@ni-c/mcp-hub 0.10.0 → 0.11.0

package/dist/auth/routes.js

@@ -1,249 +0,0 @@
-import crypto from 'node:crypto';
-import express, { Router } from 'express';
-import bcrypt from 'bcryptjs';
-import { mcpAuthRouter, createOAuthMetadata } from '@modelcontextprotocol/sdk/server/auth/router.js';
-import { SESSION_TTL_MS } from './provider.js';
-import { renderLoginPage } from './login-page.js';
-import { allowFormActionTo, contentSecurityPolicy } from './headers.js';
-import { isLoopbackOnly } from './redirect-uri.js';
-import { logSafe } from './text.js';
-import { privateKeyJwtAuth } from './private-key-jwt.js';
-import { earlyRateLimit } from './rate-limit.js';
-import { createRegistrationManagementRoutes } from './registration.js';
-const LOGIN_MAX_ATTEMPTS = 10;
-const LOGIN_WINDOW_MS = 15 * 60_000;
-const LOGIN_MAX_ATTEMPTS_TOTAL = 100;
-export class LoginRateLimiter {
-    attempts = new Map();
-    total = { count: 0, resetAt: 0 };
-    isBlocked(ip) {
-        if (this.total.resetAt > Date.now() && this.total.count >= LOGIN_MAX_ATTEMPTS_TOTAL)
-            return true;
-        const entry = this.attempts.get(ip);
-        if (!entry || entry.resetAt < Date.now())
-            return false;
-        return entry.count >= LOGIN_MAX_ATTEMPTS;
-    }
-    recordFailure(ip) {
-        this.sweepExpired(); // entries are otherwise only dropped on a successful login from that exact IP
-        const now = Date.now();
-        // Behind a reverse proxy req.ip is the proxy for every request, and a
-        // spoofable X-Forwarded-For makes the per-IP counter meaningless — this
-        // caps the total either way.
-        if (this.total.resetAt < now)
-            this.total = { count: 1, resetAt: now + LOGIN_WINDOW_MS };
-        else
-            this.total.count++;
-        const entry = this.attempts.get(ip);
-        if (!entry || entry.resetAt < now) {
-            this.attempts.set(ip, { count: 1, resetAt: now + LOGIN_WINDOW_MS });
-        }
-        else {
-            entry.count++;
-        }
-    }
-    sweepExpired() {
-        const now = Date.now();
-        for (const [ip, entry] of this.attempts) {
-            if (entry.resetAt < now)
-                this.attempts.delete(ip);
-        }
-    }
-    reset(ip) {
-        this.attempts.delete(ip);
-        this.total = { count: 0, resetAt: 0 };
-    }
-}
-export function createAuthRoutes(options) {
-    const { provider, externalUrl } = options;
-    if (!options.passwordHash && !options.password) {
-        throw new Error('Either PASSWORD_HASH (bcrypt) or PASSWORD must be set');
-    }
-    const issuerUrl = new URL(externalUrl);
-    const router = Router();
-    const rateLimiter = new LoginRateLimiter();
-    // Keep the password login/consent pages and the OAuth token responses out of
-    // any shared or browser cache (RFC 6749 §5.1 requires no-store on token
-    // responses; the login form has no business being cached either). The CSP
-    // and legacy frame header keep an attacker from clickjacking approval or
-    // password entry. This application has no legitimate framing use case.
-    router.use((_req, res, next) => {
-        res.set('Cache-Control', 'no-store');
-        res.set('Content-Security-Policy', contentSecurityPolicy());
-        res.set('X-Frame-Options', 'DENY');
-        res.set('X-Content-Type-Options', 'nosniff');
-        res.set('Referrer-Policy', 'no-referrer');
-        next();
-    });
-    // RFC 7592 registration management. It goes first for two reasons: the SDK's
-    // registration router is mounted on the /register prefix and answers 405 to
-    // anything that is not a POST, and the registration budget below is also
-    // prefix-scoped — routine management would otherwise use up a client's
-    // ability to register at all. It brings its own, more generous limit.
-    if (provider.clientsStore.registerClient) {
-        router.use(createRegistrationManagementRoutes({ store: options.store, externalUrl: issuerUrl.href }));
-    }
-    // These run before the SDK's JSON/form parsers. The SDK applies its own
-    // endpoint limits too, but those otherwise happen only after body parsing.
-    router.use('/register', earlyRateLimit(60 * 60_000, 20, 200));
-    router.use('/authorize', earlyRateLimit(15 * 60_000, 100, 1_000));
-    router.use('/token', earlyRateLimit(15 * 60_000, 50, 500));
-    router.use('/login', earlyRateLimit(15 * 60_000, 100, 500));
-    router.use('/consent', earlyRateLimit(15 * 60_000, 100, 500));
-    // Advertised capabilities. The SDK's document knows nothing about Client ID
-    // Metadata Documents, so the two fields clients key their registration
-    // choice on are added here: client_id_metadata_document_supported is what
-    // makes a spec-compliant client prefer CIMD over dynamic registration, and
-    // private_key_jwt is how a CIMD client authenticates at the token endpoint —
-    // it can hold no shared secret.
-    const asMetadata = {
-        ...createOAuthMetadata({ provider, issuerUrl }),
-        ...(options.cimd
-            ? {
-                client_id_metadata_document_supported: true,
-                token_endpoint_auth_methods_supported: ['client_secret_post', 'none', 'private_key_jwt'],
-                token_endpoint_auth_signing_alg_values_supported: ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512', 'EdDSA']
-            }
-            : {})
-    };
-    if (options.cimd) {
-        // Ahead of mcpAuthRouter so it wins the route, and ahead of the SDK's own
-        // body parser — which is harmless, because body-parser leaves an
-        // already-read request alone and req.body survives into the SDK handler.
-        router.use('/token', express.urlencoded({ extended: false }), privateKeyJwtAuth({ resolver: options.cimd, externalUrl: issuerUrl.href, tokenEndpoint: asMetadata.token_endpoint }));
-        // mcpAuthRouter serves the root RFC 8414 document itself, so the enriched
-        // one has to be registered before it to take precedence.
-        router.get('/.well-known/oauth-authorization-server', (_req, res) => {
-            res.json(asMetadata);
-        });
-    }
-    if (!provider.clientsStore.registerClient) {
-        // With dynamic registration off the SDK never mounts /register, and the
-        // request would otherwise fall through to the MCP routes and come back as
-        // a 401 — telling a client to authenticate at an endpoint that no longer
-        // exists. Say what actually happened instead.
-        router.all('/register', (_req, res) => {
-            res
-                .status(404)
-                .json({ error: 'not_found', error_description: 'Dynamic client registration is disabled; use a client ID metadata document' });
-        });
-    }
-    // Standard AS endpoints: /.well-known/*, /authorize, /token, /register, /revoke
-    router.use(mcpAuthRouter({ provider, issuerUrl, resourceName: 'mcp-hub' }));
-    // Path-scoped metadata (RFC 9728 §3.1): clients connected to /<name>/mcp look
-    // up /.well-known/oauth-protected-resource/<name>/mcp before falling back to
-    // the root document, and RFC 8414 has an equivalent path-insertion form for
-    // AS metadata. Serve both for any suffix; one AS covers all resources.
-    router.get('/.well-known/oauth-authorization-server/{*splat}', (_req, res) => {
-        res.json(asMetadata);
-    });
-    // OIDC Discovery alias: some clients (ChatGPT among them) probe
-    // /.well-known/openid-configuration instead of — or before — the RFC 8414
-    // path, and the MCP spec requires clients to support both. The RFC 8414
-    // document is a compatible answer for the fields such clients read.
-    router.get('/.well-known/openid-configuration', (_req, res) => {
-        res.json(asMetadata);
-    });
-    router.get('/.well-known/openid-configuration/{*splat}', (_req, res) => {
-        res.json(asMetadata);
-    });
-    router.get('/.well-known/oauth-protected-resource/{*splat}', (req, res) => {
-        const suffix = req.path.replace('/.well-known/oauth-protected-resource', '');
-        res.json({
-            resource: issuerUrl.origin + suffix,
-            authorization_servers: [externalUrl],
-            bearer_methods_supported: ['header'],
-            resource_name: 'mcp-hub'
-        });
-    });
-    const checkPassword = (password) => {
-        if (options.passwordHash)
-            return bcrypt.compareSync(password, options.passwordHash);
-        const expected = Buffer.from(options.password);
-        const given = Buffer.from(password);
-        return expected.length === given.length && crypto.timingSafeEqual(expected, given);
-    };
-    router.post('/login', express.urlencoded({ extended: false }), async (req, res) => {
-        const ip = req.ip ?? 'unknown';
-        const { password, request } = req.body;
-        const pending = typeof request === 'string' ? provider.decodePendingAuthorization(request) : undefined;
-        if (!pending) {
-            res.status(400).type('html').send('<p>Authorization request expired. Close this window and connect again.</p>');
-            return;
-        }
-        if (rateLimiter.isBlocked(ip)) {
-            console.warn(`mcp-hub: login rate limit exceeded from ${logSafe(ip)}`);
-            res.status(429).type('html').send('<p>Too many attempts. Try again later.</p>');
-            return;
-        }
-        if (typeof password !== 'string' || !checkPassword(password)) {
-            rateLimiter.recordFailure(ip);
-            console.warn(`mcp-hub: authentication failure from ${logSafe(ip)}`);
-            // The retry form has to reach the same redirect as the first attempt,
-            // and say the same things about who is asking.
-            const retryClient = await provider.clientsStore.getClient(pending.clientId);
-            allowFormActionTo(res, pending.redirectUri);
-            res
-                .status(401)
-                .type('html')
-                .send(renderLoginPage(request, pending.redirectUri, {
-                clientName: retryClient?.client_name,
-                resource: pending.resource,
-                clientId: provider.isMetadataDocumentClient(pending.clientId) ? pending.clientId : undefined,
-                loopbackOnly: isLoopbackOnly(retryClient?.redirect_uris)
-            }, 'Wrong password'));
-            return;
-        }
-        rateLimiter.reset(ip);
-        console.log(`mcp-hub: successful login from ${logSafe(ip)}`);
-        res.cookie(provider.sessionCookieName, provider.createSessionCookie(), {
-            httpOnly: true,
-            secure: issuerUrl.protocol === 'https:',
-            sameSite: 'lax',
-            maxAge: SESSION_TTL_MS,
-            path: '/'
-        });
-        const client = await provider.clientsStore.getClient(pending.clientId);
-        if (!client) {
-            res.status(400).type('html').send('<p>Unknown client. Close this window and connect again.</p>');
-            return;
-        }
-        provider.approve(client, pending.redirectUri); // typing the password is the consent
-        provider.redirectWithCode(client, pending, res);
-    });
-    // Reached from the consent page when a signed-in user authorizes a client
-    // for the first time. Everything here has to hold even though the request
-    // may have been triggered by a page the user did not expect to land on.
-    router.post('/consent', express.urlencoded({ extended: false }), async (req, res) => {
-        const { request, csrf, action } = req.body;
-        const pending = typeof request === 'string' ? provider.decodePendingAuthorization(request) : undefined;
-        if (!pending) {
-            res.status(400).type('html').send('<p>Authorization request expired. Close this window and connect again.</p>');
-            return;
-        }
-        const session = provider.readSessionCookie(req.headers.cookie);
-        if (!session) {
-            res.status(401).type('html').send('<p>Session expired. Close this window and connect again.</p>');
-            return;
-        }
-        if (!provider.verifyCsrfToken(session, csrf)) {
-            console.warn(`mcp-hub: consent with an invalid CSRF token from ${logSafe(req.ip ?? 'unknown')}`);
-            res.status(403).type('html').send('<p>Invalid request. Close this window and connect again.</p>');
-            return;
-        }
-        if (action !== 'approve') {
-            console.log(`mcp-hub: authorization denied for client ${pending.clientId}`);
-            provider.redirectWithError(pending.redirectUri, pending.state, 'access_denied', res);
-            return;
-        }
-        const client = await provider.clientsStore.getClient(pending.clientId);
-        if (!client) {
-            res.status(400).type('html').send('<p>Unknown client. Close this window and connect again.</p>');
-            return;
-        }
-        provider.approve(client, pending.redirectUri);
-        provider.redirectWithCode(client, pending, res);
-    });
-    return router;
-}
-//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAoB,cAAc,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAarC,MAAM,OAAO,gBAAgB;IACV,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEzC,SAAS,CAAC,EAAU;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,wBAAwB;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QACvD,OAAO,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,8EAA8E;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,sEAAsE;QACtE,wEAAwE;QACxE,6BAA6B;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC;;YACnF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE3C,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9D,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,UAAU,GAAG;QACjB,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC;gBACE,qCAAqC,EAAE,IAAI;gBAC3C,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,MAAM,EAAE,iBAAiB,CAAC;gBACxF,gDAAgD,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;aAC7I;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,0EAA0E;QAC1E,iEAAiE;QACjE,yEAAyE;QACzE,MAAM,CAAC,GAAG,CACR,QAAQ,EACR,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CACrH,CAAC;QACF,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAClE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QAC1C,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACpC,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,4EAA4E,EAAE,CAAC,CAAC;QACnI,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,kDAAkD,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM;YACnC,qBAAqB,EAAE,CAAC,WAAW,CAAC;YACpC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA+C,CAAC;QAClF,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,sEAAsE;YACtE,+CAA+C;YAC/C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5E,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CACH,eAAe,CACb,OAAQ,EACR,OAAO,CAAC,WAAW,EACnB;gBACE,UAAU,EAAE,WAAW,EAAE,WAAW;gBACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC5F,YAAY,EAAE,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC;aACzD,EACD,gBAAgB,CACjB,CACF,CAAC;YACJ,OAAO;QACT,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YACrE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACvC,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,qCAAqC;QACpF,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA4D,CAAC;QACnG,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,oDAAoD,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACjG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,4CAA4C,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5E,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}