codexgpt 1.0.0

package/dist/auth/errors.js

@@ -0,0 +1,26 @@
+export class AuthConfigurationError extends Error {
+    code;
+    repairCommand;
+    constructor(code, message, options = {}) {
+        super(message, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = "AuthConfigurationError";
+        this.code = code;
+        this.repairCommand = options.repairCommand;
+    }
+}
+export function authConfigurationError(code, message, repairCommand) {
+    return new AuthConfigurationError(code, message, repairCommand ? { repairCommand } : {});
+}
+export class OAuthProtocolError extends Error {
+    oauthCode;
+    statusCode;
+    localAction;
+    constructor(oauthCode, message, statusCode = 400, localAction) {
+        super(message);
+        this.oauthCode = oauthCode;
+        this.statusCode = statusCode;
+        this.localAction = localAction;
+        this.name = "OAuthProtocolError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAAgB;IACpB,aAAa,CAAU;IAEhC,YAAY,IAAmB,EAAE,OAAe,EAAE,UAAuD,EAAE;QACzG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAmB,EACnB,OAAe,EACf,aAAsB;IAEtB,OAAO,IAAI,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAaD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IAEA;IACA;IAJX,YACW,SAAiC,EAC1C,OAAe,EACN,aAAa,GAAG,EAChB,WAAoB;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAwB;QAEjC,eAAU,GAAV,UAAU,CAAM;QAChB,gBAAW,GAAX,WAAW,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/auth/grantStore.js

@@ -0,0 +1,307 @@
+import { timingSafeEqual } from "node:crypto";
+import { OAuthProtocolError, authConfigurationError } from "./errors.js";
+export const OAUTH_REFRESH_IDLE_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
+export const OAUTH_REFRESH_ABSOLUTE_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
+export const OAUTH_ACTIVE_GRANT_DEPLOYMENT_LIMIT = 64;
+export const OAUTH_ACTIVE_GRANT_CLIENT_LIMIT = 8;
+function deploymentLockName(bindingId) {
+    if (!/^binding_[a-f0-9]{32}$/.test(bindingId)) {
+        throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth deployment binding identifier is invalid.");
+    }
+    return `deployment_${bindingId}`;
+}
+export function isOAuthGrantRecord(record) {
+    return "familyHandle" in record && "refreshTokenHash" in record;
+}
+function exactHashEqual(left, right) {
+    const leftBytes = Buffer.from(left, "utf8");
+    const rightBytes = Buffer.from(right, "utf8");
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function invalidGrant() {
+    return new OAuthProtocolError("invalid_grant", "The OAuth grant is invalid.");
+}
+export class OAuthGrantStore {
+    #store;
+    #locks;
+    #bindingId;
+    #incarnationId;
+    #ownerRef;
+    #resource;
+    #now;
+    constructor(options) {
+        this.#store = options.store;
+        this.#locks = options.locks;
+        this.#bindingId = options.bindingId;
+        this.#incarnationId = options.incarnationId;
+        this.#ownerRef = options.ownerRef;
+        this.#resource = options.resource;
+        this.#now = options.now ?? Date.now;
+    }
+    async create(input) {
+        return await this.#mutate("authorization_code_exchanged", (state, now) => {
+            const grants = [...state.grants];
+            if (!/^grant_[a-f0-9]{32}$/.test(input.grantId)) {
+                throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth grant identifier is invalid.");
+            }
+            if (grants.some((record) => isOAuthGrantRecord(record) && record.grantId === input.grantId)) {
+                throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth grant identifier already exists.");
+            }
+            if (grants.some((record) => isOAuthGrantRecord(record) && record.authorizationCodeHash === input.authorizationCodeHash)) {
+                throw invalidGrant();
+            }
+            const active = grants.filter((record) => isOAuthGrantRecord(record) && record.status === "active");
+            if (active.length >= OAUTH_ACTIVE_GRANT_DEPLOYMENT_LIMIT || active.filter((record) => record.clientRef === input.clientRef).length >= OAUTH_ACTIVE_GRANT_CLIENT_LIMIT) {
+                throw new OAuthProtocolError("temporarily_unavailable", "OAuth grant capacity is temporarily full.", 503);
+            }
+            const createdAt = new Date(now).toISOString();
+            const absoluteExpiresAt = new Date(now + OAUTH_REFRESH_ABSOLUTE_LIFETIME_MS).toISOString();
+            const idleExpiresAt = new Date(Math.min(now + OAUTH_REFRESH_IDLE_LIFETIME_MS, Date.parse(absoluteExpiresAt))).toISOString();
+            const grant = {
+                grantId: input.grantId,
+                familyHandle: input.familyHandle,
+                clientRef: input.clientRef,
+                clientId: input.clientId,
+                ownerRef: this.#ownerRef,
+                resource: this.#resource,
+                scopes: [...input.scopes],
+                active: true,
+                status: "active",
+                grantRevision: 0,
+                refreshGeneration: 0,
+                refreshTokenHash: input.refreshTokenHash,
+                authorizationCodeHash: input.authorizationCodeHash,
+                createdAt,
+                lastUsedAt: createdAt,
+                idleExpiresAt,
+                absoluteExpiresAt,
+                revokedAt: null,
+                revokeReason: null
+            };
+            return { grants: [...grants, grant], result: structuredClone(grant) };
+        });
+    }
+    async rotateRefresh(input) {
+        return await this.#mutate("refresh_rotated", (state, now) => {
+            const grants = [...state.grants];
+            const index = grants.findIndex((record) => isOAuthGrantRecord(record) && record.familyHandle === input.familyHandle);
+            if (index < 0 || !isOAuthGrantRecord(grants[index]))
+                throw invalidGrant();
+            const current = grants[index];
+            if (current.status !== "active" || !this.#clientApproved(state, current.clientId, current.clientRef))
+                throw invalidGrant();
+            if (current.clientId !== input.clientId ||
+                current.clientRef !== input.clientRef ||
+                current.resource !== input.resource) {
+                throw invalidGrant();
+            }
+            if (current.scopes.length !== input.scopes.length ||
+                current.scopes.some((scope, index) => scope !== input.scopes[index])) {
+                throw new OAuthProtocolError("invalid_scope", "Refresh scope must exactly match the current grant.");
+            }
+            if (Date.parse(current.idleExpiresAt) <= now || Date.parse(current.absoluteExpiresAt) <= now) {
+                const expired = this.#terminal(current, now, "expired");
+                grants[index] = expired;
+                return {
+                    grants,
+                    result: { kind: "replayed", grant: structuredClone(expired) },
+                    transition: "grant_expired",
+                    throwAfterPersist: invalidGrant()
+                };
+            }
+            const currentGeneration = BigInt(current.refreshGeneration);
+            if (input.generation < currentGeneration) {
+                const revoked = this.#terminal(current, now, "replay");
+                grants[index] = revoked;
+                return {
+                    grants,
+                    result: { kind: "replayed", grant: structuredClone(revoked) },
+                    transition: "refresh_replayed"
+                };
+            }
+            if (input.generation !== currentGeneration || !exactHashEqual(current.refreshTokenHash, input.presentedTokenHash)) {
+                throw invalidGrant();
+            }
+            if (current.refreshGeneration >= Number.MAX_SAFE_INTEGER) {
+                const revoked = this.#terminal(current, now, "replay");
+                grants[index] = revoked;
+                return {
+                    grants,
+                    result: { kind: "replayed", grant: structuredClone(revoked) },
+                    transition: "refresh_replayed"
+                };
+            }
+            const next = {
+                ...current,
+                refreshGeneration: current.refreshGeneration + 1,
+                refreshTokenHash: input.nextTokenHash,
+                lastUsedAt: new Date(now).toISOString(),
+                idleExpiresAt: new Date(Math.min(now + OAUTH_REFRESH_IDLE_LIFETIME_MS, Date.parse(current.absoluteExpiresAt))).toISOString()
+            };
+            grants[index] = next;
+            return { grants, result: { kind: "rotated", grant: structuredClone(next) } };
+        });
+    }
+    async validateAccess(input) {
+        let handle = null;
+        try {
+            handle = this.#locks.acquire(deploymentLockName(this.#bindingId));
+            const state = this.#readState();
+            const record = state.grants.find((entry) => isOAuthGrantRecord(entry) && entry.grantId === input.grantId);
+            if (!record || !isOAuthGrantRecord(record))
+                throw invalidGrant();
+            const now = this.#now();
+            if (record.status !== "active" || !this.#clientApproved(state, record.clientId, record.clientRef))
+                throw invalidGrant();
+            if (Date.parse(record.idleExpiresAt) <= now || Date.parse(record.absoluteExpiresAt) <= now) {
+                const grants = state.grants.map((entry) => entry === record ? this.#terminal(record, now, "expired") : entry);
+                await this.#write(state, grants, "grant_expired", now);
+                throw invalidGrant();
+            }
+            if (record.clientId !== input.clientId ||
+                record.ownerRef !== input.ownerRef ||
+                record.resource !== input.resource ||
+                record.grantRevision !== input.grantRevision ||
+                record.scopes.length !== input.scopes.length ||
+                record.scopes.some((scope, index) => scope !== input.scopes[index])) {
+                throw invalidGrant();
+            }
+            return structuredClone(record);
+        }
+        finally {
+            handle?.release();
+        }
+    }
+    async revokeFamily(input) {
+        return await this.#mutate("grant_revoked", (state, now) => {
+            const grants = [...state.grants];
+            const index = grants.findIndex((record) => isOAuthGrantRecord(record) && record.familyHandle === input.familyHandle);
+            if (index < 0 || !isOAuthGrantRecord(grants[index]))
+                return { grants, result: false, changed: false };
+            const current = grants[index];
+            if (input.clientRef && current.clientRef !== input.clientRef)
+                return { grants, result: false, changed: false };
+            if (current.status !== "active")
+                return { grants, result: false, changed: false };
+            grants[index] = this.#terminal(current, now, input.reason);
+            return { grants, result: true };
+        });
+    }
+    async revokeGrant(grantId, reason = "local") {
+        return await this.#mutate("grant_revoked", (state, now) => {
+            const grants = [...state.grants];
+            const index = grants.findIndex((record) => isOAuthGrantRecord(record) && record.grantId === grantId);
+            if (index < 0 || !isOAuthGrantRecord(grants[index]))
+                return { grants, result: false, changed: false };
+            const current = grants[index];
+            if (current.status !== "active")
+                return { grants, result: false, changed: false };
+            grants[index] = this.#terminal(current, now, reason);
+            return { grants, result: true };
+        });
+    }
+    async revokeClient(clientRef) {
+        return await this.#mutate("grant_revoked", (state, now) => {
+            let count = 0;
+            const grants = state.grants.map((record) => {
+                if (!isOAuthGrantRecord(record) || record.status !== "active" || record.clientRef !== clientRef)
+                    return record;
+                count += 1;
+                return this.#terminal(record, now, "client");
+            });
+            return { grants, result: count, changed: count > 0 };
+        });
+    }
+    async revokeOwner() {
+        return await this.#mutate("grant_revoked", (state, now) => {
+            let count = 0;
+            const grants = state.grants.map((record) => {
+                if (!isOAuthGrantRecord(record) || record.status !== "active" || record.ownerRef !== this.#ownerRef)
+                    return record;
+                count += 1;
+                return this.#terminal(record, now, "owner");
+            });
+            return { grants, result: count, changed: count > 0 };
+        });
+    }
+    listSafe(limit = 128) {
+        if (!Number.isInteger(limit) || limit < 1 || limit > 128) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth grant list limit is invalid.");
+        }
+        return this.#readState().grants
+            .filter(isOAuthGrantRecord)
+            .sort((left, right) => right.createdAt.localeCompare(left.createdAt))
+            .slice(0, limit)
+            .map((grant) => Object.freeze({
+            grantId: grant.grantId,
+            clientRef: grant.clientRef,
+            scopes: Object.freeze([...grant.scopes]),
+            status: grant.status,
+            grantRevision: grant.grantRevision,
+            refreshGeneration: grant.refreshGeneration,
+            createdAt: grant.createdAt,
+            lastUsedAt: grant.lastUsedAt,
+            idleExpiresAt: grant.idleExpiresAt,
+            absoluteExpiresAt: grant.absoluteExpiresAt,
+            revokedAt: grant.revokedAt,
+            revokeReason: grant.revokeReason
+        }));
+    }
+    getByFamily(familyHandle) {
+        const record = this.#readState().grants.find((entry) => isOAuthGrantRecord(entry) && entry.familyHandle === familyHandle);
+        return record && isOAuthGrantRecord(record) ? structuredClone(record) : undefined;
+    }
+    getByGrantId(grantId) {
+        const record = this.#readState().grants.find((entry) => isOAuthGrantRecord(entry) && entry.grantId === grantId);
+        return record && isOAuthGrantRecord(record) ? structuredClone(record) : undefined;
+    }
+    #clientApproved(state, clientId, clientRef) {
+        const client = (state.clients ?? []).find((entry) => entry.clientId === clientId);
+        return Boolean(client && client.clientRef === clientRef && client.status === "approved");
+    }
+    #terminal(current, now, reason) {
+        return {
+            ...current,
+            active: false,
+            status: reason === "expired" ? "expired" : "revoked",
+            grantRevision: current.grantRevision + 1,
+            revokedAt: new Date(now).toISOString(),
+            revokeReason: reason
+        };
+    }
+    #readState() {
+        const state = this.#store.readDeployment(this.#bindingId, this.#incarnationId);
+        if (state.bindingId !== this.#bindingId || state.incarnationId !== this.#incarnationId) {
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth grant store identity changed.");
+        }
+        return state;
+    }
+    async #write(current, grants, transition, now) {
+        const { integrity: _integrity, ...withoutIntegrity } = current;
+        await this.#store.writeDeployment({
+            ...withoutIntegrity,
+            generation: current.generation + 1,
+            grants,
+            updatedAt: new Date(now).toISOString()
+        }, transition);
+    }
+    async #mutate(defaultTransition, action) {
+        let handle = null;
+        try {
+            handle = this.#locks.acquire(deploymentLockName(this.#bindingId));
+            const current = this.#readState();
+            const now = this.#now();
+            const mutation = await action(current, now);
+            if (mutation.changed === false)
+                return mutation.result;
+            await this.#write(current, mutation.grants, mutation.transition ?? defaultTransition, now);
+            if (mutation.throwAfterPersist)
+                throw mutation.throwAfterPersist;
+            return mutation.result;
+        }
+        finally {
+            handle?.release();
+        }
+    }
+}
+//# sourceMappingURL=grantStore.js.map

package/dist/auth/grantStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantStore.js","sourceRoot":"","sources":["../../src/auth/grantStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAUzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvE,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5E,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAwDjD,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,cAAc,SAAS,EAAoC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA+B;IAChE,OAAO,cAAc,IAAI,MAAM,IAAI,kBAAkB,IAAI,MAAM,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,kBAAkB,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAiB;IACvB,MAAM,CAAgB;IACtB,UAAU,CAAS;IACnB,cAAc,CAAS;IACvB,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,IAAI,CAAe;IAE5B,YAAY,OAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvE,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5F,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,qBAAqB,KAAK,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACxH,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;YACnG,IAAI,MAAM,CAAC,MAAM,IAAI,mCAAmC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,IAAI,+BAA+B,EAAE,CAAC;gBACtK,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,EAAE,2CAA2C,EAAE,GAAG,CAAC,CAAC;YAC5G,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3F,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5H,MAAM,KAAK,GAAuB;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;gBACzB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,CAAC;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,SAAS;gBACT,UAAU,EAAE,SAAS;gBACrB,aAAa;gBACb,iBAAiB;gBACjB,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,IAAI;aACnB,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,OAAO,MAAM,IAAI,CAAC,OAAO,CAAwB,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;YACrH,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,YAAY,EAAE,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAuB,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC;gBAAE,MAAM,YAAY,EAAE,CAAC;YAC3H,IACE,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBACnC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBACrC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EACnC,CAAC;gBACD,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;YACD,IACE,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;gBAC7C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACpE,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;gBACxD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;gBACxB,OAAO;oBACL,MAAM;oBACN,MAAM,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE;oBACtE,UAAU,EAAE,eAAwB;oBACpC,iBAAiB,EAAE,YAAY,EAAE;iBAClC,CAAC;YACJ,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC5D,IAAI,KAAK,CAAC,UAAU,GAAG,iBAAiB,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACvD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;gBACxB,OAAO;oBACL,MAAM;oBACN,MAAM,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE;oBACtE,UAAU,EAAE,kBAA2B;iBACxC,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,iBAAiB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAClH,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;YACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACvD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;gBACxB,OAAO;oBACL,MAAM;oBACN,MAAM,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE;oBACtE,UAAU,EAAE,kBAA2B;iBACxC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAuB;gBAC/B,GAAG,OAAO;gBACV,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,GAAG,CAAC;gBAChD,gBAAgB,EAAE,KAAK,CAAC,aAAa;gBACrC,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBACvC,aAAa,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;aAC7H,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAOpB;QACC,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1G,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBAAE,MAAM,YAAY,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;gBAAE,MAAM,YAAY,EAAE,CAAC;YACxH,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9G,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;gBACvD,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;YACD,IACE,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAClC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAClC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAClC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;gBAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM;gBAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACnE,CAAC;gBACD,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;YACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAIlB;QACC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;YACrH,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAuB,CAAC;YACpD,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC/G,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,SAAmE,OAAO;QAC3G,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACrG,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAuB,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACzC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC;gBAC/G,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACzC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;oBAAE,OAAO,MAAM,CAAC;gBACnH,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,KAAK,GAAG,GAAG;QAClB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM;aAC5B,MAAM,CAAC,kBAAkB,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC,CAAC;IACR,CAAC;IAED,WAAW,CAAC,YAAoB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAC1H,OAAO,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAChH,OAAO,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,CAAC;IAED,eAAe,CAAC,KAAwB,EAAE,QAAgB,EAAE,SAAiB;QAC3E,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAClF,OAAO,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC3F,CAAC;IAED,SAAS,CAAC,OAA2B,EAAE,GAAW,EAAE,MAAyB;QAC3E,OAAO;YACL,GAAG,OAAO;YACV,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACpD,aAAa,EAAE,OAAO,CAAC,aAAa,GAAG,CAAC;YACxC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,YAAY,EAAE,MAAM;SACrB,CAAC;IACJ,CAAC;IAED,UAAU;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YACvF,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAA0B,EAC1B,MAAiC,EACjC,UAA6C,EAC7C,GAAW;QAEX,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;QAC/D,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAChC,GAAG,gBAAgB;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;YAClC,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;SACvC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,iBAAoD,EACpD,MAYC;QAED,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;YACvD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC3F,IAAI,QAAQ,CAAC,iBAAiB;gBAAE,MAAM,QAAQ,CAAC,iBAAiB,CAAC;YACjE,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;CAEF"}

package/dist/auth/index.js

@@ -0,0 +1,39 @@
+import { authorizationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/authorize.js";
+import { revocationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/revoke.js";
+import { tokenHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/token.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { mcpAuthRouter } from "@modelcontextprotocol/sdk/server/auth/router.js";
+export const SDK_AUTH_CONTRACT_VERSION = "1.29.0";
+export { authorizationHandler, mcpAuthRouter, requireBearerAuth, revocationHandler, tokenHandler };
+export function createLookupOnlyClientStore(getClient) {
+    return Object.freeze({ getClient });
+}
+export * from "./audit.js";
+export * from "./authorizationStore.js";
+export * from "./clientStore.js";
+export * from "./cloudflareConfig.js";
+export * from "./configuration.js";
+export * from "./credentialStore.js";
+export * from "./deploymentLock.js";
+export * from "./deploymentRegistry.js";
+export * from "./errors.js";
+export * from "./grantStore.js";
+export * from "./keyManager.js";
+export * from "./localAdminSession.js";
+export * from "./metadata.js";
+export * from "./oauthProvider.js";
+export * from "./ownerApproval.js";
+export * from "./policyIdentity.js";
+export * from "./rateLimits.js";
+export * from "./requestContext.js";
+export * from "./resourceMiddleware.js";
+export * from "./runtimeStatus.js";
+export * from "./challenges.js";
+export * from "./recovery.js";
+export * from "./schemas.js";
+export * from "./stateStore.js";
+export * from "./tokenService.js";
+export * from "./toolSecurity.js";
+export * from "./types.js";
+export * from "./windowsDpapi.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,yDAAyD,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AAGhF,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAiB,CAAC;AAE3D,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACb,CAAC;AAEF,MAAM,UAAU,2BAA2B,CACzC,SAA4B;IAE5B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC"}

package/dist/auth/keyManager.js

@@ -0,0 +1,148 @@
+import { randomBytes as nodeRandomBytes } from "node:crypto";
+import { exportJWK, generateKeyPair, importJWK } from "jose";
+import { authConfigurationError } from "./errors.js";
+function keyPurpose(bindingId, incarnationId) {
+    return `codexgpt-deployment-v1:${bindingId}:${incarnationId}:signing-key`;
+}
+function pepperPurpose(bindingId, incarnationId) {
+    return `codexgpt-deployment-v1:${bindingId}:${incarnationId}:refresh-pepper`;
+}
+function validatePrivateJwk(value) {
+    if (value.kty !== "EC" || value.crv !== "P-256" ||
+        typeof value.d !== "string" || typeof value.x !== "string" || typeof value.y !== "string") {
+        throw authConfigurationError("OAUTH_STATE_INVALID", "Generated OAuth signing key is invalid.");
+    }
+}
+export class AuthKeyManager {
+    #credentialStore;
+    #randomBytes;
+    #now;
+    constructor(credentialStore, dependencies = {}) {
+        this.#credentialStore = credentialStore;
+        this.#randomBytes = dependencies.randomBytes ?? nodeRandomBytes;
+        this.#now = dependencies.now ?? Date.now;
+    }
+    newId(prefix) {
+        const value = this.#randomBytes(16);
+        if (!Buffer.isBuffer(value) || value.length !== 16) {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth key random source is invalid.");
+        }
+        return `${prefix}_${value.toString("hex")}`;
+    }
+    async createKeyBundle(bindingId, incarnationId) {
+        const { publicKey, privateKey } = await generateKeyPair("ES256", { extractable: true });
+        const [publicJwkRaw, privateJwk] = await Promise.all([exportJWK(publicKey), exportJWK(privateKey)]);
+        validatePrivateJwk(privateJwk);
+        if (publicJwkRaw.kty !== "EC" || publicJwkRaw.crv !== "P-256" ||
+            typeof publicJwkRaw.x !== "string" || typeof publicJwkRaw.y !== "string") {
+            throw authConfigurationError("OAUTH_STATE_INVALID", "Generated OAuth public key is invalid.");
+        }
+        const kid = this.newId("kid");
+        const privatePayload = Buffer.from(JSON.stringify({ ...privateJwk, kid, alg: "ES256", use: "sig" }), "utf8");
+        const pepper = this.#randomBytes(32);
+        if (!Buffer.isBuffer(pepper) || pepper.length !== 32) {
+            privatePayload.fill(0);
+            throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth refresh pepper random source is invalid.");
+        }
+        try {
+            const [protectedSigningPrivateJwk, protectedRefreshPepper] = await Promise.all([
+                this.#credentialStore.protect(privatePayload, keyPurpose(bindingId, incarnationId)),
+                this.#credentialStore.protect(pepper, pepperPurpose(bindingId, incarnationId))
+            ]);
+            return {
+                protectedSigningPrivateJwk,
+                activePublicJwk: {
+                    kty: "EC",
+                    crv: "P-256",
+                    x: publicJwkRaw.x,
+                    y: publicJwkRaw.y,
+                    kid,
+                    alg: "ES256",
+                    use: "sig"
+                },
+                protectedRefreshPepper
+            };
+        }
+        finally {
+            privatePayload.fill(0);
+            pepper.fill(0);
+        }
+    }
+    async createInitialDeployment(input) {
+        const bindingId = input.bindingId ?? this.newId("binding");
+        const incarnationId = input.incarnationId ?? this.newId("incarnation");
+        const recoveryEpoch = input.recoveryEpoch ?? this.newId("epoch");
+        const bundle = await this.createKeyBundle(bindingId, incarnationId);
+        const timestamp = new Date(input.now ?? this.#now()).toISOString();
+        return {
+            schemaVersion: 1,
+            generation: 1,
+            bindingId,
+            incarnationId,
+            recoveryEpoch,
+            canonicalRoot: input.canonicalRoot,
+            profileId: input.profileId,
+            hostname: input.hostname,
+            issuer: input.issuer,
+            resource: input.resource,
+            ownerRef: input.owner.ownerRef,
+            credentialProvider: this.#credentialStore.provider,
+            ...bundle,
+            previousPublicJwks: [],
+            grants: [],
+            recoveryRequired: false,
+            auditCursorRef: null,
+            createdAt: timestamp,
+            updatedAt: timestamp
+        };
+    }
+    async loadRefreshPepper(state) {
+        const plaintext = await this.#credentialStore.unprotect(state.protectedRefreshPepper, pepperPurpose(state.bindingId, state.incarnationId));
+        const pepper = Buffer.from(plaintext);
+        plaintext.fill(0);
+        if (pepper.length !== 32) {
+            pepper.fill(0);
+            throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth refresh pepper payload is invalid.");
+        }
+        return pepper;
+    }
+    async loadPrivateKey(state) {
+        const plaintext = await this.#credentialStore.unprotect(state.protectedSigningPrivateJwk, keyPurpose(state.bindingId, state.incarnationId));
+        try {
+            let parsed;
+            try {
+                parsed = JSON.parse(Buffer.from(plaintext).toString("utf8"));
+            }
+            catch {
+                throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth signing key payload is malformed.");
+            }
+            const jwk = parsed;
+            validatePrivateJwk(jwk);
+            if (jwk.kid !== state.activePublicJwk.kid ||
+                jwk.x !== state.activePublicJwk.x ||
+                jwk.y !== state.activePublicJwk.y ||
+                jwk.alg !== "ES256" ||
+                jwk.use !== "sig") {
+                throw authConfigurationError("OAUTH_STATE_RECOVERY_REQUIRED", "OAuth signing key identity does not match state.");
+            }
+            return await importJWK(jwk, "ES256");
+        }
+        finally {
+            plaintext.fill(0);
+        }
+    }
+    async rotateSigningKey(store, state) {
+        const bundle = await this.createKeyBundle(state.bindingId, state.incarnationId);
+        const next = {
+            ...state,
+            generation: state.generation + 1,
+            protectedSigningPrivateJwk: bundle.protectedSigningPrivateJwk,
+            activePublicJwk: bundle.activePublicJwk,
+            previousPublicJwks: [state.activePublicJwk],
+            updatedAt: new Date(this.#now()).toISOString()
+        };
+        delete next.integrity;
+        return store.writeDeployment(next, "signing_key_rotated");
+    }
+}
+//# sourceMappingURL=keyManager.js.map

package/dist/auth/keyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyManager.js","sourceRoot":"","sources":["../../src/auth/keyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,SAAS,EACT,eAAe,EACf,SAAS,EAEV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAgCrD,SAAS,UAAU,CAAC,SAAiB,EAAE,aAAqB;IAC1D,OAAO,0BAA0B,SAAS,IAAI,aAAa,cAAc,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,aAAqB;IAC7D,OAAO,0BAA0B,SAAS,IAAI,aAAa,iBAAiB,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAU;IACpC,IACE,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO;QAC3C,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ,EACzF,CAAC;QACD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,gBAAgB,CAAkB;IAClC,YAAY,CAA2B;IACvC,IAAI,CAAe;IAE5B,YAAY,eAAgC,EAAE,eAA2C,EAAE;QACzF,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,WAAW,IAAI,eAAe,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAgE;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,GAAG,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,aAAqB;QAC5D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACpG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/B,IACE,YAAY,CAAC,GAAG,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO;YACzD,OAAO,YAAY,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,YAAY,CAAC,CAAC,KAAK,QAAQ,EACxE,CAAC;YACD,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACrD,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,0BAA0B,EAAE,sBAAsB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC7E,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBACnF,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;aAC/E,CAAC,CAAC;YACH,OAAO;gBACL,0BAA0B;gBAC1B,eAAe,EAAE;oBACf,GAAG,EAAE,IAAI;oBACT,GAAG,EAAE,OAAO;oBACZ,CAAC,EAAE,YAAY,CAAC,CAAC;oBACjB,CAAC,EAAE,YAAY,CAAC,CAAC;oBACjB,GAAG;oBACH,GAAG,EAAE,OAAO;oBACZ,GAAG,EAAE,KAAK;iBACX;gBACD,sBAAsB;aACvB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAA2B;QACvD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,CAAC;YACb,SAAS;YACT,aAAa;YACb,aAAa;YACb,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ;YAClD,GAAG,MAAM;YACT,kBAAkB,EAAE,EAAE;YACtB,MAAM,EAAE,EAAE;YACV,gBAAgB,EAAE,KAAK;YACvB,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAwB;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACrD,KAAK,CAAC,sBAAsB,EAC5B,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CACpD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,0CAA0C,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACrD,KAAK,CAAC,0BAA0B,EAChC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CACjD,CAAC;QACF,IAAI,CAAC;YACH,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,yCAAyC,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,GAAG,GAAG,MAAa,CAAC;YAC1B,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,IACE,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,GAAG;gBACrC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC;gBACjC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC;gBACjC,GAAG,CAAC,GAAG,KAAK,OAAO;gBACnB,GAAG,CAAC,GAAG,KAAK,KAAK,EACjB,CAAC;gBACD,MAAM,sBAAsB,CAAC,+BAA+B,EAAE,kDAAkD,CAAC,CAAC;YACpH,CAAC;YACD,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,CAAc,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAqB,EAAE,KAAwB;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAChF,MAAM,IAAI,GAAyC;YACjD,GAAG,KAAK;YACR,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC;YAChC,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;YAC7D,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,kBAAkB,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;YAC3C,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SAC/C,CAAC;QACF,OAAQ,IAAmC,CAAC,SAAS,CAAC;QACtD,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC5D,CAAC;CACF"}