codexgpt 1.0.0

package/dist/auth/clientStore.js

@@ -0,0 +1,469 @@
+import { createHash, randomBytes as nodeRandomBytes } from "node:crypto";
+import { TextDecoder } from "node:util";
+import { OAuthProtocolError, authConfigurationError } from "./errors.js";
+import { KNOWN_OAUTH_SCOPES } from "./types.js";
+export const DCR_BODY_MAX_BYTES = 16 * 1024;
+export const DCR_MAX_PROPERTIES = 32;
+export const DCR_MAX_DEPTH = 4;
+export const DCR_UNAPPROVED_LIMIT = 32;
+export const DCR_APPROVED_LIMIT = 16;
+export const DCR_UNAPPROVED_LIFETIME_MS = 24 * 60 * 60 * 1000;
+const LEGACY_CHATGPT_REDIRECT = "https://chatgpt.com/connector_platform_oauth_redirect";
+const CURRENT_CHATGPT_REDIRECT = /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]{8,160}$/;
+const FORBIDDEN_DISPLAY_PATTERN = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
+const FORBIDDEN_DCR_FIELDS = new Set([
+    "client_id",
+    "client_secret",
+    "client_secret_expires_at",
+    "jwks",
+    "jwks_uri",
+    "software_statement",
+    "registration_access_token",
+    "registration_client_uri",
+    "token_endpoint_auth_signing_alg",
+    "request_uris"
+]);
+class BoundedJsonParser {
+    text;
+    #index = 0;
+    #properties = 0;
+    constructor(text) {
+        this.text = text;
+    }
+    parseObjectRoot() {
+        this.#skipWhitespace();
+        const value = this.#parseValue(1);
+        this.#skipWhitespace();
+        if (this.#index !== this.text.length || !value || Array.isArray(value) || typeof value !== "object") {
+            throw invalidRegistration("Registration body must be one JSON object.");
+        }
+        return value;
+    }
+    #parseValue(depth) {
+        if (depth > DCR_MAX_DEPTH)
+            throw invalidRegistration("Registration JSON nesting is too deep.");
+        this.#skipWhitespace();
+        const character = this.text[this.#index];
+        if (character === "{")
+            return this.#parseObject(depth);
+        if (character === "[")
+            return this.#parseArray(depth);
+        if (character === '"')
+            return this.#parseString();
+        if (character === "t" && this.text.startsWith("true", this.#index)) {
+            this.#index += 4;
+            return true;
+        }
+        if (character === "f" && this.text.startsWith("false", this.#index)) {
+            this.#index += 5;
+            return false;
+        }
+        if (character === "n" && this.text.startsWith("null", this.#index)) {
+            this.#index += 4;
+            return null;
+        }
+        return this.#parseNumber();
+    }
+    #parseObject(depth) {
+        this.#index += 1;
+        const output = Object.create(null);
+        const keys = new Set();
+        this.#skipWhitespace();
+        if (this.text[this.#index] === "}") {
+            this.#index += 1;
+            return output;
+        }
+        while (true) {
+            this.#skipWhitespace();
+            if (this.text[this.#index] !== '"')
+                throw invalidRegistration("Registration JSON object key is invalid.");
+            const key = this.#parseString();
+            this.#properties += 1;
+            if (this.#properties > DCR_MAX_PROPERTIES)
+                throw invalidRegistration("Registration JSON has too many properties.");
+            if (keys.has(key))
+                throw invalidRegistration("Registration JSON contains duplicate fields.");
+            keys.add(key);
+            this.#skipWhitespace();
+            if (this.text[this.#index] !== ":")
+                throw invalidRegistration("Registration JSON object is malformed.");
+            this.#index += 1;
+            output[key] = this.#parseValue(depth + 1);
+            this.#skipWhitespace();
+            const separator = this.text[this.#index];
+            if (separator === "}") {
+                this.#index += 1;
+                return output;
+            }
+            if (separator !== ",")
+                throw invalidRegistration("Registration JSON object is malformed.");
+            this.#index += 1;
+        }
+    }
+    #parseArray(depth) {
+        this.#index += 1;
+        const output = [];
+        this.#skipWhitespace();
+        if (this.text[this.#index] === "]") {
+            this.#index += 1;
+            return output;
+        }
+        while (true) {
+            output.push(this.#parseValue(depth + 1));
+            this.#skipWhitespace();
+            const separator = this.text[this.#index];
+            if (separator === "]") {
+                this.#index += 1;
+                return output;
+            }
+            if (separator !== ",")
+                throw invalidRegistration("Registration JSON array is malformed.");
+            this.#index += 1;
+        }
+    }
+    #parseString() {
+        const start = this.#index;
+        this.#index += 1;
+        let escaped = false;
+        while (this.#index < this.text.length) {
+            const character = this.text[this.#index];
+            if (!escaped && character === '"') {
+                this.#index += 1;
+                try {
+                    return JSON.parse(this.text.slice(start, this.#index));
+                }
+                catch {
+                    throw invalidRegistration("Registration JSON string is invalid.");
+                }
+            }
+            if (!escaped && character === "\\")
+                escaped = true;
+            else
+                escaped = false;
+            this.#index += 1;
+        }
+        throw invalidRegistration("Registration JSON string is unterminated.");
+    }
+    #parseNumber() {
+        const remainder = this.text.slice(this.#index);
+        const match = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(remainder);
+        if (!match)
+            throw invalidRegistration("Registration JSON value is invalid.");
+        this.#index += match[0].length;
+        const value = Number(match[0]);
+        if (!Number.isFinite(value))
+            throw invalidRegistration("Registration JSON number is invalid.");
+        return value;
+    }
+    #skipWhitespace() {
+        while (this.#index < this.text.length && /[\t\n\r ]/.test(this.text[this.#index]))
+            this.#index += 1;
+    }
+}
+function invalidRegistration(message) {
+    return new OAuthProtocolError("invalid_client_metadata", message);
+}
+function utf8Bytes(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function boundedString(value, label, maximumBytes, nullable = false) {
+    if (value === undefined && nullable)
+        return null;
+    if (typeof value !== "string" || value.length === 0 || utf8Bytes(value) > maximumBytes || FORBIDDEN_DISPLAY_PATTERN.test(value)) {
+        throw invalidRegistration(`${label} is invalid.`);
+    }
+    return value;
+}
+function optionalHttpsUrl(value, label) {
+    if (value === undefined || value === "")
+        return null;
+    const text = boundedString(value, label, 2048);
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        throw invalidRegistration(`${label} is invalid.`);
+    }
+    if (url.protocol !== "https:" || url.username || url.password || url.hash) {
+        throw invalidRegistration(`${label} is invalid.`);
+    }
+    return text;
+}
+function exactStringArray(value, label) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+        throw invalidRegistration(`${label} is invalid.`);
+    }
+    return [...value];
+}
+function parseScopes(value) {
+    if (value === undefined)
+        return Object.freeze([...KNOWN_OAUTH_SCOPES]);
+    if (typeof value !== "string" || value.length === 0 || utf8Bytes(value) > 256 || /\s{2,}|[^\x20-\x7e]/.test(value)) {
+        throw new OAuthProtocolError("invalid_scope", "Registration scope is invalid.");
+    }
+    const requested = value.split(" ");
+    const unique = new Set(requested);
+    if (unique.size !== requested.length || requested.some((scope) => !KNOWN_OAUTH_SCOPES.includes(scope))) {
+        throw new OAuthProtocolError("invalid_scope", "Registration scope is invalid.");
+    }
+    return Object.freeze(KNOWN_OAUTH_SCOPES.filter((scope) => unique.has(scope)));
+}
+export function parseDynamicClientRegistration(raw) {
+    const bytes = Buffer.isBuffer(raw) ? raw : Buffer.from(raw, "utf8");
+    if (bytes.length < 2 || bytes.length > DCR_BODY_MAX_BYTES) {
+        throw invalidRegistration("Registration body size is invalid.");
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw invalidRegistration("Registration body must be valid UTF-8.");
+    }
+    const input = new BoundedJsonParser(text).parseObjectRoot();
+    for (const key of Object.keys(input)) {
+        if (FORBIDDEN_DCR_FIELDS.has(key))
+            throw invalidRegistration(`${key} is not accepted.`);
+    }
+    const redirectUris = exactStringArray(input.redirect_uris, "redirect_uris");
+    if (redirectUris.length !== 1) {
+        throw new OAuthProtocolError("invalid_redirect_uri", "Exactly one ChatGPT redirect URI is required.");
+    }
+    const redirectUri = redirectUris[0];
+    if (utf8Bytes(redirectUri) > 2048 || (redirectUri !== LEGACY_CHATGPT_REDIRECT && !CURRENT_CHATGPT_REDIRECT.test(redirectUri))) {
+        throw new OAuthProtocolError("invalid_redirect_uri", "The redirect URI is not an accepted ChatGPT callback.");
+    }
+    if (input.response_types !== undefined) {
+        const values = exactStringArray(input.response_types, "response_types");
+        if (values.length !== 1 || values[0] !== "code")
+            throw invalidRegistration("response_types must be exactly code.");
+    }
+    if (input.grant_types !== undefined) {
+        const values = exactStringArray(input.grant_types, "grant_types");
+        const set = new Set(values);
+        if (values.length !== 2 || set.size !== 2 || !set.has("authorization_code") || !set.has("refresh_token")) {
+            throw invalidRegistration("grant_types must contain authorization_code and refresh_token.");
+        }
+    }
+    if (input.token_endpoint_auth_method !== undefined && input.token_endpoint_auth_method !== "none") {
+        throw invalidRegistration("token_endpoint_auth_method must be none.");
+    }
+    const contacts = input.contacts === undefined ? [] : exactStringArray(input.contacts, "contacts");
+    if (contacts.length > 8 || contacts.some((entry) => entry.length === 0 || utf8Bytes(entry) > 128 || FORBIDDEN_DISPLAY_PATTERN.test(entry))) {
+        throw invalidRegistration("contacts is invalid.");
+    }
+    return Object.freeze({
+        redirectUri,
+        clientName: boundedString(input.client_name, "client_name", 128, true),
+        clientUri: optionalHttpsUrl(input.client_uri, "client_uri"),
+        logoUri: optionalHttpsUrl(input.logo_uri, "logo_uri"),
+        tosUri: optionalHttpsUrl(input.tos_uri, "tos_uri"),
+        policyUri: optionalHttpsUrl(input.policy_uri, "policy_uri"),
+        contacts: Object.freeze([...contacts]),
+        softwareId: boundedString(input.software_id, "software_id", 128, true),
+        softwareVersion: boundedString(input.software_version, "software_version", 128, true),
+        requestedScopes: parseScopes(input.scope)
+    });
+}
+export function clientRefForId(clientId) {
+    if (!/^client_[A-Za-z0-9_-]{43}$/.test(clientId)) {
+        throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+    }
+    return `clientref_${createHash("sha256").update(clientId, "utf8").digest("hex").slice(0, 32)}`;
+}
+function deploymentLockName(bindingId) {
+    if (!/^binding_[a-f0-9]{32}$/.test(bindingId)) {
+        throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth deployment binding identifier is invalid.");
+    }
+    return `deployment_${bindingId}`;
+}
+function clientInformation(record) {
+    return {
+        redirect_uris: [record.redirectUri],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        scope: KNOWN_OAUTH_SCOPES.join(" "),
+        ...(record.clientName ? { client_name: record.clientName } : {}),
+        ...(record.clientUri ? { client_uri: record.clientUri } : {}),
+        ...(record.logoUri ? { logo_uri: record.logoUri } : {}),
+        ...(record.contacts.length > 0 ? { contacts: [...record.contacts] } : {}),
+        ...(record.tosUri ? { tos_uri: record.tosUri } : {}),
+        ...(record.policyUri ? { policy_uri: record.policyUri } : {}),
+        ...(record.softwareId ? { software_id: record.softwareId } : {}),
+        ...(record.softwareVersion ? { software_version: record.softwareVersion } : {}),
+        client_id: record.clientId,
+        client_id_issued_at: record.issuedAt
+    };
+}
+export class OAuthClientStore {
+    #store;
+    #locks;
+    #bindingId;
+    #incarnationId;
+    #now;
+    #randomBytes;
+    constructor(options) {
+        this.#store = options.store;
+        this.#locks = options.locks;
+        this.#bindingId = options.bindingId;
+        this.#incarnationId = options.incarnationId;
+        this.#now = options.now ?? Date.now;
+        this.#randomBytes = options.randomBytes ?? nodeRandomBytes;
+    }
+    async getClient(clientId) {
+        if (!/^client_[A-Za-z0-9_-]{43}$/.test(clientId))
+            return undefined;
+        const state = this.#readState();
+        const record = (state.clients ?? []).find((entry) => entry.clientId === clientId);
+        if (!record || record.status === "revoked")
+            return undefined;
+        if (record.status === "unapproved" && Date.parse(record.expiresAt ?? "") <= this.#now())
+            return undefined;
+        return clientInformation(record);
+    }
+    getRecord(clientId) {
+        const state = this.#readState();
+        const record = (state.clients ?? []).find((entry) => entry.clientId === clientId);
+        if (!record || record.status === "revoked")
+            return undefined;
+        if (record.status === "unapproved" && Date.parse(record.expiresAt ?? "") <= this.#now())
+            return undefined;
+        return structuredClone(record);
+    }
+    async register(input) {
+        return await this.#mutate("client_registered", async (state, now) => {
+            const active = (state.clients ?? []).filter((record) => record.status === "approved" || (record.status === "unapproved" && Date.parse(record.expiresAt ?? "") > now));
+            const unapproved = active.filter((record) => record.status === "unapproved").length;
+            if (unapproved >= DCR_UNAPPROVED_LIMIT) {
+                throw new OAuthProtocolError("temporarily_unavailable", "Client registration capacity is full.", 503, "Run `codexgpt oauth-clients list --server <server_id>`, revoke an unused client, and retry.");
+            }
+            const random = this.#random(32);
+            const clientId = `client_${random.toString("base64url")}`;
+            const clientRef = clientRefForId(clientId);
+            const createdAt = new Date(now).toISOString();
+            const record = {
+                clientId,
+                clientRef,
+                redirectUri: input.redirectUri,
+                clientName: input.clientName,
+                clientUri: input.clientUri,
+                logoUri: input.logoUri,
+                tosUri: input.tosUri,
+                policyUri: input.policyUri,
+                contacts: [...input.contacts],
+                softwareId: input.softwareId,
+                softwareVersion: input.softwareVersion,
+                issuedAt: Math.floor(now / 1000),
+                status: "unapproved",
+                createdAt,
+                expiresAt: new Date(now + DCR_UNAPPROVED_LIFETIME_MS).toISOString(),
+                approvedAt: null
+            };
+            return {
+                clients: [...active, record],
+                result: clientInformation(record)
+            };
+        });
+    }
+    async markApproved(clientId) {
+        return await this.#mutate("client_approved", async (state, now) => {
+            const clients = [...(state.clients ?? [])];
+            const index = clients.findIndex((record) => record.clientId === clientId);
+            if (index < 0 || clients[index].status === "revoked" || (clients[index].status === "unapproved" && Date.parse(clients[index].expiresAt ?? "") <= now)) {
+                throw new OAuthProtocolError("invalid_client", "The OAuth client is unavailable.");
+            }
+            if (clients[index].status === "approved")
+                return { clients, result: structuredClone(clients[index]), changed: false };
+            if (clients.filter((record) => record.status === "approved").length >= DCR_APPROVED_LIMIT) {
+                throw new OAuthProtocolError("temporarily_unavailable", "Approved client capacity is full.", 503, "Run `codexgpt oauth-clients list --server <server_id>`, revoke an unused approved client, and retry.");
+            }
+            clients[index] = {
+                ...clients[index],
+                status: "approved",
+                expiresAt: null,
+                approvedAt: new Date(now).toISOString()
+            };
+            return { clients, result: structuredClone(clients[index]) };
+        });
+    }
+    async revoke(clientId) {
+        return await this.#mutate("client_revoked", (state) => {
+            const clients = [...(state.clients ?? [])];
+            const index = clients.findIndex((record) => record.clientId === clientId);
+            if (index < 0 || clients[index].status === "revoked") {
+                return { clients, result: false, changed: false };
+            }
+            clients[index] = { ...clients[index], status: "revoked", expiresAt: null, approvedAt: null };
+            return { clients, result: true };
+        });
+    }
+    async pruneUnapproved() {
+        return await this.#mutate("client_revoked", (state) => {
+            const previous = state.clients ?? [];
+            const clients = previous.filter((record) => record.status !== "unapproved");
+            const removed = previous.length - clients.length;
+            return { clients, result: removed, changed: removed > 0 };
+        });
+    }
+    listSafe() {
+        const now = this.#now();
+        return (this.#readState().clients ?? [])
+            .filter((record) => record.status !== "unapproved" || Date.parse(record.expiresAt ?? "") > now)
+            .map((record) => {
+            const redirect = new URL(record.redirectUri);
+            return {
+                clientId: record.clientId,
+                clientRef: record.clientRef,
+                label: record.clientName ?? "ChatGPT",
+                redirectHost: redirect.host,
+                redirectPath: redirect.pathname,
+                status: record.status,
+                createdAt: record.createdAt,
+                expiresAt: record.expiresAt,
+                approvedAt: record.approvedAt
+            };
+        });
+    }
+    generation() {
+        return this.#readState().generation;
+    }
+    #readState() {
+        const state = this.#store.readDeployment(this.#bindingId, this.#incarnationId);
+        if (state.bindingId !== this.#bindingId || state.incarnationId !== this.#incarnationId) {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth client store identity changed.");
+        }
+        return state;
+    }
+    async #mutate(transition, action) {
+        let handle = null;
+        try {
+            handle = this.#locks.acquire(deploymentLockName(this.#bindingId));
+            const current = this.#readState();
+            const now = this.#now();
+            const mutation = await action(current, now);
+            if (mutation.changed === false)
+                return mutation.result;
+            const { integrity: _integrity, ...withoutIntegrity } = current;
+            await this.#store.writeDeployment({
+                ...withoutIntegrity,
+                generation: current.generation + 1,
+                clients: mutation.clients,
+                updatedAt: new Date(now).toISOString()
+            }, transition);
+            return mutation.result;
+        }
+        finally {
+            handle?.release();
+        }
+    }
+    #random(size) {
+        const value = this.#randomBytes(size);
+        if (!Buffer.isBuffer(value) || value.length !== size) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth client random source is invalid.");
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=clientStore.js.map

package/dist/auth/clientStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientStore.js","sourceRoot":"","sources":["../../src/auth/clientStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAOzE,OAAO,EACL,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9D,MAAM,uBAAuB,GAAG,uDAAuD,CAAC;AACxF,MAAM,wBAAwB,GAAG,kEAAkE,CAAC;AACpG,MAAM,yBAAyB,GAAG,yDAAyD,CAAC;AAC5F,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW;IACX,eAAe;IACf,0BAA0B;IAC1B,MAAM;IACN,UAAU;IACV,oBAAoB;IACpB,2BAA2B;IAC3B,yBAAyB;IACzB,iCAAiC;IACjC,cAAc;CACf,CAAC,CAAC;AAoCH,MAAM,iBAAiB;IAIA;IAHrB,MAAM,GAAG,CAAC,CAAC;IACX,WAAW,GAAG,CAAC,CAAC;IAEhB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,eAAe;QACb,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpG,MAAM,mBAAmB,CAAC,4CAA4C,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAgC,CAAC;IAC1C,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,KAAK,GAAG,aAAa;YAAE,MAAM,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC/F,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAClD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,MAAM,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;YAC1G,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,WAAW,GAAG,kBAAkB;gBAAE,MAAM,mBAAmB,CAAC,4CAA4C,CAAC,CAAC;YACnH,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,MAAM,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YACxG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,KAAK,GAAG;gBAAE,MAAM,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,KAAK,GAAG;gBAAE,MAAM,mBAAmB,CAAC,uCAAuC,CAAC,CAAC;YAC1F,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,YAAY;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAW,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;;gBAC9C,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;IACzE,CAAC;IAED,YAAY;QACV,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,uDAAuD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK;YAAE,MAAM,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACtG,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa,EAAE,YAAoB,EAAE,QAAQ,GAAG,KAAK;IAC1F,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,YAAY,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChI,MAAM,mBAAmB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAE,CAAC;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,mBAAmB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,mBAAmB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,mBAAmB,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAa,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAmB,CAAC,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,GAAoB;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC1D,MAAM,mBAAmB,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,mBAAmB,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC5E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,+CAA+C,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,KAAK,uBAAuB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,EAAE,uDAAuD,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,MAAM,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACzG,MAAM,mBAAmB,CAAC,gEAAgE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,0BAA0B,KAAK,SAAS,IAAI,KAAK,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;QAClG,MAAM,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3I,MAAM,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW;QACX,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QACrD,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;QAClD,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACtC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC;QACtE,eAAe,EAAE,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,EAAE,IAAI,CAAC;QACrF,eAAe,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,aAAa,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,cAAc,SAAS,EAAoC,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B;IACxD,OAAO;QACL,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QACnC,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;QACxB,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,MAAM,CAAC,QAAQ;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,MAAM,CAAiB;IACvB,MAAM,CAAgB;IACtB,UAAU,CAAS;IACnB,cAAc,CAAS;IACvB,IAAI,CAAe;IACnB,YAAY,CAA2B;IAEhD,YAAY,OAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAkC;QAC/C,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAC7G,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;YACpF,IAAI,UAAU,IAAI,oBAAoB,EAAE,CAAC;gBACvC,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EACzB,uCAAuC,EACvC,GAAG,EACH,6FAA6F,CAC9F,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,MAAM,GAA4B;gBACtC,QAAQ;gBACR,SAAS;gBACT,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;gBAChC,MAAM,EAAE,YAAY;gBACpB,SAAS;gBACT,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC,CAAC,WAAW,EAAE;gBACnE,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,CAAC;gBAC5B,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC;aAClC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAChE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC1E,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACtJ,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACtH,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;gBAC1F,MAAM,IAAI,kBAAkB,CAC1B,yBAAyB,EACzB,mCAAmC,EACnC,GAAG,EACH,sGAAsG,CACvG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,GAAG;gBACf,GAAG,OAAO,CAAC,KAAK,CAAC;gBACjB,MAAM,EAAE,UAAU;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACxC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YACpD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC1E,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACpD,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;aACrC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC;aAC9F,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACd,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7C,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS;gBACrC,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,YAAY,EAAE,QAAQ,CAAC,QAAQ;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC;IACtC,CAAC;IAED,UAAU;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YACvF,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,sCAAsC,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAsE,EACtE,MAAuM;QAEvM,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;YACvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;YAC/D,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;gBAChC,GAAG,gBAAgB;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;gBAClC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACvC,EAAE,UAAU,CAAC,CAAC;YACf,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/auth/cloudflareConfig.js

@@ -0,0 +1,112 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { parse, stringify } from "yaml";
+import { normalizeOAuthHostname } from "./configuration.js";
+const TUNNEL_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function tunnelError(code, message) {
+    return Object.assign(new Error(`${code}: ${message}`), { code });
+}
+function exactPort(value, label) {
+    if (!Number.isInteger(value) || value < 1 || value > 65535) {
+        throw tunnelError("AUTH_TUNNEL_INGRESS_INVALID", `${label} must be an integer from 1 to 65535.`);
+    }
+    return value;
+}
+function exactTunnelId(value) {
+    const normalized = value.trim().toLocaleLowerCase("en-US");
+    if (!TUNNEL_ID_PATTERN.test(normalized)) {
+        throw tunnelError("AUTH_TUNNEL_ID_INVALID", "Cloudflare tunnel id is invalid.");
+    }
+    return normalized;
+}
+function exactCredentialsFile(value) {
+    const normalized = value.trim();
+    if (!normalized || normalized.length > 32768 || /[\u0000-\u001f\u007f]/.test(normalized)) {
+        throw tunnelError("AUTH_TUNNEL_CREDENTIALS_INVALID", "Cloudflare credentials-file path is invalid.");
+    }
+    return normalized;
+}
+export function createDedicatedTunnelConfig(input) {
+    const tunnelId = exactTunnelId(input.tunnelId);
+    const credentialsFile = exactCredentialsFile(input.credentialsFile);
+    const hostname = normalizeOAuthHostname(input.hostname);
+    const publicPort = exactPort(input.publicPort, "Public port");
+    return stringify({
+        tunnel: tunnelId,
+        "credentials-file": credentialsFile,
+        ingress: [
+            { hostname, service: `http://127.0.0.1:${publicPort}` },
+            { service: "http_status:404" }
+        ]
+    }, { lineWidth: 0 });
+}
+export function validateDedicatedTunnelConfig(text, input) {
+    if (!text || Buffer.byteLength(text, "utf8") > 64 * 1024) {
+        throw tunnelError("AUTH_TUNNEL_CONFIG_INVALID", "Cloudflare config is empty or too large.");
+    }
+    let parsed;
+    try {
+        parsed = parse(text, { maxAliasCount: 0, uniqueKeys: true });
+    }
+    catch {
+        throw tunnelError("AUTH_TUNNEL_CONFIG_INVALID", "Cloudflare config is not valid YAML.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw tunnelError("AUTH_TUNNEL_CONFIG_INVALID", "Cloudflare config must be one mapping.");
+    }
+    const record = parsed;
+    const allowedKeys = new Set(["tunnel", "credentials-file", "ingress", "no-autoupdate"]);
+    if (Object.keys(record).some((key) => !allowedKeys.has(key))) {
+        throw tunnelError("AUTH_TUNNEL_SHARED_CONFIG", "Cloudflare config contains unreviewed shared-service settings.");
+    }
+    const tunnelId = exactTunnelId(String(record.tunnel ?? ""));
+    if (input.tunnelId && tunnelId !== exactTunnelId(input.tunnelId)) {
+        throw tunnelError("AUTH_TUNNEL_ID_MISMATCH", "Cloudflare config belongs to another tunnel.");
+    }
+    const credentialsFile = exactCredentialsFile(String(record["credentials-file"] ?? ""));
+    const credentialBasename = path.win32.basename(credentialsFile).toLocaleLowerCase("en-US");
+    if (credentialBasename !== `${tunnelId}.json`) {
+        throw tunnelError("AUTH_TUNNEL_CREDENTIALS_INVALID", "Cloudflare credentials-file must match the exact tunnel id.");
+    }
+    if ("no-autoupdate" in record && record["no-autoupdate"] !== true) {
+        throw tunnelError("AUTH_TUNNEL_CONFIG_INVALID", "Cloudflare no-autoupdate must be true when present.");
+    }
+    const hostname = normalizeOAuthHostname(input.hostname);
+    const publicPort = exactPort(input.publicPort, "Public port");
+    const localAdminPort = exactPort(input.localAdminPort, "Local-admin port");
+    if (publicPort === localAdminPort) {
+        throw tunnelError("AUTH_TUNNEL_ADMIN_EXPOSED", "Public and local-admin ports must be distinct.");
+    }
+    if (!Array.isArray(record.ingress) || record.ingress.length !== 2) {
+        throw tunnelError("AUTH_TUNNEL_SHARED_CONFIG", "OAuth requires one dedicated hostname route and one final 404 route.");
+    }
+    const first = record.ingress[0];
+    const second = record.ingress[1];
+    if (!first || typeof first !== "object" || Array.isArray(first) || !second || typeof second !== "object" || Array.isArray(second)) {
+        throw tunnelError("AUTH_TUNNEL_INGRESS_INVALID", "Cloudflare ingress entries are invalid.");
+    }
+    const firstRecord = first;
+    const secondRecord = second;
+    if (Object.keys(firstRecord).some((key) => key !== "hostname" && key !== "service") ||
+        Object.keys(secondRecord).some((key) => key !== "service")) {
+        throw tunnelError("AUTH_TUNNEL_SHARED_CONFIG", "Cloudflare ingress contains unreviewed fields.");
+    }
+    const service = String(firstRecord.service ?? "");
+    if (service === `http://127.0.0.1:${localAdminPort}` || service.endsWith(`:${localAdminPort}`)) {
+        throw tunnelError("AUTH_TUNNEL_ADMIN_EXPOSED", "Cloudflare ingress must never target the local-admin port.");
+    }
+    if (firstRecord.hostname !== hostname ||
+        service !== `http://127.0.0.1:${publicPort}` ||
+        secondRecord.service !== "http_status:404") {
+        throw tunnelError("AUTH_TUNNEL_INGRESS_INVALID", "Cloudflare ingress does not match the exact OAuth listener contract.");
+    }
+    return Object.freeze({
+        ok: true,
+        tunnelId,
+        credentialsFile,
+        hostname,
+        publicPort,
+        digest: `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`
+    });
+}
+//# sourceMappingURL=cloudflareConfig.js.map

package/dist/auth/cloudflareConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflareConfig.js","sourceRoot":"","sources":["../../src/auth/cloudflareConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,iBAAiB,GAAG,4EAA4E,CAAC;AAyBvG,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAC3D,MAAM,WAAW,CAAC,6BAA6B,EAAE,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzF,MAAM,WAAW,CAAC,iCAAiC,EAAE,8CAA8C,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAiC;IAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,QAAQ;QAChB,kBAAkB,EAAE,eAAe;QACnC,OAAO,EAAE;YACP,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,UAAU,EAAE,EAAE;YACvD,EAAE,OAAO,EAAE,iBAAiB,EAAE;SAC/B;KACF,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,KAAqC;IAErC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACzD,MAAM,WAAW,CAAC,4BAA4B,EAAE,0CAA0C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,CAAC,4BAA4B,EAAE,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,WAAW,CAAC,4BAA4B,EAAE,wCAAwC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,WAAW,CAAC,2BAA2B,EAAE,gEAAgE,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,QAAQ,IAAI,QAAQ,KAAK,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,CAAC,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,kBAAkB,KAAK,GAAG,QAAQ,OAAO,EAAE,CAAC;QAC9C,MAAM,WAAW,CAAC,iCAAiC,EAAE,6DAA6D,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,WAAW,CAAC,4BAA4B,EAAE,qDAAqD,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC3E,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,CAAC,2BAA2B,EAAE,gDAAgD,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,WAAW,CAAC,2BAA2B,EAAE,sEAAsE,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClI,MAAM,WAAW,CAAC,6BAA6B,EAAE,yCAAyC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,WAAW,GAAG,KAAgC,CAAC;IACrD,MAAM,YAAY,GAAG,MAAiC,CAAC;IACvD,IACE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,EAC1D,CAAC;QACD,MAAM,WAAW,CAAC,2BAA2B,EAAE,gDAAgD,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,oBAAoB,cAAc,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,cAAc,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,WAAW,CAAC,2BAA2B,EAAE,4DAA4D,CAAC,CAAC;IAC/G,CAAC;IACD,IACE,WAAW,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,KAAK,oBAAoB,UAAU,EAAE;QAC5C,YAAY,CAAC,OAAO,KAAK,iBAAiB,EAC1C,CAAC;QACD,MAAM,WAAW,CAAC,6BAA6B,EAAE,sEAAsE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,IAAa;QACjB,QAAQ;QACR,eAAe;QACf,QAAQ;QACR,UAAU;QACV,MAAM,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC"}