@noodleseed/one 0.86.1 → 0.87.0

package/node_modules/@noodle-borg/transport-http/dist/handler.js

@@ -1,10 +1,12 @@
 import { parseLegacyTenantMcpPath, parsePublicTenantMcpUrl } from '@noodle-borg/module';
 import { handleStatelessHttp, JSON_RPC, } from '@noodle-borg/protocol';
 import { admissionContexts, requestsInvocationContext } from './admission-context.js';
-import { applySecurityHeaders, effectiveProto, enforceHttps, } from './front-door.js';
+import { applySecurityHeaders, enforceHttps } from './front-door.js';
+import { authorizeIdentityMode, authorizeMixedMode, isIdentityMode, } from './identity-authorization.js';
 import { noopLogger } from './logging.js';
 import { canonicalPublicResourceUrl, edgeTokenMatches } from './public-routing.js';
 import { emitRequestEvent, header } from './request-capture.js';
+import { preflightToolAuthorization, sendToolAuthorizationDenial } from './tool-authorization.js';
 import { withHostedToolDispatch } from './tool-dispatch.js';
 const DEFAULT_ENDPOINT = '/mcp';
 const DEFAULT_MAX_BODY = 1 << 20;
@@ -217,6 +219,7 @@ async function serveRequest(req, res, target, auth, routeId, maxBody, allowed, t
         if (authResult.caller !== undefined) {
             protocolContext = { caller: authResult.caller };
             subject = authResult.caller.subject;
+            res.setHeader('Cache-Control', 'private, no-store');
         }
         else if (authResult.subject !== undefined) {
             subject = authResult.subject;
@@ -229,6 +232,7 @@ async function serveRequest(req, res, target, auth, routeId, maxBody, allowed, t
         if (authResult.caller !== undefined) {
             protocolContext = { caller: authResult.caller };
             subject = authResult.caller.subject;
+            res.setHeader('Cache-Control', 'private, no-store');
         }
     }
     // Content negotiation (Accept / Content-Type) is owned by the SDK transport ([ADR 0021]); it returns
@@ -275,6 +279,20 @@ async function serveRequest(req, res, target, auth, routeId, maxBody, allowed, t
             return sendJson(res, decision.status ?? 403, admissionRpcError(context, decision));
         }
     }
+    const authorization = preflightToolAuthorization(parsed, target, protocolContext.caller);
+    for (const observation of authorization.observations) {
+        auth.logger.info('mcp.tool_authorization', {
+            toolName: observation.toolName,
+            decision: observation.decision,
+            reason: observation.reason,
+            ruleClass: observation.ruleClass,
+            ruleFingerprint: observation.ruleFingerprint,
+        });
+    }
+    if (authorization.denial !== undefined) {
+        sendToolAuthorizationDenial(req, res, auth, authorization.denial);
+        return;
+    }
     if (auth.resolveInvocationContext !== undefined && requestsInvocationContext(parsed)) {
         const invocationContext = await auth.resolveInvocationContext({
             target,
@@ -301,13 +319,6 @@ async function serveRequest(req, res, target, auth, routeId, maxBody, allowed, t
     await handleStatelessHttp(target, req, res, parsed, protocolContext);
     emitRequestEvent({ req, res, target, auth, tenant, parsed, subject, observed, startedAt });
 }
-function bearerToken(req) {
-    const auth = header(req, 'authorization');
-    if (!auth)
-        return null;
-    const match = /^Bearer\s+(.+)$/i.exec(auth);
-    return match?.[1] ?? null;
-}
 function originAllowed(origin, allowed) {
     if (allowed === undefined)
         return true;
@@ -329,118 +340,6 @@ function sendJson(res, status, body) {
     res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
     res.end(JSON.stringify(body));
 }
-/**
- * A `401` with a bearer challenge and a transport-level JSON-RPC error body. For owner-only endpoints,
- * `resourceMetadataUrl` is included so an MCP client can discover the authorization server (RFC 9728 /
- * the MCP authorization spec).
- */
-function sendUnauthorized(res, resourceMetadataUrl) {
-    const challenge = resourceMetadataUrl !== undefined
-        ? `Bearer realm="noodle", resource_metadata="${resourceMetadataUrl}"`
-        : 'Bearer realm="noodle"';
-    res.writeHead(401, {
-        'content-type': 'application/json; charset=utf-8',
-        'www-authenticate': challenge,
-    });
-    res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'unauthorized')));
-}
-/** A `403` with a transport-level JSON-RPC error body (authenticated, but not authorized). */
-function sendForbidden(res) {
-    sendJson(res, 403, rpcError(JSON_RPC.INVALID_REQUEST, 'forbidden'));
-}
-async function authorizeIdentityMode(req, res, auth) {
-    const challenge = protectedResourceMetadataUrl(req, auth);
-    const token = bearerToken(req);
-    if (token === null || auth.verifyOwnerToken === undefined) {
-        sendUnauthorized(res, challenge);
-        return { allow: false };
-    }
-    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth));
-    if (identity === null) {
-        sendUnauthorized(res, challenge);
-        return { allow: false };
-    }
-    if (auth.accessMode === 'authenticated') {
-        return { allow: true, caller: identity };
-    }
-    if (auth.accessMode === 'customers') {
-        if (identity.identityKind !== 'customer') {
-            sendUnauthorized(res, challenge);
-            return { allow: false };
-        }
-        return { allow: true, caller: identity };
-    }
-    if (auth.accessMode === 'owner-only') {
-        if (auth.ownerSubject === undefined) {
-            sendUnauthorized(res, challenge);
-            return { allow: false };
-        }
-        if (identity.subject !== auth.ownerSubject) {
-            sendForbidden(res);
-            return { allow: false };
-        }
-        return { allow: true, caller: identity };
-    }
-    if (auth.accessMode === 'org-members') {
-        const membership = auth.org === undefined || auth.authorizeDataPlaneIdentity === undefined
-            ? undefined
-            : await auth.authorizeDataPlaneIdentity({
-                accessMode: auth.accessMode,
-                org: auth.org,
-                subject: identity.subject,
-                ...(identity.email !== undefined ? { email: identity.email } : {}),
-                ...(auth.orgMembershipSources !== undefined
-                    ? { membershipSources: auth.orgMembershipSources }
-                    : {}),
-            });
-        if (membership?.allowed !== true) {
-            sendForbidden(res);
-            return { allow: false };
-        }
-    }
-    return { allow: true, caller: identity };
-}
-async function authorizeMixedMode(req, res, auth) {
-    const token = bearerToken(req);
-    if (token === null)
-        return { allow: true };
-    const challenge = protectedResourceMetadataUrl(req, auth);
-    if (auth.verifyOwnerToken === undefined) {
-        sendUnauthorized(res, challenge);
-        return { allow: false };
-    }
-    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth));
-    if (identity === null) {
-        sendUnauthorized(res, challenge);
-        return { allow: false };
-    }
-    return { allow: true, caller: identity };
-}
-function isIdentityMode(mode) {
-    return (mode === 'owner-only' ||
-        mode === 'org-members' ||
-        mode === 'authenticated' ||
-        mode === 'customers');
-}
-/** The public origin + path for this request, honouring the trusted forwarded-proto when configured. */
-function requestUrl(req, trustProxy) {
-    const proto = effectiveProto(req, trustProxy);
-    const host = header(req, 'host') ?? 'localhost';
-    const pathname = new URL(req.url ?? '/', `${proto}://${host}`).pathname;
-    return { origin: `${proto}://${host}`, pathname };
-}
-/** The canonical resource identifier (the tenant MCP URL) a token must be audience-bound to (RFC 8707). */
-function resourceUrl(req, auth) {
-    if (auth.publicResourceUrl !== undefined)
-        return auth.publicResourceUrl;
-    const { origin, pathname } = requestUrl(req, auth.trustProxy);
-    return `${origin}${pathname}`;
-}
-/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
-function protectedResourceMetadataUrl(req, auth) {
-    const resource = new URL(resourceUrl(req, auth));
-    return `${resource.origin}/.well-known/oauth-protected-resource${resource.pathname}`;
-}
 /** A transport-level JSON-RPC error response with no id (per the Streamable HTTP spec). */
 function rpcError(code, message) {
     return { jsonrpc: '2.0', id: null, error: { code, message } };

package/node_modules/@noodle-borg/transport-http/dist/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,QAAQ,GAIT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAe,UAAU,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAA+B,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA0EzF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsB,EACtB,UAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YACpE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CACR,GAAG,EACH,YAAY,CACV,GAAG,EACH,GAAG,EACH,MAAM,EACN;YACE,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,SAAS;YACtB,oBAAoB,EAAE,SAAS;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,MAAM;YACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;SACpC,EACD,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,cAAc,CACvB,CACF,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AA0CD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAoBvC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,UAII,EAAE;IAEN,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YAClF,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,gGAAgG;QAChG,iGAAiG;QACjG,uGAAuG;QACvG,KAAK,KAAK,CACR,GAAG,EACH,CAAC,KAAK,IAAI,EAAE;YACV,MAAM,MAAM,GACV,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY;gBAC9C,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;gBACvC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAClC,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM,KAAK,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,MAAM,cAAc,GAAG,MAAM,IAAI,KAAK,EAAE,MAAM,CAAC;YAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GACX,KAAK,EAAE,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,KAAK,CAAC,YAAY;oBACpB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,YAAY,CAChB,GAAG,EACH,GAAG,EACH,cAAc,CAAC,MAAM,EACrB;gBACE,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,GAAG,EAAE,cAAc,CAAC,GAAG;gBACvB,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;gBACzD,gBAAgB,EACd,cAAc,CAAC,UAAU,KAAK,WAAW;oBACvC,CAAC,CAAC,cAAc,CAAC,WAAW;oBAC5B,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;gBAC9D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;gBAC9D,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;gBAC1D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,GAAG,EAAE,cAAc,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG;gBACtC,WAAW,EAAE,cAAc,CAAC,WAAW,IAAI,MAAM,EAAE,GAAG;gBACtD,MAAM;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;gBACnC,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;oBACnE,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;aACR,EACD,OAAO,EACP,OAAO,EACP,OAAO,CAAC,cAAc,EACtB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,QAAgB,EAChB,mBAAoD;IAEpD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IACE,mBAAmB,KAAK,SAAS;YACjC,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,EACpF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,GAAG;gBACH,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;gBACvB,iBAAiB,EAAE,0BAA0B,CAAC,aAAa,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACtC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7G,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,MAAc,EACd,OAAe,EACf,GAAoB,EACpB,GAAmB,EACnB,KAAa;IAEb,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;QACzB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;QAC/B,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAmB,EAAE,EAAiB;IACnD,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC;AAwBD;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,MAAsB,EACtB,IAAe,EACf,OAAe,EACf,OAAe,EACf,OAAiC,EACjC,MAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,0GAA0G;IAC1G,yGAAyG;IACzG,gCAAgC;IAChC,IAAI,eAAe,GAA2B,EAAE,CAAC;IACjD,IAAI,OAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;aAAM,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE1F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACzC,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACnC,CAAC,CAAE,EAAE,KAAK,EAAE,IAAI,EAAY,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC7C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,wBAAwB,KAAK,SAAS,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC;YAC5D,MAAM;YACN,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;QACH,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,eAAe,GAAG,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAErE,sGAAsG;IACtG,wGAAwG;IACxG,wGAAwG;IACxG,iGAAiG;IACjG,IAAI,QAAyC,CAAC;IAC9C,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC3C,eAAe,GAAG;YAChB,GAAG,eAAe;YAClB,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE;gBACvB,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACrE,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAiC;IACtE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAoB,EACpB,GAAW;IAEX,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,mBAA4B;IACzE,MAAM,SAAS,GACb,mBAAmB,KAAK,SAAS;QAC/B,CAAC,CAAC,6CAA6C,mBAAmB,GAAG;QACrE,CAAC,CAAC,uBAAuB,CAAC;IAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAmB;IACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AACtE,CAAC;AAgBD,KAAK,UAAU,qBAAqB,CAClC,GAAoB,EACpB,GAAmB,EACnB,IAAe;IAEf,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACzC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,UAAU,GACd,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,0BAA0B,KAAK,SAAS;YACrE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC;gBACpC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACT,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,GAAoB,EACpB,GAAmB,EACnB,IAAe;IAEf,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,IAA4B;IAClD,OAAO,CACL,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,aAAa;QACtB,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,WAAW,CACrB,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,UAAU,CACjB,GAAoB,EACpB,UAAmB;IAEnB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,2GAA2G;AAC3G,SAAS,WAAW,CAAC,GAAoB,EAAE,IAAe;IACxD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;IACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,yGAAyG;AACzG,SAAS,4BAA4B,CAAC,GAAoB,EAAE,IAAe;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,QAAQ,CAAC,MAAM,wCAAwC,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAyB,EACzB,QAAsE;IAMtE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,OAAO,GACX,IAAI,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK;YACf,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,yBAAyB,CAAC;IAClC,MAAM,IAAI,GAAoC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACvE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IACtF,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IAClG,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,mBAAmB,EACnB,QAAQ,GAIT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAmB,MAAM,iBAAiB,CAAC;AACtF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAElB,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAe,UAAU,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAA+B,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA0EzF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsB,EACtB,UAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YACpE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CACR,GAAG,EACH,YAAY,CACV,GAAG,EACH,GAAG,EACH,MAAM,EACN;YACE,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,SAAS;YACd,WAAW,EAAE,SAAS;YACtB,oBAAoB,EAAE,SAAS;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,MAAM;YACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;SACpC,EACD,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,cAAc,CACvB,CACF,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AA0CD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAoBvC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,UAII,EAAE;IAEN,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YAClF,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,gGAAgG;QAChG,iGAAiG;QACjG,uGAAuG;QACvG,KAAK,KAAK,CACR,GAAG,EACH,CAAC,KAAK,IAAI,EAAE;YACV,MAAM,MAAM,GACV,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY;gBAC9C,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;gBACvC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAClC,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM,KAAK,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,MAAM,cAAc,GAAG,MAAM,IAAI,KAAK,EAAE,MAAM,CAAC;YAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GACX,KAAK,EAAE,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,KAAK,CAAC,YAAY;oBACpB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,YAAY,CAChB,GAAG,EACH,GAAG,EACH,cAAc,CAAC,MAAM,EACrB;gBACE,UAAU,EAAE,cAAc,CAAC,UAAU;gBACrC,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,GAAG,EAAE,cAAc,CAAC,GAAG;gBACvB,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;gBACzD,gBAAgB,EACd,cAAc,CAAC,UAAU,KAAK,WAAW;oBACvC,CAAC,CAAC,cAAc,CAAC,WAAW;oBAC5B,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,IAAI,OAAO,CAAC,gBAAgB,CAAC;gBAC9D,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;gBAC9D,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;gBAC1D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,GAAG,EAAE,cAAc,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG;gBACtC,WAAW,EAAE,cAAc,CAAC,WAAW,IAAI,MAAM,EAAE,GAAG;gBACtD,MAAM;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;gBACnC,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS;oBACnE,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;aACR,EACD,OAAO,EACP,OAAO,EACP,OAAO,CAAC,cAAc,EACtB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAoB,EACpB,QAAgB,EAChB,mBAAoD;IAEpD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IACE,mBAAmB,KAAK,SAAS;YACjC,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,EACpF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,GAAG;gBACH,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;gBACvB,iBAAiB,EAAE,0BAA0B,CAAC,aAAa,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACtC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7G,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,MAAc,EACd,OAAe,EACf,GAAoB,EACpB,GAAmB,EACnB,KAAa;IAEb,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;QACzB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;QAC/B,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAmB,EAAE,EAAiB;IACnD,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC;AAcD;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,MAAsB,EACtB,IAAe,EACf,OAAe,EACf,OAAe,EACf,OAAiC,EACjC,MAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,0GAA0G;IAC1G,yGAAyG;IACzG,gCAAgC;IAChC,IAAI,eAAe,GAA2B,EAAE,CAAC;IACjD,IAAI,OAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE1F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACzC,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACnC,CAAC,CAAE,EAAE,KAAK,EAAE,IAAI,EAAY,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC7C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IACzF,KAAK,MAAM,WAAW,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACzC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,eAAe,EAAE,WAAW,CAAC,eAAe;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,wBAAwB,KAAK,SAAS,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC;YAC5D,MAAM;YACN,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;QACH,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,eAAe,GAAG,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAErE,sGAAsG;IACtG,wGAAwG;IACxG,wGAAwG;IACxG,iGAAiG;IACjG,IAAI,QAAyC,CAAC;IAC9C,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC3C,eAAe,GAAG;YAChB,GAAG,eAAe;YAClB,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE;gBACvB,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACrE,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAiC;IACtE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAoB,EACpB,GAAW;IAEX,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAyB,EACzB,QAAsE;IAMtE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,OAAO,GACX,IAAI,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK;YACf,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,yBAAyB,CAAC;IAClC,MAAM,IAAI,GAAoC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACvE,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IACtF,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IAClG,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.d.ts

@@ -0,0 +1,33 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AccessMode, DataPlaneIdentityAuthorizer, OrgMembershipSource, OwnerTokenVerifier } from '@noodle-borg/module';
+import { type ProtocolRequestContext } from '@noodle-borg/protocol';
+export interface IdentityAuthorizationOptions {
+    readonly accessMode: AccessMode | undefined;
+    readonly ownerSubject: string | undefined;
+    readonly org: string | undefined;
+    readonly orgMembershipSources: readonly OrgMembershipSource[] | undefined;
+    readonly verifyOwnerToken: OwnerTokenVerifier | undefined;
+    readonly authorizeDataPlaneIdentity: DataPlaneIdentityAuthorizer | undefined;
+    /** Whether to trust forwarded-proto when reconstructing the public resource/PRM URLs. */
+    readonly trustProxy: boolean;
+    /** Public resource URL supplied by a trusted edge for org-subdomain MCP routes. */
+    readonly publicResourceUrl?: string;
+}
+export type IdentityAuthResult = {
+    readonly allow: true;
+    readonly caller?: NonNullable<ProtocolRequestContext['caller']>;
+    readonly subject?: string;
+} | {
+    readonly allow: false;
+};
+/**
+ * Identity gate (OA-1/OA-3): require a verified token and authorize it against the deployment access mode.
+ * `allow: true` means the request may proceed, with caller and subject fields when available. `allow: false`
+ * means this function already wrote the denial response. Missing tokens and absent verifiers fail closed.
+ */
+export declare function authorizeIdentityMode(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+export declare function authorizeMixedMode(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+export declare function isIdentityMode(mode: AccessMode | undefined): boolean;
+/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
+export declare function protectedResourceMetadataUrl(req: IncomingMessage, auth: IdentityAuthorizationOptions): string;
+//# sourceMappingURL=identity-authorization.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-authorization.d.ts","sourceRoot":"","sources":["../src/identity-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EACV,UAAU,EACV,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAY,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAI9E,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,0BAA0B,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC7E,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GACD;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAE9B;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAoD7B;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAc7B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAOpE;AAkDD,yGAAyG;AACzG,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAGR"}

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js

@@ -0,0 +1,133 @@
+import { JSON_RPC } from '@noodle-borg/protocol';
+import { effectiveProto } from './front-door.js';
+import { header } from './request-capture.js';
+/**
+ * Identity gate (OA-1/OA-3): require a verified token and authorize it against the deployment access mode.
+ * `allow: true` means the request may proceed, with caller and subject fields when available. `allow: false`
+ * means this function already wrote the denial response. Missing tokens and absent verifiers fail closed.
+ */
+export async function authorizeIdentityMode(req, res, auth) {
+    const challenge = protectedResourceMetadataUrl(req, auth);
+    const token = bearerToken(req);
+    if (token === null || auth.verifyOwnerToken === undefined) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth));
+    if (identity === null) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    if (auth.accessMode === 'authenticated') {
+        return { allow: true, caller: identity };
+    }
+    if (auth.accessMode === 'customers') {
+        if (identity.identityKind !== 'customer') {
+            sendUnauthorized(res, challenge);
+            return { allow: false };
+        }
+        return { allow: true, caller: identity };
+    }
+    if (auth.accessMode === 'owner-only') {
+        if (auth.ownerSubject === undefined) {
+            sendUnauthorized(res, challenge);
+            return { allow: false };
+        }
+        if (identity.subject !== auth.ownerSubject) {
+            sendForbidden(res);
+            return { allow: false };
+        }
+        return { allow: true, caller: identity };
+    }
+    if (auth.accessMode === 'org-members') {
+        const membership = auth.org === undefined || auth.authorizeDataPlaneIdentity === undefined
+            ? undefined
+            : await auth.authorizeDataPlaneIdentity({
+                accessMode: auth.accessMode,
+                org: auth.org,
+                subject: identity.subject,
+                ...(identity.email !== undefined ? { email: identity.email } : {}),
+                ...(auth.orgMembershipSources !== undefined
+                    ? { membershipSources: auth.orgMembershipSources }
+                    : {}),
+            });
+        if (membership?.allowed !== true) {
+            sendForbidden(res);
+            return { allow: false };
+        }
+    }
+    return { allow: true, caller: identity };
+}
+export async function authorizeMixedMode(req, res, auth) {
+    const token = bearerToken(req);
+    if (token === null)
+        return { allow: true };
+    const challenge = protectedResourceMetadataUrl(req, auth);
+    if (auth.verifyOwnerToken === undefined) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth));
+    if (identity === null) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    return { allow: true, caller: identity };
+}
+export function isIdentityMode(mode) {
+    return (mode === 'owner-only' ||
+        mode === 'org-members' ||
+        mode === 'authenticated' ||
+        mode === 'customers');
+}
+function bearerToken(req) {
+    const auth = header(req, 'authorization');
+    if (!auth)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(auth);
+    return match?.[1] ?? null;
+}
+/**
+ * A `401` with a bearer challenge and a transport-level JSON-RPC error body. For owner-only endpoints,
+ * `resourceMetadataUrl` is included so an MCP client can discover the authorization server (RFC 9728 /
+ * the MCP authorization spec).
+ */
+function sendUnauthorized(res, resourceMetadataUrl) {
+    const challenge = resourceMetadataUrl !== undefined
+        ? `Bearer realm="noodle", resource_metadata="${resourceMetadataUrl}"`
+        : 'Bearer realm="noodle"';
+    res.writeHead(401, {
+        'content-type': 'application/json; charset=utf-8',
+        'www-authenticate': challenge,
+    });
+    res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'unauthorized')));
+}
+/** A `403` with a transport-level JSON-RPC error body (authenticated, but not authorized). */
+function sendForbidden(res) {
+    res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'forbidden')));
+}
+/** The public origin + path for this request, honouring the trusted forwarded-proto when configured. */
+function requestUrl(req, trustProxy) {
+    const proto = effectiveProto(req, trustProxy);
+    const host = header(req, 'host') ?? 'localhost';
+    const pathname = new URL(req.url ?? '/', `${proto}://${host}`).pathname;
+    return { origin: `${proto}://${host}`, pathname };
+}
+/** The canonical resource identifier (the tenant MCP URL) a token must be audience-bound to (RFC 8707). */
+function resourceUrl(req, auth) {
+    if (auth.publicResourceUrl !== undefined)
+        return auth.publicResourceUrl;
+    const { origin, pathname } = requestUrl(req, auth.trustProxy);
+    return `${origin}${pathname}`;
+}
+/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
+export function protectedResourceMetadataUrl(req, auth) {
+    const resource = new URL(resourceUrl(req, auth));
+    return `${resource.origin}/.well-known/oauth-protected-resource${resource.pathname}`;
+}
+/** A transport-level JSON-RPC error response with no id (per the Streamable HTTP spec). */
+function rpcError(code, message) {
+    return { jsonrpc: '2.0', id: null, error: { code, message } };
+}
+//# sourceMappingURL=identity-authorization.js.map

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-authorization.js","sourceRoot":"","sources":["../src/identity-authorization.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAA+B,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAuB9C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAoB,EACpB,GAAmB,EACnB,IAAkC;IAElC,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACzC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,UAAU,GACd,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,0BAA0B,KAAK,SAAS;YACrE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC;gBACpC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACT,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAoB,EACpB,GAAmB,EACnB,IAAkC;IAElC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAA4B;IACzD,OAAO,CACL,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,aAAa;QACtB,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,WAAW,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,mBAA4B;IACzE,MAAM,SAAS,GACb,mBAAmB,KAAK,SAAS;QAC/B,CAAC,CAAC,6CAA6C,mBAAmB,GAAG;QACrE,CAAC,CAAC,uBAAuB,CAAC;IAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAmB;IACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,wGAAwG;AACxG,SAAS,UAAU,CACjB,GAAoB,EACpB,UAAmB;IAEnB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,2GAA2G;AAC3G,SAAS,WAAW,CAAC,GAAoB,EAAE,IAAkC;IAC3E,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;IACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,4BAA4B,CAC1C,GAAoB,EACpB,IAAkC;IAElC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,QAAQ,CAAC,MAAM,wCAAwC,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAChE,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.d.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type ProtocolRequestContext, type ServedArtifact, type ToolAuthorizationDecision, type ToolAuthorizationRuleClass } from '@noodle-borg/protocol';
+import { type IdentityAuthorizationOptions } from './identity-authorization.js';
+export interface ToolAuthorizationObservation {
+    readonly toolName: string;
+    readonly decision: 'allow' | 'deny';
+    readonly reason: 'allowed' | Exclude<ToolAuthorizationDecision, {
+        allow: true;
+    }>['reason'];
+    readonly ruleClass: ToolAuthorizationRuleClass;
+    readonly ruleFingerprint: string;
+}
+interface ToolAuthorizationDenial {
+    readonly requestId: string | number | null;
+    readonly decision: Exclude<ToolAuthorizationDecision, {
+        allow: true;
+    }>;
+}
+export declare function preflightToolAuthorization(parsed: unknown, target: ServedArtifact, caller: ProtocolRequestContext['caller']): {
+    readonly observations: readonly ToolAuthorizationObservation[];
+    readonly denial?: ToolAuthorizationDenial;
+};
+export declare function sendToolAuthorizationDenial(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions, denial: ToolAuthorizationDenial): void;
+export {};
+//# sourceMappingURL=tool-authorization.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-authorization.d.ts","sourceRoot":"","sources":["../src/tool-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EAEnB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAGhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,yBAAyB,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3F,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,yBAAyB,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACvC;IACD,QAAQ,CAAC,YAAY,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAC3C,CA8BA;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,4BAA4B,EAClC,MAAM,EAAE,uBAAuB,GAC9B,IAAI,CAkBN"}

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.js

@@ -0,0 +1,64 @@
+import { evaluateToolAuthorization, TOOL_AUTHORIZATION_DENIED, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from '@noodle-borg/protocol';
+import { protectedResourceMetadataUrl, } from './identity-authorization.js';
+import { rpcMethod, rpcTargetName, safeRpcId } from './request-capture.js';
+export function preflightToolAuthorization(parsed, target, caller) {
+    const items = Array.isArray(parsed) ? parsed : [parsed];
+    const observations = [];
+    let denial;
+    for (const item of items) {
+        const method = rpcMethod(item);
+        if (method !== 'tools/call')
+            continue;
+        const toolName = rpcTargetName(item, method);
+        if (toolName === undefined)
+            continue;
+        const tool = target.artifact.tools.find((candidate) => candidate.name === toolName);
+        if (tool === undefined)
+            continue;
+        const decision = evaluateToolAuthorization(tool.authorization, caller);
+        observations.push({
+            toolName,
+            decision: decision.allow ? 'allow' : 'deny',
+            reason: decision.allow ? 'allowed' : decision.reason,
+            ruleClass: toolAuthorizationRuleClass(tool.authorization),
+            ruleFingerprint: toolAuthorizationRuleFingerprint(tool.authorization),
+        });
+        if (!decision.allow && denial === undefined) {
+            denial = {
+                requestId: safeRpcId(item).requestId ?? null,
+                decision,
+            };
+        }
+    }
+    return {
+        observations,
+        ...(denial === undefined ? {} : { denial }),
+    };
+}
+export function sendToolAuthorizationDenial(req, res, auth, denial) {
+    const metadata = protectedResourceMetadataUrl(req, auth);
+    if (denial.decision.reason === 'authentication_required') {
+        res.setHeader('WWW-Authenticate', `Bearer realm="noodle", resource_metadata="${metadata}"`);
+        sendError(res, 401, denial.requestId, 'unauthorized', denial.decision.reason);
+        return;
+    }
+    if (denial.decision.reason === 'insufficient_scope') {
+        res.setHeader('WWW-Authenticate', `Bearer error="insufficient_scope", scope="${denial.decision.requiredScopes.join(' ')}", resource_metadata="${metadata}"`);
+        sendError(res, 403, denial.requestId, 'insufficient scope', denial.decision.reason);
+        return;
+    }
+    sendError(res, 403, denial.requestId, 'forbidden', denial.decision.reason);
+}
+function sendError(res, status, requestId, message, reason) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        id: requestId,
+        error: {
+            code: TOOL_AUTHORIZATION_DENIED,
+            message,
+            data: { reason },
+        },
+    }));
+}
+//# sourceMappingURL=tool-authorization.js.map

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-authorization.js","sourceRoot":"","sources":["../src/tool-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EAGzB,yBAAyB,EAGzB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAe3E,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,MAAsB,EACtB,MAAwC;IAKxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,IAAI,MAA2C,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,YAAY;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvE,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YACpD,SAAS,EAAE,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC;YACzD,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,aAAa,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG;gBACP,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC5C,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,GAAmB,EACnB,IAAkC,EAClC,MAA+B;IAE/B,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;QAC5F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,CACX,kBAAkB,EAClB,6CAA6C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAC9E,GAAG,CACJ,yBAAyB,QAAQ,GAAG,CACtC,CAAC;QACF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAChB,GAAmB,EACnB,MAAiB,EACjB,SAAiC,EACjC,OAAe,EACf,MAAqE;IAErE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,SAAS;QACb,KAAK,EAAE;YACL,IAAI,EAAE,yBAAyB;YAC/B,OAAO;YACP,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.86.1",
+  "version": "0.87.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",