agentic-qe 3.3.4 → 3.4.0

package/v3/dist/adapters/a2a/auth/middleware.d.ts

@@ -0,0 +1,173 @@
+/**
+ * A2A OAuth 2.0 JWT Middleware
+ *
+ * JWT validation middleware for protecting A2A endpoints.
+ * Supports Bearer token authentication, scope validation, and optional auth.
+ *
+ * @module adapters/a2a/auth/middleware
+ * @see https://datatracker.ietf.org/doc/html/rfc6750
+ */
+import type { HttpRequest, HttpResponse, NextFunction, AuthenticatedRequest } from '../discovery/routes.js';
+/**
+ * Token claims extracted from JWT
+ */
+export interface TokenClaims {
+    /** Subject (user/client ID) */
+    readonly sub: string;
+    /** Issuer */
+    readonly iss?: string;
+    /** Audience */
+    readonly aud?: string | string[];
+    /** Expiration time (Unix timestamp) */
+    readonly exp?: number;
+    /** Issued at (Unix timestamp) */
+    readonly iat?: number;
+    /** Not before (Unix timestamp) */
+    readonly nbf?: number;
+    /** JWT ID */
+    readonly jti?: string;
+    /** OAuth 2.0 scopes (space-separated or array) */
+    readonly scope?: string | string[];
+    /** Client ID for client credentials grant */
+    readonly client_id?: string;
+    /** Additional custom claims */
+    readonly [key: string]: unknown;
+}
+/**
+ * JWT verifier interface
+ * Allows plugging in different JWT verification implementations
+ */
+export interface JWTVerifier {
+    /**
+     * Verify a JWT token and return the claims
+     * @throws Error if token is invalid
+     */
+    verify(token: string): Promise<TokenClaims>;
+}
+/**
+ * Extended request with authentication info
+ */
+export interface JWTAuthenticatedRequest extends AuthenticatedRequest {
+    /** Token claims */
+    claims?: TokenClaims;
+    /** Parsed scopes from token */
+    scopes?: string[];
+    /** Raw token (for forwarding) */
+    token?: string;
+}
+/**
+ * Middleware options
+ */
+export interface JWTMiddlewareOptions {
+    /** JWT verifier instance */
+    readonly verifier: JWTVerifier;
+    /** Allow requests without Authorization header (sets user to undefined) */
+    readonly optional?: boolean;
+    /** Required audience claim */
+    readonly audience?: string;
+    /** Required issuer claim */
+    readonly issuer?: string;
+    /** Clock tolerance in seconds for exp/nbf validation */
+    readonly clockTolerance?: number;
+}
+/**
+ * Scope requirement options
+ */
+export interface ScopeOptions {
+    /** Require all scopes (AND) vs any scope (OR) */
+    readonly requireAll?: boolean;
+}
+/**
+ * OAuth 2.0 error types as defined in RFC 6749
+ */
+export type OAuthErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'access_denied' | 'invalid_token' | 'insufficient_scope';
+/**
+ * OAuth 2.0 error response
+ */
+export interface OAuthError {
+    readonly error: OAuthErrorType;
+    readonly error_description?: string;
+    readonly error_uri?: string;
+}
+/**
+ * Create an OAuth 2.0 error response
+ */
+export declare function createOAuthError(type: OAuthErrorType, description?: string, uri?: string): OAuthError;
+/**
+ * Extract Bearer token from Authorization header
+ * @param req HTTP request
+ * @returns Token string or null if not present/invalid
+ */
+export declare function extractBearerToken(req: HttpRequest): string | null;
+/**
+ * Parse scope string or array into array of scopes
+ */
+export declare function parseScopes(scope: string | string[] | undefined): string[];
+/**
+ * Create JWT authentication middleware
+ *
+ * @param options Middleware options
+ * @returns Express-compatible middleware function
+ *
+ * @example
+ * ```typescript
+ * const authMiddleware = createJWTMiddleware({
+ *   verifier: myJWTVerifier,
+ *   issuer: 'https://auth.example.com',
+ *   audience: 'api://my-api',
+ * });
+ *
+ * app.use('/api', authMiddleware);
+ * ```
+ */
+export declare function createJWTMiddleware(options: JWTMiddlewareOptions): (req: HttpRequest, res: HttpResponse, next?: NextFunction) => Promise<void>;
+/**
+ * Shorthand factory for JWT auth middleware
+ */
+export declare function jwtAuthMiddleware(options: JWTMiddlewareOptions): (req: HttpRequest, res: HttpResponse, next?: NextFunction) => Promise<void>;
+/**
+ * Create scope validation middleware
+ *
+ * Must be used after JWT authentication middleware
+ *
+ * @param requiredScopes Scopes to require
+ * @param options Scope options
+ * @returns Express-compatible middleware function
+ *
+ * @example
+ * ```typescript
+ * // Require all scopes
+ * app.post('/tasks', authMiddleware, requireScopes('tasks:write', 'tasks:read'));
+ *
+ * // Require any scope
+ * app.get('/tasks', authMiddleware, requireScopes('tasks:read', 'tasks:admin', { requireAll: false }));
+ * ```
+ */
+export declare function requireScopes(...args: [...string[], ScopeOptions] | string[]): (req: HttpRequest, res: HttpResponse, next?: NextFunction) => void;
+/**
+ * Check if request has a specific scope
+ * Utility function for conditional logic in handlers
+ */
+export declare function hasScope(req: HttpRequest, scope: string): boolean;
+/**
+ * Check if request has any of the specified scopes
+ */
+export declare function hasAnyScope(req: HttpRequest, scopes: string[]): boolean;
+/**
+ * Check if request has all of the specified scopes
+ */
+export declare function hasAllScopes(req: HttpRequest, scopes: string[]): boolean;
+/**
+ * Create optional authentication middleware
+ * Same as jwtAuthMiddleware with optional: true
+ */
+export declare function optionalAuth(options: Omit<JWTMiddlewareOptions, 'optional'>): (req: HttpRequest, res: HttpResponse, next?: NextFunction) => Promise<void>;
+/**
+ * No-op authentication middleware for testing/development
+ * Sets a mock user on the request
+ */
+export declare function mockAuthMiddleware(mockUser?: {
+    id: string;
+    scopes?: string[];
+}): (req: HttpRequest, res: HttpResponse, next?: NextFunction) => void;
+//# sourceMappingURL=middleware.d.ts.map

package/v3/dist/adapters/a2a/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../src/adapters/a2a/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACrB,MAAM,wBAAwB,CAAC;AAYhC;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa;IACb,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,mBAAmB;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,4BAA4B;IAC5B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAMD;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,GACf,eAAe,GACf,eAAe,GACf,oBAAoB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACX,UAAU,CASZ;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAqBlE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAS1E;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CA+G7E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAE7E;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAC3B,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,YAAY,CAAC,GAAG,MAAM,EAAE,GAC9C,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,CA2CpE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAIvE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAIxE;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,GAC9C,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3C,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,CAapE"}

package/v3/dist/adapters/a2a/auth/middleware.js

@@ -0,0 +1,300 @@
+/**
+ * A2A OAuth 2.0 JWT Middleware
+ *
+ * JWT validation middleware for protecting A2A endpoints.
+ * Supports Bearer token authentication, scope validation, and optional auth.
+ *
+ * @module adapters/a2a/auth/middleware
+ * @see https://datatracker.ietf.org/doc/html/rfc6750
+ */
+import { A2A_ERRORS, A2A_ERROR_MESSAGES, getHttpStatusCode, } from '../jsonrpc/errors.js';
+/**
+ * Create an OAuth 2.0 error response
+ */
+export function createOAuthError(type, description, uri) {
+    const error = { error: type };
+    if (description) {
+        error.error_description = description;
+    }
+    if (uri) {
+        error.error_uri = uri;
+    }
+    return error;
+}
+// ============================================================================
+// Token Extraction
+// ============================================================================
+/**
+ * Extract Bearer token from Authorization header
+ * @param req HTTP request
+ * @returns Token string or null if not present/invalid
+ */
+export function extractBearerToken(req) {
+    const authHeader = req.header('Authorization');
+    if (!authHeader) {
+        return null;
+    }
+    // RFC 6750: Bearer token must be in "Bearer <token>" format
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {
+        return null;
+    }
+    const token = parts[1];
+    // Basic validation: token should not be empty
+    if (!token || token.length === 0) {
+        return null;
+    }
+    return token;
+}
+/**
+ * Parse scope string or array into array of scopes
+ */
+export function parseScopes(scope) {
+    if (!scope) {
+        return [];
+    }
+    if (Array.isArray(scope)) {
+        return scope;
+    }
+    // OAuth 2.0 uses space-separated scopes
+    return scope.split(' ').filter((s) => s.length > 0);
+}
+// ============================================================================
+// JWT Middleware
+// ============================================================================
+/**
+ * Create JWT authentication middleware
+ *
+ * @param options Middleware options
+ * @returns Express-compatible middleware function
+ *
+ * @example
+ * ```typescript
+ * const authMiddleware = createJWTMiddleware({
+ *   verifier: myJWTVerifier,
+ *   issuer: 'https://auth.example.com',
+ *   audience: 'api://my-api',
+ * });
+ *
+ * app.use('/api', authMiddleware);
+ * ```
+ */
+export function createJWTMiddleware(options) {
+    const { verifier, optional = false, audience, issuer, clockTolerance = 0 } = options;
+    return async (req, res, next) => {
+        const authReq = req;
+        try {
+            // Extract token
+            const token = extractBearerToken(req);
+            if (!token) {
+                if (optional) {
+                    // Allow request without auth
+                    authReq.user = undefined;
+                    authReq.claims = undefined;
+                    authReq.scopes = [];
+                    if (next)
+                        next();
+                    return;
+                }
+                // Return 401 with WWW-Authenticate header (RFC 6750)
+                res.setHeader('WWW-Authenticate', 'Bearer realm="a2a"');
+                res
+                    .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                    .json(createOAuthError('invalid_request', 'Missing Authorization header'));
+                return;
+            }
+            // Verify token
+            let claims;
+            try {
+                claims = await verifier.verify(token);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'Token verification failed';
+                res.setHeader('WWW-Authenticate', `Bearer realm="a2a", error="invalid_token", error_description="${message}"`);
+                res
+                    .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                    .json(createOAuthError('invalid_token', message));
+                return;
+            }
+            // Validate expiration
+            const now = Math.floor(Date.now() / 1000);
+            if (claims.exp !== undefined && claims.exp + clockTolerance < now) {
+                res.setHeader('WWW-Authenticate', 'Bearer realm="a2a", error="invalid_token", error_description="Token expired"');
+                res
+                    .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                    .json(createOAuthError('invalid_token', 'Token expired'));
+                return;
+            }
+            // Validate not-before
+            if (claims.nbf !== undefined && claims.nbf - clockTolerance > now) {
+                res.setHeader('WWW-Authenticate', 'Bearer realm="a2a", error="invalid_token", error_description="Token not yet valid"');
+                res
+                    .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                    .json(createOAuthError('invalid_token', 'Token not yet valid'));
+                return;
+            }
+            // Validate issuer
+            if (issuer && claims.iss !== issuer) {
+                res.setHeader('WWW-Authenticate', 'Bearer realm="a2a", error="invalid_token", error_description="Invalid issuer"');
+                res
+                    .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                    .json(createOAuthError('invalid_token', 'Invalid issuer'));
+                return;
+            }
+            // Validate audience
+            if (audience) {
+                const tokenAudience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+                if (!tokenAudience.includes(audience)) {
+                    res.setHeader('WWW-Authenticate', 'Bearer realm="a2a", error="invalid_token", error_description="Invalid audience"');
+                    res
+                        .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                        .json(createOAuthError('invalid_token', 'Invalid audience'));
+                    return;
+                }
+            }
+            // Parse scopes
+            const scopes = parseScopes(claims.scope);
+            // Attach to request
+            authReq.token = token;
+            authReq.claims = claims;
+            authReq.scopes = scopes;
+            authReq.user = {
+                id: claims.sub,
+                scopes,
+            };
+            if (next)
+                next();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Authentication error';
+            res
+                .status(500)
+                .json({
+                error: {
+                    code: A2A_ERRORS.AUTHENTICATION_REQUIRED,
+                    message: A2A_ERROR_MESSAGES[A2A_ERRORS.AUTHENTICATION_REQUIRED],
+                    data: { details: message },
+                },
+            });
+        }
+    };
+}
+/**
+ * Shorthand factory for JWT auth middleware
+ */
+export function jwtAuthMiddleware(options) {
+    return createJWTMiddleware(options);
+}
+// ============================================================================
+// Scope Validation Middleware
+// ============================================================================
+/**
+ * Create scope validation middleware
+ *
+ * Must be used after JWT authentication middleware
+ *
+ * @param requiredScopes Scopes to require
+ * @param options Scope options
+ * @returns Express-compatible middleware function
+ *
+ * @example
+ * ```typescript
+ * // Require all scopes
+ * app.post('/tasks', authMiddleware, requireScopes('tasks:write', 'tasks:read'));
+ *
+ * // Require any scope
+ * app.get('/tasks', authMiddleware, requireScopes('tasks:read', 'tasks:admin', { requireAll: false }));
+ * ```
+ */
+export function requireScopes(...args) {
+    // Parse arguments
+    let requiredScopes;
+    let options = { requireAll: true };
+    const lastArg = args[args.length - 1];
+    if (typeof lastArg === 'object' && lastArg !== null) {
+        options = lastArg;
+        requiredScopes = args.slice(0, -1);
+    }
+    else {
+        requiredScopes = args;
+    }
+    return (req, res, next) => {
+        const authReq = req;
+        // Check if authenticated
+        if (!authReq.user || !authReq.scopes) {
+            res.setHeader('WWW-Authenticate', 'Bearer realm="a2a"');
+            res
+                .status(getHttpStatusCode(A2A_ERRORS.AUTHENTICATION_REQUIRED))
+                .json(createOAuthError('invalid_request', 'Authentication required'));
+            return;
+        }
+        const userScopes = new Set(authReq.scopes);
+        // Check scopes
+        const hasScopes = options.requireAll
+            ? requiredScopes.every((scope) => userScopes.has(scope))
+            : requiredScopes.some((scope) => userScopes.has(scope));
+        if (!hasScopes) {
+            const scopeList = requiredScopes.join(' ');
+            res.setHeader('WWW-Authenticate', `Bearer realm="a2a", scope="${scopeList}", error="insufficient_scope"`);
+            res
+                .status(getHttpStatusCode(A2A_ERRORS.AUTHORIZATION_FAILED))
+                .json(createOAuthError('insufficient_scope', `Required scope(s): ${scopeList}`));
+            return;
+        }
+        if (next)
+            next();
+    };
+}
+/**
+ * Check if request has a specific scope
+ * Utility function for conditional logic in handlers
+ */
+export function hasScope(req, scope) {
+    const authReq = req;
+    return authReq.scopes?.includes(scope) ?? false;
+}
+/**
+ * Check if request has any of the specified scopes
+ */
+export function hasAnyScope(req, scopes) {
+    const authReq = req;
+    const userScopes = new Set(authReq.scopes ?? []);
+    return scopes.some((scope) => userScopes.has(scope));
+}
+/**
+ * Check if request has all of the specified scopes
+ */
+export function hasAllScopes(req, scopes) {
+    const authReq = req;
+    const userScopes = new Set(authReq.scopes ?? []);
+    return scopes.every((scope) => userScopes.has(scope));
+}
+// ============================================================================
+// Utility Middleware
+// ============================================================================
+/**
+ * Create optional authentication middleware
+ * Same as jwtAuthMiddleware with optional: true
+ */
+export function optionalAuth(options) {
+    return createJWTMiddleware({ ...options, optional: true });
+}
+/**
+ * No-op authentication middleware for testing/development
+ * Sets a mock user on the request
+ */
+export function mockAuthMiddleware(mockUser) {
+    const user = mockUser ?? { id: 'mock-user', scopes: ['*'] };
+    return (req, _res, next) => {
+        const authReq = req;
+        authReq.user = user;
+        authReq.scopes = user.scopes ?? [];
+        authReq.claims = {
+            sub: user.id,
+            scope: user.scopes?.join(' '),
+        };
+        if (next)
+            next();
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/v3/dist/adapters/a2a/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../../src/adapters/a2a/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AA2G9B;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,WAAoB,EACpB,GAAY;IAEZ,MAAM,KAAK,GAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,WAAW,EAAE,CAAC;QACf,KAAwC,CAAC,iBAAiB,GAAG,WAAW,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACP,KAAgC,CAAC,SAAS,GAAG,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAgB;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAE/C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEvB,8CAA8C;IAC9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAoC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wCAAwC;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC;IAErF,OAAO,KAAK,EACV,GAAgB,EAChB,GAAiB,EACjB,IAAmB,EACJ,EAAE;QACjB,MAAM,OAAO,GAAG,GAA8B,CAAC;QAE/C,IAAI,CAAC;YACH,gBAAgB;YAChB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,QAAQ,EAAE,CAAC;oBACb,6BAA6B;oBAC7B,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;oBACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;oBAC3B,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;oBACpB,IAAI,IAAI;wBAAE,IAAI,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,qDAAqD;gBACrD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;gBACxD,GAAG;qBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;qBAC7D,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,eAAe;YACf,IAAI,MAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;gBACrF,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,iEAAiE,OAAO,GAAG,CAAC,CAAC;gBAC/G,GAAG;qBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;qBAC7D,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,sBAAsB;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;gBAClE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,8EAA8E,CAAC,CAAC;gBAClH,GAAG;qBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;qBAC7D,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,sBAAsB;YACtB,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;gBAClE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,oFAAoF,CAAC,CAAC;gBACxH,GAAG;qBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;qBAC7D,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YAED,kBAAkB;YAClB,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,+EAA+E,CAAC,CAAC;gBACnH,GAAG;qBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;qBAC7D,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,iFAAiF,CAAC,CAAC;oBACrH,GAAG;yBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;yBAC7D,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;YACH,CAAC;YAED,eAAe;YACf,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzC,oBAAoB;YACpB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;YACtB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,MAAM;aACP,CAAC;YAEF,IAAI,IAAI;gBAAE,IAAI,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;YAChF,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,UAAU,CAAC,uBAAuB;oBACxC,OAAO,EAAE,kBAAkB,CAAC,UAAU,CAAC,uBAAuB,CAAC;oBAC/D,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;iBAC3B;aACF,CAAC,CAAC;QACP,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA6B;IAE7B,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAG,IAA4C;IAE/C,kBAAkB;IAClB,IAAI,cAAwB,CAAC;IAC7B,IAAI,OAAO,GAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,GAAG,OAAuB,CAAC;QAClC,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,cAAc,GAAG,IAAgB,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAgB,EAAE,GAAiB,EAAE,IAAmB,EAAQ,EAAE;QACxE,MAAM,OAAO,GAAG,GAA8B,CAAC;QAE/C,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;YACxD,GAAG;iBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;iBAC7D,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3C,eAAe;QACf,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,8BAA8B,SAAS,+BAA+B,CAAC,CAAC;YAC1G,GAAG;iBACA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;iBAC1D,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,sBAAsB,SAAS,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAgB,EAAE,KAAa;IACtD,MAAM,OAAO,GAAG,GAA8B,CAAC;IAC/C,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,MAAgB;IAC5D,MAAM,OAAO,GAAG,GAA8B,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,MAAgB;IAC7D,MAAM,OAAO,GAAG,GAA8B,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA+C;IAE/C,OAAO,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4C;IAE5C,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAE5D,OAAO,CAAC,GAAgB,EAAE,IAAkB,EAAE,IAAmB,EAAQ,EAAE;QACzE,MAAM,OAAO,GAAG,GAA8B,CAAC;QAC/C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,GAAG;YACf,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;QACF,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}