@onyxsecurity/mcp-gateway 1.0.61 → 1.0.63

package/dist/transportDetection-DquHtdNu.js

@@ -1,2 +0,0 @@
-import{SSEClientTransport as e,StreamableHTTPClientTransport as t,discoverAuthorizationServerMetadata as n,discoverOAuthProtectedResourceMetadata as r,logger as i}from"./streamableHttp-DM0LA7pR.js";var a=class extends Error{constructor(e,t){let n=t instanceof Error?t.message:String(t);super(`Auth server metadata discovery failed for ${e}: ${n}`),this.authServerUrl=e,this.cause=t,this.name=`AuthServerDiscoveryError`}};async function o(e,t={}){let{logger:i,signal:o}=t,c=o?s(o):void 0;i?.debug(`Discovering OAuth protected resource metadata...`);let l;try{l=c?await r(e,void 0,c):await r(e),i?.info(`Discovered protected resource metadata`,{authorizationServers:l?.authorization_servers,resource:l?.resource,scopesSupported:l?.scopes_supported})}catch(e){i?.warn(`Could not discover protected resource metadata, will try direct discovery`,{error:String(e)})}let u;l?.authorization_servers?.length?(u=new URL(l.authorization_servers[0]),i?.debug(`Using authorization server from resource metadata`,{authServerUrl:u.toString()})):(u=e,i?.debug(`Using server URL as authorization server`,{authServerUrl:u.toString()})),i?.debug(`Discovering authorization server metadata...`);let d;try{d=c?await n(u,{fetchFn:c}):await n(u)}catch(e){throw new a(u,e)}return d&&i?.info(`Discovered authorization server metadata`,{authorizationEndpoint:d.authorization_endpoint,issuer:d.issuer,registrationEndpoint:d.registration_endpoint,tokenEndpoint:d.token_endpoint}),{authMetadata:d,authServerUrl:u,resourceMetadata:l}}function s(e){return(t,n)=>{let r=n?.signal,i=r?AbortSignal.any([e,r]):e;return fetch(t,{...n,signal:i})}}let c=[];function l(e){let t=typeof e==`string`?new URL(e):e,n=t.hostname.toLowerCase();for(let e of c)for(let t of e.urlPatterns){let r=t.toLowerCase();if(f(n,r))return i.debug(`Found matching OAuth provider for URL`,{hostname:n,pattern:t,providerId:e.id,providerName:e.name}),d(e)}i.debug(`No pre-configured OAuth provider found for URL`,{hostname:n,serverUrl:t.toString()})}function u(e){c=e.map(d)}function d(e){return{...e,scopes:e.scopes?[...e.scopes]:void 0,urlPatterns:[...e.urlPatterns]}}function f(e,t){return!!(e===t||e.endsWith(`.${t}`))}const p=[`streamable-http`,`sse`];async function m(e,t,n){let{result:r,transportType:i}=await _(async r=>{let i=e(),a=h(t,r,n);return await i.connect(a),i});return{client:r,transportType:i}}function h(n,r,i){let a=new URL(n);return r===`streamable-http`?new t(a,{requestInit:i}):new e(a,{requestInit:i})}function g(e){if(!e||typeof e!=`object`)return!1;let t=e.status,n=e.code,r=e.message;return!!(t===404||t===405||n===404||n===405||r&&/404|not found|405|method not allowed/i.test(String(r)))}async function _(e){let t=[];for(let n of p)try{return{result:await e(n),transportType:n}}catch(e){if(g(e)){i.info(`${n} not supported, trying next transport...`),t.push({err:e,transport:n});continue}throw e}let n=t.map(({err:e,transport:t})=>{let n=e?.status;if(n!==void 0)return`${t}: ${n}`;let r=e instanceof Error?e.message:String(e);return`${t}: ${r}`}).join(`, `),r=t.length>0?Error(`all transports returned not-supported (${n})`):Error(`No compatible transport found`);throw r.cause=t,r}export{a as AuthServerDiscoveryError,m as connectWithTransportFallback,o as discoverAuthServer,l as findProviderForUrl,u as setOAuthProviders,_ as walkTransports};
-//# sourceMappingURL=transportDetection-DquHtdNu.js.map

package/dist/transportDetection-DquHtdNu.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"transportDetection-DquHtdNu.js","names":["authServerUrl: URL","cause: unknown","resourceMetadata: OAuthProtectedResourceMetadata | undefined","authMetadata: Awaited<ReturnType<typeof discoverAuthorizationServerMetadata>>","oauthProviders: OAuthProviderConfig[]","TRANSPORT_PRIORITY: TransportType[]","client","transportType","failures: Array<{ err: unknown; transport: TransportType }>"],"sources":["../src/auth/discovery.ts","../src/auth/providers.ts","../src/lib/transportDetection.ts"],"sourcesContent":["import {\n  discoverAuthorizationServerMetadata,\n  discoverOAuthProtectedResourceMetadata,\n} from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type { OAuthProtectedResourceMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\n\nexport interface DiscoverAuthServerOptions {\n  /**\n   * Optional logger. When provided, emits the same debug/info/warn lines that\n   * `performOAuthFlow` used to emit inline. When omitted, discovery runs\n   * silently.\n   */\n  logger?: DiscoveryLogger;\n  /**\n   * Optional AbortSignal, threaded into both SDK discovery calls via a fetch\n   * wrapper. When omitted, the SDK calls are made with no fetch override —\n   * preserving the existing `performOAuthFlow` call shape exactly.\n   */\n  signal?: AbortSignal;\n}\n\n/**\n * Minimal logging surface used by the discovery helper. Matches the shape of\n * `../lib/logger.ts`'s singleton so callers can pass it directly. Omit to run\n * discovery silently (the probe's call pattern).\n */\nexport interface DiscoveryLogger {\n  debug(message: string, meta?: Record<string, unknown>): void;\n  info(message: string, meta?: Record<string, unknown>): void;\n  warn(message: string, meta?: Record<string, unknown>): void;\n}\n\nexport interface DiscoveryResult {\n  /** Auth-server metadata. May be undefined — caller decides how to respond. */\n  authMetadata: Awaited<ReturnType<typeof discoverAuthorizationServerMetadata>>;\n  /**\n   * The chosen auth server URL: the first entry of `resourceMetadata.authorization_servers`\n   * when present, otherwise `serverUrl` itself.\n   */\n  authServerUrl: URL;\n  /** Protected-resource metadata. Undefined when the document is missing or lookup soft-failed. */\n  resourceMetadata: OAuthProtectedResourceMetadata | undefined;\n}\n\n/**\n * Thrown when `discoverAuthorizationServerMetadata` fails. Preserves the\n * computed `authServerUrl` so callers can include it in error messages /\n * probe results — the pre-refactor inline code had it in scope naturally.\n */\nexport class AuthServerDiscoveryError extends Error {\n  constructor(\n    public readonly authServerUrl: URL,\n    public readonly cause: unknown\n  ) {\n    const msg = cause instanceof Error ? cause.message : String(cause);\n    super(`Auth server metadata discovery failed for ${authServerUrl}: ${msg}`);\n    this.name = \"AuthServerDiscoveryError\";\n  }\n}\n\n/**\n * Runs the OAuth metadata discovery sequence shared by the full OAuth flow and\n * the install-time DCR probe:\n *\n *   1. Look up the protected-resource metadata (soft-fails on error).\n *   2. Pick the auth server URL — the first `authorization_servers` entry, or\n *      `serverUrl` as a fallback.\n *   3. Look up the auth-server metadata. Throws iff the SDK call itself throws;\n *      does NOT throw when the SDK returns undefined (caller decides).\n *\n * No policy decisions baked in — both callers (`performOAuthFlow` and `probeOne`)\n * apply their own handling to the result.\n */\nexport async function discoverAuthServer(\n  serverUrl: URL,\n  options: DiscoverAuthServerOptions = {}\n): Promise<DiscoveryResult> {\n  const { logger, signal } = options;\n  const fetchFn = signal ? signaledFetch(signal) : undefined;\n\n  logger?.debug(\"Discovering OAuth protected resource metadata...\");\n  let resourceMetadata: OAuthProtectedResourceMetadata | undefined;\n  try {\n    // Preserve the exact SDK call arity used by performOAuthFlow when no\n    // signal is provided (single-arg form) — some SDKs treat an explicit\n    // `undefined` differently from an omitted arg.\n    resourceMetadata = fetchFn\n      ? await discoverOAuthProtectedResourceMetadata(serverUrl, undefined, fetchFn)\n      : await discoverOAuthProtectedResourceMetadata(serverUrl);\n    logger?.info(\"Discovered protected resource metadata\", {\n      authorizationServers: resourceMetadata?.authorization_servers,\n      resource: resourceMetadata?.resource,\n      scopesSupported: resourceMetadata?.scopes_supported,\n    });\n  } catch (err) {\n    logger?.warn(\"Could not discover protected resource metadata, will try direct discovery\", {\n      error: String(err),\n    });\n  }\n\n  let authServerUrl: URL;\n  if (resourceMetadata?.authorization_servers?.length) {\n    authServerUrl = new URL(resourceMetadata.authorization_servers[0]);\n    logger?.debug(\"Using authorization server from resource metadata\", {\n      authServerUrl: authServerUrl.toString(),\n    });\n  } else {\n    authServerUrl = serverUrl;\n    logger?.debug(\"Using server URL as authorization server\", {\n      authServerUrl: authServerUrl.toString(),\n    });\n  }\n\n  logger?.debug(\"Discovering authorization server metadata...\");\n  let authMetadata: Awaited<ReturnType<typeof discoverAuthorizationServerMetadata>>;\n  try {\n    authMetadata = fetchFn\n      ? await discoverAuthorizationServerMetadata(authServerUrl, { fetchFn })\n      : await discoverAuthorizationServerMetadata(authServerUrl);\n  } catch (err) {\n    throw new AuthServerDiscoveryError(authServerUrl, err);\n  }\n\n  if (authMetadata) {\n    logger?.info(\"Discovered authorization server metadata\", {\n      authorizationEndpoint: authMetadata.authorization_endpoint,\n      issuer: authMetadata.issuer,\n      registrationEndpoint: authMetadata.registration_endpoint,\n      tokenEndpoint: authMetadata.token_endpoint,\n    });\n  }\n\n  return { authMetadata, authServerUrl, resourceMetadata };\n}\n\n/** Wraps global fetch so the SDK inherits a caller-supplied AbortSignal. */\nfunction signaledFetch(probeSignal: AbortSignal): typeof fetch {\n  return (input, init) => {\n    const sdkSignal = init?.signal;\n    const combined =\n      sdkSignal ? AbortSignal.any([probeSignal, sdkSignal]) : probeSignal;\n    return fetch(input, { ...init, signal: combined });\n  };\n}\n","import type { OAuthProviderConfig } from \"../config/config.js\";\n\nimport { logger } from \"../lib/logger.js\";\n\n// Mutable store. Populated by setOAuthProviders() during startup once the\n// gateway has fetched provider config from the web extension service.\n// Pre-startup or when the fetch fails, the array stays empty and OAuth flows\n// fall through to Dynamic Client Registration via oauthFlow.ts.\nlet oauthProviders: OAuthProviderConfig[] = [];\n\n/**\n * Finds a pre-configured OAuth provider that matches the given server URL.\n *\n * @param serverUrl The MCP server URL to match against provider URL patterns\n * @returns The matching provider config, or undefined if no match found\n */\nexport function findProviderForUrl(serverUrl: string | URL): OAuthProviderConfig | undefined {\n  const serverUrlObj = typeof serverUrl === \"string\" ? new URL(serverUrl) : serverUrl;\n  const hostname = serverUrlObj.hostname.toLowerCase();\n\n  for (const provider of oauthProviders) {\n    for (const pattern of provider.urlPatterns) {\n      // Pattern can be a hostname or a hostname with path prefix\n      const patternLower = pattern.toLowerCase();\n\n      // Check if pattern matches hostname (with or without subdomains)\n      if (matchesHostname(hostname, patternLower)) {\n        logger.debug(\"Found matching OAuth provider for URL\", {\n          hostname,\n          pattern,\n          providerId: provider.id,\n          providerName: provider.name,\n        });\n        // Return a defensive clone — callers in oauthFlow.ts must not be\n        // able to corrupt the in-memory store via the returned reference.\n        return cloneProvider(provider);\n      }\n    }\n  }\n\n  logger.debug(\"No pre-configured OAuth provider found for URL\", {\n    hostname,\n    serverUrl: serverUrlObj.toString(),\n  });\n  return undefined;\n}\n\n/**\n * Gets a provider by its ID.\n *\n * @param providerId The provider ID (e.g., \"github\")\n * @returns The provider config, or undefined if not found\n */\nexport function getProviderById(providerId: string): OAuthProviderConfig | undefined {\n  const found = oauthProviders.find((p) => p.id === providerId);\n  return found ? cloneProvider(found) : undefined;\n}\n\n/**\n * Lists all configured OAuth providers.\n * Useful for debugging and admin interfaces.\n *\n * @returns Array of provider summaries (without secrets)\n */\nexport function listProviders(): Array<{\n  hasClientSecret: boolean;\n  id: string;\n  name: string;\n  urlPatterns: string[];\n}> {\n  return oauthProviders.map((p) => ({\n    hasClientSecret: !!p.clientSecret,\n    id: p.id,\n    name: p.name,\n    urlPatterns: [...p.urlPatterns],\n  }));\n}\n\n/**\n * Replaces the in-memory OAuth provider list. Called once at gateway startup\n * after fetching from the web extension service. Pass an empty array to clear.\n *\n * Stores defensive shallow copies of each provider so that callers cannot\n * mutate the in-memory store via the references they passed in. The\n * urlPatterns array is also cloned for the same reason.\n */\nexport function setOAuthProviders(providers: OAuthProviderConfig[]): void {\n  oauthProviders = providers.map(cloneProvider);\n}\n\n// cloneProvider returns a defensive shallow copy with array fields cloned,\n// so callers can read and even mutate the result without corrupting the\n// in-memory store. Used on every read path (findProviderForUrl,\n// getProviderById) to match the write-side contract in setOAuthProviders.\nfunction cloneProvider(p: OAuthProviderConfig): OAuthProviderConfig {\n  return {\n    ...p,\n    scopes: p.scopes ? [...p.scopes] : undefined,\n    urlPatterns: [...p.urlPatterns],\n  };\n}\n\n/**\n * Checks if a hostname matches a pattern.\n * Supports exact matches and subdomain matches.\n *\n * @param hostname The hostname to check (e.g., \"api.github.com\")\n * @param pattern The pattern to match against (e.g., \"github.com\")\n * @returns true if the hostname matches the pattern\n */\nfunction matchesHostname(hostname: string, pattern: string): boolean {\n  // Exact match\n  if (hostname === pattern) {\n    return true;\n  }\n\n  // Subdomain match: hostname ends with \".pattern\"\n  // e.g., \"api.github.com\" matches \"github.com\"\n  if (hostname.endsWith(`.${pattern}`)) {\n    return true;\n  }\n\n  return false;\n}\n","/**\n * MCP Transport Utilities\n *\n * Simple transport creation for remote MCP servers.\n * Transport type is determined by trying Streamable HTTP first,\n * falling back to SSE if the endpoint doesn't support it.\n */\n\nimport type { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\n\nimport { logger } from \"./logger.js\";\n\nexport type TransportType = \"sse\" | \"streamable-http\";\n\n/** Order in which transports are tried (per MCP spec: Streamable HTTP first, SSE fallback) */\nconst TRANSPORT_PRIORITY: TransportType[] = [\"streamable-http\", \"sse\"];\n\n/** Result of a successful transport connection */\nexport interface TransportConnectionResult {\n  /** The connected client instance */\n  client: Client;\n  /** The transport type that successfully connected */\n  transportType: TransportType;\n}\n\n/**\n * Connects to a remote MCP server, trying transports in order.\n * Per MCP spec: tries Streamable HTTP first, falls back to SSE if not supported (404/405).\n *\n * Creates a fresh client for each transport attempt to avoid state issues.\n * The MCP SDK Client maintains internal connection state that does not properly\n * reset after a failed connect attempt, so reusing the same client instance\n * across transport fallbacks can cause \"already connected\" or similar errors.\n *\n * @param createClient - Factory function to create a new Client instance\n * @param url - The URL of the remote MCP server\n * @param requestInit - Optional request init for the transport (headers, etc.)\n * @returns The connected client and transport type\n * @throws The error from the last transport attempt if none succeed,\n *         or immediately if an error is not a \"transport not supported\" error\n */\nexport async function connectWithTransportFallback(\n  createClient: () => Client,\n  url: string,\n  requestInit?: RequestInit\n): Promise<TransportConnectionResult> {\n  const { result: client, transportType } = await walkTransports(async (transportType) => {\n    // Create a fresh client for each transport attempt to avoid state issues\n    const client = createClient();\n    const transport = createTransport(url, transportType, requestInit);\n    await client.connect(transport);\n    return client;\n  });\n  return { client, transportType };\n}\n\n/**\n * Creates a transport instance for the given type.\n */\nexport function createTransport(\n  url: string,\n  type: TransportType,\n  requestInit?: RequestInit\n): SSEClientTransport | StreamableHTTPClientTransport {\n  const parsedUrl = new URL(url);\n\n  if (type === \"streamable-http\") {\n    return new StreamableHTTPClientTransport(parsedUrl, { requestInit });\n  }\n\n  return new SSEClientTransport(parsedUrl, { requestInit });\n}\n\n/**\n * Checks if an error indicates the transport/endpoint is not supported (404/405).\n * This means we should try a different transport type.\n */\nexport function isTransportNotSupportedError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n\n  const status = (err as { status?: number }).status;\n  const code = (err as { code?: number }).code;\n  const message = (err as { message?: string }).message;\n\n  // Check status codes that indicate endpoint doesn't support this transport\n  if (status === 404 || status === 405 || code === 404 || code === 405) {\n    return true;\n  }\n\n  // Check error message for these status codes\n  if (message && /404|not found|405|method not allowed/i.test(String(message))) {\n    return true;\n  }\n\n  return false;\n}\n\n/**\n * Walks transports in priority order, calling `attempt` for each. Returns the\n * first successful result. Continues to the next transport on\n * `isTransportNotSupportedError` (404/405); propagates any other error.\n *\n * Shared primitive for both connect-style attempts (the runtime proxy via\n * `connectWithTransportFallback`) and probe-style attempts (the install-time\n * scan in `src/probe`). Callers supply the per-transport request shape; this\n * helper owns only the priority-order + fallback-on-404/405 logic.\n *\n * When every transport fails with a not-supported error, throws an aggregate\n * error whose message lists each transport's status — so callers can tell\n * \"URL is dead\" from \"URL only speaks one transport\". The original errors are\n * available via `error.cause` (an array of `{ transport, err }`).\n *\n * @param attempt - Per-transport function. Throw an error matching\n *   `isTransportNotSupportedError` to trigger fallback; throw anything else\n *   (or any one transport's non-fallback error) to propagate.\n * @returns The first transport that succeeded and its result.\n * @throws The propagated non-fallback error, or an aggregate of every\n *   transport's not-supported error when all transports fail.\n */\nexport async function walkTransports<T>(\n  attempt: (transportType: TransportType) => Promise<T>\n): Promise<{ result: T; transportType: TransportType }> {\n  const failures: Array<{ err: unknown; transport: TransportType }> = [];\n\n  for (const transportType of TRANSPORT_PRIORITY) {\n    try {\n      const result = await attempt(transportType);\n      return { result, transportType };\n    } catch (err) {\n      if (isTransportNotSupportedError(err)) {\n        logger.info(`${transportType} not supported, trying next transport...`);\n        failures.push({ err, transport: transportType });\n        continue;\n      }\n\n      // Non-transport error (e.g., 401, network error) - propagate immediately\n      throw err;\n    }\n  }\n\n  // All transports failed with \"not supported\" errors. Build a message that\n  // lists every transport's status (or message), so callers don't see only\n  // the last transport's failure and assume the others were never tried.\n  const summary = failures\n    .map(({ err, transport }) => {\n      const status = (err as { status?: number } | null)?.status;\n      if (status !== undefined) return `${transport}: ${status}`;\n      const message = err instanceof Error ? err.message : String(err);\n      return `${transport}: ${message}`;\n    })\n    .join(\", \");\n  const aggregate =\n    failures.length > 0\n      ? new Error(`all transports returned not-supported (${summary})`)\n      : new Error(\"No compatible transport found\");\n  // Preserve original errors for callers that need to introspect them.\n  (aggregate as { cause?: unknown } & Error).cause = failures;\n  throw aggregate;\n}\n"],"mappings":"sMAiDA,IAAa,EAAb,cAA8C,KAAM,CAClD,YACE,EACA,EACA,CACA,IAAM,EAAM,aAAiB,MAAQ,EAAM,QAAU,OAAO,EAAM,CAClE,MAAM,6CAA6C,EAAc,IAAI,IAAM,CAJ3D,KAAA,cAAA,EACA,KAAA,MAAA,EAIhB,KAAK,KAAO,6BAiBhB,eAAsB,EACpB,EACA,EAAqC,EAAE,CACb,CAC1B,GAAM,CAAE,OAAA,EAAQ,UAAW,EACrB,EAAU,EAAS,EAAc,EAAO,CAAG,IAAA,GAEjD,GAAQ,MAAM,mDAAmD,CACjE,IAAIE,EACJ,GAAI,CAIF,EAAmB,EACf,MAAM,EAAuC,EAAW,IAAA,GAAW,EAAQ,CAC3E,MAAM,EAAuC,EAAU,CAC3D,GAAQ,KAAK,yCAA0C,CACrD,qBAAsB,GAAkB,sBACxC,SAAU,GAAkB,SAC5B,gBAAiB,GAAkB,iBACpC,CAAC,OACK,EAAK,CACZ,GAAQ,KAAK,4EAA6E,CACxF,MAAO,OAAO,EAAI,CACnB,CAAC,CAGJ,IAAIF,EACA,GAAkB,uBAAuB,QAC3C,EAAgB,IAAI,IAAI,EAAiB,sBAAsB,GAAG,CAClE,GAAQ,MAAM,oDAAqD,CACjE,cAAe,EAAc,UAAU,CACxC,CAAC,GAEF,EAAgB,EAChB,GAAQ,MAAM,2CAA4C,CACxD,cAAe,EAAc,UAAU,CACxC,CAAC,EAGJ,GAAQ,MAAM,+CAA+C,CAC7D,IAAIG,EACJ,GAAI,CACF,EAAe,EACX,MAAM,EAAoC,EAAe,CAAE,UAAS,CAAC,CACrE,MAAM,EAAoC,EAAc,OACrD,EAAK,CACZ,MAAM,IAAI,EAAyB,EAAe,EAAI,CAYxD,OATI,GACF,GAAQ,KAAK,2CAA4C,CACvD,sBAAuB,EAAa,uBACpC,OAAQ,EAAa,OACrB,qBAAsB,EAAa,sBACnC,cAAe,EAAa,eAC7B,CAAC,CAGG,CAAE,eAAc,gBAAe,mBAAkB,CAI1D,SAAS,EAAc,EAAwC,CAC7D,OAAQ,EAAO,IAAS,CACtB,IAAM,EAAY,GAAM,OAClB,EACJ,EAAY,YAAY,IAAI,CAAC,EAAa,EAAU,CAAC,CAAG,EAC1D,OAAO,MAAM,EAAO,CAAE,GAAG,EAAM,OAAQ,EAAU,CAAC,ECrItD,IAAIC,EAAwC,EAAE,CAQ9C,SAAgB,EAAmB,EAA0D,CAC3F,IAAM,EAAe,OAAO,GAAc,SAAW,IAAI,IAAI,EAAU,CAAG,EACpE,EAAW,EAAa,SAAS,aAAa,CAEpD,IAAK,IAAM,KAAY,EACrB,IAAK,IAAM,KAAW,EAAS,YAAa,CAE1C,IAAM,EAAe,EAAQ,aAAa,CAG1C,GAAI,EAAgB,EAAU,EAAa,CASzC,OARA,EAAO,MAAM,wCAAyC,CACpD,WACA,UACA,WAAY,EAAS,GACrB,aAAc,EAAS,KACxB,CAAC,CAGK,EAAc,EAAS,CAKpC,EAAO,MAAM,iDAAkD,CAC7D,WACA,UAAW,EAAa,UAAU,CACnC,CAAC,CA2CJ,SAAgB,EAAkB,EAAwC,CACxE,EAAiB,EAAU,IAAI,EAAc,CAO/C,SAAS,EAAc,EAA6C,CAClE,MAAO,CACL,GAAG,EACH,OAAQ,EAAE,OAAS,CAAC,GAAG,EAAE,OAAO,CAAG,IAAA,GACnC,YAAa,CAAC,GAAG,EAAE,YAAY,CAChC,CAWH,SAAS,EAAgB,EAAkB,EAA0B,CAYnE,MAJA,GANI,IAAa,GAMb,EAAS,SAAS,IAAI,IAAU,ECrGtC,MAAMC,EAAsC,CAAC,kBAAmB,MAAM,CA0BtE,eAAsB,EACpB,EACA,EACA,EACoC,CACpC,GAAM,CAAE,OAAQ,EAAQ,iBAAkB,MAAM,EAAe,KAAO,IAAkB,CAEtF,IAAMC,EAAS,GAAc,CACvB,EAAY,EAAgB,EAAKC,EAAe,EAAY,CAElE,OADA,MAAMD,EAAO,QAAQ,EAAU,CACxBA,GACP,CACF,MAAO,CAAE,SAAQ,gBAAe,CAMlC,SAAgB,EACd,EACA,EACA,EACoD,CACpD,IAAM,EAAY,IAAI,IAAI,EAAI,CAM9B,OAJI,IAAS,kBACJ,IAAI,EAA8B,EAAW,CAAE,cAAa,CAAC,CAG/D,IAAI,EAAmB,EAAW,CAAE,cAAa,CAAC,CAO3D,SAAgB,EAA6B,EAAuB,CAClE,GAAI,CAAC,GAAO,OAAO,GAAQ,SAAU,MAAO,GAE5C,IAAM,EAAU,EAA4B,OACtC,EAAQ,EAA0B,KAClC,EAAW,EAA6B,QAY9C,MAJA,GALI,IAAW,KAAO,IAAW,KAAO,IAAS,KAAO,IAAS,KAK7D,GAAW,wCAAwC,KAAK,OAAO,EAAQ,CAAC,EA6B9E,eAAsB,EACpB,EACsD,CACtD,IAAME,EAA8D,EAAE,CAEtE,IAAK,IAAM,KAAiB,EAC1B,GAAI,CAEF,MAAO,CAAE,OADM,MAAM,EAAQ,EAAc,CAC1B,gBAAe,OACzB,EAAK,CACZ,GAAI,EAA6B,EAAI,CAAE,CACrC,EAAO,KAAK,GAAG,EAAc,0CAA0C,CACvE,EAAS,KAAK,CAAE,MAAK,UAAW,EAAe,CAAC,CAChD,SAIF,MAAM,EAOV,IAAM,EAAU,EACb,KAAK,CAAE,MAAK,eAAgB,CAC3B,IAAM,EAAU,GAAoC,OACpD,GAAI,IAAW,IAAA,GAAW,MAAO,GAAG,EAAU,IAAI,IAClD,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,OAAO,EAAI,CAChE,MAAO,GAAG,EAAU,IAAI,KACxB,CACD,KAAK,KAAK,CACP,EACJ,EAAS,OAAS,EACV,MAAM,0CAA0C,EAAQ,GAAG,CAC3D,MAAM,gCAAgC,CAGhD,KADC,GAA0C,MAAQ,EAC7C"}