@n24q02m/hull 0.0.0-stage → 0.4.0-beta.10

package/build/transport/local-server.js

@@ -0,0 +1,457 @@
+/**
+ * Local MCP server entry point combining OAuth 2.1 AS + Streamable HTTP transport.
+ *
+ * Composes:
+ *  1. OAuth 2.1 AS (credential form + token exchange) -- serves /authorize,
+ *     /token, /otp, /setup-status, /.well-known/*
+ *  2. MCP Streamable HTTP transport -- serves /mcp with optional Bearer auth
+ *  3. /health endpoint -- liveness probe
+ *
+ * For servers without credential input (e.g. godot) ``relaySchema`` may be
+ * omitted: only /mcp (unauthenticated) and /health are served.
+ *
+ * This is a TypeScript port of ``core-py``'s ``local_server.py``. Route layout,
+ * Bearer enforcement, and lifecycle semantics are kept identical.
+ */
+import { randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import { createServer } from 'node:http';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { isSchemaComplete } from '../auth/credential-form.js';
+import { createDelegatedOAuthApp } from '../auth/delegated-oauth-app.js';
+import { createLocalOAuthApp } from '../auth/local-oauth-app.js';
+import { jsonResponse } from '../auth/router.js';
+import { refreshLockTimestamp, sweepStaleLocks, writeLockFile } from '../lifecycle/lock.js';
+import { tryOpenBrowser } from '../relay/browser.js';
+import { readStoredConfig } from '../storage/credential-store.js';
+import { Authenticator } from '../token-auth/authenticator.js';
+import { guardRequest } from '../token-auth/http-guard.js';
+import { assertNoAuthLoopback } from '../token-auth/loopback.js';
+import { extractBearerToken } from './oauth-middleware.js';
+/**
+ * Start an HTTP server with optional local OAuth AS + MCP Streamable HTTP transport.
+ *
+ * Behavior:
+ *  - If ``relaySchema`` is provided, serves OAuth routes (/authorize, /token,
+ *    /otp, /setup-status, /.well-known/*) AND /mcp with Bearer auth.
+ *  - If ``relaySchema`` is undefined (e.g., godot), serves ONLY /mcp without
+ *    auth (plus /health).
+ *  - Binds to ``host:port``. Port 0 auto-assigns via the OS.
+ *  - Returns a handle for lifecycle management; the server runs in the
+ *    background until ``close()`` is called.
+ */
+export async function runHttpServer(serverFactory, options) {
+    const host = options.host ?? '127.0.0.1';
+    const wantedPort = options.port ?? 0;
+    // Token-table auth replaces the OAuth/relay stack entirely; combining them
+    // would leave two competing Bearer schemes on /mcp.
+    let tokenAuth = null;
+    if (options.auth !== undefined) {
+        const conflicting = ['relaySchema', 'delegatedOAuth', 'jwtIssuer', 'authDisabled', 'authScope'].filter((key) => options[key] !== undefined && options[key] !== false);
+        if (conflicting.length > 0) {
+            throw new Error(`\`auth\` is mutually exclusive with ${conflicting.map((key) => `\`${key}\``).join(', ')}`);
+        }
+        tokenAuth = new Authenticator(options.auth);
+        if (tokenAuth.mode === 'no-auth')
+            assertNoAuthLoopback(host);
+    }
+    // Edge auth deployment warning (per spec 2026-05-01-stdio-pure-http-multiuser
+    // §4.2.1). When ``PUBLIC_URL`` points to a non-localhost host but
+    // ``MCP_RELAY_PASSWORD`` is empty, the relay form is reachable from the
+    // public Internet without authentication — that's the wedge this gate
+    // closes. Operators running single-user dev on localhost intentionally
+    // skip the password; everyone else gets a startup warning so the misconfig
+    // doesn't pass silently.
+    const publicUrl = process.env.PUBLIC_URL ?? '';
+    const relayPassword = process.env.MCP_RELAY_PASSWORD ?? '';
+    const isLocalhost = /^https?:\/\/(localhost|127\.0\.0\.1)/.test(publicUrl);
+    if (tokenAuth === null && publicUrl && !isLocalhost && !relayPassword) {
+        console.warn('[hull] WARNING: HTTP mode public deployment without MCP_RELAY_PASSWORD — relay form is open to Internet');
+    }
+    let oauthApp = null;
+    let jwtIssuer = null;
+    if (options.relaySchema && options.delegatedOAuth) {
+        throw new Error('`relaySchema` and `delegatedOAuth` are mutually exclusive');
+    }
+    if (options.delegatedOAuth) {
+        oauthApp = await createDelegatedOAuthApp({
+            serverName: options.serverName,
+            flow: options.delegatedOAuth.flow,
+            upstream: options.delegatedOAuth.upstream,
+            onTokenReceived: options.delegatedOAuth.onTokenReceived,
+            sessionKv: options.delegatedOAuth.sessionKv,
+            jwtIssuer: options.jwtIssuer
+        });
+        jwtIssuer = oauthApp.jwtIssuer;
+    }
+    else if (options.relaySchema) {
+        oauthApp = await createLocalOAuthApp({
+            serverName: options.serverName,
+            relaySchema: options.relaySchema,
+            onCredentialsSaved: options.onCredentialsSaved,
+            onStepSubmitted: options.onStepSubmitted,
+            customCredentialFormHtml: options.customCredentialFormHtml,
+            stableSubEnabled: options.stableSubEnabled,
+            jwtIssuer: options.jwtIssuer
+        });
+        jwtIssuer = oauthApp.jwtIssuer;
+    }
+    // MCP per-session pattern (mirrors Python's StreamableHTTPSessionManager):
+    //
+    //  - Each MCP client gets its own ``StreamableHTTPServerTransport`` keyed by
+    //    Mcp-Session-Id, plus its own ``McpServer`` instance.
+    //  - The first POST (initialize) has no session header; we mint a UUID via
+    //    ``sessionIdGenerator`` and register the transport in ``onsessioninitialized``.
+    //  - Subsequent POSTs (notifications/initialized, tools/list, tools/call)
+    //    carry Mcp-Session-Id and are routed to the same transport, so the SDK's
+    //    ``_initialized`` flag is in the right state for ``validateSession`` /
+    //    ``validateProtocolVersion`` to accept the request.
+    //  - Anything else -- an ID we never issued, or no ID on a request that
+    //    cannot open a session -- is refused without building anything. Only
+    //    ``initialize`` may open a session, which is what keeps the count of
+    //    live ``McpServer`` instances tied to sessions rather than to requests.
+    //
+    // Stateless mode (sessionIdGenerator: undefined) was an earlier attempt; it
+    // returned HTTP 500 on the SDK-mandatory ``notifications/initialized`` POST
+    // because each request landed on a fresh transport with ``_initialized=false``
+    // and the SDK had no session manager to bridge them. Per-session routing is
+    // the same architecture the SDK examples + Python core-py use.
+    const transports = new Map();
+    const servers = new Map();
+    /** JSON-RPC error envelope, shaped like core-py's session manager replies. */
+    function jsonRpcError(res, status, code, message) {
+        jsonResponse(res, status, {
+            jsonrpc: '2.0',
+            id: 'server-error',
+            error: { code, message }
+        });
+    }
+    /**
+     * Buffer and parse the body of a request that carries no session ID.
+     *
+     * Only the bootstrap path pays this cost. Once a session exists the request
+     * stream is handed to the SDK untouched, as before -- we need the body here
+     * solely to tell an ``initialize`` apart from a request that has no business
+     * opening a session, and the SDK cannot re-read a stream we consumed, so the
+     * parsed value is passed on to ``handleRequest``.
+     *
+     * The size ceiling matches the SDK transport's own ``maximumMessageSize``
+     * default; without one, this buffer is an unbounded allocation reachable
+     * before any session exists.
+     */
+    async function readBootstrapBody(req) {
+        const MAX_BYTES = 4 * 1024 * 1024;
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of req) {
+            const buf = chunk;
+            size += buf.length;
+            if (size > MAX_BYTES) {
+                return { ok: false, status: 413, code: -32600, message: 'Request body too large' };
+            }
+            chunks.push(buf);
+        }
+        try {
+            return { ok: true, body: JSON.parse(Buffer.concat(chunks).toString('utf8')) };
+        }
+        catch {
+            return { ok: false, status: 400, code: -32700, message: 'Parse error' };
+        }
+    }
+    async function handleSessionRequest(req, res) {
+        const sessionHeader = req.headers['mcp-session-id'];
+        const incomingSessionId = Array.isArray(sessionHeader) ? sessionHeader[0] : sessionHeader;
+        if (incomingSessionId) {
+            const known = transports.get(incomingSessionId);
+            if (!known) {
+                // 404 is the spec's signal for "that session is gone" and the status
+                // core-py returns. A client that lost its session to a restart reads
+                // it as "open a new one"; a 400 would read as "your request is
+                // malformed" and it would retry the dead ID.
+                jsonRpcError(res, 404, -32600, 'Session not found');
+                return;
+            }
+            await known.handleRequest(req, res);
+            return;
+        }
+        // No session ID. GET (opens the server-to-client SSE stream) and DELETE
+        // (closes a session) both presuppose one, so only a POST can get further.
+        if (req.method !== 'POST') {
+            jsonRpcError(res, 400, -32600, 'Bad Request: Mcp-Session-Id header is required');
+            return;
+        }
+        const parsed = await readBootstrapBody(req);
+        if (!parsed.ok) {
+            jsonRpcError(res, parsed.status, parsed.code, parsed.message);
+            return;
+        }
+        if (!isInitializeRequest(parsed.body)) {
+            jsonRpcError(res, 400, -32600, 'Bad Request: no valid session ID provided');
+            return;
+        }
+        const server = serverFactory();
+        let transport;
+        transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            onsessioninitialized: (sessionId) => {
+                transports.set(sessionId, transport);
+                servers.set(sessionId, server);
+            },
+            onsessionclosed: (sessionId) => {
+                transports.delete(sessionId);
+                servers.delete(sessionId);
+                server.close().catch(() => {
+                    /* best-effort cleanup */
+                });
+            }
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, parsed.body);
+    }
+    // Derive the RFC 9728 protected-resource-metadata URL for the Bearer
+    // challenge. Mirrors ``local-oauth-app.ts``'s ``getBaseUrl`` PUBLIC_URL-first
+    // convention: the deployed servers (oci-vm-prod behind CF Tunnel -> Caddy)
+    // set ``PUBLIC_URL`` so the advertised metadata URL is the public HTTPS host
+    // rather than the internal HTTP socket address. When unset, fall back to the
+    // request Host + ``X-Forwarded-Proto`` (or the socket ``encrypted`` flag).
+    function resourceMetadataUrl(req) {
+        const envPublicUrl = process.env.PUBLIC_URL;
+        let base;
+        if (envPublicUrl !== undefined && envPublicUrl.length > 0) {
+            base = envPublicUrl.replace(/\/+$/, '');
+        }
+        else {
+            const reqHost = req.headers.host ?? 'localhost';
+            const encrypted = req.socket.encrypted === true;
+            const forwardedProto = req.headers['x-forwarded-proto'];
+            let protocol = encrypted ? 'https' : 'http';
+            if (typeof forwardedProto === 'string' && forwardedProto.length > 0) {
+                const commaIdx = forwardedProto.indexOf(',');
+                protocol = (commaIdx !== -1 ? forwardedProto.substring(0, commaIdx) : forwardedProto).trim();
+            }
+            base = `${protocol}://${reqHost}`;
+        }
+        return `${base}/.well-known/oauth-protected-resource`;
+    }
+    async function mcpHandler(req, res) {
+        // Bearer auth bypass for deployments behind an external auth boundary.
+        // Caller (reverse proxy, API gateway) is trusted to enforce auth upstream.
+        if (jwtIssuer && options.authDisabled) {
+            const anonymousClaims = { sub: 'anonymous', anonymous: true };
+            if (options.authScope) {
+                await options.authScope(anonymousClaims, async () => {
+                    await handleSessionRequest(req, res);
+                });
+                return;
+            }
+            await handleSessionRequest(req, res);
+            return;
+        }
+        // Bearer auth if configured.
+        if (jwtIssuer) {
+            const authHeader = req.headers.authorization;
+            const token = extractBearerToken(authHeader);
+            if (!token) {
+                res.writeHead(401, {
+                    'WWW-Authenticate': `Bearer resource_metadata="${resourceMetadataUrl(req)}"`
+                });
+                res.end();
+                return;
+            }
+            let claims;
+            try {
+                claims = await jwtIssuer.verifyAccessToken(token);
+            }
+            catch {
+                res.writeHead(401, {
+                    'WWW-Authenticate': `Bearer resource_metadata="${resourceMetadataUrl(req)}", error="invalid_token"`
+                });
+                res.end();
+                return;
+            }
+            if (options.authScope) {
+                await options.authScope(claims, async () => {
+                    await handleSessionRequest(req, res);
+                });
+                return;
+            }
+        }
+        // Delegate to per-session MCP transport.
+        await handleSessionRequest(req, res);
+    }
+    async function dispatch(req, res, pathname) {
+        // Route /mcp to MCP transport (with optional Bearer auth).
+        if (pathname === '/mcp') {
+            await mcpHandler(req, res);
+            return;
+        }
+        // Consumer-registered routes. After the built-ins (which win) and before
+        // the OAuth app, whose handler is a catch-all for the remaining paths.
+        if (options.extraRoutes) {
+            for (const route of options.extraRoutes) {
+                if (route.path === pathname && route.method === req.method) {
+                    await route.handler(req, res);
+                    return;
+                }
+            }
+        }
+        // Route everything else to OAuth app if present.
+        if (oauthApp) {
+            await oauthApp.handler(req, res);
+            return;
+        }
+        // No OAuth app and no match -- 404.
+        jsonResponse(res, 404, { error: 'not_found' });
+    }
+    const handler = async (req, res) => {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const pathname = url.pathname;
+        // Liveness probe. Always available, never behind token auth.
+        if (pathname === '/health') {
+            jsonResponse(res, 200, { status: 'ok', server: options.serverName });
+            return;
+        }
+        // Token-table auth runs before any routing and binds the caller's
+        // AuthContext for the rest of the request (read via currentUser()).
+        if (tokenAuth !== null) {
+            await guardRequest(tokenAuth, req, res, () => dispatch(req, res, pathname));
+            return;
+        }
+        await dispatch(req, res, pathname);
+    };
+    const httpServer = createServer((req, res) => {
+        handler(req, res).catch(() => {
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'internal_error' }));
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(wantedPort, host, () => {
+            httpServer.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const addr = httpServer.address();
+    const actualPort = addr.port;
+    // Sweep stale locks for our server name BEFORE writing our own. Without
+    // this, abnormal-exit residue (Windows OOM, taskkill, signal) can pile up
+    // dozens of `<server>-<port>.lock` files — see 2026-04-28 wet-mcp 11-stale-lock incident.
+    const swept = sweepStaleLocks(options.serverName);
+    if (swept > 0) {
+        console.error(`[runHttpServer] cleaned ${swept} stale lock(s) for ${options.serverName}`);
+    }
+    const proxyToken = jwtIssuer ? await jwtIssuer.issueAccessToken('proxy', 31536000) : '';
+    const lockDirPath = path.join(os.homedir(), '.config', 'mcp', 'locks');
+    fs.mkdirSync(lockDirPath, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32') {
+        fs.chmodSync(lockDirPath, 0o700);
+    }
+    const lockFile = writeLockFile(options.serverName, actualPort, proxyToken, lockDirPath);
+    // Refresh the lock timestamp hourly so the 24h TTL sweep does not kill
+    // long-running daemons. Cancelled in `close()`.
+    const lockRefreshInterval = setInterval(() => refreshLockTimestamp(lockFile), 3600 * 1000);
+    if (typeof lockRefreshInterval.unref === 'function') {
+        lockRefreshInterval.unref();
+    }
+    // Auto-open the credential form in the user's browser when no creds exist
+    // yet. We open the root URL ("/") which auto-bootstraps PKCE and redirects
+    // to /authorize with valid params; opening /authorize directly returns
+    // invalid_request because it requires client_id/redirect_uri/state/
+    // code_challenge. See `local-oauth-app.ts` root handler docstring.
+    // Best-effort: any failure surfaces via tryOpenBrowser's ASCII fallback banner.
+    // ``openBrowser: false`` opts out entirely -- see the option's docstring for
+    // why a consumer that already published the URL must not get a second tab.
+    if (oauthApp && options.openBrowser !== false) {
+        try {
+            const existingConfig = await readStoredConfig(options.serverName);
+            // Use schema completeness instead of "config === null" so peer-share
+            // paths writing partial entries (e.g. wet inheriting CRG cloud keys)
+            // do not suppress the relay form when required fields are missing.
+            const configComplete = options.relaySchema
+                ? isSchemaComplete(existingConfig, options.relaySchema)
+                : existingConfig !== null;
+            if (!configComplete && process.env.NODE_ENV !== 'test') {
+                const setupUrl = `http://${host}:${actualPort}/`;
+                await tryOpenBrowser(setupUrl);
+            }
+        }
+        catch {
+            /* best-effort: never crash startup on browser-open failure */
+        }
+    }
+    // Invoke setup hook. Supports legacy 1-arg (success-only) and new 2-arg
+    // (success + failure) signatures via Function.prototype.length so upstream
+    // errors (invalid_grant / expired_token / access_denied) propagate to the
+    // browser form instead of leaving the spinner waiting forever.
+    if (options.setupCompleteHook && oauthApp) {
+        const markSetupFailed = 'markSetupFailed' in oauthApp && typeof oauthApp.markSetupFailed === 'function'
+            ? oauthApp.markSetupFailed
+            : undefined;
+        if (options.setupCompleteHook.length >= 2 && markSetupFailed !== undefined) {
+            ;
+            options.setupCompleteHook(oauthApp.markSetupComplete, markSetupFailed);
+        }
+        else {
+            ;
+            options.setupCompleteHook(oauthApp.markSetupComplete);
+        }
+    }
+    return {
+        port: actualPort,
+        host,
+        close: async () => {
+            if (oauthApp && 'shutdown' in oauthApp) {
+                await oauthApp.shutdown();
+            }
+            // Drain per-session transports + servers so their open SSE streams
+            // and tool-call timers don't keep the event loop alive after the
+            // HTTP server closes.
+            for (const transport of transports.values()) {
+                try {
+                    await transport.close();
+                }
+                catch {
+                    /* best-effort cleanup */
+                }
+            }
+            for (const server of servers.values()) {
+                try {
+                    await server.close();
+                }
+                catch {
+                    /* best-effort cleanup */
+                }
+            }
+            transports.clear();
+            servers.clear();
+            if (lockRefreshInterval !== null) {
+                clearInterval(lockRefreshInterval);
+            }
+            return new Promise((resolve, reject) => {
+                httpServer.close(async (err) => {
+                    if (lockFile) {
+                        try {
+                            await fs.promises.unlink(lockFile);
+                        }
+                        catch {
+                            /* best-effort cleanup */
+                        }
+                    }
+                    if (err) {
+                        reject(err);
+                    }
+                    else {
+                        resolve();
+                    }
+                });
+            });
+        }
+    };
+}
+//# sourceMappingURL=local-server.js.map

package/build/transport/local-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.js","sourceRoot":"","sources":["../../src/transport/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAEhG,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAGjC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAGxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EACL,uBAAuB,EAGxB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAEL,mBAAmB,EAGpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE3F,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,aAAa,EAAuB,MAAM,gCAAgC,CAAA;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AA8I1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAA8B,EAC9B,OAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAA;IAEpC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,SAAS,GAAyB,IAAI,CAAA;IAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,CAAW,CAAC,MAAM,CAC/G,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAC9D,CAAA;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,uCAAuC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC7G,CAAC;QACD,SAAS,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;YAAE,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC;IAED,8EAA8E;IAC9E,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IAC1D,MAAM,WAAW,GAAG,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC1E,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QACtE,OAAO,CAAC,IAAI,CACV,yGAAyG,CAC1G,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,GAAyD,IAAI,CAAA;IACzE,IAAI,SAAS,GAAqB,IAAI,CAAA;IAEtC,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,QAAQ,GAAG,MAAM,uBAAuB,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI;YACjC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,QAAQ;YACzC,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,eAAe;YACvD,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,SAAS;YAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAA;QACF,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAChC,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACnC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAA;QACF,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAChC,CAAC;IAED,2EAA2E;IAC3E,EAAE;IACF,6EAA6E;IAC7E,0DAA0D;IAC1D,2EAA2E;IAC3E,oFAAoF;IACpF,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,wDAAwD;IACxD,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyC,CAAA;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAA;IAE5C,8EAA8E;IAC9E,SAAS,YAAY,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;QACtF,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE;YACxB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,iBAAiB,CAC9B,GAAoB;QAEpB,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;QACjC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,KAAe,CAAA;YAC3B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAA;YAClB,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;gBACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;YACpF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACzE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,GAAoB,EAAE,GAAmB;QAC3E,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACnD,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;QAEzF,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,qEAAqE;gBACrE,qEAAqE;gBACrE,+DAA+D;gBAC/D,6CAA6C;gBAC7C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YACD,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,gDAAgD,CAAC,CAAA;YAChF,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;YAC7D,OAAM;QACR,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;QAC9B,IAAI,SAAwC,CAAA;QAC5C,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;YACtC,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE;gBAClC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBACpC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAChC,CAAC;YACD,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE;gBAC7B,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzB,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBACxB,yBAAyB;gBAC3B,CAAC,CAAC,CAAA;YACJ,CAAC;SACF,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IACtD,CAAC;IAED,qEAAqE;IACrE,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,SAAS,mBAAmB,CAAC,GAAoB;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;QAC3C,IAAI,IAAY,CAAA;QAChB,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACzC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;YAC/C,MAAM,SAAS,GAAI,GAAG,CAAC,MAAkC,CAAC,SAAS,KAAK,IAAI,CAAA;YAC5E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;YACvD,IAAI,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;YAC3C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAC5C,QAAQ,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAA;YAC9F,CAAC;YACD,IAAI,GAAG,GAAG,QAAQ,MAAM,OAAO,EAAE,CAAA;QACnC,CAAC;QACD,OAAO,GAAG,IAAI,uCAAuC,CAAA;IACvD,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAoB,EAAE,GAAmB;QACjE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,eAAe,GAAc,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YACxE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;oBAClD,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACtC,CAAC,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QACD,6BAA6B;QAC7B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;YAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,kBAAkB,EAAE,6BAA6B,mBAAmB,CAAC,GAAG,CAAC,GAAG;iBAC7E,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,IAAI,MAAiB,CAAA;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,kBAAkB,EAAE,6BAA6B,mBAAmB,CAAC,GAAG,CAAC,0BAA0B;iBACpG,CAAC,CAAA;gBACF,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;oBACzC,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACtC,CAAC,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;QACH,CAAC;QACD,yCAAyC;QACzC,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,GAAmB,EAAE,QAAgB;QACjF,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC1B,OAAM;QACR,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;oBAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBAC7B,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QAED,oCAAoC;QACpC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;QAE7B,6DAA6D;QAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,kEAAkE;QAClE,oEAAoE;QACpE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;IACpC,CAAC,CAAA;IAED,MAAM,UAAU,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE;YACvC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC1C,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAiB,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAA;IAE5B,wEAAwE;IACxE,0EAA0E;IAC1E,0FAA0F;IAC1F,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,2BAA2B,KAAK,sBAAsB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IACtE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;IAEvF,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,mBAAmB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;IAC1F,IAAI,OAAO,mBAAmB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACpD,mBAAmB,CAAC,KAAK,EAAE,CAAA;IAC7B,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,gFAAgF;IAChF,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACjE,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW;gBACxC,CAAC,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC;gBACvD,CAAC,CAAC,cAAc,KAAK,IAAI,CAAA;YAE3B,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACvD,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,UAAU,GAAG,CAAA;gBAChD,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,OAAO,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,eAAe,GACnB,iBAAiB,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,UAAU;YAC7E,CAAC,CAAC,QAAQ,CAAC,eAAe;YAC1B,CAAC,CAAC,SAAS,CAAA;QACf,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC3E,CAAC;YAAC,OAAO,CAAC,iBAAsG,CAC9G,QAAQ,CAAC,iBAAiB,EAC1B,eAAe,CAChB,CAAA;QACH,CAAC;aAAM,CAAC;YACN,CAAC;YAAC,OAAO,CAAC,iBAA0D,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAClG,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;gBACvC,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAA;YAC3B,CAAC;YAED,mEAAmE;YACnE,iEAAiE;YACjE,sBAAsB;YACtB,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5C,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAA;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;YACD,UAAU,CAAC,KAAK,EAAE,CAAA;YAClB,OAAO,CAAC,KAAK,EAAE,CAAA;YAEf,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBACjC,aAAa,CAAC,mBAAmB,CAAC,CAAA;YACpC,CAAC;YAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBAC7B,IAAI,QAAQ,EAAE,CAAC;wBACb,IAAI,CAAC;4BACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;wBACpC,CAAC;wBAAC,MAAM,CAAC;4BACP,yBAAyB;wBAC3B,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,EAAE,CAAC;wBACR,MAAM,CAAC,GAAG,CAAC,CAAA;oBACb,CAAC;yBAAM,CAAC;wBACN,OAAO,EAAE,CAAA;oBACX,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/build/transport/oauth-middleware.d.ts

@@ -0,0 +1,45 @@
+/**
+ * OAuth 2.1 Bearer token validation middleware for Streamable HTTP.
+ *
+ * Validates `Authorization: Bearer <token>` headers on incoming requests
+ * against a `JWTIssuer`. On missing or invalid token it writes a 401
+ * with `WWW-Authenticate: Bearer resource_metadata="..."` per RFC 6750 +
+ * RFC 9728 (OAuth 2.1 protected resource metadata discovery).
+ *
+ * Success attaches the validated claims to `AuthenticatedRequest.user` so
+ * downstream handlers can read the subject without re-validating.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { JWTIssuer } from '../oauth/jwt-issuer.js';
+export interface OAuthMiddlewareOptions {
+    jwtIssuer: JWTIssuer;
+    resourceMetadataUrl: string;
+    /**
+     * When `true`, skip Bearer token validation and attach an anonymous user
+     * claim. Intended for deployments behind an external auth boundary
+     * (reverse proxy, API gateway like agentgateway/Zitadel) where the caller
+     * has already verified identity. Logs a warning on construction; the
+     * deployer is responsible for ensuring upstream auth is in place.
+     */
+    authDisabled?: boolean;
+}
+export interface AuthenticatedRequest extends IncomingMessage {
+    user?: Record<string, unknown>;
+}
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+export declare class OAuthMiddleware {
+    private readonly _issuer;
+    private readonly _resourceMetadataUrl;
+    private readonly _authDisabled;
+    constructor(options: OAuthMiddlewareOptions);
+    /**
+     * Validate the request. Returns `true` if the request should proceed
+     * (and attaches `req.user` on success). Returns `false` if the
+     * middleware has already written a 401 response.
+     *
+     * When constructed with `authDisabled: true`, this short-circuits to
+     * `true` and attaches `{ sub: 'anonymous', anonymous: true }` to `req.user`.
+     */
+    validate(req: AuthenticatedRequest, res: ServerResponse): Promise<boolean>;
+}
+//# sourceMappingURL=oauth-middleware.d.ts.map

package/build/transport/oauth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-middleware.d.ts","sourceRoot":"","sources":["../../src/transport/oauth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAEvD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,SAAS,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAiBD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAsBhF;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAQ;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,OAAO,EAAE,sBAAsB,EAU1C;IAED;;;;;;;OAOG;IACG,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAkB/E;CACF"}

package/build/transport/oauth-middleware.js

@@ -0,0 +1,86 @@
+/**
+ * OAuth 2.1 Bearer token validation middleware for Streamable HTTP.
+ *
+ * Validates `Authorization: Bearer <token>` headers on incoming requests
+ * against a `JWTIssuer`. On missing or invalid token it writes a 401
+ * with `WWW-Authenticate: Bearer resource_metadata="..."` per RFC 6750 +
+ * RFC 9728 (OAuth 2.1 protected resource metadata discovery).
+ *
+ * Success attaches the validated claims to `AuthenticatedRequest.user` so
+ * downstream handlers can read the subject without re-validating.
+ */
+function writeChallenge(res, resourceMetadataUrl, error) {
+    const params = [`resource_metadata="${resourceMetadataUrl}"`];
+    if (error)
+        params.push(`error="${error}"`);
+    res.writeHead(401, {
+        'WWW-Authenticate': `Bearer ${params.join(', ')}`,
+        'Content-Type': 'application/json'
+    });
+    res.end(JSON.stringify({
+        error: error ?? 'unauthorized',
+        error_description: error ? 'The access token is missing or invalid' : 'Authentication required'
+    }));
+}
+export function extractBearerToken(authHeader) {
+    if (!authHeader)
+        return null;
+    // Fast path for strictly "Bearer " or "bearer " (exact case & single space)
+    if (authHeader.startsWith('Bearer ') || authHeader.startsWith('bearer ')) {
+        const token = authHeader.substring(7).trim();
+        return token.length > 0 ? token : null;
+    }
+    // Fallback for tricky cases (mixed case, leading whitespace, etc.)
+    const trimmed = authHeader.trim();
+    if (trimmed.length <= 6)
+        return null;
+    const prefix = trimmed.substring(0, 6);
+    if (prefix.toLowerCase() !== 'bearer')
+        return null;
+    const char6 = trimmed.charCodeAt(6);
+    // Check if character 6 is whitespace (space=32, tab=9, newline=10, return=13)
+    if (char6 !== 32 && char6 !== 9 && char6 !== 10 && char6 !== 13)
+        return null;
+    const token = trimmed.substring(7).trim();
+    return token.length > 0 ? token : null;
+}
+export class OAuthMiddleware {
+    constructor(options) {
+        this._issuer = options.jwtIssuer;
+        this._resourceMetadataUrl = options.resourceMetadataUrl;
+        this._authDisabled = options.authDisabled === true;
+        if (this._authDisabled) {
+            console.warn('[hull OAuthMiddleware] auth_disabled=true — Bearer token validation skipped. ' +
+                'Caller must enforce authentication at the network boundary (e.g. reverse proxy, API gateway).');
+        }
+    }
+    /**
+     * Validate the request. Returns `true` if the request should proceed
+     * (and attaches `req.user` on success). Returns `false` if the
+     * middleware has already written a 401 response.
+     *
+     * When constructed with `authDisabled: true`, this short-circuits to
+     * `true` and attaches `{ sub: 'anonymous', anonymous: true }` to `req.user`.
+     */
+    async validate(req, res) {
+        if (this._authDisabled) {
+            req.user = { sub: 'anonymous', anonymous: true };
+            return true;
+        }
+        const token = extractBearerToken(req.headers.authorization);
+        if (!token) {
+            writeChallenge(res, this._resourceMetadataUrl);
+            return false;
+        }
+        try {
+            const claims = await this._issuer.verifyAccessToken(token);
+            req.user = claims;
+            return true;
+        }
+        catch {
+            writeChallenge(res, this._resourceMetadataUrl, 'invalid_token');
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=oauth-middleware.js.map

package/build/transport/oauth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-middleware.js","sourceRoot":"","sources":["../../src/transport/oauth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuBH,SAAS,cAAc,CAAC,GAAmB,EAAE,mBAA2B,EAAE,KAAc;IACtF,MAAM,MAAM,GAAG,CAAC,sBAAsB,mBAAmB,GAAG,CAAC,CAAA;IAC7D,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;IAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,kBAAkB,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,cAAc,EAAE,kBAAkB;KACnC,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,KAAK,IAAI,cAAc;QAC9B,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,yBAAyB;KAChG,CAAC,CACH,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAA8B;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAE5B,4EAA4E;IAC5E,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACxC,CAAC;IAED,mEAAmE;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACtC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAElD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACnC,8EAA8E;IAC9E,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAE5E,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,OAAO,eAAe;IAK1B,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAA;QAChC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAA;QACvD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAA;QAClD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CACV,+EAA+E;gBAC7E,+FAA+F,CAClG,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAyB,EAAE,GAAmB;QAC3D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;YAC9C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAC1D,GAAG,CAAC,IAAI,GAAG,MAAM,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAA;YAC/D,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;CACF"}