@rubytech/create-maxy-code 0.1.472 → 0.1.474

package/payload/platform/plugins/google/mcp/dist/tools/account-register.js

@@ -2,10 +2,11 @@
  * Register flow: authorization-code + PKCE.
  *
  * `runAccountRegisterStart` mints the PKCE pair and `state`, persists them, and
- * returns a consent URL the operator opens on any device. Google redirects to
- * platform/ui's /api/google/oauth/callback, which holds the client secret,
- * exchanges the code, and writes tokens. `runAccountRegisterPoll` then reports
- * the outcome from local state only — no network.
+ * returns a consent URL the user opens on any device. Google redirects to a
+ * loopback address nothing listens on, so the page fails to load and the user
+ * copies the code from the address bar; `runAccountRegisterSubmit` exchanges it
+ * here, in-process, using the brand-config client secret.
+ * `runAccountRegisterPoll` reports the outcome from local state only.
  */
 import { createHash, randomBytes } from "node:crypto";
 import { existsSync, readdirSync } from "node:fs";
@@ -15,6 +16,8 @@ import { TokenStore } from "../auth/token-store.js";
 import { log } from "../lib/log.js";
 export const CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar";
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const PRIMARY_CALENDAR_URL = "https://www.googleapis.com/calendar/v3/calendars/primary";
 /** Google refuses an authorization code older than roughly ten minutes; a
  *  pending entry past that is stranded, not live. */
 export const PENDING_LIFETIME_SEC = 600;
@@ -22,33 +25,34 @@ export function newPkce() {
     const verifier = randomBytes(48).toString("base64url");
     return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
 }
-/** The `state` value carries BOTH the account id and the nonce, as
- *  `<accountId>.<nonce>`.
+/** Desktop (installed app) clients permit ONLY loopback redirects. https is
+ *  rejected outright and custom URI schemes are withdrawn, so this is the whole
+ *  option space.
  *
- *  It cannot ride on the redirect_uri: Google requires redirect_uri to match a
- *  registered value EXACTLY, so a per-request query parameter makes every
- *  authorization request fail with redirect_uri_mismatch. Google's own guidance
- *  names `state` as the mechanism for per-request application state.
+ *  The IP literal is mandatory. RFC 8252 s7.3 makes the port irrelevant when
+ *  matching a loopback redirect, but only for `127.0.0.1` / `::1` — NOT for the
+ *  hostname `localhost`, which strict servers match literally.
  *
- *  Putting the account id in an attacker-visible field is safe because it is
- *  routing information, not authorisation: the callback still requires the
- *  nonce half to equal the one stored in that account's pending entry, and an
- *  attacker cannot produce a valid nonce for an account they do not control. */
-export function encodeState(accountId, nonce) {
-    return `${accountId}.${nonce}`;
-}
-export function decodeState(state) {
-    const idx = state.lastIndexOf(".");
-    if (idx <= 0 || idx === state.length - 1)
-        return null;
-    return { accountId: state.slice(0, idx), nonce: state.slice(idx + 1) };
-}
+ *  Nothing listens on this port, by design: the consenting browser is on the
+ *  user's own phone, so the redirect fails to load and the user copies the code
+ *  out of the address bar. The value is fixed so the consent URL is
+ *  deterministic and one register's logs compare against another's. */
+export const LOOPBACK_REDIRECT_URI = "http://127.0.0.1:8571";
+/** `state` is an opaque CSRF nonce and nothing more.
+ *
+ *  It deliberately does NOT carry the account id. Under the Desktop flow the
+ *  pending entry is keyed on the spawn's own ACCOUNT_ID, so submit can only ever
+ *  read its own account's pending, and PKCE binds the code to that entry's
+ *  verifier. Routing information in `state` would therefore buy nothing, while
+ *  putting an account uuid into a URL opened on a personal phone, stored in
+ *  browser history and Google's logs, and pasted back through chat.
+ *
+ *  (Task 1761 encoded `<accountId>.<nonce>` because a shared hosted callback had
+ *  to route an inbound request to an account. That callback is gone.) */
 export function buildConsentUrl(args) {
-    // redirect_uri is sent VERBATIM — no query string. See encodeState above.
-    const redirect = args.redirectUri;
     const q = new URLSearchParams({
         client_id: args.clientId,
-        redirect_uri: redirect,
+        redirect_uri: LOOPBACK_REDIRECT_URI,
         response_type: "code",
         scope: CALENDAR_SCOPE,
         access_type: "offline",
@@ -91,24 +95,18 @@ export async function runAccountRegisterStart(args) {
         });
         return { status: "in-progress", ageSec: age };
     }
-    const nonce = randomBytes(16).toString("hex");
-    const state = encodeState(args.accountId, nonce);
+    const state = randomBytes(16).toString("hex");
     const { verifier, challenge } = newPkce();
-    log({ tag: "[google-oauth]", op: "register", account: args.accountId, reg: nonce });
-    // The pending entry stores the NONCE, not the composed state: the account is
-    // already implied by which account's store this is, and comparing the nonce
-    // alone keeps the check independent of the encoding.
-    pending.write({ state: nonce, verifier, createdAt: Date.now() });
-    log({ tag: "[google-oauth]", op: "pending-write", reg: nonce, account: args.accountId });
-    const redirectUri = `${args.publicBase}/api/google/oauth/callback`;
+    log({ tag: "[google-oauth]", op: "register", account: args.accountId, reg: state });
+    pending.write({ state, verifier, createdAt: Date.now() });
+    log({ tag: "[google-oauth]", op: "pending-write", reg: state, account: args.accountId });
     const consentUrl = buildConsentUrl({
         clientId: args.clientId,
-        redirectUri,
         state,
         challenge,
         accountId: args.accountId,
     });
-    log({ tag: "[google-oauth]", op: "consent-url", reg: nonce, scopes: CALENDAR_SCOPE, redirect: redirectUri });
+    log({ tag: "[google-oauth]", op: "consent-url", reg: state, scopes: CALENDAR_SCOPE, redirect: LOOPBACK_REDIRECT_URI });
     return { status: "pending", consentUrl };
 }
 export async function runAccountRegisterPoll(args) {
@@ -123,4 +121,112 @@ export async function runAccountRegisterPoll(args) {
     }
     return { status: "pending", accounts, ageSec: age };
 }
+/** Users paste what they can see, and what they can see is Google's loopback
+ *  redirect — which ALWAYS carries `scope` alongside `code`, and often
+ *  `authuser` and `prompt` too. So the realistic pastes are a whole URL or a
+ *  `code=…&scope=…` fragment, not a bare value.
+ *
+ *  Extracting `code` properly matters because a mangled value reaches Google as
+ *  an opaque string and comes back `invalid_grant`, which reads to the user as
+ *  "your code expired" and sends them round the consent loop again. It never
+ *  says the paste was the problem.
+ *
+ *  A malformed percent escape must not throw either: `decodeURIComponent` raises
+ *  URIError on a stray `%`, and surfacing that instead of Google's own error
+ *  would be our parser blaming the user for a value Google would have explained.
+ */
+export function normalisePastedCode(raw) {
+    const s = raw.trim();
+    // A full URL, or a query fragment carrying more than one parameter.
+    if (s.includes("://") || s.startsWith("?") || s.includes("&")) {
+        const query = s.slice(s.indexOf("?") >= 0 ? s.indexOf("?") + 1 : 0);
+        const fromQuery = new URLSearchParams(query).get("code");
+        if (fromQuery)
+            return fromQuery.trim();
+    }
+    let out = s;
+    if (out.startsWith("code="))
+        out = out.slice("code=".length);
+    if (out.includes("%")) {
+        try {
+            out = decodeURIComponent(out);
+        }
+        catch {
+            // Leave it as pasted; Google's error is more useful than ours.
+        }
+    }
+    return out.trim();
+}
+/**
+ * Finish a registration from the code the user pasted back.
+ *
+ * The exchange happens HERE, in the plugin, because a Desktop client's secret
+ * ships in brand config — there is no server-side holder to delegate to. The
+ * redirect_uri sent here is the same constant the consent URL carried; Google
+ * compares them byte for byte.
+ */
+export async function runAccountRegisterSubmit(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const pending = new PendingStore(args.accountId, args.accountsDir);
+    const held = pending.read();
+    if (!held) {
+        throw new Error("no registration in progress; run google-account-register first");
+    }
+    const code = normalisePastedCode(args.code);
+    log({ tag: "[google-oauth]", op: "submit", account: args.accountId, reg: held.state });
+    const res = await doFetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            code,
+            client_id: args.clientId,
+            client_secret: args.clientSecret,
+            redirect_uri: LOOPBACK_REDIRECT_URI,
+            grant_type: "authorization_code",
+            code_verifier: held.verifier,
+        }),
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        // Never discard the body: invalid_grant means expired or already used,
+        // redirect_uri_mismatch means the sent and registered redirects diverged.
+        log({
+            tag: "[google-oauth]", op: "submit", reg: held.state,
+            outcome: "error", status: res.status, body: text.slice(0, 300),
+        });
+        throw new Error(`token exchange failed (${res.status}): ${text.slice(0, 300)}`);
+    }
+    const tok = JSON.parse(text);
+    // Identity comes from the primary calendar's id, which IS the address, so the
+    // identity scopes are never requested.
+    const calRes = await doFetch(PRIMARY_CALENDAR_URL, {
+        headers: { authorization: `Bearer ${tok.access_token}` },
+    });
+    const calText = await calRes.text();
+    if (!calRes.ok) {
+        throw new Error(`identity lookup failed (${calRes.status}): ${calText.slice(0, 200)}`);
+    }
+    const email = JSON.parse(calText).id;
+    const stored = new TokenStore(args.accountId, args.accountsDir, email).store(tok.access_token, tok.refresh_token ?? null, tok.expires_in, { email, scopes: tok.scope ? tok.scope.split(" ") : [] });
+    log({
+        tag: "[google-oauth]", op: "tokens-write", reg: held.state,
+        account: args.accountId, refreshIssued: tok.refresh_token ? "true" : "false",
+    });
+    pending.clear();
+    log({ tag: "[google-oauth]", op: "registered", reg: held.state, account: args.accountId, email });
+    // A connection with no refresh token works for about an hour and then dies.
+    // Reporting only in the log would tell the operator "connected" and leave the
+    // failure to surface later as an unexplained loss of access.
+    const refreshTokenIssued = Boolean(stored.refreshToken);
+    return {
+        status: "registered",
+        email,
+        refreshTokenIssued,
+        ...(refreshTokenIssued
+            ? {}
+            : {
+                warning: "Google returned no refresh token, so this connection will stop working when the access token expires in about an hour. Re-run google-account-register to reconnect.",
+            }),
+    };
+}
 //# sourceMappingURL=account-register.js.map

package/payload/platform/plugins/google/mcp/dist/tools/account-register.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-register.js","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,0CAA0C,CAAC;AACzE,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAEhE;qDACqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,MAAM,UAAU,OAAO;IACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;gFAWgF;AAChF,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,KAAa;IAC1D,OAAO,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAM/B;IACC,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,QAAQ;QACtB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvC,CAAC;AAOD;;6DAE6D;AAC7D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAK7C;IACC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAC/C,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB;YACrB,EAAE,EAAE,kBAAkB;YACtB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,6EAA6E;IAC7E,4EAA4E;IAC5E,qDAAqD;IACrD,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,UAAU,4BAA4B,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW;QACX,KAAK;QACL,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7G,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAG5C;IAKC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvF,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAChC,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"account-register.js","sourceRoot":"","sources":["../../src/tools/account-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,0CAA0C,CAAC;AACzE,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAChE,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,oBAAoB,GAAG,0DAA0D,CAAC;AAExF;qDACqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,MAAM,UAAU,OAAO;IACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;uEAWuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D;;;;;;;;;;yEAUyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAK/B;IACC,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE,qBAAqB;QACnC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvC,CAAC;AAOD;;6DAE6D;AAC7D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAI7C;IACC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAC/C,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB;YACrB,EAAE,EAAE,kBAAkB;YACtB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK;QACL,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAG5C;IAKC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACvF,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAChC,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAErB,oEAAoE;IACpE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAO9C;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,YAAY,EAAE,qBAAqB;YACnC,UAAU,EAAE,oBAAoB;YAChC,aAAa,EAAE,IAAI,CAAC,QAAQ;SAC7B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,uEAAuE;QACvE,0EAA0E;QAC1E,GAAG,CAAC;YACF,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK;YACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK1B,CAAC;IACF,8EAA8E;IAC9E,uCAAuC;IACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,oBAAoB,EAAE;QACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,YAAY,EAAE,EAAE;KACzD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,CAC1E,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,aAAa,IAAI,IAAI,EACzB,GAAG,CAAC,UAAU,EACd,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC;IACF,GAAG,CAAC;QACF,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK;QAC1D,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;KAC7E,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,4EAA4E;IAC5E,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,KAAK;QACL,kBAAkB;QAClB,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EACL,qKAAqK;aACxK,CAAC;KACP,CAAC;AACJ,CAAC"}