@noodleseed/one 0.96.2 → 0.97.0

package/dist/devtools-microsoft-auth.js

@@ -0,0 +1,362 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { canonicalScopes, } from '@noodle-borg/auth';
+import { decodeJwt } from 'jose';
+import { microsoftCallbackError, microsoftTokenError } from './devtools-microsoft-errors.js';
+export { MicrosoftDevtoolsAuthError } from './devtools-microsoft-errors.js';
+const MICROSOFT_CALLBACK_PATH = '/auth/callback/microsoft';
+const MICROSOFT_REQUIRED_SCOPES = ['openid', 'profile', 'email', 'offline_access'];
+const MAX_TOKEN_RESPONSE_BYTES = 256 * 1_024;
+const TOKEN_REQUEST_TIMEOUT_MS = 10_000;
+/**
+ * Confidential Microsoft authorization-code client for the loopback Devtools host. The Graph access
+ * token and client secret never cross into the browser; the ID token is retained as the local MCP bearer
+ * and is independently signature/issuer/audience verified by the loopback service before tool access.
+ */
+export class MicrosoftDevtoolsAuthDriver {
+    #auth;
+    #resource;
+    #redirectUri;
+    #issuer;
+    #authorizationEndpoint;
+    #tokenEndpoint;
+    #fetch;
+    #now;
+    #stateFactory;
+    #codeVerifierFactory;
+    #nonceFactory;
+    #pendingNonces = new Map();
+    constructor(options) {
+        this.#auth = validateAuth(options.auth);
+        this.#resource = validateResource(options.resource);
+        this.#redirectUri = validateMicrosoftRedirect(options.redirectUri);
+        this.#issuer = microsoftIssuer(this.#auth.tenantId);
+        this.#authorizationEndpoint = validateEndpoint(this.#auth.authorizeUrl ?? microsoftAuthorizeUrl(this.#auth.tenantId), 'Microsoft authorization endpoint', this.#auth.allowInsecureLocalhost === true);
+        this.#tokenEndpoint = validateEndpoint(this.#auth.tokenUrl ?? microsoftTokenUrl(this.#auth.tenantId), 'Microsoft token endpoint', this.#auth.allowInsecureLocalhost === true);
+        this.#fetch = options.fetchFn ?? fetch;
+        this.#now = options.now ?? Date.now;
+        this.#stateFactory = options.stateFactory ?? (() => randomBytes(32).toString('base64url'));
+        this.#codeVerifierFactory =
+            options.codeVerifierFactory ?? (() => randomBytes(32).toString('base64url'));
+        this.#nonceFactory = options.nonceFactory ?? (() => randomBytes(32).toString('base64url'));
+    }
+    async discover() {
+        return {
+            resource: this.#resource,
+            issuer: this.#issuer,
+            authorizationEndpoint: this.#authorizationEndpoint,
+            tokenEndpoint: this.#tokenEndpoint,
+            // Microsoft clients are pre-registered in Entra; this sentinel is never fetched.
+            registrationEndpoint: 'urn:noodleseed:devtools:microsoft:pre-registered',
+            scopes: microsoftScopes(this.#auth.scopes),
+            authorizationResponseIssuerRequired: false,
+        };
+    }
+    async register(discovery, _scopes = discovery.scopes) {
+        this.#assertDiscovery(discovery);
+        // The shared OAuth shape models public DCR. This driver owns confidential client authentication
+        // internally, so no registration or secret is returned through this value.
+        return { clientId: this.#auth.clientId, tokenEndpointAuthMethod: 'none' };
+    }
+    beginAuthorization(discovery, registration, scopes = discovery.scopes) {
+        this.#assertDiscovery(discovery);
+        this.#assertRegistration(registration);
+        const state = this.#stateFactory();
+        const codeVerifier = this.#codeVerifierFactory();
+        const nonce = this.#nonceFactory();
+        assertEntropyValue(state, 'state');
+        assertEntropyValue(codeVerifier, 'PKCE verifier');
+        assertEntropyValue(nonce, 'nonce');
+        const selectedScopes = microsoftScopes(scopes);
+        const authorizationUrl = new URL(this.#authorizationEndpoint);
+        authorizationUrl.searchParams.set('client_id', this.#auth.clientId);
+        authorizationUrl.searchParams.set('response_type', 'code');
+        authorizationUrl.searchParams.set('response_mode', 'query');
+        authorizationUrl.searchParams.set('redirect_uri', this.#redirectUri);
+        authorizationUrl.searchParams.set('scope', selectedScopes.join(' '));
+        authorizationUrl.searchParams.set('state', state);
+        authorizationUrl.searchParams.set('nonce', nonce);
+        authorizationUrl.searchParams.set('code_challenge_method', 'S256');
+        authorizationUrl.searchParams.set('code_challenge', createHash('sha256').update(codeVerifier).digest('base64url'));
+        this.#pendingNonces.clear();
+        this.#pendingNonces.set(state, nonce);
+        return {
+            authorizationUrl: authorizationUrl.href,
+            state,
+            codeVerifier,
+            scopes: selectedScopes,
+        };
+    }
+    async exchangeCallback(discovery, registration, pending, callbackUrl) {
+        this.#assertDiscovery(discovery);
+        this.#assertRegistration(registration);
+        assertCallback(callbackUrl, this.#redirectUri);
+        const callback = new URL(callbackUrl);
+        if (!constantTimeStringEqual(callback.searchParams.get('state') ?? '', pending.state)) {
+            throw new Error('Microsoft callback state is invalid');
+        }
+        const expectedNonce = this.#pendingNonces.get(pending.state);
+        this.#pendingNonces.delete(pending.state);
+        if (expectedNonce === undefined)
+            throw new Error('Microsoft authorization request expired');
+        if (callback.searchParams.has('error')) {
+            throw microsoftCallbackError(callback.searchParams.get('error'));
+        }
+        const code = callback.searchParams.get('code');
+        if (!code)
+            throw new Error('Microsoft callback did not include an authorization code');
+        return this.#requestTokens(new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            code_verifier: pending.codeVerifier,
+            redirect_uri: this.#redirectUri,
+            scope: pending.scopes.join(' '),
+        }), pending.scopes, expectedNonce);
+    }
+    async refresh(discoveryOrCurrent, registration, currentMaybe) {
+        const current = currentMaybe ?? discoveryOrCurrent;
+        if (currentMaybe !== undefined) {
+            this.#assertDiscovery(discoveryOrCurrent);
+            if (registration === undefined)
+                throw new Error('Microsoft client registration is missing');
+            this.#assertRegistration(registration);
+        }
+        if (!current.refreshToken)
+            throw new Error('Microsoft session does not have a refresh token');
+        const refreshed = await this.#requestTokens(new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: current.refreshToken,
+            scope: current.scope.join(' '),
+        }), current.scope);
+        return {
+            ...refreshed,
+            refreshToken: refreshed.refreshToken ?? current.refreshToken,
+        };
+    }
+    async #requestTokens(params, fallbackScopes, expectedNonce) {
+        const headers = {
+            accept: 'application/json',
+            'content-type': 'application/x-www-form-urlencoded',
+        };
+        if ((this.#auth.authMethod ?? 'client_secret_post') === 'client_secret_basic') {
+            headers.authorization = `Basic ${Buffer.from(`${this.#auth.clientId}:${this.#auth.clientSecret}`).toString('base64')}`;
+        }
+        else {
+            params.set('client_id', this.#auth.clientId);
+            params.set('client_secret', this.#auth.clientSecret);
+        }
+        let response;
+        try {
+            response = await this.#fetch(this.#tokenEndpoint, {
+                method: 'POST',
+                headers,
+                body: params.toString(),
+                redirect: 'error',
+                signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch {
+            throw new Error(`Microsoft token endpoint could not be reached: ${new URL(this.#tokenEndpoint).origin}`);
+        }
+        if (!response.ok) {
+            let json;
+            try {
+                json = await readBoundedJson(response);
+            }
+            catch (error) {
+                if (error instanceof Error && /too large/u.test(error.message))
+                    throw error;
+            }
+            throw microsoftTokenError(response.status, json);
+        }
+        const json = await readBoundedJson(response);
+        if (typeof json.access_token !== 'string' || json.access_token.length === 0) {
+            throw new Error('Microsoft returned an invalid token response');
+        }
+        if (typeof json.id_token !== 'string' || json.id_token.length === 0) {
+            throw new Error('Microsoft token response did not include an ID token');
+        }
+        if (typeof json.token_type !== 'string' || json.token_type.toLowerCase() !== 'bearer') {
+            throw new Error('Microsoft returned an unsupported token type');
+        }
+        const claims = validateIdTokenShape(json.id_token, this.#auth.clientId, this.#issuer, this.#now(), expectedNonce);
+        const responseScopes = typeof json.scope === 'string' ? json.scope.split(/\s+/u) : fallbackScopes;
+        const expiresIn = typeof json.expires_in === 'number' && Number.isFinite(json.expires_in)
+            ? Math.max(0, json.expires_in)
+            : undefined;
+        return {
+            // Deliberately discard the Graph/API access token. The local MCP front door accepts only the ID
+            // token, which it verifies against Microsoft's keys and this configured client ID.
+            accessToken: json.id_token,
+            ...(typeof json.refresh_token === 'string' && json.refresh_token.length > 0
+                ? { refreshToken: json.refresh_token }
+                : {}),
+            tokenType: 'Bearer',
+            ...(typeof claims.exp === 'number'
+                ? { expiresAt: claims.exp * 1_000 }
+                : expiresIn === undefined
+                    ? {}
+                    : { expiresAt: this.#now() + expiresIn * 1_000 }),
+            scope: canonicalScopes(responseScopes),
+        };
+    }
+    #assertDiscovery(discovery) {
+        if (discovery.resource !== this.#resource ||
+            discovery.issuer !== this.#issuer ||
+            discovery.authorizationEndpoint !== this.#authorizationEndpoint ||
+            discovery.tokenEndpoint !== this.#tokenEndpoint) {
+            throw new Error('Microsoft OAuth state belongs to a different configuration');
+        }
+    }
+    #assertRegistration(registration) {
+        if (registration.clientId !== this.#auth.clientId) {
+            throw new Error('Microsoft OAuth client does not match the configured app');
+        }
+    }
+}
+export function microsoftIssuer(tenantId) {
+    return `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/v2.0`;
+}
+function microsoftAuthorizeUrl(tenantId) {
+    return `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/authorize`;
+}
+function microsoftTokenUrl(tenantId) {
+    return `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`;
+}
+function microsoftScopes(scopes) {
+    return canonicalScopes([...MICROSOFT_REQUIRED_SCOPES, ...(scopes ?? [])]);
+}
+function validateAuth(auth) {
+    if (auth.tenantId.trim().length === 0)
+        throw new Error('Microsoft tenant ID is required');
+    if (auth.clientId.trim().length === 0)
+        throw new Error('Microsoft client ID is required');
+    if (auth.clientSecret.length === 0)
+        throw new Error('Microsoft client secret is required');
+    return auth;
+}
+function validateResource(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.hash) {
+        throw new Error('Microsoft MCP resource must not contain credentials or a fragment');
+    }
+    if (url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback(url.hostname))) {
+        return url.href;
+    }
+    throw new Error('Microsoft MCP resource must use HTTPS or an HTTP loopback URL');
+}
+function validateMicrosoftRedirect(value) {
+    const url = new URL(value);
+    if (url.protocol !== 'http:' ||
+        !isLoopback(url.hostname) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== MICROSOFT_CALLBACK_PATH) {
+        throw new Error(`Microsoft redirect must be an HTTP loopback URL at ${MICROSOFT_CALLBACK_PATH}`);
+    }
+    return url.href;
+}
+function validateEndpoint(value, label, allowInsecureLocalhost) {
+    const url = new URL(value);
+    if (url.username || url.password || url.hash) {
+        throw new Error(`${label} must not contain credentials or a fragment`);
+    }
+    if (url.protocol !== 'https:' &&
+        !(allowInsecureLocalhost && url.protocol === 'http:' && isLoopback(url.hostname))) {
+        throw new Error(`${label} must use HTTPS`);
+    }
+    return url.href;
+}
+function assertCallback(callbackValue, redirectValue) {
+    const callback = new URL(callbackValue);
+    const redirect = new URL(redirectValue);
+    const sameLoopbackAlias = isLoopback(callback.hostname) && isLoopback(redirect.hostname);
+    if (callback.protocol !== redirect.protocol ||
+        callback.port !== redirect.port ||
+        callback.pathname !== redirect.pathname ||
+        callback.username ||
+        callback.password ||
+        callback.hash ||
+        (!sameLoopbackAlias && callback.hostname !== redirect.hostname)) {
+        throw new Error('Microsoft callback URL does not match the registered redirect');
+    }
+}
+function validateIdTokenShape(idToken, clientId, issuer, nowMs, expectedNonce) {
+    let claims;
+    try {
+        claims = decodeJwt(idToken);
+    }
+    catch {
+        throw new Error('Microsoft returned an invalid ID token');
+    }
+    const audiences = typeof claims.aud === 'string' ? [claims.aud] : claims.aud;
+    if (!Array.isArray(audiences) || !audiences.includes(clientId)) {
+        throw new Error('Microsoft ID token audience is invalid');
+    }
+    if (claims.iss !== issuer) {
+        throw new Error('Microsoft ID token issuer is invalid');
+    }
+    if (typeof claims.exp !== 'number' || claims.exp <= Math.floor(nowMs / 1_000)) {
+        throw new Error('Microsoft ID token is expired');
+    }
+    if (expectedNonce !== undefined &&
+        !constantTimeStringEqual(typeof claims.nonce === 'string' ? claims.nonce : '', expectedNonce)) {
+        throw new Error('Microsoft ID token nonce is invalid');
+    }
+    return claims;
+}
+async function readBoundedJson(response) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > MAX_TOKEN_RESPONSE_BYTES) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error('Microsoft token response is too large');
+    }
+    if (response.body === null)
+        throw new Error('Microsoft token endpoint returned invalid JSON');
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > MAX_TOKEN_RESPONSE_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error('Microsoft token response is too large');
+            }
+            chunks.push(decoder.decode(chunk.value, { stream: true }));
+        }
+        chunks.push(decoder.decode());
+    }
+    finally {
+        reader.releaseLock();
+    }
+    try {
+        const value = JSON.parse(chunks.join(''));
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error('Microsoft token endpoint returned invalid JSON');
+    }
+}
+function assertEntropyValue(value, label) {
+    if (value.length < 16 || !/^[A-Za-z0-9._~-]+$/u.test(value)) {
+        throw new Error(`Microsoft ${label} is invalid`);
+    }
+}
+function constantTimeStringEqual(left, right) {
+    const leftBytes = Buffer.from(left);
+    const rightBytes = Buffer.from(right);
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function isLoopback(hostname) {
+    const normalized = hostname.replace(/^\[|\]$/gu, '').toLowerCase();
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+//# sourceMappingURL=devtools-microsoft-auth.js.map

package/dist/devtools-microsoft-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-microsoft-auth.js","sourceRoot":"","sources":["../src/devtools-microsoft-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAE5E,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAC5F,MAAM,wBAAwB,GAAG,GAAG,GAAG,KAAK,CAAC;AAC7C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAsBxC;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAC7B,KAAK,CAA8B;IACnC,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,OAAO,CAAS;IAChB,sBAAsB,CAAS;IAC/B,cAAc,CAAS;IACvB,MAAM,CAAe;IACrB,IAAI,CAAe;IACnB,aAAa,CAAe;IAC5B,oBAAoB,CAAe;IACnC,aAAa,CAAe;IAC5B,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,OASX;QACC,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,sBAAsB,GAAG,gBAAgB,CAC5C,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EACrE,kCAAkC,EAClC,IAAI,CAAC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAC3C,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,gBAAgB,CACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7D,0BAA0B,EAC1B,IAAI,CAAC,KAAK,CAAC,sBAAsB,KAAK,IAAI,CAC3C,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,oBAAoB;YACvB,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,qBAAqB,EAAE,IAAI,CAAC,sBAAsB;YAClD,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,iFAAiF;YACjF,oBAAoB,EAAE,kDAAkD;YACxE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1C,mCAAmC,EAAE,KAAK;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAA4B,EAC5B,UAA6B,SAAS,CAAC,MAAM;QAE7C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,gGAAgG;QAChG,2EAA2E;QAC3E,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IAED,kBAAkB,CAChB,SAA4B,EAC5B,YAAwC,EACxC,SAA4B,SAAS,CAAC,MAAM;QAE5C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,kBAAkB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAClD,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC9D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC3D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC5D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACnE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAC/B,gBAAgB,EAChB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO;YACL,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;YACvC,KAAK;YACL,YAAY;YACZ,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,SAA4B,EAC5B,YAAwC,EACxC,OAAqC,EACrC,WAAmB;QAEnB,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACvC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,cAAc,CACxB,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAChC,CAAC,EACF,OAAO,CAAC,MAAM,EACd,aAAa,CACd,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,kBAAsD,EACtD,YAAyC,EACzC,YAA6B;QAE7B,MAAM,OAAO,GAAG,YAAY,IAAK,kBAAqC,CAAC;QACvE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,kBAAuC,CAAC,CAAC;YAC/D,IAAI,YAAY,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC5F,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC9F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CACzC,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SAC/B,CAAC,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QACF,OAAO;YACL,GAAG,SAAS;YACZ,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;SAC7D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAuB,EACvB,cAAiC,EACjC,aAAsB;QAEtB,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACpD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,oBAAoB,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAC9E,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAC1C,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CACpD,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACvB,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,IAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,MAAM,KAAK,CAAC;YAC9E,CAAC;YACD,MAAM,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CACjC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,CAAC,QAAQ,EACnB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,IAAI,EAAE,EACX,aAAa,CACd,CAAC;QACF,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAC7E,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;YAC9B,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,gGAAgG;YAChG,mFAAmF;YACnF,WAAW,EAAE,IAAI,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBACzE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAChC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE;gBACnC,CAAC,CAAC,SAAS,KAAK,SAAS;oBACvB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC;YACrD,KAAK,EAAE,eAAe,CAAC,cAAc,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,SAA4B;QAC3C,IACE,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;YACrC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO;YACjC,SAAS,CAAC,qBAAqB,KAAK,IAAI,CAAC,sBAAsB;YAC/D,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,cAAc,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,mBAAmB,CAAC,YAAwC;QAC1D,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,qCAAqC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,qCAAqC,kBAAkB,CAAC,QAAQ,CAAC,wBAAwB,CAAC;AACnG,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,qCAAqC,kBAAkB,CAAC,QAAQ,CAAC,oBAAoB,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,MAAqC;IAC5D,OAAO,eAAe,CAAC,CAAC,GAAG,yBAAyB,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CAAC,IAAiC;IACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,QAAQ,KAAK,uBAAuB,EACxC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sDAAsD,uBAAuB,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa,EAAE,sBAA+B;IACrF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;IACzE,CAAC;IACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,CAAC,sBAAsB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EACjF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,aAAqB,EAAE,aAAqB;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzF,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACvC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC/B,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACvC,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,IAAI;QACb,CAAC,CAAC,iBAAiB,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAe,EACf,QAAgB,EAChB,MAAc,EACd,KAAa,EACb,aAAsB;IAEtB,IAAI,MAAoC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,uBAAuB,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,aAAa,CAAC,EAC7F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAkB;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QACrE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,KAAK,GAAG,wBAAwB,EAAE,CAAC;gBACrC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3F,OAAO,KAAmB,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAAa;IACtD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC"}

package/dist/devtools-microsoft-errors.d.ts

@@ -0,0 +1,7 @@
+import { DevtoolsAuthError } from './devtools-auth-types.js';
+export declare class MicrosoftDevtoolsAuthError extends DevtoolsAuthError {
+    constructor(code: string, message: string);
+}
+export declare function microsoftCallbackError(error: string | null): MicrosoftDevtoolsAuthError;
+export declare function microsoftTokenError(status: number, response: Readonly<Record<string, unknown>> | undefined): MicrosoftDevtoolsAuthError;
+//# sourceMappingURL=devtools-microsoft-errors.d.ts.map

package/dist/devtools-microsoft-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-microsoft-errors.d.ts","sourceRoot":"","sources":["../src/devtools-microsoft-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,qBAAa,0BAA2B,SAAQ,iBAAiB;gBACnD,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI1C;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,0BAA0B,CAWvF;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACtD,0BAA0B,CAQ5B"}

package/dist/devtools-microsoft-errors.js

@@ -0,0 +1,60 @@
+import { DevtoolsAuthError } from './devtools-auth-types.js';
+export class MicrosoftDevtoolsAuthError extends DevtoolsAuthError {
+    constructor(code, message) {
+        super(code, message);
+        this.name = 'MicrosoftDevtoolsAuthError';
+    }
+}
+export function microsoftCallbackError(error) {
+    if (error === 'access_denied') {
+        return new MicrosoftDevtoolsAuthError('access_denied', 'Microsoft sign-in was cancelled or denied. Start a fresh sign-in when you are ready.');
+    }
+    return new MicrosoftDevtoolsAuthError('microsoft_authorization_failed', 'Microsoft did not authorize this sign-in. Return to Devtools and start a fresh sign-in.');
+}
+export function microsoftTokenError(status, response) {
+    const code = microsoftProviderCode(response);
+    const remediation = code === undefined ? undefined : MICROSOFT_ERROR_REMEDIATION[code];
+    return new MicrosoftDevtoolsAuthError(code ?? 'microsoft_token_exchange_failed', remediation ??
+        `Microsoft rejected the token exchange (HTTP ${status}). Check the app registration and start a fresh sign-in.`);
+}
+function microsoftProviderCode(response) {
+    if (response === undefined)
+        return undefined;
+    const firstNumeric = Array.isArray(response.error_codes)
+        ? response.error_codes.find((value) => typeof value === 'number' &&
+            Number.isSafeInteger(value) &&
+            value >= 0 &&
+            value <= 9_999_999_999)
+        : undefined;
+    if (firstNumeric !== undefined)
+        return `AADSTS${firstNumeric}`;
+    const description = response.error_description;
+    if (typeof description === 'string') {
+        const match = /\bAADSTS(\d{3,10})\b/u.exec(description);
+        if (match?.[1] !== undefined)
+            return `AADSTS${match[1]}`;
+    }
+    const standardError = response.error;
+    return typeof standardError === 'string' && SAFE_OAUTH_ERROR_CODES.has(standardError)
+        ? standardError
+        : undefined;
+}
+const SAFE_OAUTH_ERROR_CODES = new Set([
+    'access_denied',
+    'invalid_client',
+    'invalid_grant',
+    'interaction_required',
+    'temporarily_unavailable',
+]);
+const MICROSOFT_ERROR_REMEDIATION = {
+    AADSTS50020: 'This account is not available in the configured tenant. Use an invited tenant account or update the tenant setting.',
+    AADSTS65001: 'Microsoft requires consent for this app or scope. Grant consent, then start a fresh sign-in.',
+    AADSTS700016: 'Microsoft could not find this app registration in the configured tenant. Check the tenant ID and client ID.',
+    AADSTS7000215: 'Microsoft rejected the client secret. Create a fresh secret value for this app registration.',
+    AADSTS7000222: 'The Microsoft client secret has expired. Create and configure a fresh secret value.',
+    invalid_client: 'Microsoft rejected the app credentials. Check the client ID and client secret value.',
+    invalid_grant: 'The Microsoft authorization grant is no longer valid. Start a fresh sign-in.',
+    interaction_required: 'Microsoft requires user interaction. Return to Devtools and sign in again.',
+    temporarily_unavailable: 'Microsoft sign-in is temporarily unavailable. Try again shortly.',
+};
+//# sourceMappingURL=devtools-microsoft-errors.js.map

package/dist/devtools-microsoft-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-microsoft-errors.js","sourceRoot":"","sources":["../src/devtools-microsoft-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,OAAO,0BAA2B,SAAQ,iBAAiB;IAC/D,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,IAAI,0BAA0B,CACnC,eAAe,EACf,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,0BAA0B,CACnC,gCAAgC,EAChC,yFAAyF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAuD;IAEvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,IAAI,0BAA0B,CACnC,IAAI,IAAI,iCAAiC,EACzC,WAAW;QACT,+CAA+C,MAAM,0DAA0D,CAClH,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAuD;IAEvD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtD,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CACvB,CAAC,KAAK,EAAmB,EAAE,CACzB,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAC3B,KAAK,IAAI,CAAC;YACV,KAAK,IAAI,aAAa,CACzB;QACH,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,YAAY,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IAC/C,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;IACrC,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC;QACnF,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAqC;IACpE,WAAW,EACT,qHAAqH;IACvH,WAAW,EACT,8FAA8F;IAChG,YAAY,EACV,6GAA6G;IAC/G,aAAa,EACX,8FAA8F;IAChG,aAAa,EACX,qFAAqF;IACvF,cAAc,EACZ,sFAAsF;IACxF,aAAa,EAAE,8EAA8E;IAC7F,oBAAoB,EAClB,4EAA4E;IAC9E,uBAAuB,EAAE,kEAAkE;CAC5F,CAAC"}

package/dist/devtools-preview.d.ts

@@ -1,5 +1,8 @@
+import type { LocalDevtoolsDelegatedCredentialSink } from '@noodle-borg/service';
+import { type DevtoolsCustomerAuth } from './devtools-auth-session.js';
 import { type DesignRouteContext } from './devtools-design-routes.js';
 import { calculateRangeProgress, harnessHtml, openAiShimScript, type PreviewDevice, type PreviewTheme, wrapWidgetHtml } from './devtools-harness.js';
+import { type RpcLogEntry } from './devtools-rpc-forwarder.js';
 /**
  * `noodle devtools` preview server. It boots alongside a `dev` MCP endpoint and:
  *   - serves the three-pane harness shell (HTML/CSS/JS in `devtools-harness.ts`),
@@ -9,7 +12,7 @@ import { calculateRangeProgress, harnessHtml, openAiShimScript, type PreviewDevi
  * The MCP server already inlines the ext-apps bridge; the shim lets a widget's `callServerTool` become a
  * `fetch('/rpc')` the harness proxies and records, without reimplementing the ext-apps host protocol.
  */
-export type { PreviewDevice, PreviewTheme };
+export type { PreviewDevice, PreviewTheme, RpcLogEntry };
 export { calculateRangeProgress, harnessHtml, openAiShimScript, wrapWidgetHtml };
 export interface PreviewOptions {
     readonly mcpUrl: string;
@@ -25,24 +28,23 @@ export interface PreviewOptions {
     readonly geminiModel?: string;
     /** Trusted local project context for Design Session persistence. Never sourced from browser input. */
     readonly design?: DesignRouteContext;
-}
-export interface RpcLogEntry {
-    readonly time: number;
-    readonly method: string;
-    readonly name?: string;
-    readonly status: 'ok' | 'error';
-    readonly durationMs: number;
-    readonly summary: string;
-    /** Request params (input) captured for the inspector; size-capped. */
-    readonly request?: unknown;
-    /** Response result or error (output) captured for the inspector; size-capped. */
-    readonly response?: unknown;
+    /**
+     * Isolate untrusted widgets from the credential-owning host. Enabled automatically for authenticated
+     * previews; exposed here so the boundary can be tested independently.
+     */
+    readonly secureWidgets?: boolean;
+    /** Sanitized customer-auth projection from the compiled local app. */
+    readonly customerAuth?: DevtoolsCustomerAuth;
+    /** In-process-only credential bridge supplied by `noodle dev`; never reachable from browser routes. */
+    readonly delegatedCredentialSink?: LocalDevtoolsDelegatedCredentialSink;
 }
 export interface PreviewHandle {
     readonly url: string;
     readonly log: readonly RpcLogEntry[];
     /** Tell connected browsers to reload (refresh the tool list + re-fetch the open widget). */
     signalReload(): void;
+    /** Rebind auth after a successful source reload; changing auth hard-reloads connected browsers. */
+    updateCustomerAuth(auth: DevtoolsCustomerAuth | undefined): void;
     close(): Promise<void>;
 }
 export declare function startPreview(options: PreviewOptions): Promise<PreviewHandle>;

package/dist/devtools-preview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devtools-preview.d.ts","sourceRoot":"","sources":["../src/devtools-preview.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,6BAA6B,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,cAAc,EACf,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AAEH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAOD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAC;IACrC,4FAA4F;IAC5F,YAAY,IAAI,IAAI,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA8HD,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAkelF"}
+{"version":3,"file":"devtools-preview.d.ts","sourceRoot":"","sources":["../src/devtools-preview.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,sBAAsB,CAAC;AAEjF,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAQ5F,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,6BAA6B,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,cAAc,EACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAA8B,KAAK,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAG3F;;;;;;;;GAQG;AAEH,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IAC7C,uGAAuG;IACvG,QAAQ,CAAC,uBAAuB,CAAC,EAAE,oCAAoC,CAAC;CACzE;AAOD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,SAAS,WAAW,EAAE,CAAC;IACrC,4FAA4F;IAC5F,YAAY,IAAI,IAAI,CAAC;IACrB,mGAAmG;IACnG,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAyDD,wBAAsB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA+elF"}