@noodleseed/one 0.96.3 → 0.97.0

package/dist/devtools-auth-session.js

@@ -0,0 +1,433 @@
+import { canonicalScopes, McpOAuthClient, parseBearerChallenge, } from '@noodle-borg/auth';
+import { constantTimeStringEqual, safeFailure } from './devtools-auth-session-helpers.js';
+import { DevtoolsAuthRequiredError, } from './devtools-auth-types.js';
+import { storeDevtoolsDelegatedCredential } from './devtools-delegated-credential.js';
+import { FirebaseDevtoolsAuthDriver, } from './devtools-firebase-auth.js';
+import { MicrosoftDevtoolsAuthDriver, microsoftIssuer } from './devtools-microsoft-auth.js';
+export { DevtoolsAuthRequiredError, } from './devtools-auth-types.js';
+export class DevtoolsAuthSession {
+    #resource;
+    #auth;
+    #delegatedCredentialSink;
+    #driverFactory;
+    #firebaseDriver;
+    #driver;
+    #selectedIssuer;
+    #discovery;
+    #registration;
+    #pending;
+    #firebasePending;
+    #tokens;
+    #requestedScopes = [];
+    #state;
+    #message;
+    #errorCode;
+    #generation = 0;
+    #refreshing;
+    constructor(options) {
+        this.#resource = options.resource;
+        this.#auth = options.auth;
+        this.#delegatedCredentialSink = options.delegatedCredentialSink;
+        this.#state = options.auth.kind === 'unsupported' ? 'unsupported' : 'signed_out';
+        if (options.auth.kind === 'firebase') {
+            this.#firebaseDriver =
+                options.firebaseDriver ??
+                    new FirebaseDevtoolsAuthDriver({
+                        auth: options.auth,
+                        resource: options.resource,
+                        redirectUri: options.redirectUri,
+                        ...(options.fetchFn !== undefined ? { fetchFn: options.fetchFn } : {}),
+                    });
+        }
+        else if (options.auth.kind === 'microsoft') {
+            const microsoftAuth = options.auth;
+            const issuer = microsoftIssuer(microsoftAuth.tenantId);
+            this.#selectedIssuer = issuer;
+            this.#driverFactory =
+                options.driverFactory ??
+                    (() => options.driver ??
+                        new MicrosoftDevtoolsAuthDriver({
+                            auth: microsoftAuth,
+                            resource: options.resource,
+                            redirectUri: options.redirectUri,
+                            ...(options.fetchFn !== undefined ? { fetchFn: options.fetchFn } : {}),
+                        }));
+            this.#driver = this.#driverFactory(issuer);
+        }
+        else if (options.auth.kind !== 'unsupported') {
+            const allowInsecureLocalhost = options.auth.allowInsecureLocalhost === true;
+            this.#driverFactory =
+                options.driverFactory ??
+                    (options.driver !== undefined
+                        ? () => options.driver
+                        : (issuer) => new McpOAuthClient({
+                            resource: options.resource,
+                            issuer,
+                            redirectUri: options.redirectUri,
+                            ...(options.fetchFn !== undefined ? { fetchFn: options.fetchFn } : {}),
+                            ...(allowInsecureLocalhost ? { allowInsecureLocalhost: true } : {}),
+                        }));
+            if (options.auth.kind === 'oidc') {
+                this.#selectedIssuer = options.auth.issuer;
+                this.#driver = this.#driverFactory(options.auth.issuer);
+            }
+        }
+    }
+    status() {
+        if (this.#auth.kind === 'unsupported') {
+            return {
+                required: true,
+                supported: false,
+                state: 'unsupported',
+                method: this.#auth.method,
+                scopes: [],
+                message: `${this.#auth.method} sign-in is not supported in Devtools yet`,
+            };
+        }
+        const issuers = this.#configuredIssuers();
+        const firebaseIssuer = this.#auth.kind === 'firebase'
+            ? (this.#auth.authDomain ?? `${this.#auth.projectId}.firebaseapp.com`)
+            : undefined;
+        return {
+            required: true,
+            supported: true,
+            state: this.#state,
+            ...(this.#selectedIssuer !== undefined
+                ? { issuer: this.#selectedIssuer }
+                : firebaseIssuer === undefined
+                    ? {}
+                    : { issuer: firebaseIssuer }),
+            ...(this.#auth.kind === 'federatedOidc' ? { issuers } : {}),
+            ...(this.#auth.kind === 'firebase' ? { method: 'firebase' } : {}),
+            ...(this.#auth.kind === 'microsoft' ? { method: 'microsoft' } : {}),
+            scopes: [...this.#visibleScopes()],
+            ...(this.#tokens?.expiresAt !== undefined ? { expiresAt: this.#tokens.expiresAt } : {}),
+            ...(this.#errorCode !== undefined ? { errorCode: this.#errorCode } : {}),
+            ...(this.#message !== undefined ? { message: this.#message } : {}),
+        };
+    }
+    async start(issuer) {
+        if (this.#auth.kind === 'firebase')
+            return this.#startFirebase();
+        const selectedIssuer = this.#resolveIssuer(issuer);
+        const switchingIssuer = selectedIssuer !== this.#selectedIssuer;
+        const generation = ++this.#generation;
+        this.#refreshing = undefined;
+        this.#pending = undefined;
+        this.#tokens = undefined;
+        this.#clearDelegatedCredential();
+        this.#state = 'authorizing';
+        this.#message = undefined;
+        this.#errorCode = undefined;
+        try {
+            if (switchingIssuer) {
+                this.#selectedIssuer = selectedIssuer;
+                this.#driver = undefined;
+                this.#discovery = undefined;
+                this.#registration = undefined;
+            }
+            const driver = this.#requiredDriver();
+            const discovery = this.#discovery ?? (await driver.discover());
+            this.#assertGeneration(generation);
+            this.#discovery = discovery;
+            if (this.#requestedScopes.length === 0) {
+                this.#requestedScopes = discovery.scopes;
+            }
+            const registration = this.#registration ?? (await driver.register(discovery, this.#requestedScopes));
+            this.#assertGeneration(generation);
+            this.#registration = registration;
+            const pending = driver.beginAuthorization(discovery, registration, this.#requestedScopes);
+            this.#assertGeneration(generation);
+            this.#pending = pending;
+            this.#state = 'authorizing';
+            this.#message = undefined;
+            return pending.authorizationUrl;
+        }
+        catch (error) {
+            if (this.#generation === generation) {
+                this.#state = 'error';
+                const failure = safeFailure(error, 'Could not start sign-in');
+                this.#message = failure.message;
+                this.#errorCode = failure.errorCode;
+            }
+            throw error;
+        }
+    }
+    async complete(callbackUrl) {
+        if (this.#auth.kind === 'firebase') {
+            throw new DevtoolsAuthRequiredError('Firebase sign-in requires a form POST');
+        }
+        const driver = this.#requiredDriver();
+        if (!this.#discovery || !this.#registration || !this.#pending) {
+            throw new DevtoolsAuthRequiredError('No OAuth sign-in is pending');
+        }
+        const generation = this.#generation;
+        const discovery = this.#discovery;
+        const registration = this.#registration;
+        const pending = this.#pending;
+        const callbackState = new URL(callbackUrl).searchParams.get('state') ?? '';
+        if (!constantTimeStringEqual(callbackState, pending.state)) {
+            throw new DevtoolsAuthRequiredError('OAuth callback does not match the active sign-in');
+        }
+        this.#pending = undefined;
+        try {
+            const tokens = await driver.exchangeCallback(discovery, registration, pending, callbackUrl);
+            this.#assertGeneration(generation);
+            await this.#storeDelegatedCredential(tokens);
+            this.#assertGeneration(generation);
+            this.#tokens = tokens;
+            this.#requestedScopes = canonicalScopes([...this.#requestedScopes, ...tokens.scope]);
+            this.#state = 'signed_in';
+            this.#message = undefined;
+            this.#errorCode = undefined;
+        }
+        catch (error) {
+            if (this.#generation === generation) {
+                this.#state = 'error';
+                const failure = safeFailure(error, 'Sign-in failed');
+                this.#message = failure.message;
+                this.#errorCode = failure.errorCode;
+            }
+            throw error;
+        }
+    }
+    callbackTransport() {
+        return this.#auth.kind === 'firebase' ? 'form_post' : 'query';
+    }
+    firebaseAuthorizationPage(url) {
+        if (this.#auth.kind !== 'firebase' || !this.#firebasePending)
+            return undefined;
+        return this.#requiredFirebaseDriver().renderAuthorizationPage(url, this.#firebasePending);
+    }
+    async completeFirebase(callback) {
+        if (this.#auth.kind !== 'firebase' || !this.#firebasePending) {
+            throw new DevtoolsAuthRequiredError('No Firebase sign-in is pending');
+        }
+        const pending = this.#firebasePending;
+        if (!constantTimeStringEqual(callback.state, pending.state)) {
+            throw new DevtoolsAuthRequiredError('Firebase callback does not match the active sign-in');
+        }
+        const generation = this.#generation;
+        this.#firebasePending = undefined;
+        try {
+            const tokens = await this.#requiredFirebaseDriver().completeAuthorization(pending, callback);
+            this.#assertGeneration(generation);
+            await this.#storeDelegatedCredential(tokens);
+            this.#assertGeneration(generation);
+            this.#tokens = tokens;
+            this.#state = 'signed_in';
+            this.#message = undefined;
+            this.#errorCode = undefined;
+        }
+        catch (error) {
+            if (this.#generation === generation) {
+                this.#state = 'error';
+                const failure = safeFailure(error, 'Firebase sign-in failed');
+                this.#message = failure.message;
+                this.#errorCode = failure.errorCode;
+            }
+            throw error;
+        }
+    }
+    async accessToken(options = {}) {
+        if (this.#state === 'reauthorization_required')
+            throw new DevtoolsAuthRequiredError();
+        if (!this.#tokens)
+            throw new DevtoolsAuthRequiredError();
+        const expiring = this.#tokens.expiresAt !== undefined && this.#tokens.expiresAt <= Date.now() + 30_000;
+        if (options.forceRefresh === true || expiring) {
+            if (!this.#tokens.refreshToken) {
+                this.#tokens = undefined;
+                this.#state = 'signed_out';
+                this.#clearDelegatedCredential();
+                throw new DevtoolsAuthRequiredError('Your sign-in expired; sign in again');
+            }
+            const generation = this.#generation;
+            const current = this.#tokens;
+            let refreshing = this.#refreshing;
+            if (!refreshing || refreshing.generation !== generation) {
+                const refreshPromise = this.#auth.kind === 'firebase'
+                    ? this.#requiredFirebaseDriver().refresh(current)
+                    : this.#discovery !== undefined && this.#registration !== undefined
+                        ? this.#requiredDriver().refresh(this.#discovery, this.#registration, current)
+                        : undefined;
+                if (refreshPromise === undefined) {
+                    this.#tokens = undefined;
+                    this.#state = 'signed_out';
+                    this.#clearDelegatedCredential();
+                    throw new DevtoolsAuthRequiredError('Your sign-in expired; sign in again');
+                }
+                refreshing = {
+                    generation,
+                    promise: refreshPromise,
+                };
+                this.#refreshing = refreshing;
+            }
+            try {
+                const tokens = await refreshing.promise;
+                this.#assertGeneration(generation);
+                await this.#storeDelegatedCredential(tokens);
+                this.#assertGeneration(generation);
+                this.#tokens = tokens;
+            }
+            catch {
+                if (this.#generation === generation) {
+                    this.#tokens = undefined;
+                    this.#state = 'signed_out';
+                    this.#clearDelegatedCredential();
+                }
+                throw new DevtoolsAuthRequiredError('Your sign-in expired; sign in again');
+            }
+            finally {
+                if (this.#refreshing === refreshing) {
+                    this.#refreshing = undefined;
+                }
+            }
+        }
+        this.#state = 'signed_in';
+        return this.#tokens.accessToken;
+    }
+    noteBearerChallenge(status, header) {
+        const challenge = parseBearerChallenge(header);
+        if (status !== 403 ||
+            challenge?.error !== 'insufficient_scope' ||
+            challenge.scopes.length === 0) {
+            return;
+        }
+        this.#generation += 1;
+        this.#refreshing = undefined;
+        this.#requestedScopes = canonicalScopes(this.#auth.kind === 'microsoft'
+            ? [
+                ...this.#requestedScopes,
+                ...(this.#discovery?.scopes ?? []),
+                ...(this.#tokens?.scope ?? []),
+            ]
+            : [
+                ...this.#requestedScopes,
+                ...(this.#discovery?.scopes ?? []),
+                ...(this.#tokens?.scope ?? []),
+                ...challenge.scopes,
+            ]);
+        this.#tokens = undefined;
+        this.#clearDelegatedCredential();
+        this.#pending = undefined;
+        this.#state = 'reauthorization_required';
+        this.#message =
+            this.#auth.kind === 'firebase'
+                ? 'This Firebase user is missing required app permissions; update its custom claims, then sign in again'
+                : this.#auth.kind === 'microsoft'
+                    ? 'This Microsoft user is missing required app permissions; update its Entra app roles or claims, then sign in again'
+                    : 'Additional permission is required; sign in again to continue';
+        this.#errorCode = undefined;
+    }
+    clear() {
+        this.#generation += 1;
+        this.#refreshing = undefined;
+        this.#discovery = undefined;
+        this.#registration = undefined;
+        this.#pending = undefined;
+        this.#firebasePending = undefined;
+        this.#tokens = undefined;
+        this.#clearDelegatedCredential();
+        this.#driver = undefined;
+        this.#requestedScopes = [];
+        this.#message = undefined;
+        this.#errorCode = undefined;
+        this.#state = this.#auth.kind === 'unsupported' ? 'unsupported' : 'signed_out';
+    }
+    async #storeDelegatedCredential(tokens) {
+        await storeDevtoolsDelegatedCredential({
+            auth: this.#auth,
+            resource: this.#resource,
+            tokens,
+            sink: this.#delegatedCredentialSink,
+        });
+    }
+    #clearDelegatedCredential() {
+        this.#delegatedCredentialSink?.clearResource(this.#resource);
+    }
+    #visibleScopes() {
+        return canonicalScopes([
+            ...this.#requestedScopes,
+            ...(this.#tokens?.scope ?? []),
+            ...(this.#pending?.scopes ?? []),
+        ]);
+    }
+    #requiredDriver() {
+        if (!this.#driver && this.#selectedIssuer && this.#driverFactory) {
+            this.#driver = this.#driverFactory(this.#selectedIssuer);
+        }
+        if (!this.#driver) {
+            throw new Error(`${this.#auth.kind === 'unsupported' ? this.#auth.method : 'configured'} authentication is not supported in Devtools yet`);
+        }
+        return this.#driver;
+    }
+    #requiredFirebaseDriver() {
+        if (!this.#firebaseDriver) {
+            throw new Error('Firebase authentication is not supported in Devtools yet');
+        }
+        return this.#firebaseDriver;
+    }
+    async #startFirebase() {
+        const generation = ++this.#generation;
+        this.#refreshing = undefined;
+        this.#pending = undefined;
+        this.#firebasePending = undefined;
+        this.#tokens = undefined;
+        this.#clearDelegatedCredential();
+        this.#state = 'authorizing';
+        this.#message = undefined;
+        this.#errorCode = undefined;
+        try {
+            const pending = this.#requiredFirebaseDriver().beginAuthorization();
+            this.#assertGeneration(generation);
+            this.#firebasePending = pending;
+            return pending.authorizationUrl;
+        }
+        catch (error) {
+            if (this.#generation === generation) {
+                this.#state = 'error';
+                const failure = safeFailure(error, 'Could not start Firebase sign-in');
+                this.#message = failure.message;
+                this.#errorCode = failure.errorCode;
+            }
+            throw error;
+        }
+    }
+    #configuredIssuers() {
+        if (this.#auth.kind === 'oidc')
+            return [this.#auth.issuer];
+        if (this.#auth.kind === 'federatedOidc')
+            return [...this.#auth.issuers];
+        if (this.#auth.kind === 'microsoft')
+            return [microsoftIssuer(this.#auth.tenantId)];
+        return [];
+    }
+    #resolveIssuer(requestedIssuer) {
+        if (this.#auth.kind === 'unsupported') {
+            throw new Error(`${this.#auth.method} sign-in is not supported in Devtools yet`);
+        }
+        const issuers = this.#configuredIssuers();
+        if (requestedIssuer !== undefined) {
+            if (!issuers.includes(requestedIssuer)) {
+                throw new DevtoolsAuthRequiredError('Selected identity provider is not configured');
+            }
+            return requestedIssuer;
+        }
+        if (this.#selectedIssuer !== undefined && issuers.includes(this.#selectedIssuer)) {
+            return this.#selectedIssuer;
+        }
+        if (issuers.length === 1 && issuers[0] !== undefined)
+            return issuers[0];
+        if (issuers.length > 1) {
+            throw new DevtoolsAuthRequiredError('Choose an identity provider to sign in');
+        }
+        throw new DevtoolsAuthRequiredError('No identity provider is configured');
+    }
+    #assertGeneration(generation) {
+        if (this.#generation !== generation) {
+            throw new DevtoolsAuthRequiredError('Sign-in was cancelled');
+        }
+    }
+}
+//# sourceMappingURL=devtools-auth-session.js.map

package/dist/devtools-auth-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-auth-session.js","sourceRoot":"","sources":["../src/devtools-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,cAAc,EAKd,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EACL,yBAAyB,GAK1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAKL,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE5F,OAAO,EACL,yBAAyB,GAK1B,MAAM,0BAA0B,CAAC;AAIlC,MAAM,OAAO,mBAAmB;IACrB,SAAS,CAAS;IAClB,KAAK,CAAuB;IAC5B,wBAAwB,CAAmD;IAC3E,cAAc,CAA2C;IACzD,eAAe,CAA0B;IAClD,OAAO,CAAkC;IACzC,eAAe,CAAqB;IACpC,UAAU,CAAgC;IAC1C,aAAa,CAAyC;IACtD,QAAQ,CAA2C;IACnD,gBAAgB,CAAmD;IACnE,OAAO,CAA6B;IACpC,gBAAgB,GAAsB,EAAE,CAAC;IACzC,MAAM,CAAoB;IAC1B,QAAQ,CAAqB;IAC7B,UAAU,CAAqB;IAC/B,WAAW,GAAG,CAAC,CAAC;IAChB,WAAW,CAKG;IAEd,YAAY,OAaX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;QACjF,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe;gBAClB,OAAO,CAAC,cAAc;oBACtB,IAAI,0BAA0B,CAAC;wBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACvE,CAAC,CAAC;QACP,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;YACnC,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAC9B,IAAI,CAAC,cAAc;gBACjB,OAAO,CAAC,aAAa;oBACrB,CAAC,GAAG,EAAE,CACJ,OAAO,CAAC,MAAM;wBACd,IAAI,2BAA2B,CAAC;4BAC9B,IAAI,EAAE,aAAa;4BACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACvE,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC;YAC5E,IAAI,CAAC,cAAc;gBACjB,OAAO,CAAC,aAAa;oBACrB,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;wBAC3B,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAA6B;wBAC7C,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,cAAc,CAAC;4BACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,MAAM;4BACN,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACtE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACpE,CAAC,CAAC,CAAC;YACZ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACjC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBACzB,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,2CAA2C;aACzE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1C,MAAM,cAAc,GAClB,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;YAC5B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,kBAAkB,CAAC;YACtE,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE;gBAClC,CAAC,CAAC,cAAc,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAe;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,cAAc,KAAK,IAAI,CAAC,eAAe,CAAC;QAChE,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;gBACtC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YACjC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC;YAC3C,CAAC;YACD,MAAM,YAAY,GAChB,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC1F,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YACxB,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,OAAO,OAAO,CAAC,gBAAgB,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;gBAC9D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;gBAChC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CAAC,6BAA6B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,yBAAyB,CAAC,kDAAkD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC5F,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;gBAChC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC;IAED,yBAAyB,CAAC,GAAQ;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QAC/E,OAAO,IAAI,CAAC,uBAAuB,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAkC;QACvD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACtC,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,yBAAyB,CAAC,qDAAqD,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7F,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;gBAC9D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;gBAChC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAA+C,EAAE;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,0BAA0B;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACzD,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACxF,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;gBAC3B,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,IAAI,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;YAClC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACxD,MAAM,cAAc,GAClB,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;oBAC5B,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;oBACjD,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;wBACjE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;wBAC9E,CAAC,CAAC,SAAS,CAAC;gBAClB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACzB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;oBAC3B,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBACjC,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;gBAC7E,CAAC;gBACD,UAAU,GAAG;oBACX,UAAU;oBACV,OAAO,EAAE,cAAc;iBACxB,CAAC;gBACF,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;YAChC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBACxC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACnC,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;oBACpC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACzB,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;oBAC3B,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACnC,CAAC;gBACD,MAAM,IAAI,yBAAyB,CAAC,qCAAqC,CAAC,CAAC;YAC7E,CAAC;oBAAS,CAAC;gBACT,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;oBACpC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;IAClC,CAAC;IAED,mBAAmB,CAAC,MAAc,EAAE,MAAqB;QACvD,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/C,IACE,MAAM,KAAK,GAAG;YACd,SAAS,EAAE,KAAK,KAAK,oBAAoB;YACzC,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,eAAe,CACrC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;YAC7B,CAAC,CAAC;gBACE,GAAG,IAAI,CAAC,gBAAgB;gBACxB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;aAC/B;YACH,CAAC,CAAC;gBACE,GAAG,IAAI,CAAC,gBAAgB;gBACxB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC9B,GAAG,SAAS,CAAC,MAAM;aACpB,CACN,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,0BAA0B,CAAC;QACzC,IAAI,CAAC,QAAQ;YACX,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;gBAC5B,CAAC,CAAC,sGAAsG;gBACxG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;oBAC/B,CAAC,CAAC,mHAAmH;oBACrH,CAAC,CAAC,8DAA8D,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,MAAsB;QACpD,MAAM,gCAAgC,CAAC;YACrC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,wBAAwB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;QACvB,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,eAAe,CAAC;YACrB,GAAG,IAAI,CAAC,gBAAgB;YACxB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACjE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,kDAAkD,CAC1H,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,uBAAuB;QACrB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC,kBAAkB,EAAE,CAAC;YACpE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;YAChC,OAAO,OAAO,CAAC,gBAAgB,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;gBAChC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;YACtC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,kBAAkB;QAChB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,eAAmC;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,2CAA2C,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,yBAAyB,CAAC,8CAA8C,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,eAAe,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,yBAAyB,CAAC,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IAED,iBAAiB,CAAC,UAAkB;QAClC,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF"}

package/dist/devtools-auth-types.d.ts

@@ -0,0 +1,51 @@
+import type { McpOAuthClientRegistration, McpOAuthDiscovery, McpOAuthPendingAuthorization, McpOAuthTokens } from '@noodle-borg/auth';
+import type { DevtoolsFirebaseAuthConfig } from './devtools-firebase-auth.js';
+import type { DevtoolsMicrosoftAuthConfig } from './devtools-microsoft-auth.js';
+export type DevtoolsCustomerAuth = {
+    readonly kind: 'oidc';
+    readonly issuer: string;
+    /** Opaque local-only revision used to clear credentials when audience/claim routing changes. */
+    readonly configurationKey?: string;
+    /** Test/self-host seam. Production authorization servers must use HTTPS. */
+    readonly allowInsecureLocalhost?: boolean;
+} | {
+    readonly kind: 'federatedOidc';
+    readonly issuers: readonly string[];
+    /** Opaque local-only revision used to clear credentials when audience/claim routing changes. */
+    readonly configurationKey?: string;
+    /** Test/self-host seam. Production authorization servers must use HTTPS. */
+    readonly allowInsecureLocalhost?: boolean;
+} | DevtoolsFirebaseAuthConfig | DevtoolsMicrosoftAuthConfig | {
+    readonly kind: 'unsupported';
+    readonly method: string;
+};
+export interface DevtoolsOAuthDriver {
+    discover(): Promise<McpOAuthDiscovery>;
+    register(discovery: McpOAuthDiscovery, scopes?: readonly string[]): Promise<McpOAuthClientRegistration>;
+    beginAuthorization(discovery: McpOAuthDiscovery, registration: McpOAuthClientRegistration, scopes?: readonly string[]): McpOAuthPendingAuthorization;
+    exchangeCallback(discovery: McpOAuthDiscovery, registration: McpOAuthClientRegistration, pending: McpOAuthPendingAuthorization, callbackUrl: string): Promise<McpOAuthTokens>;
+    refresh(discovery: McpOAuthDiscovery, registration: McpOAuthClientRegistration, current: McpOAuthTokens): Promise<McpOAuthTokens>;
+}
+export type DevtoolsAuthState = 'signed_out' | 'authorizing' | 'signed_in' | 'reauthorization_required' | 'unsupported' | 'error';
+export interface DevtoolsAuthStatus {
+    readonly required: true;
+    readonly supported: boolean;
+    readonly state: DevtoolsAuthState;
+    readonly issuer?: string;
+    readonly issuers?: readonly string[];
+    readonly method?: string;
+    readonly scopes: readonly string[];
+    readonly expiresAt?: number;
+    /** Allowlisted provider/standards code only; never a raw provider response or request identifier. */
+    readonly errorCode?: string;
+    readonly message?: string;
+}
+/** A browser-safe auth failure whose code and message are intentionally curated by the Node host. */
+export declare class DevtoolsAuthError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare class DevtoolsAuthRequiredError extends Error {
+    constructor(message?: string);
+}
+//# sourceMappingURL=devtools-auth-types.d.ts.map

package/dist/devtools-auth-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-auth-types.d.ts","sourceRoot":"","sources":["../src/devtools-auth-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhF,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C,GACD,0BAA0B,GAC1B,2BAA2B,GAC3B;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,MAAM,WAAW,mBAAmB;IAClC,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvC,QAAQ,CACN,SAAS,EAAE,iBAAiB,EAC5B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvC,kBAAkB,CAChB,SAAS,EAAE,iBAAiB,EAC5B,YAAY,EAAE,0BAA0B,EACxC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GACzB,4BAA4B,CAAC;IAChC,gBAAgB,CACd,SAAS,EAAE,iBAAiB,EAC5B,YAAY,EAAE,0BAA0B,EACxC,OAAO,EAAE,4BAA4B,EACrC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,OAAO,CACL,SAAS,EAAE,iBAAiB,EAC5B,YAAY,EAAE,0BAA0B,EACxC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B;AAED,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,aAAa,GACb,WAAW,GACX,0BAA0B,GAC1B,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qGAAqG;AACrG,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,SAAiC;CAIrD"}

package/dist/devtools-auth-types.js

@@ -0,0 +1,16 @@
+/** A browser-safe auth failure whose code and message are intentionally curated by the Node host. */
+export class DevtoolsAuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'DevtoolsAuthError';
+    }
+}
+export class DevtoolsAuthRequiredError extends Error {
+    constructor(message = 'Sign in to test this MCP app') {
+        super(message);
+        this.name = 'DevtoolsAuthRequiredError';
+    }
+}
+//# sourceMappingURL=devtools-auth-types.js.map

package/dist/devtools-auth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-auth-types.js","sourceRoot":"","sources":["../src/devtools-auth-types.ts"],"names":[],"mappings":"AA+EA,qGAAqG;AACrG,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B;IADX,YACW,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,GAAG,8BAA8B;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF"}

package/dist/devtools-auth-ui.d.ts

@@ -0,0 +1,6 @@
+/** Authenticated-preview UI. All OAuth credentials remain in the loopback process. */
+export declare const DEVTOOLS_AUTH_STYLES = "\n.auth-gate{\n  position:absolute;\n  inset:64px 0 0;\n  z-index:20;\n  display:none;\n  align-items:center;\n  justify-content:center;\n  padding:28px;\n  background:rgba(8,8,10,.88);\n  backdrop-filter:blur(18px);\n}\n.auth-locked .auth-gate{display:flex}\n.auth-card{\n  display:flex;\n  width:min(440px,100%);\n  flex-direction:column;\n  align-items:center;\n  gap:12px;\n  padding:30px;\n  border:1px solid var(--nd-border);\n  border-radius:24px;\n  background:var(--nd-panel-solid);\n  text-align:center;\n  box-shadow:0 24px 80px rgba(0,0,0,.45);\n}\n.auth-card h3{margin:0;font-size:22px;font-weight:610;letter-spacing:-.03em}\n.auth-card p{margin:0;color:var(--nd-muted);font-size:12.5px;line-height:1.6}\n.auth-issuer{font-family:var(--nd-mono);color:#d4d4d8!important;word-break:break-all}\n.auth-issuer[hidden]{display:none}\n.auth-provider{\n  display:grid;\n  width:min(320px,100%);\n  gap:6px;\n  text-align:left;\n}\n.auth-provider[hidden]{display:none}\n.auth-provider label{color:var(--nd-muted);font-size:10.5px}\n.auth-provider select{\n  width:100%;\n  padding:9px 30px 9px 10px;\n  border:1px solid var(--nd-border);\n  border-radius:9px;\n  background:var(--nd-panel);\n  color:var(--nd-text);\n  font:11px var(--nd-mono);\n}\n.auth-provider select:disabled{cursor:wait;opacity:.7}\n.auth-detail{min-height:16px;color:var(--nd-faint)!important;font-size:10.5px!important}\n.auth-detail.err{color:var(--nd-error)!important}\n.auth-card .btn{\n  min-width:164px;\n  display:inline-flex;\n  align-items:center;\n  justify-content:center;\n  gap:8px;\n}\n.auth-card .btn.is-loading::before{\n  width:12px;\n  height:12px;\n  border:2px solid currentColor;\n  border-right-color:transparent;\n  border-radius:50%;\n  content:\"\";\n  animation:auth-button-spin .7s linear infinite;\n}\n@keyframes auth-button-spin{to{transform:rotate(360deg)}}\n@media (prefers-reduced-motion:reduce){\n  .auth-card .btn.is-loading::before{animation-duration:1.4s}\n}\n.auth-session{\n  display:none;\n  align-items:center;\n  gap:7px;\n  margin-left:auto;\n  color:var(--nd-muted);\n  font-size:10.5px;\n}\n.auth-session.on{display:flex}\n.auth-session button{\n  padding:5px 8px;\n  border:0;\n  background:transparent;\n  color:var(--nd-faint);\n  font-size:10px;\n  cursor:pointer;\n}\n.auth-session button:hover{color:var(--nd-text)}\n.auth-session .status-dot{width:6px;height:6px}\n.auth-required .brand__url{display:none}\n";
+export declare const DEVTOOLS_AUTH_GATE_HTML: string;
+export declare const DEVTOOLS_AUTH_SESSION_HTML: string;
+export declare const DEVTOOLS_AUTH_CLIENT_JS: string;
+//# sourceMappingURL=devtools-auth-ui.d.ts.map

package/dist/devtools-auth-ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devtools-auth-ui.d.ts","sourceRoot":"","sources":["../src/devtools-auth-ui.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,w4EA0FhC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAYpB,CAAC;AAEjB,eAAO,MAAM,0BAA0B,QAK7B,CAAC;AAGX,eAAO,MAAM,uBAAuB,QAexB,CAAC"}