]): Promise<{
+        rows: any[];
+    }>;
+}
+/**
+ * The schema, one statement per entry. `migrate()` runs these; export them to
+ * your own migration tool instead if you have one.
+ */
+export declare const schema: readonly string[];
+export declare function migrate(db: Queryable): Promise<void>;
+export declare function pgCredentialStore(db: Queryable): CredentialStore;
+//# sourceMappingURL=postgres.d.ts.map

package/dist/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,MAAM,EAqBnC,CAAC;AAEF,wBAAsB,OAAO,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,GAAG,eAAe,CA6EhE"}