@ni-c/mcp-hub 0.9.2 → 0.10.0

package/dist/admin.js

@@ -1,16 +1,33 @@
 #!/usr/bin/env node
-import { AuthStore } from './auth/store.js';
+import crypto from 'node:crypto';
+import { AuthStore, clientLimitsFromEnv } from './auth/store.js';
+import { isSafeRedirectUri } from './auth/redirect-uri.js';
+import { clampDisplayName } from './auth/text.js';
+import { isClientIdMetadataUrl } from './auth/cimd.js';
 import { mintApiToken } from './auth/provider.js';
+import { loadConfig } from './config.js';
+import { authFor, requireOAuthServer, startUpstreamLogin, upstreamStatus } from './upstream/login.js';
 function usage() {
     console.error([
         'Usage:',
         '  mcp-hub-admin clients list',
-        '  mcp-hub-admin clients revoke <client-id>',
+        '  mcp-hub-admin clients add --name <text> --redirect-uri <uri> [--public]',
+        '  mcp-hub-admin clients revoke <client-id>   (withdraws access, keeps the registration)',
+        '  mcp-hub-admin clients delete <client-id>   (removes the registration outright)',
+        '  mcp-hub-admin clients prune [--dry-run]',
         '  mcp-hub-admin tokens create --resource <name|hub> [--days <n>] [--label <text>]',
         '  mcp-hub-admin tokens list',
         '  mcp-hub-admin tokens revoke <token-id>',
+        '  mcp-hub-admin upstream list',
+        '  mcp-hub-admin upstream status <server>',
+        '  mcp-hub-admin upstream login <server> [--no-wait]',
+        '  mcp-hub-admin upstream register <server>   (obtain a client_id without logging in)',
+        '  mcp-hub-admin upstream refresh <server>    (renew the token now)',
+        '  mcp-hub-admin upstream logout <server>     (forget it here and revoke it there)',
         '',
-        'tokens create needs EXTERNAL_URL in the environment (same value the hub runs with).'
+        'tokens create needs EXTERNAL_URL in the environment (same value the hub runs with).',
+        'upstream commands read CONFIG_PATH; run them inside the hub container so the',
+        'same mcp.json and the same ${VAR} values are in scope.'
     ].join('\n'));
     process.exit(2);
 }
@@ -25,38 +42,138 @@ function flag(args, name) {
     }
     return value;
 }
+/** How this client came to exist, for `clients list`. */
+function clientOrigin(clientId) {
+    if (isClientIdMetadataUrl(clientId))
+        return 'cimd';
+    return store.isOperatorManaged(clientId) ? 'static' : 'dcr';
+}
 const [, , group, action, ...rest] = process.argv;
-const store = new AuthStore(process.env.DATA_PATH ?? '/data');
+// The same limits the hub runs with, so a prune here removes exactly what the
+// hub would. `docker exec` into the hub container shares its environment.
+const store = new AuthStore(process.env.DATA_PATH ?? '/data', clientLimitsFromEnv());
 if (group === 'clients' && action === 'list') {
     const approvals = store.listApprovals();
-    const rows = Object.entries(store.listClients()).map(([id, client]) => ({
+    const clients = store.listClients();
+    const rows = Object.entries(clients).map(([id, client]) => ({
         clientId: id,
         clientName: client.client_name ?? '',
+        via: clientOrigin(id),
         registeredRedirectUris: client.redirect_uris,
         approvedRedirectUris: approvals[id]?.redirectUris ?? [],
         approvedAt: approvals[id] ? new Date(approvals[id].approvedAt * 1000).toISOString() : null
     }));
+    // Metadata-document clients are never stored — the document is fetched fresh
+    // on every authorization — so an approval is the only trace they leave. They
+    // would otherwise be a blind spot in the one command that answers "who can
+    // reach this hub", even though `clients revoke` works on them fine.
+    for (const [id, approval] of Object.entries(approvals)) {
+        if (clients[id])
+            continue;
+        rows.push({
+            clientId: id,
+            clientName: approval.clientName ?? '',
+            via: clientOrigin(id),
+            registeredRedirectUris: [],
+            approvedRedirectUris: approval.redirectUris,
+            approvedAt: new Date(approval.approvedAt * 1000).toISOString()
+        });
+    }
     console.log(JSON.stringify(rows, null, 2));
     process.exit(0);
 }
+if (group === 'clients' && action === 'add') {
+    const name = flag(rest, 'name');
+    const redirectUri = flag(rest, 'redirect-uri');
+    if (!name || !redirectUri)
+        usage();
+    if (!isSafeRedirectUri(redirectUri, { allowPrivateUseSchemes: true })) {
+        console.error(`redirect-uri must be https, a loopback address or a private-use scheme: ${redirectUri}`);
+        process.exit(2);
+    }
+    const isPublic = rest.includes('--public');
+    const clientId = crypto.randomBytes(16).toString('base64url');
+    const clientSecret = isPublic ? undefined : crypto.randomBytes(32).toString('hex');
+    const stored = {
+        client_id: clientId,
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+        client_name: clampDisplayName(name),
+        redirect_uris: [redirectUri],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: isPublic ? 'none' : 'client_secret_post',
+        ...(clientSecret ? { client_secret: clientSecret, client_secret_expires_at: 0 } : {})
+    };
+    // operatorManaged: exempt from the ceiling and from every expiry rule. A
+    // client somebody typed out by hand must not vanish after ninety idle days.
+    store.addClient(stored, undefined, { operatorManaged: true });
+    // Creating it *is* the approval: the operator named the redirect URI, so
+    // sending them through a browser to confirm what they just typed is noise.
+    store.saveApproval(clientId, redirectUri, stored.client_name);
+    console.error('OAuth client created. This is the only time the secret is shown:');
+    console.log(JSON.stringify({ client_id: clientId, ...(clientSecret ? { client_secret: clientSecret } : {}) }, null, 2));
+    console.error(JSON.stringify({ clientName: stored.client_name, redirectUri, public: isPublic, approved: true }, null, 2));
+    process.exit(0);
+}
 if (group === 'clients' && action === 'revoke') {
     const clientId = rest[0];
     if (!clientId)
         usage();
+    // A metadata-document client has no stored registration, so its approval is
+    // what proves it was ever let in.
     const client = store.getClient(clientId);
-    if (!client) {
+    const approval = store.getApproval(clientId);
+    if (!client && !approval) {
         console.error(`Unknown OAuth client: ${clientId}`);
         process.exit(1);
     }
     const result = store.revokeClientAccess(clientId);
     console.log(JSON.stringify({
         clientId,
-        clientName: client.client_name ?? '',
+        clientName: client?.client_name ?? approval?.clientName ?? '',
         revokedRefreshTokens: result.refreshTokens,
         revokedAt: new Date(result.revokedBefore).toISOString()
     }, null, 2));
     process.exit(0);
 }
+if (group === 'clients' && action === 'delete') {
+    const clientId = rest[0];
+    if (!clientId)
+        usage();
+    const client = store.getClient(clientId);
+    const approval = store.getApproval(clientId);
+    if (!client && !approval) {
+        console.error(`Unknown OAuth client: ${clientId}`);
+        process.exit(1);
+    }
+    // Unlike revoke, this leaves nothing behind: the client would have to
+    // register again from scratch.
+    store.deleteClient(clientId);
+    console.log(JSON.stringify({ clientId, clientName: client?.client_name ?? approval?.clientName ?? '', deleted: true }, null, 2));
+    process.exit(0);
+}
+if (group === 'clients' && action === 'prune') {
+    const dryRun = rest.includes('--dry-run');
+    const limits = store.clientLimits;
+    const describe = (ids) => ids.map(id => ({ clientId: id, clientName: store.getClient(id)?.client_name ?? '' }));
+    // Read the plan before acting so a dry run and a real run report the same
+    // shape, and so the names are still resolvable.
+    const planned = store.planClientPrune();
+    const report = {
+        dryRun,
+        limits: {
+            maxClients: limits.maxClients,
+            pendingTtlHours: limits.pendingTtlSeconds / 3600,
+            inactiveDays: limits.inactiveSeconds / 86_400
+        },
+        neverApproved: describe(planned.pending),
+        unused: describe(planned.inactive)
+    };
+    if (!dryRun)
+        store.pruneClients();
+    console.log(JSON.stringify(report, null, 2));
+    process.exit(0);
+}
 if (group === 'tokens' && action === 'create') {
     const externalUrl = process.env.EXTERNAL_URL;
     if (!externalUrl) {
@@ -107,5 +224,112 @@ if (group === 'tokens' && action === 'revoke') {
     console.log(JSON.stringify({ id, revoked: true }, null, 2));
     process.exit(0);
 }
+if (group === 'upstream') {
+    const configPath = process.env.CONFIG_PATH ?? '/config/mcp.json';
+    let config;
+    try {
+        config = loadConfig(configPath);
+    }
+    catch (error) {
+        console.error(`Cannot read ${configPath}: ${error.message}`);
+        process.exit(1);
+    }
+    // The image sets CONFIG_PATH and DATA_PATH but never EXTERNAL_URL, so the
+    // value the hub recorded at boot is normally the one that applies.
+    const externalUrl = process.env.EXTERNAL_URL ?? store.getExternalUrl();
+    const name = rest.find(argument => !argument.startsWith('--'));
+    const fail = message => {
+        console.error(message);
+        process.exit(2);
+    };
+    if (action === 'list' || action === 'status') {
+        try {
+            console.log(JSON.stringify(upstreamStatus(store, config, action === 'status' ? name : undefined), null, 2));
+        }
+        catch (error) {
+            fail(error.message);
+        }
+        process.exit(0);
+    }
+    if (!name)
+        usage();
+    if (!externalUrl) {
+        console.error('upstream commands need EXTERNAL_URL (the origin the hub runs under), or a hub that has run at least once');
+        process.exit(1);
+    }
+    let auth;
+    try {
+        auth = authFor(store, new URL(externalUrl).href, name, requireOAuthServer(config, name));
+    }
+    catch (error) {
+        fail(error.message);
+    }
+    if (action === 'login') {
+        let started;
+        try {
+            started = await startUpstreamLogin(store, auth);
+        }
+        catch (error) {
+            fail(error.message);
+        }
+        console.error('Open this in a browser that is signed in to the hub:');
+        console.log(started.authorizationUrl);
+        if (rest.includes('--no-wait'))
+            process.exit(0);
+        console.error('Waiting for the upstream to redirect back…');
+        // The callback lands on the hub, in another process, and writes the tokens
+        // to the same state file. Each poll is a stat, so this stays cheap.
+        const before = store.getUpstreamCredentials(name, auth.fingerprint)?.obtainedAt ?? 0;
+        for (;;) {
+            const record = store.getUpstreamCredentials(name, auth.fingerprint);
+            if (record?.tokens && record.obtainedAt >= before) {
+                console.log(JSON.stringify({ server: name, authorized: true }, null, 2));
+                process.exit(0);
+            }
+            if (Date.now() > started.expiresAt) {
+                console.error('The login was not completed in time. Run it again.');
+                process.exit(1);
+            }
+            await new Promise(resolve => setTimeout(resolve, 1_000));
+        }
+    }
+    if (action === 'register') {
+        try {
+            const discovery = await auth.discover(true);
+            const information = await auth.clientInformation(discovery);
+            console.log(JSON.stringify({ server: name, clientId: information.client_id }, null, 2));
+        }
+        catch (error) {
+            fail(error.message);
+        }
+        process.exit(0);
+    }
+    if (action === 'refresh') {
+        try {
+            await auth.prepare({ force: true });
+        }
+        catch (error) {
+            fail(error.message);
+        }
+        const record = store.getUpstreamCredentials(name, auth.fingerprint);
+        console.log(JSON.stringify({
+            server: name,
+            refreshed: true,
+            ...(record?.accessTokenValidUntil ? { accessTokenValidUntil: new Date(record.accessTokenValidUntil * 1000).toISOString() } : {})
+        }, null, 2));
+        process.exit(0);
+    }
+    if (action === 'logout') {
+        // Best effort at the upstream, unconditional locally: a third party being
+        // unreachable must never leave a credential behind here.
+        const problems = await auth.revokeRemotely().catch(error => [error.message]);
+        const forgotten = store.forgetUpstreamCredentials(name);
+        for (const problem of problems)
+            console.error(`Upstream revocation: ${problem}`);
+        console.log(JSON.stringify({ server: name, forgotten, revokedAtUpstream: problems.length === 0 }, null, 2));
+        process.exit(problems.length > 0 ? 1 : 0);
+    }
+    usage();
+}
 usage();
 //# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CACX;QACE,QAAQ;QACR,8BAA8B;QAC9B,4CAA4C;QAC5C,mFAAmF;QACnF,6BAA6B;QAC7B,0CAA0C;QAC1C,EAAE;QACF,qFAAqF;KACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,EAAE,AAAD,EAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;AAClD,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;AAE9D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACpC,sBAAsB,EAAE,MAAM,CAAC,aAAa;QAC5C,oBAAoB,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE;QACvD,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC3F,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACpC,oBAAoB,EAAE,MAAM,CAAC,aAAa;QAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;KACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IAC1C,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC1D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,EAAE,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":";AACA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtG,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CACX;QACE,QAAQ;QACR,8BAA8B;QAC9B,2EAA2E;QAC3E,yFAAyF;QACzF,kFAAkF;QAClF,2CAA2C;QAC3C,mFAAmF;QACnF,6BAA6B;QAC7B,0CAA0C;QAC1C,+BAA+B;QAC/B,0CAA0C;QAC1C,qDAAqD;QACrD,sFAAsF;QACtF,oEAAoE;QACpE,mFAAmF;QACnF,EAAE;QACF,qFAAqF;QACrF,8EAA8E;QAC9E,wDAAwD;KACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,OAAO,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,EAAE,AAAD,EAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;AAClD,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAErF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACpC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACrB,sBAAsB,EAAE,MAAM,CAAC,aAAa;QAC5C,oBAAoB,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE;QACvD,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC3F,CAAC,CAAC,CAAC;IACJ,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,EAAE,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACrB,sBAAsB,EAAE,EAAE;YAC1B,oBAAoB,EAAE,QAAQ,CAAC,YAAY;YAC3C,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;QAAE,KAAK,EAAE,CAAC;IACnC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,2EAA2E,WAAW,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,QAAQ;QACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;QACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,yEAAyE;IACzE,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,QAAQ;QACR,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE;QAC7D,oBAAoB,EAAE,MAAM,CAAC,aAAa;QAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;KACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,KAAK,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,sEAAsE;IACtE,+BAA+B;IAC/B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAa,EAAE,EAAE,CACjC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG;QACb,MAAM;QACN,MAAM,EAAE;YACN,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,iBAAiB,GAAG,IAAI;YAChD,YAAY,EAAE,MAAM,CAAC,eAAe,GAAG,MAAM;SAC9C;QACD,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IAC1C,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC1D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACjE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,eAAe,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAA+B,OAAO,CAAC,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,KAAK,EAAE,CAAC;IACnB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC1H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,OAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC5D,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;QACrF,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjI,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,EAAE,CAAC;AACV,CAAC;AAED,KAAK,EAAE,CAAC"}

package/dist/auth/address.js

@@ -0,0 +1,89 @@
+import dns from 'node:dns/promises';
+import net from 'node:net';
+/**
+ * Which addresses the hub refuses to make an outbound request to, and the
+ * resolution step that decides it.
+ *
+ * Shared by the two places that fetch a URL somebody else chose: a client's
+ * metadata document (inbound registration) and an upstream's authorization
+ * server (outbound login). In both cases the URL, or a URL derived from a
+ * document at that URL, is not the operator's.
+ */
+/** RFC 1918/4193/3927/6598 and friends: anything a public host could not
+ *  legitimately be on, and that the hub can reach from inside. */
+export function isPrivateAddress(address) {
+    const version = net.isIP(address);
+    if (version === 4) {
+        const [a, b, c] = address.split('.').map(Number);
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local, incl. cloud metadata
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        if (a === 192 && b === 0 && (c === 0 || c === 2))
+            return true; // protocol assignments, TEST-NET-1
+        if (a === 198 && (b === 18 || b === 19))
+            return true; // benchmarking
+        if (a === 198 && b === 51 && c === 100)
+            return true; // TEST-NET-2
+        if (a === 203 && b === 0 && c === 113)
+            return true; // TEST-NET-3
+        return a >= 224; // multicast and reserved
+    }
+    if (version !== 6)
+        return true; // not an address we resolved — refuse
+    const normalized = address.toLowerCase().replace(/^\[|\]$/g, '');
+    if (normalized === '::1' || normalized === '::')
+        return true;
+    if (normalized.startsWith('fe80') || normalized.startsWith('fec0'))
+        return true;
+    if (/^f[cd]/.test(normalized))
+        return true; // unique local
+    // 6to4 and NAT64 carry an IPv4 address that the textual form hides, so the
+    // ranges above would never see it — `64:ff9b::a9fe:a9fe` reaches the cloud
+    // metadata endpoint. Both prefixes are refused whole: neither is a plausible
+    // place for a public host.
+    if (normalized.startsWith('2002:'))
+        return true; // 6to4 (RFC 3056)
+    if (normalized.startsWith('64:ff9b:'))
+        return true; // NAT64 (RFC 6052)
+    if (normalized.startsWith('::ffff:'))
+        return isPrivateAddress(normalized.slice(7));
+    return false;
+}
+/**
+ * Resolves a hostname and refuses every private or loopback answer, returning
+ * the address the connection must then be pinned to.
+ *
+ * Resolving here and letting `fetch` resolve again would leave the check and
+ * the connection looking at two different answers — see pinned-fetch.ts.
+ * Undefined means there is nothing to pin: a literal address cannot be
+ * re-resolved, and the development escape hatch skips the check entirely.
+ */
+export async function resolvePublicAddress(hostname, allowPrivate = false) {
+    if (allowPrivate)
+        return undefined;
+    const literal = hostname.replace(/^\[|\]$/g, '');
+    if (net.isIP(literal)) {
+        if (isPrivateAddress(literal))
+            throw new Error(`${hostname} is a private address`);
+        return undefined;
+    }
+    let addresses;
+    try {
+        addresses = await dns.lookup(hostname, { all: true });
+    }
+    catch (error) {
+        throw new Error(`cannot resolve ${hostname}: ${error.message}`);
+    }
+    if (addresses.some(entry => isPrivateAddress(entry.address))) {
+        throw new Error(`${hostname} resolves to a private address`);
+    }
+    return addresses[0]?.address;
+}
+//# sourceMappingURL=address.js.map

package/dist/auth/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../src/auth/address.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B;;;;;;;;GAQG;AAEH;kEACkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAC5E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,QAAQ;QAC3D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAClG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,aAAa;QAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,aAAa;QACjE,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,yBAAyB;IAC5C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAC3D,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,2BAA2B;IAC3B,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACnE,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;IACvE,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,YAAY,GAAG,KAAK;IAC/E,IAAI,YAAY;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,gBAAgB,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,uBAAuB,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC/B,CAAC"}