@synoikia/core 0.1.0

package/dist/http/mcp/oauth-routes.js

@@ -0,0 +1,465 @@
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
+import { writeAudit } from '../../audit.js';
+import { effectiveAuthMode, publicMcpBase, resourceUrl } from '../../auth/mcp-auth.js';
+import { canonicalResource, OAuthError } from '../../auth/oauth.js';
+import { randomToken, safeEqual, sha256, signPayload, verifyPayload } from '../../auth/tokens.js';
+import { ServiceError } from '../../errors.js';
+import { getSettings } from '../../settings.js';
+import { localLoginEnabled, mustEnrollTotp } from '../admin/auth.js';
+import { clientIp, isSecure } from '../common.js';
+import { consentPage, errorPage, loginPage, totpPage } from './pages.js';
+const UI_SESSIONS = {
+    oauth: { cookie: 'syn_mcp_oauth', kind: 'oauth_ui', path: '/oauth' },
+    approval: { cookie: 'syn_mcp_approve', kind: 'approval_ui', path: '/a' },
+};
+/** Which kind of session a sign-in continuing to `continueTo` creates. */
+export const purposeOf = (continueTo) => (continueTo.startsWith('/a/') ? 'approval' : 'oauth');
+const UI_CSRF_COOKIE = 'syn_mcp_csrf';
+const OIDC_COOKIE = 'syn_mcp_oidc';
+export const UI_LIMITS = { idleMs: 15 * 60_000, absoluteMs: 60 * 60_000 };
+const FORM_TTL_MS = 10 * 60_000;
+const NEEDS_TOTP = 'This server requires two-factor authentication. Set up your authenticator app in the admin portal (Profile) first.';
+/** Where a sign-in may continue to: only our own consent and approval pages. */
+export const safeContinue = (v) => typeof v === 'string' && (v.startsWith('/oauth/authorize?') || /^\/a\/[A-Za-z0-9_-]+$/.test(v))
+    ? v
+    : '/oauth/authorize';
+export function uiSession(ctx, c, purpose) {
+    const { cookie, kind } = UI_SESSIONS[purpose];
+    return ctx.sessions.validate(getCookie(c, cookie), kind, UI_LIMITS);
+}
+/** Double-submit CSRF for the MCP-port forms (SameSite=Strict cookie + hidden field). */
+export function uiCsrf(ctx, c) {
+    let token = getCookie(c, UI_CSRF_COOKIE);
+    if (!token) {
+        token = randomToken(24);
+        setCookie(c, UI_CSRF_COOKIE, token, {
+            httpOnly: true,
+            secure: isSecure(c, ctx.config.TRUST_PROXY),
+            sameSite: 'Strict',
+            path: '/',
+        });
+    }
+    return token;
+}
+export const checkUiCsrf = (c, submitted) => {
+    const cookie = getCookie(c, UI_CSRF_COOKIE);
+    return !!cookie && typeof submitted === 'string' && safeEqual(cookie, submitted);
+};
+/**
+ * When each MCP-port session last proved a TOTP code (design §5.3). Approvals need one; locked
+ * operations need a recent one. Kept in memory: after a restart the page simply asks again.
+ */
+const totpProofs = new Map();
+export function recordTotpProof(ctx, idHash) {
+    const now = ctx.now().getTime();
+    for (const [k, at] of totpProofs)
+        if (now - at > UI_LIMITS.absoluteMs)
+            totpProofs.delete(k);
+    totpProofs.set(idHash, now);
+}
+/** Milliseconds since this session last proved TOTP, or Infinity if it never did. */
+export function sinceTotpProof(ctx, session) {
+    const at = totpProofs.get(session.idHash);
+    return at === undefined ? Infinity : ctx.now().getTime() - at;
+}
+function startUiSession(ctx, c, userId, method, continueTo) {
+    const purpose = purposeOf(continueTo);
+    const { cookie, kind, path } = UI_SESSIONS[purpose];
+    const raw = ctx.sessions.create(userId, kind, UI_LIMITS, {
+        ip: clientIp(c, ctx.config.TRUST_PROXY),
+        userAgent: c.req.header('user-agent'),
+    });
+    if (method === 'password+totp')
+        recordTotpProof(ctx, ctx.sessions.hashId(raw));
+    // Lax: the browser must send it when an OIDC provider redirects back into the consent flow.
+    setCookie(c, cookie, raw, {
+        httpOnly: true,
+        secure: isSecure(c, ctx.config.TRUST_PROXY),
+        sameSite: 'Lax',
+        path,
+        maxAge: UI_LIMITS.absoluteMs / 1000,
+    });
+    ctx.users.markLogin(userId);
+    writeAudit(ctx.db, {
+        kind: 'auth',
+        decision: 'login',
+        actorKind: 'user',
+        actorId: userId,
+        detail: { method, surface: 'mcp', purpose },
+    });
+}
+export function renderLogin(ctx, c, continueTo, purpose, error, status = 200) {
+    const oidc = ctx.oidc.getSettings();
+    return loginPage(c, {
+        purpose,
+        continueTo,
+        csrf: uiCsrf(ctx, c),
+        error,
+        localLogin: localLoginEnabled(ctx),
+        oidc: oidc?.enabled ? { label: oidc.label } : undefined,
+    }, status);
+}
+export function registerOAuthRoutes(app, ctx, oauth) {
+    // The authorization server only runs with a configured public URL (design §2.1): its issuer and every
+    // discovery document must not come from the request's Host header, which a client controls.
+    const asOff = (c) => {
+        c.header('Cache-Control', 'no-store');
+        return c.json({
+            error: 'temporarily_unavailable',
+            error_description: 'OAuth is off until the server operator sets PUBLIC_MCP_URL',
+        }, 503);
+    };
+    for (const path of [
+        '/.well-known/*',
+        '/oauth/register',
+        '/oauth/authorize',
+        '/oauth/consent',
+        '/oauth/token',
+        '/oauth/revoke',
+    ]) {
+        app.use(path, async (c, next) => (ctx.config.PUBLIC_MCP_URL ? next() : asOff(c)));
+    }
+    const issuer = (c) => publicMcpBase(ctx, c);
+    const oauthEndpoints = (c) => ctx.instances
+        .list()
+        .filter((i) => {
+        const mode = effectiveAuthMode(ctx, i.authMode);
+        return mode === 'oauth' || mode === 'bearer+oauth';
+    })
+        .map((i) => ({ resource: resourceUrl(issuer(c), i.slug), slug: i.slug, name: i.displayName, id: i.id }));
+    // ── metadata ──
+    const asMetadata = (c) => {
+        const base = issuer(c);
+        return {
+            issuer: base,
+            authorization_endpoint: `${base}/oauth/authorize`,
+            token_endpoint: `${base}/oauth/token`,
+            revocation_endpoint: `${base}/oauth/revoke`,
+            ...(getSettings(ctx.db, 'mcp').allowDynamicRegistration
+                ? { registration_endpoint: `${base}/oauth/register` }
+                : {}),
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none', 'client_secret_post', 'client_secret_basic'],
+            scopes_supported: ['mcp'],
+            authorization_response_iss_parameter_supported: true,
+        };
+    };
+    app.get('/.well-known/oauth-authorization-server', (c) => c.json(asMetadata(c)));
+    app.get('/.well-known/openid-configuration', (c) => c.json(asMetadata(c)));
+    // RFC 9728: the path of the protected resource is appended to the well-known prefix.
+    app.get('/.well-known/oauth-protected-resource/:slug', (c) => {
+        const endpoint = ctx.instances.bySlug(c.req.param('slug'));
+        const mode = endpoint && effectiveAuthMode(ctx, endpoint.instance.authMode);
+        if (!endpoint || (mode !== 'oauth' && mode !== 'bearer+oauth'))
+            return c.json({ error: 'not_found' }, 404);
+        return c.json({
+            resource: resourceUrl(issuer(c), endpoint.instance.slug),
+            authorization_servers: [issuer(c)],
+            bearer_methods_supported: ['header'],
+            scopes_supported: ['mcp'],
+            // No resource_name: the endpoint's display name is not for unauthenticated callers.
+        });
+    });
+    // ── dynamic client registration (RFC 7591) ──
+    app.post('/oauth/register', async (c) => {
+        if (!getSettings(ctx.db, 'mcp').allowDynamicRegistration) {
+            return c.json({ error: 'registration_disabled', error_description: 'Ask the administrator to register this client' }, 403);
+        }
+        if (!ctx.throttle.allowIp(clientIp(c, ctx.config.TRUST_PROXY)))
+            return c.json({ error: 'slow_down' }, 429);
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: 'invalid_client_metadata', error_description: 'Body must be JSON' }, 400);
+        }
+        try {
+            return c.json(oauth.register(body, 'dcr'), 201);
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return c.json({ error: err.code, error_description: err.message }, 400);
+            throw err;
+        }
+    });
+    // ── authorize: validate, then sign-in, then consent ──
+    app.get('/oauth/authorize', (c) => {
+        const q = new URL(c.req.url).searchParams;
+        const client = oauth.client(q.get('client_id') ?? '');
+        if (!client)
+            return errorPage(c, 'Unknown application', 'This application is not registered with this server.');
+        const redirectUri = q.get('redirect_uri') ?? (client.redirectUris.length === 1 ? client.redirectUris[0] : '');
+        // Never redirect to an unregistered URI, not even with an error.
+        if (!client.redirectUris.includes(redirectUri))
+            return errorPage(c, 'Invalid redirect', 'The redirect address is not registered for this application.');
+        const back = (params) => {
+            const url = new URL(redirectUri);
+            for (const [k, v] of Object.entries({
+                ...params,
+                ...(q.get('state') ? { state: q.get('state') } : {}),
+                iss: issuer(c),
+            }))
+                url.searchParams.set(k, v);
+            return c.redirect(url.toString());
+        };
+        if (q.get('response_type') !== 'code')
+            return back({ error: 'unsupported_response_type' });
+        const challenge = q.get('code_challenge');
+        if (!challenge || q.get('code_challenge_method') !== 'S256' || !/^[A-Za-z0-9_-]{43}$/.test(challenge)) {
+            return back({ error: 'invalid_request', error_description: 'PKCE with S256 is required' });
+        }
+        const available = oauthEndpoints(c);
+        const requested = q.getAll('resource').map(canonicalResource);
+        const unknown = requested.filter((r) => !available.some((e) => e.resource === r));
+        if (unknown.length)
+            return back({
+                error: 'invalid_target',
+                error_description: `Unknown or non-OAuth endpoint: ${unknown.join(', ')}`,
+            });
+        const offered = requested.length ? available.filter((e) => requested.includes(e.resource)) : available;
+        if (offered.length === 0)
+            return back({ error: 'invalid_target', error_description: 'No endpoints accept OAuth' });
+        const session = uiSession(ctx, c, 'oauth');
+        const continueTo = `/oauth/authorize?${q.toString()}`;
+        if (!session)
+            return renderLogin(ctx, c, continueTo, `Sign in to let ${client.name} use your MCP endpoints.`);
+        const form = {
+            clientId: client.clientId,
+            redirectUri,
+            state: q.get('state') ?? undefined,
+            codeChallenge: challenge,
+            offered: offered.map((e) => e.resource),
+            preselected: requested,
+            session: sha256(getCookie(c, UI_SESSIONS.oauth.cookie) ?? ''),
+        };
+        return consentPage(c, {
+            clientName: client.name,
+            redirectHost: new URL(redirectUri).host || redirectUri,
+            username: session.user.username,
+            endpoints: offered.map((e) => ({ ...e, checked: requested.includes(e.resource) })),
+            formToken: signPayload(ctx.keys.state, form, FORM_TTL_MS),
+            access: 'read',
+        });
+    });
+    app.post('/oauth/consent', async (c) => {
+        const body = await c.req.parseBody({ all: true });
+        const form = verifyPayload(ctx.keys.state, typeof body.form === 'string' ? body.form : undefined);
+        const session = uiSession(ctx, c, 'oauth');
+        // The consent form is bound to the session that rendered it (and so to this browser).
+        if (!form || !session || form.session !== sha256(getCookie(c, UI_SESSIONS.oauth.cookie) ?? '')) {
+            return errorPage(c, 'Session expired', 'Start the connection again from your MCP client.');
+        }
+        const client = oauth.client(form.clientId);
+        if (!client || !client.redirectUris.includes(form.redirectUri))
+            return errorPage(c, 'Unknown application', 'This application is no longer registered.');
+        const back = (params) => {
+            const url = new URL(form.redirectUri);
+            for (const [k, v] of Object.entries({ ...params, ...(form.state ? { state: form.state } : {}), iss: issuer(c) }))
+                url.searchParams.set(k, v);
+            return c.redirect(url.toString(), 302);
+        };
+        if (body.decision !== 'approve') {
+            writeAudit(ctx.db, {
+                kind: 'auth',
+                decision: 'oauth_consent_denied',
+                actorKind: 'user',
+                actorId: session.user.id,
+                detail: { clientId: client.clientId },
+            });
+            return back({ error: 'access_denied' });
+        }
+        const chosen = [].concat(body.resource ?? []).filter((r) => typeof r === 'string');
+        // Bind each resource to the instance it names right now; one renamed since the form was shown drops out.
+        const current = new Map(oauthEndpoints(c).map((e) => [e.resource, e.id]));
+        const resources = [...new Set(chosen.map(canonicalResource))].filter((r) => form.offered.includes(r) && current.has(r));
+        if (resources.length === 0) {
+            return consentPage(c, {
+                clientName: client.name,
+                redirectHost: new URL(form.redirectUri).host || form.redirectUri,
+                username: session.user.username,
+                endpoints: oauthEndpoints(c)
+                    .filter((e) => form.offered.includes(e.resource))
+                    .map((e) => ({ ...e, checked: false })),
+                formToken: signPayload(ctx.keys.state, form, FORM_TTL_MS),
+                access: body.access === 'write' ? 'write' : 'read',
+                error: 'Pick at least one endpoint, or deny.',
+            });
+        }
+        const code = oauth.issueCode({
+            client,
+            userId: session.user.id,
+            resources,
+            instanceIds: resources.map((r) => current.get(r)),
+            // Anything but an explicit "Read & write" choice is read-only (design §6.3).
+            access: body.access === 'write' ? 'write' : 'read',
+            codeChallenge: form.codeChallenge,
+            redirectUri: form.redirectUri,
+        });
+        return back({ code });
+    });
+    // ── MCP-port sign-in (also used by the approval page) ──
+    app.post('/oauth/login', async (c) => {
+        const body = await c.req.parseBody();
+        const continueTo = safeContinue(body.continue);
+        if (!checkUiCsrf(c, body.csrf))
+            return renderLogin(ctx, c, continueTo, 'Sign in', 'Your form expired; try again.', 401);
+        if (!localLoginEnabled(ctx))
+            return renderLogin(ctx, c, continueTo, 'Sign in', 'Use single sign-on.', 401);
+        const ip = clientIp(c, ctx.config.TRUST_PROXY);
+        const username = String(body.username ?? '').slice(0, 64);
+        if (!ctx.throttle.allowIp(ip) || ctx.throttle.lockedFor(username, 'mcp') > 0) {
+            return renderLogin(ctx, c, continueTo, 'Sign in', 'Too many attempts; try again later.', 429);
+        }
+        const user = await ctx.users.verifyPassword(username, String(body.password ?? '').slice(0, 1024));
+        if (!user) {
+            if (ctx.throttle.fail(username, 'mcp'))
+                ctx.events.emit('auth.lockout', { username, ip, surface: 'mcp' });
+            writeAudit(ctx.db, {
+                kind: 'auth',
+                decision: 'login_failed',
+                actorKind: 'system',
+                detail: { username, ip, surface: 'mcp' },
+            });
+            return renderLogin(ctx, c, continueTo, 'Sign in', 'Invalid username or password.', 401);
+        }
+        if (mustEnrollTotp(ctx, user)) {
+            // The portal would force enrollment first; the internet-facing sign-in must not skip it.
+            return renderLogin(ctx, c, continueTo, 'Sign in', NEEDS_TOTP, 403);
+        }
+        if (user.totpEnabled) {
+            return totpPage(c, {
+                mfa: signPayload(ctx.keys.state, { mfaUser: user.id }, 5 * 60_000),
+                continueTo,
+                csrf: uiCsrf(ctx, c),
+            });
+        }
+        ctx.throttle.succeed(username, 'mcp');
+        startUiSession(ctx, c, user.id, 'password', continueTo);
+        return c.redirect(continueTo, 303);
+    });
+    app.post('/oauth/login/totp', async (c) => {
+        const body = await c.req.parseBody();
+        const continueTo = safeContinue(body.continue);
+        const pending = verifyPayload(ctx.keys.state, typeof body.mfa === 'string' ? body.mfa : undefined);
+        if (!checkUiCsrf(c, body.csrf) || !pending)
+            return renderLogin(ctx, c, continueTo, 'Sign in', 'Your sign-in expired; try again.', 401);
+        const user = ctx.users.get(pending.mfaUser);
+        if (ctx.throttle.lockedFor(user.username, 'mcp') > 0)
+            return renderLogin(ctx, c, continueTo, 'Sign in', 'Too many attempts; try again later.', 429);
+        if (!ctx.users.verifySecondFactor(user.id, String(body.code ?? ''))) {
+            ctx.throttle.fail(user.username, 'mcp');
+            return totpPage(c, { mfa: String(body.mfa), continueTo, csrf: uiCsrf(ctx, c), error: 'Invalid code.' }, 401);
+        }
+        ctx.throttle.succeed(user.username, 'mcp');
+        startUiSession(ctx, c, user.id, 'password+totp', continueTo);
+        return c.redirect(continueTo, 303);
+    });
+    app.get('/oauth/login/oidc', async (c) => {
+        const { url, stateToken } = await ctx.oidc.begin({
+            purpose: 'mcp_login',
+            redirectUri: `${issuer(c)}/oauth/oidc/callback`,
+            returnTo: safeContinue(c.req.query('continue')),
+        });
+        setCookie(c, OIDC_COOKIE, stateToken, {
+            httpOnly: true,
+            secure: isSecure(c, ctx.config.TRUST_PROXY),
+            sameSite: 'Lax',
+            path: '/oauth',
+            maxAge: 600,
+        });
+        return c.redirect(url);
+    });
+    app.get('/oauth/oidc/callback', async (c) => {
+        try {
+            const { identity, state } = await ctx.oidc.complete(new URL(c.req.url, `${issuer(c)}/oauth/oidc/callback`), getCookie(c, OIDC_COOKIE));
+            if (state.purpose !== 'mcp_login')
+                return errorPage(c, 'Sign-in failed', 'Unexpected sign-in flow.');
+            const user = await ctx.oidc.resolveUser(ctx.users, identity);
+            if (!user)
+                return errorPage(c, 'Not allowed', 'Your account is not allowed to sign in here.', 403);
+            if (mustEnrollTotp(ctx, user))
+                return errorPage(c, 'Two-factor authentication required', NEEDS_TOTP, 403);
+            const continueTo = safeContinue(state.returnTo);
+            startUiSession(ctx, c, user.id, 'oidc', continueTo);
+            return c.redirect(continueTo);
+        }
+        catch (err) {
+            if (err instanceof ServiceError)
+                return errorPage(c, 'Sign-in failed', err.message);
+            throw err;
+        }
+        finally {
+            deleteCookie(c, OIDC_COOKIE, { path: '/oauth' });
+        }
+    });
+    // ── token & revocation (form-encoded, RFC 6749 errors, no caching) ──
+    const clientCredentials = (c, body) => {
+        const basic = c.req.header('authorization')?.match(/^Basic\s+(.+)$/i)?.[1];
+        if (basic) {
+            const [id, secret] = Buffer.from(basic, 'base64').toString('utf8').split(':');
+            return { id: decodeURIComponent(id ?? ''), secret: decodeURIComponent(secret ?? '') };
+        }
+        return {
+            id: typeof body.client_id === 'string' ? body.client_id : undefined,
+            secret: typeof body.client_secret === 'string' ? body.client_secret : undefined,
+        };
+    };
+    const oauthError = (c, err) => {
+        c.header('Cache-Control', 'no-store');
+        if (err instanceof OAuthError)
+            return c.json({ error: err.code, error_description: err.message }, err.httpStatus);
+        throw err;
+    };
+    app.post('/oauth/token', async (c) => {
+        c.header('Cache-Control', 'no-store');
+        const body = await c.req.parseBody({ all: true });
+        const one = (k) => (typeof body[k] === 'string' ? body[k] : undefined);
+        const resources = [].concat(body.resource ?? []).filter((r) => typeof r === 'string');
+        const mcp = getSettings(ctx.db, 'mcp');
+        const ttl = { accessMs: mcp.accessTokenTtlMinutes * 60_000, refreshMs: mcp.refreshTokenTtlDays * 86_400_000 };
+        try {
+            const creds = clientCredentials(c, body);
+            const client = oauth.authenticateClient(creds.id, creds.secret);
+            switch (one('grant_type')) {
+                case 'authorization_code':
+                    return c.json(oauth.exchangeCode({
+                        client,
+                        code: one('code') ?? '',
+                        redirectUri: one('redirect_uri') ?? '',
+                        codeVerifier: one('code_verifier') ?? '',
+                        resource: resources,
+                        ttl,
+                    }));
+                case 'refresh_token':
+                    return c.json(oauth.refresh({ client, refreshToken: one('refresh_token') ?? '', resource: resources, ttl }));
+                default:
+                    throw new OAuthError('unsupported_grant_type', 'Only authorization_code and refresh_token are supported');
+            }
+        }
+        catch (err) {
+            return oauthError(c, err);
+        }
+    });
+    app.post('/oauth/revoke', async (c) => {
+        const body = await c.req.parseBody();
+        try {
+            const creds = clientCredentials(c, body);
+            const client = oauth.authenticateClient(creds.id, creds.secret);
+            if (typeof body.token === 'string')
+                oauth.revokeToken(body.token, client);
+            return c.body(null, 200);
+        }
+        catch (err) {
+            return oauthError(c, err);
+        }
+    });
+    app.post('/oauth/logout', (c) => {
+        ctx.sessions.revoke(getCookie(c, UI_SESSIONS.oauth.cookie));
+        deleteCookie(c, UI_SESSIONS.oauth.cookie, { path: UI_SESSIONS.oauth.path });
+        return c.redirect('/oauth/authorize', 303);
+    });
+}
+//# sourceMappingURL=oauth-routes.js.map

package/dist/http/mcp/oauth-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-routes.js","sourceRoot":"","sources":["../../../src/http/mcp/oauth-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAczE,MAAM,WAAW,GAAG;IAClB,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpE,QAAQ,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE;CAChE,CAAC;AACX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAkB,EAAa,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAClH,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAkB,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;AACzF,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,UAAU,GACd,oHAAoH,CAAC;AAEvH,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,EAAE,CACzC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,CAAC,CAAC,kBAAkB,CAAC;AAEzB,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,CAAU,EAAE,OAAkB;IACvE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACtE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,MAAM,CAAC,GAAe,EAAE,CAAU;IAChD,IAAI,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACxB,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE;YAClC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YAC3C,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAU,EAAE,SAAkB,EAAE,EAAE;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU;QAAE,IAAI,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU;YAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5F,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,OAAqB;IACnE,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,GAAe,EAAE,CAAU,EAAE,MAAc,EAAE,MAAc,EAAE,UAAkB;IACrG,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;QACvD,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,eAAe;QAAE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,4FAA4F;IAC5F,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE;QACxB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QAC3C,QAAQ,EAAE,KAAK;QACf,IAAI;QACJ,MAAM,EAAE,SAAS,CAAC,UAAU,GAAG,IAAI;KACpC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;QACjB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,CAAU,EACV,UAAkB,EAClB,OAAe,EACf,KAAc,EACd,SAAgC,GAAG;IAEnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,SAAS,CACd,CAAC,EACD;QACE,OAAO;QACP,UAAU;QACV,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAClC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;KACxD,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,mBAAmB,CAAC,GAAS,EAAE,GAAe,EAAE,KAAmB;IACjF,sGAAsG;IACtG,4FAA4F;IAC5F,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE;QAC3B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE,yBAAyB;YAChC,iBAAiB,EAAE,4DAA4D;SAChF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI;QACjB,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,cAAc;QACd,eAAe;KAChB,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,CAAC,CAAU,EAAE,EAAE,CACpC,GAAG,CAAC,SAAS;SACV,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC;IACrD,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAE7G,iBAAiB;IAEjB,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;YACjD,cAAc,EAAE,GAAG,IAAI,cAAc;YACrC,mBAAmB,EAAE,GAAG,IAAI,eAAe;YAC3C,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,wBAAwB;gBACrD,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,IAAI,iBAAiB,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACP,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;YAC5F,gBAAgB,EAAE,CAAC,KAAK,CAAC;YACzB,8CAA8C,EAAE,IAAI;SACrD,CAAC;IACJ,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3E,qFAAqF;IACrF,GAAG,CAAC,GAAG,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,QAAQ,IAAI,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,cAAc,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3G,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxD,qBAAqB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAClC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,gBAAgB,EAAE,CAAC,KAAK,CAAC;YACzB,oFAAoF;SACrF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAE/C,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,wBAAwB,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,+CAA+C,EAAE,EACtG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3G,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACvG,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wDAAwD;IAExD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,qBAAqB,EAAE,sDAAsD,CAAC,CAAC;QAChH,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,iEAAiE;QACjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5C,OAAO,SAAS,CAAC,CAAC,EAAE,kBAAkB,EAAE,8DAA8D,CAAC,CAAC;QAE1G,MAAM,IAAI,GAAG,CAAC,MAA8B,EAAE,EAAE;YAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;gBAClC,GAAG,MAAM;gBACT,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;aACf,CAAC;gBACA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtG,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,MAAM;YAChB,OAAO,IAAI,CAAC;gBACV,KAAK,EAAE,gBAAgB;gBACvB,iBAAiB,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC1E,CAAC,CAAC;QACL,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAEnH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,kBAAkB,MAAM,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAE9G,MAAM,IAAI,GAAqB;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW;YACX,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAClC,aAAa,EAAE,SAAS;YACxB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvC,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9D,CAAC;QACF,OAAO,WAAW,CAAC,CAAC,EAAE;YACpB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,YAAY,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,WAAW;YACtD,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClF,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC;YACzD,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,aAAa,CAAmB,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,sFAAsF;QACtF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/F,OAAO,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;YAC5D,OAAO,SAAS,CAAC,CAAC,EAAE,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,CAAC,MAA8B,EAAE,EAAE;YAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9G,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,sBAAsB;gBAChC,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACxB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;aACtC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAI,EAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/G,yGAAyG;QACzG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC,CAAC,EAAE;gBACpB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,YAAY,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;gBAChE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAC/B,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;qBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;qBAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzC,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC;gBACzD,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAClD,KAAK,EAAE,sCAAsC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC;YAC3B,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,SAAS;YACT,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YAClD,6EAA6E;YAC7E,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAClD,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,0DAA0D;IAE1D,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC3G,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7E,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1G,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,cAAc;gBACxB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aACzC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9B,yFAAyF;YACzF,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC,CAAC,EAAE;gBACjB,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;gBAClE,UAAU;gBACV,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;aACrB,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,aAAa,CAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,EACd,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CACpD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YACxC,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;YAClD,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/G,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/C,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB;YAC/C,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;SAChD,CAAC,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YAC3C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CACjD,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,EACtD,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAC1B,CAAC;YACF,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;YACrG,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,aAAa,EAAE,8CAA8C,EAAE,GAAG,CAAC,CAAC;YACnG,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,oCAAoC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1G,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChD,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACpF,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAE,IAA6B,EAAE,EAAE;QACtE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9E,OAAO,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACnE,MAAM,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SAChF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,GAAY,EAAE,EAAE;QAC9C,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,GAAG,YAAY,UAAU;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAClH,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAI,EAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAClH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,mBAAmB,GAAG,UAAU,EAAE,CAAC;QAC9G,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChE,QAAQ,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1B,KAAK,oBAAoB;oBACvB,OAAO,CAAC,CAAC,IAAI,CACX,KAAK,CAAC,YAAY,CAAC;wBACjB,MAAM;wBACN,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;wBACvB,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;wBACtC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;wBACxC,QAAQ,EAAE,SAAS;wBACnB,GAAG;qBACJ,CAAC,CACH,CAAC;gBACJ,KAAK,eAAe;oBAClB,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC/G;oBACE,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,yDAAyD,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,YAAY,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/mcp/pages.d.ts

@@ -0,0 +1,63 @@
+import type { Context } from 'hono';
+import type { HtmlEscapedString } from 'hono/utils/html';
+/**
+ * The few server-rendered pages on the public MCP port (design §2.1): sign-in, TOTP, OAuth consent,
+ * approval decisions and errors. Every interpolated value is HTML-escaped by `html`. No scripts.
+ */
+type Body = HtmlEscapedString | Promise<HtmlEscapedString>;
+export declare function page(c: Context, title: string, body: Body, status?: 200 | 400 | 401 | 403 | 404 | 429): Response | Promise<Response>;
+export declare function errorPage(c: Context, title: string, message: string, status?: 200 | 400 | 403 | 404): Response | Promise<Response>;
+export interface LoginView {
+    purpose: string;
+    continueTo: string;
+    csrf: string;
+    error?: string;
+    localLogin: boolean;
+    oidc?: {
+        label: string;
+    };
+}
+export declare function loginPage(c: Context, v: LoginView, status?: 200 | 401 | 403 | 429): Response | Promise<Response>;
+export declare function totpPage(c: Context, v: {
+    mfa: string;
+    continueTo: string;
+    csrf: string;
+    error?: string;
+}, status?: 200 | 401): Response | Promise<Response>;
+export interface ConsentView {
+    clientName: string;
+    redirectHost: string;
+    username: string;
+    endpoints: {
+        resource: string;
+        slug: string;
+        name: string;
+        checked: boolean;
+    }[];
+    formToken: string;
+    /** Pre-selected access ceiling; read-only unless the user picks otherwise. */
+    access: 'read' | 'write';
+    error?: string;
+}
+export declare function consentPage(c: Context, v: ConsentView): Response | Promise<Response>;
+export interface ApprovalView {
+    token: string;
+    csrf: string;
+    username: string;
+    slug: string;
+    instanceName: string;
+    operationKey: string;
+    locked: boolean;
+    summary: string;
+    params: unknown;
+    targets: unknown;
+    diff: unknown;
+    expiresAt: Date;
+    confirmLiteral: string | null;
+    /** Ask for a TOTP code with the decision (locked operations without a recent one). */
+    needsTotp: boolean;
+    status: string;
+    error?: string;
+}
+export declare function approvalPage(c: Context, v: ApprovalView, status?: 200 | 400): Response | Promise<Response>;
+export {};