@noodleseed/one 0.96.3 → 0.97.0

package/node_modules/@noodle-borg/auth/dist/mcp-oauth-client.js

@@ -0,0 +1,367 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { issuerMetadataCandidates } from './discovery.js';
+import { protectedResourceMetadataUrl } from './metadata.js';
+const MAX_OAUTH_JSON_BYTES = 256 * 1024;
+const OAUTH_REQUEST_TIMEOUT_MS = 10_000;
+/**
+ * Express-free MCP OAuth client primitives. The caller owns session storage; this class keeps only immutable
+ * resource/client configuration and never persists credentials.
+ */
+export class McpOAuthClient {
+    #resource;
+    #issuer;
+    #redirectUri;
+    #fetch;
+    #clientName;
+    #allowInsecureLocalhost;
+    constructor(options) {
+        this.#allowInsecureLocalhost = options.allowInsecureLocalhost === true;
+        this.#resource = this.#validateResource(options.resource);
+        this.#issuer = this.#validateIssuer(options.issuer);
+        this.#redirectUri = this.#validateRedirect(options.redirectUri);
+        this.#fetch = options.fetchFn ?? fetch;
+        this.#clientName = options.clientName ?? 'Noodle Seed Devtools';
+    }
+    async discover() {
+        const protectedResource = await this.#getJson(protectedResourceMetadataUrl(this.#resource));
+        if (protectedResource.resource !== this.#resource) {
+            throw new Error('protected resource metadata does not match the MCP resource');
+        }
+        const authorizationServers = stringArray(protectedResource.authorization_servers);
+        if (!authorizationServers.includes(this.#issuer)) {
+            throw new Error('protected resource metadata does not advertise the configured issuer');
+        }
+        let firstError;
+        for (const candidate of issuerMetadataCandidates(this.#issuer)) {
+            try {
+                const metadata = await this.#getJson(candidate.url);
+                if (metadata.issuer !== this.#issuer) {
+                    throw new Error('issuer metadata does not exactly match the configured issuer');
+                }
+                const authorizationEndpoint = this.#requiredEndpoint(metadata.authorization_endpoint, 'authorization endpoint');
+                const tokenEndpoint = this.#requiredEndpoint(metadata.token_endpoint, 'token endpoint');
+                const registrationEndpoint = this.#requiredEndpoint(metadata.registration_endpoint, 'registration endpoint');
+                const responseTypes = stringArray(metadata.response_types_supported);
+                if (!responseTypes.includes('code')) {
+                    throw new Error('authorization server does not support the authorization-code flow');
+                }
+                const grantTypes = stringArray(metadata.grant_types_supported);
+                if (!grantTypes.includes('authorization_code') || !grantTypes.includes('refresh_token')) {
+                    throw new Error('authorization server does not advertise code and refresh grants');
+                }
+                const challengeMethods = stringArray(metadata.code_challenge_methods_supported);
+                if (!challengeMethods.includes('S256')) {
+                    throw new Error('authorization server does not support PKCE S256');
+                }
+                const tokenAuthMethods = stringArray(metadata.token_endpoint_auth_methods_supported);
+                if (!tokenAuthMethods.includes('none')) {
+                    throw new Error('authorization server does not support public OAuth clients');
+                }
+                return {
+                    resource: this.#resource,
+                    issuer: this.#issuer,
+                    authorizationEndpoint,
+                    tokenEndpoint,
+                    registrationEndpoint,
+                    scopes: canonicalScopes(stringArray(protectedResource.scopes_supported)),
+                    authorizationResponseIssuerRequired: metadata.authorization_response_iss_parameter_supported === true,
+                };
+            }
+            catch (error) {
+                firstError ??= safeError(error, 'authorization server discovery failed');
+            }
+        }
+        throw firstError ?? new Error('authorization server discovery failed');
+    }
+    async register(discovery, scopes = discovery.scopes) {
+        this.#assertDiscovery(discovery);
+        const selectedScopes = canonicalScopes(scopes);
+        const body = {
+            application_type: 'native',
+            client_name: this.#clientName,
+            redirect_uris: [this.#redirectUri],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            ...(selectedScopes.length > 0 ? { scope: selectedScopes.join(' ') } : {}),
+        };
+        const response = await this.#getJson(discovery.registrationEndpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (typeof response.client_id !== 'string' || response.client_id.length === 0) {
+            throw new Error('authorization server returned an invalid client registration');
+        }
+        if (response.token_endpoint_auth_method !== 'none') {
+            throw new Error('authorization server did not register a public client');
+        }
+        const registeredRedirects = stringArray(response.redirect_uris);
+        if (registeredRedirects.length > 0 && !registeredRedirects.includes(this.#redirectUri)) {
+            throw new Error('authorization server registered a different callback URL');
+        }
+        return { clientId: response.client_id, tokenEndpointAuthMethod: 'none' };
+    }
+    beginAuthorization(discovery, registration, scopes = discovery.scopes) {
+        this.#assertDiscovery(discovery);
+        assertPublicRegistration(registration);
+        const state = randomBytes(32).toString('base64url');
+        const codeVerifier = randomBytes(32).toString('base64url');
+        const selectedScopes = canonicalScopes(scopes);
+        const authorizationUrl = new URL(discovery.authorizationEndpoint);
+        authorizationUrl.searchParams.set('response_type', 'code');
+        authorizationUrl.searchParams.set('client_id', registration.clientId);
+        authorizationUrl.searchParams.set('redirect_uri', this.#redirectUri);
+        authorizationUrl.searchParams.set('state', state);
+        authorizationUrl.searchParams.set('code_challenge_method', 'S256');
+        authorizationUrl.searchParams.set('code_challenge', createHash('sha256').update(codeVerifier).digest('base64url'));
+        authorizationUrl.searchParams.set('resource', this.#resource);
+        if (selectedScopes.length > 0) {
+            authorizationUrl.searchParams.set('scope', selectedScopes.join(' '));
+        }
+        return {
+            authorizationUrl: authorizationUrl.href,
+            state,
+            codeVerifier,
+            scopes: selectedScopes,
+        };
+    }
+    async exchangeCallback(discovery, registration, pending, callbackUrl) {
+        this.#assertDiscovery(discovery);
+        assertPublicRegistration(registration);
+        const callback = new URL(callbackUrl);
+        const expectedCallback = new URL(this.#redirectUri);
+        if (callback.origin !== expectedCallback.origin ||
+            callback.pathname !== expectedCallback.pathname) {
+            throw new Error('OAuth callback URL does not match the registered redirect');
+        }
+        if (!constantTimeStringEqual(callback.searchParams.get('state') ?? '', pending.state)) {
+            throw new Error('OAuth callback state is invalid');
+        }
+        const responseIssuer = callback.searchParams.get('iss');
+        if ((discovery.authorizationResponseIssuerRequired && responseIssuer === null) ||
+            (responseIssuer !== null && responseIssuer !== discovery.issuer)) {
+            throw new Error('OAuth callback issuer is invalid');
+        }
+        if (callback.searchParams.has('error')) {
+            throw new Error('authorization server denied the sign-in request');
+        }
+        const code = callback.searchParams.get('code');
+        if (!code)
+            throw new Error('OAuth callback did not include an authorization code');
+        return this.#requestTokens(discovery, new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            code_verifier: pending.codeVerifier,
+            redirect_uri: this.#redirectUri,
+            client_id: registration.clientId,
+            resource: this.#resource,
+        }), pending.scopes);
+    }
+    async refresh(discovery, registration, current) {
+        this.#assertDiscovery(discovery);
+        assertPublicRegistration(registration);
+        if (!current.refreshToken)
+            throw new Error('OAuth session does not have a refresh token');
+        const refreshed = await this.#requestTokens(discovery, new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: current.refreshToken,
+            client_id: registration.clientId,
+            resource: this.#resource,
+        }), current.scope);
+        return {
+            ...refreshed,
+            refreshToken: refreshed.refreshToken ?? current.refreshToken,
+        };
+    }
+    async #requestTokens(discovery, body, fallbackScope) {
+        const response = await this.#getJson(discovery.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+            },
+            body,
+        });
+        if (typeof response.access_token !== 'string' || response.access_token.length === 0) {
+            throw new Error('authorization server returned an invalid token response');
+        }
+        if (typeof response.token_type !== 'string' || response.token_type.toLowerCase() !== 'bearer') {
+            throw new Error('authorization server returned an unsupported token type');
+        }
+        const expiresIn = typeof response.expires_in === 'number' && Number.isFinite(response.expires_in)
+            ? Math.max(0, response.expires_in)
+            : undefined;
+        const responseScopes = typeof response.scope === 'string' ? response.scope.split(/\s+/u) : fallbackScope;
+        return {
+            accessToken: response.access_token,
+            ...(typeof response.refresh_token === 'string' && response.refresh_token.length > 0
+                ? { refreshToken: response.refresh_token }
+                : {}),
+            tokenType: 'Bearer',
+            ...(expiresIn !== undefined ? { expiresAt: Date.now() + expiresIn * 1000 } : {}),
+            scope: canonicalScopes(responseScopes),
+        };
+    }
+    async #getJson(url, init) {
+        let response;
+        const headers = new Headers(init?.headers);
+        if (!headers.has('accept'))
+            headers.set('accept', 'application/json');
+        try {
+            response = await this.#fetch(url, {
+                ...init,
+                headers,
+                redirect: 'manual',
+                signal: init?.signal ?? AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch {
+            throw new Error(`OAuth endpoint could not be reached: ${new URL(url).origin}`);
+        }
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`OAuth endpoint returned HTTP ${response.status}: ${new URL(url).origin}`);
+        }
+        const text = await readBoundedText(response);
+        try {
+            const parsed = JSON.parse(text);
+            if (!isJsonObject(parsed))
+                throw new Error('not an object');
+            return parsed;
+        }
+        catch {
+            throw new Error('OAuth endpoint returned invalid JSON');
+        }
+    }
+    #requiredEndpoint(value, label) {
+        if (typeof value !== 'string')
+            throw new Error(`issuer metadata is missing ${label}`);
+        return this.#validateEndpoint(value, label);
+    }
+    #validateResource(value) {
+        const url = new URL(value);
+        if (url.username || url.password || url.hash) {
+            throw new Error('MCP OAuth resource must not contain credentials or a fragment');
+        }
+        if (url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback(url.hostname))) {
+            return url.href;
+        }
+        throw new Error('MCP OAuth resource must use HTTPS or an HTTP loopback URL');
+    }
+    #validateRedirect(value) {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' ||
+            !isLoopback(url.hostname) ||
+            url.username ||
+            url.password ||
+            url.hash) {
+            throw new Error('MCP OAuth redirect must use an HTTP loopback URL');
+        }
+        return url.href;
+    }
+    #validateEndpoint(value, label) {
+        const url = new URL(value);
+        if (url.username || url.password || url.hash) {
+            throw new Error(`${label} must not contain credentials or a fragment`);
+        }
+        if (url.protocol !== 'https:' &&
+            !(this.#allowInsecureLocalhost && url.protocol === 'http:' && isLoopback(url.hostname))) {
+            throw new Error(`${label} must use HTTPS`);
+        }
+        return url.href;
+    }
+    #validateIssuer(value) {
+        const url = new URL(value);
+        this.#validateEndpoint(value, 'authorization server issuer');
+        if (url.search || url.hash) {
+            throw new Error('authorization server issuer must not contain a query or fragment');
+        }
+        // The issuer identifier is compared byte-for-byte with metadata and the callback `iss`.
+        return value;
+    }
+    #assertDiscovery(discovery) {
+        if (discovery.resource !== this.#resource || discovery.issuer !== this.#issuer) {
+            throw new Error('OAuth discovery state belongs to a different resource or issuer');
+        }
+    }
+}
+/** Parse only the challenge fields needed for reauthorization; ignore realms and metadata URLs. */
+export function parseBearerChallenge(header) {
+    if (!header || !/^Bearer(?:\s|$)/iu.test(header))
+        return undefined;
+    const fields = new Map();
+    const raw = header.replace(/^Bearer\s*/iu, '');
+    const pattern = /([A-Za-z][A-Za-z0-9_-]*)=(?:"((?:\\.|[^"])*)"|([^,\s]+))/gu;
+    for (const match of raw.matchAll(pattern)) {
+        const key = match[1]?.toLowerCase();
+        const value = match[2]?.replace(/\\(["\\])/gu, '$1') ?? match[3];
+        if (key && value !== undefined)
+            fields.set(key, value);
+    }
+    const error = fields.get('error');
+    return {
+        ...(error !== undefined ? { error } : {}),
+        scopes: canonicalScopes((fields.get('scope') ?? '').split(/\s+/u)),
+    };
+}
+export function canonicalScopes(scopes) {
+    return [...new Set(scopes.map((scope) => scope.trim()).filter(Boolean))].sort();
+}
+function assertPublicRegistration(registration) {
+    if (registration.clientId.length === 0 || registration.tokenEndpointAuthMethod !== 'none') {
+        throw new Error('OAuth client registration is not a public client');
+    }
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : [];
+}
+function isJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+async function readBoundedText(response) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > MAX_OAUTH_JSON_BYTES) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error('OAuth JSON response is too large');
+    }
+    if (response.body === null)
+        return '';
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const chunks = [];
+    let bytes = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > MAX_OAUTH_JSON_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                throw new Error('OAuth JSON response is too large');
+            }
+            chunks.push(decoder.decode(chunk.value, { stream: true }));
+        }
+        chunks.push(decoder.decode());
+        return chunks.join('');
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function safeError(value, fallback) {
+    return value instanceof Error ? value : new Error(fallback);
+}
+function constantTimeStringEqual(left, right) {
+    const leftBytes = Buffer.from(left);
+    const rightBytes = Buffer.from(right);
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function isLoopback(hostname) {
+    const normalized = hostname.replace(/^\[|\]$/gu, '').toLowerCase();
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+//# sourceMappingURL=mcp-oauth-client.js.map

package/node_modules/@noodle-borg/auth/dist/mcp-oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-client.js","sourceRoot":"","sources":["../src/mcp-oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAmD7D,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AACxC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,OAAO,cAAc;IAChB,SAAS,CAAS;IAClB,OAAO,CAAS;IAChB,YAAY,CAAS;IACrB,MAAM,CAAe;IACrB,WAAW,CAAS;IACpB,uBAAuB,CAAU;IAE1C,YAAY,OAA8B;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC;QACvE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5F,IAAI,iBAAiB,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,oBAAoB,GAAG,WAAW,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QAClF,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,UAA6B,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,CAClD,QAAQ,CAAC,sBAAsB,EAC/B,wBAAwB,CACzB,CAAC;gBACF,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;gBACxF,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CACjD,QAAQ,CAAC,qBAAqB,EAC9B,uBAAuB,CACxB,CAAC;gBACF,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;gBACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACvF,CAAC;gBACD,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;gBAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;oBACxF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;gBAChF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;gBACrF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,IAAI,CAAC,OAAO;oBACpB,qBAAqB;oBACrB,aAAa;oBACb,oBAAoB;oBACpB,MAAM,EAAE,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;oBACxE,mCAAmC,EACjC,QAAQ,CAAC,8CAA8C,KAAK,IAAI;iBACnE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,KAAK,SAAS,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,MAAM,UAAU,IAAI,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAA4B,EAC5B,SAA4B,SAAS,CAAC,MAAM;QAE5C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG;YACX,gBAAgB,EAAE,QAAQ;YAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;YAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,oBAAoB,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,QAAQ,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,mBAAmB,GAAG,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,kBAAkB,CAChB,SAA4B,EAC5B,YAAwC,EACxC,SAA4B,SAAS,CAAC,MAAM;QAE5C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAClE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC3D,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QACnE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAC/B,gBAAgB,EAChB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAC9D,CAAC;QACF,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;YACvC,KAAK;YACL,YAAY;YACZ,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,SAA4B,EAC5B,YAAwC,EACxC,OAAqC,EACrC,WAAmB;QAEnB,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,IACE,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;YAC3C,QAAQ,CAAC,QAAQ,KAAK,gBAAgB,CAAC,QAAQ,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxD,IACE,CAAC,SAAS,CAAC,mCAAmC,IAAI,cAAc,KAAK,IAAI,CAAC;YAC1E,CAAC,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,CAAC,MAAM,CAAC,EAChE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,cAAc,CACxB,SAAS,EACT,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,YAAY,CAAC,QAAQ;YAChC,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,EACF,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,SAA4B,EAC5B,YAAwC,EACxC,OAAuB;QAEvB,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CACzC,SAAS,EACT,IAAI,eAAe,CAAC;YAClB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,SAAS,EAAE,YAAY,CAAC,QAAQ;YAChC,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QACF,OAAO;YACL,GAAG,SAAS;YACZ,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;SAC7D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,SAA4B,EAC5B,IAAqB,EACrB,aAAgC;QAEhC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI;SACL,CAAC,CAAC;QACH,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7E,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC;YAClC,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,cAAc,GAClB,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACpF,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,GAAG,CAAC,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;gBACjF,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,KAAK,EAAE,eAAe,CAAC,cAAc,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAkB;QAC5C,IAAI,QAAkB,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;gBAChC,GAAG,IAAI;gBACP,OAAO;gBACP,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;aACtE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAc,EAAE,KAAa;QAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxF,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI,EACR,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,iBAAiB,CAAC,KAAa,EAAE,KAAa;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;QACzE,CAAC;QACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,uBAAuB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EACvF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,wFAAwF;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB,CAAC,SAA4B;QAC3C,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,4DAA4D,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,wBAAwB,CAAC,YAAwC;IACxE,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAkB;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACjE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YACtB,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;gBACjC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,QAAgB;IACjD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC"}

package/node_modules/@noodle-borg/service/dist/customer-verifier-boundaries.d.ts

@@ -0,0 +1,13 @@
+import type { OwnerTokenVerifier } from '@noodle-borg/transport-http';
+import type { TenantAuthConfig, TenantBridgeAuthConfig } from './store.js';
+export declare function createHostedCustomerVerifierFactory(rawFactory: (auth: TenantAuthConfig) => OwnerTokenVerifier, platformVerifier: OwnerTokenVerifier | undefined): (auth: TenantAuthConfig) => OwnerTokenVerifier;
+/**
+ * Local Devtools accepts Firebase and Microsoft ID tokens directly because no hosted Noodle issuer exists
+ * in the author loop. The configured provider still verifies signature, issuer, and audience; this wrapper
+ * then binds the customer identity to the exact loopback MCP resource. Other bridge providers remain denied.
+ */
+export declare function createLocalDevtoolsCustomerVerifierFactory(rawFactory: (auth: TenantAuthConfig) => OwnerTokenVerifier, options?: {
+    readonly allowedProviders?: readonly ('firebase' | 'microsoft')[];
+    readonly resolveBridgeAuth?: (auth: TenantBridgeAuthConfig, resource: string) => Promise<TenantBridgeAuthConfig>;
+}): (auth: TenantAuthConfig) => OwnerTokenVerifier;
+//# sourceMappingURL=customer-verifier-boundaries.d.ts.map

package/node_modules/@noodle-borg/service/dist/customer-verifier-boundaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-verifier-boundaries.d.ts","sourceRoot":"","sources":["../src/customer-verifier-boundaries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE3E,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,EAC1D,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,GAC/C,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,CAehD;AAED;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,UAAU,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,EAC1D,OAAO,GAAE;IACP,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC;IAClE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACjC,GACL,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,CA8BhD"}

package/node_modules/@noodle-borg/service/dist/customer-verifier-boundaries.js

@@ -0,0 +1,71 @@
+export function createHostedCustomerVerifierFactory(rawFactory, platformVerifier) {
+    return (auth) => {
+        if (auth.kind !== 'bridge')
+            return rawFactory(auth);
+        if (platformVerifier === undefined)
+            return async () => null;
+        return async (token, resource) => {
+            const verification = await platformVerifier(token, resource);
+            if (verification?.caller.identityKind !== 'customer' ||
+                verification.caller.identityProvider !== auth.provider) {
+                return null;
+            }
+            return { caller: verification.caller };
+        };
+    };
+}
+/**
+ * Local Devtools accepts Firebase and Microsoft ID tokens directly because no hosted Noodle issuer exists
+ * in the author loop. The configured provider still verifies signature, issuer, and audience; this wrapper
+ * then binds the customer identity to the exact loopback MCP resource. Other bridge providers remain denied.
+ */
+export function createLocalDevtoolsCustomerVerifierFactory(rawFactory, options = {}) {
+    return (auth) => {
+        if (auth.kind !== 'bridge')
+            return rawFactory(auth);
+        if (auth.provider !== 'firebase' && auth.provider !== 'microsoft')
+            return async () => null;
+        if (options.allowedProviders !== undefined &&
+            !options.allowedProviders.includes(auth.provider)) {
+            return async () => null;
+        }
+        const resolveBridgeAuth = options.resolveBridgeAuth;
+        if (resolveBridgeAuth !== undefined) {
+            return async (token, resource) => {
+                if (resource === undefined || resource.length === 0)
+                    return null;
+                let resolved;
+                try {
+                    resolved = await resolveBridgeAuth(auth, resource);
+                }
+                catch {
+                    return null;
+                }
+                if (resolved.provider !== auth.provider)
+                    return null;
+                return bindLocalBridgeIdentity(rawFactory(resolved), resolved, token, resource);
+            };
+        }
+        const verifyBridge = rawFactory(auth);
+        return async (token, resource) => {
+            if (resource === undefined || resource.length === 0)
+                return null;
+            return bindLocalBridgeIdentity(verifyBridge, auth, token, resource);
+        };
+    };
+}
+async function bindLocalBridgeIdentity(verifier, auth, token, resource) {
+    const providerAudience = auth.provider === 'firebase' ? (auth.projectId ?? '') : (auth.clientId ?? '');
+    const verification = await verifier(token, providerAudience);
+    if (verification === null)
+        return null;
+    return {
+        caller: {
+            ...verification.caller,
+            audience: resource,
+            identityKind: 'customer',
+            identityProvider: auth.provider,
+        },
+    };
+}
+//# sourceMappingURL=customer-verifier-boundaries.js.map

package/node_modules/@noodle-borg/service/dist/customer-verifier-boundaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-verifier-boundaries.js","sourceRoot":"","sources":["../src/customer-verifier-boundaries.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,mCAAmC,CACjD,UAA0D,EAC1D,gBAAgD;IAEhD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,gBAAgB,KAAK,SAAS;YAAE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAC5D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC/B,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,IACE,YAAY,EAAE,MAAM,CAAC,YAAY,KAAK,UAAU;gBAChD,YAAY,CAAC,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,QAAQ,EACtD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;QACzC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0CAA0C,CACxD,UAA0D,EAC1D,UAMI,EAAE;IAEN,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAC3F,IACE,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACtC,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EACjD,CAAC;YACD,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACpD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACjE,IAAI,QAAgC,CAAC;gBACrC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBACrD,OAAO,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClF,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjE,OAAO,uBAAuB,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAA4B,EAC5B,IAA4B,EAC5B,KAAa,EACb,QAAgB;IAEhB,MAAM,gBAAgB,GACpB,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC7D,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO;QACL,MAAM,EAAE;YACN,GAAG,YAAY,CAAC,MAAM;YACtB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,UAAmB;YACjC,gBAAgB,EAAE,IAAI,CAAC,QAAQ;SAChC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/customer-verifier.d.ts

@@ -2,6 +2,7 @@ import { type DnsLookup } from '@noodle-borg/connector-http';
 import type { OwnerTokenVerifier } from '@noodle-borg/transport-http';
 import { type JSONWebKeySet } from 'jose';
 import type { TenantAuthClaimMap, TenantAuthConfig } from './store.js';
+export { createHostedCustomerVerifierFactory, createLocalDevtoolsCustomerVerifierFactory, } from './customer-verifier-boundaries.js';
 export interface CustomerVerifierFactoryOptions {
     readonly fetchImpl?: typeof fetch;
     readonly firebaseJwks?: JSONWebKeySet;
@@ -16,6 +17,5 @@ export interface CustomerVerifierFactoryOptions {
     readonly allowInsecureLocalhost?: boolean;
 }
 export declare function createCustomerVerifierFactory(options?: CustomerVerifierFactoryOptions): (auth: TenantAuthConfig) => OwnerTokenVerifier;
-export declare function createHostedCustomerVerifierFactory(rawFactory: (auth: TenantAuthConfig) => OwnerTokenVerifier, platformVerifier: OwnerTokenVerifier | undefined): (auth: TenantAuthConfig) => OwnerTokenVerifier;
 export declare function createFirebaseIdTokenVerifier(projectId: string | undefined, options: CustomerVerifierFactoryOptions, claims?: TenantAuthClaimMap): Promise<OwnerTokenVerifier>;
 //# sourceMappingURL=customer-verifier.d.ts.map

package/node_modules/@noodle-borg/service/dist/customer-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"customer-verifier.d.ts","sourceRoot":"","sources":["../src/customer-verifier.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAIL,KAAK,aAAa,EAGnB,MAAM,MAAM,CAAC;AAEd,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAwB,MAAM,YAAY,CAAC;AAE7F,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,8BAAmC,GAC3C,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,CA2EhD;AAED,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,EAC1D,gBAAgB,EAAE,kBAAkB,GAAG,SAAS,GAC/C,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,CAehD;AAED,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,8BAA8B,EACvC,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA0C7B"}
+{"version":3,"file":"customer-verifier.d.ts","sourceRoot":"","sources":["../src/customer-verifier.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAIL,KAAK,aAAa,EAGnB,MAAM,MAAM,CAAC;AAGd,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAwB,MAAM,YAAY,CAAC;AAE7F,OAAO,EACL,mCAAmC,EACnC,0CAA0C,GAC3C,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAOD,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,8BAAmC,GAC3C,CAAC,IAAI,EAAE,gBAAgB,KAAK,kBAAkB,CA0FhD;AAoBD,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,8BAA8B,EACvC,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA0C7B"}

package/node_modules/@noodle-borg/service/dist/customer-verifier.js

@@ -2,6 +2,8 @@ import { createJwtVerifier, discoverIssuerMetadata, projectMappedAuthorizationCl
 import { guardedFetch, isPublicUnicast, needsGuard, } from '@noodle-borg/connector-http';
 import { createLocalJWKSet, decodeJwt, importX509, jwtVerify, } from 'jose';
 import { canonicalOAuthIdentityPreferences } from './oauth/identity-preferences.js';
+import { createMicrosoftIdTokenVerifier, isConfiguredMicrosoftBridge } from './oauth/microsoft.js';
+export { createHostedCustomerVerifierFactory, createLocalDevtoolsCustomerVerifierFactory, } from './customer-verifier-boundaries.js';
 export function createCustomerVerifierFactory(options = {}) {
     const cache = new Map();
     const cacheTtlMs = options.cacheTtlMs ?? 300_000;
@@ -9,7 +11,6 @@ export function createCustomerVerifierFactory(options = {}) {
         const verifyOidc = async (oidc, token, resource) => {
             if (resource === undefined || resource.length === 0)
                 return null;
-            const now = Date.now();
             const key = JSON.stringify([
                 oidc.issuer,
                 oidc.audience,
@@ -17,13 +18,7 @@ export function createCustomerVerifierFactory(options = {}) {
                 oidc.claims?.scopes ?? '',
                 routingClaimEntries(oidc),
             ]);
-            const cached = cache.get(key);
-            const verifier = cached !== undefined && cached.expiresAt > now
-                ? cached.verifier
-                : discoverCustomerVerifier(oidc, options);
-            if (cached === undefined || cached.expiresAt <= now) {
-                cache.set(key, { expiresAt: now + cacheTtlMs, verifier });
-            }
+            const verifier = cachedCustomerVerifier(cache, key, cacheTtlMs, () => discoverCustomerVerifier(oidc, options));
             try {
                 return await (await verifier)(token, resource);
             }
@@ -48,23 +43,43 @@ export function createCustomerVerifierFactory(options = {}) {
             };
         }
         if (auth.kind === 'bridge') {
+            if (auth.provider === 'microsoft') {
+                if (!isConfiguredMicrosoftBridge(auth))
+                    return async () => null;
+                return async (token) => {
+                    const key = [
+                        'microsoft',
+                        auth.tenantId,
+                        auth.clientId,
+                        JSON.stringify(auth.user ?? {}),
+                    ].join('\u0000');
+                    const verifier = cachedCustomerVerifier(cache, key, cacheTtlMs, () => createMicrosoftIdTokenVerifier({
+                        auth,
+                        fetchImpl: options.fetchImpl ?? fetch,
+                    }).then((verify) => async (candidate) => {
+                        const identity = await verify(candidate);
+                        return identity === null
+                            ? null
+                            : { caller: { ...identity, audience: auth.clientId } };
+                    }));
+                    try {
+                        return await (await verifier)(token, auth.clientId);
+                    }
+                    catch {
+                        return null;
+                    }
+                };
+            }
             if (auth.provider !== 'firebase')
                 return async () => null;
             return async (token) => {
-                const now = Date.now();
                 const key = [
                     'firebase',
                     auth.projectId ?? '',
                     auth.user?.roles ?? '',
                     auth.user?.scopes ?? '',
                 ].join('\u0000');
-                const cached = cache.get(key);
-                const verifier = cached !== undefined && cached.expiresAt > now
-                    ? cached.verifier
-                    : createFirebaseIdTokenVerifier(auth.projectId, options, auth.user);
-                if (cached === undefined || cached.expiresAt <= now) {
-                    cache.set(key, { expiresAt: now + cacheTtlMs, verifier });
-                }
+                const verifier = cachedCustomerVerifier(cache, key, cacheTtlMs, () => createFirebaseIdTokenVerifier(auth.projectId, options, auth.user));
                 try {
                     return await (await verifier)(token, auth.projectId ?? '');
                 }
@@ -76,21 +91,18 @@ export function createCustomerVerifierFactory(options = {}) {
         return async (token, resource) => verifyOidc(auth, token, resource);
     };
 }
-export function createHostedCustomerVerifierFactory(rawFactory, platformVerifier) {
-    return (auth) => {
-        if (auth.kind !== 'bridge')
-            return rawFactory(auth);
-        if (platformVerifier === undefined)
-            return async () => null;
-        return async (token, resource) => {
-            const verification = await platformVerifier(token, resource);
-            if (verification?.caller.identityKind !== 'customer' ||
-                verification.caller.identityProvider !== auth.provider) {
-                return null;
-            }
-            return { caller: verification.caller };
-        };
-    };
+function cachedCustomerVerifier(cache, key, cacheTtlMs, create) {
+    const now = Date.now();
+    const cached = cache.get(key);
+    if (cached !== undefined && cached.expiresAt > now)
+        return cached.verifier;
+    const verifier = create();
+    cache.set(key, { expiresAt: now + cacheTtlMs, verifier });
+    void verifier.catch(() => {
+        if (cache.get(key)?.verifier === verifier)
+            cache.delete(key);
+    });
+    return verifier;
 }
 export async function createFirebaseIdTokenVerifier(projectId, options, claims) {
     if (projectId === undefined || projectId.length === 0)