codexgpt 1.0.0

package/dist/auth/oauthProvider.js

@@ -0,0 +1,589 @@
+import { createHash } from "node:crypto";
+import { OAUTH_BROWSER_COOKIE } from "./authorizationStore.js";
+import { AuthConfigurationError, OAuthProtocolError } from "./errors.js";
+import { CORE_OAUTH_RATE_LIMITS, FixedWindowRateLimiter } from "./rateLimits.js";
+import { KNOWN_OAUTH_SCOPES } from "./types.js";
+export const OAUTH_QUERY_FORM_MAX_BYTES = 8 * 1024;
+export const OAUTH_QUERY_FORM_MAX_PARAMETERS = 24;
+export const OAUTH_QUERY_KEY_MAX_BYTES = 64;
+export const OAUTH_QUERY_VALUE_MAX_BYTES = 4096;
+const AUTHORIZATION_LOCALS = "codexgptAuthorization";
+const UNKNOWN_SAFE_ERROR = Object.freeze({ error: "authorization_unavailable" });
+function utf8Bytes(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+function parseComponent(value) {
+    try {
+        return decodeURIComponent(value.replaceAll("+", " "));
+    }
+    catch {
+        throw new OAuthProtocolError("invalid_request", "OAuth parameters are malformed.");
+    }
+}
+export function parseBoundedOAuthParameters(raw) {
+    if (utf8Bytes(raw) > OAUTH_QUERY_FORM_MAX_BYTES) {
+        throw new OAuthProtocolError("invalid_request", "OAuth parameters are too large.");
+    }
+    const output = {};
+    if (raw.length === 0)
+        return Object.freeze(output);
+    const pairs = raw.split("&");
+    if (pairs.length > OAUTH_QUERY_FORM_MAX_PARAMETERS) {
+        throw new OAuthProtocolError("invalid_request", "OAuth parameter count is invalid.");
+    }
+    for (const pair of pairs) {
+        if (pair.length === 0)
+            throw new OAuthProtocolError("invalid_request", "OAuth parameters are malformed.");
+        const separator = pair.indexOf("=");
+        const rawKey = separator < 0 ? pair : pair.slice(0, separator);
+        const rawValue = separator < 0 ? "" : pair.slice(separator + 1);
+        const key = parseComponent(rawKey);
+        const value = parseComponent(rawValue);
+        if (!key || utf8Bytes(key) > OAUTH_QUERY_KEY_MAX_BYTES || utf8Bytes(value) > OAUTH_QUERY_VALUE_MAX_BYTES) {
+            throw new OAuthProtocolError("invalid_request", "OAuth parameter size is invalid.");
+        }
+        if (Object.hasOwn(output, key)) {
+            throw new OAuthProtocolError("invalid_request", "OAuth parameters contain duplicates.");
+        }
+        output[key] = value;
+    }
+    return Object.freeze(output);
+}
+function authorizeErrorCode(error) {
+    return error instanceof OAuthProtocolError ? error.oauthCode : "invalid_request";
+}
+function authorizeErrorMessage(error) {
+    return error instanceof OAuthProtocolError ? error.message : "The authorization request is invalid.";
+}
+function noStore(res) {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Pragma", "no-cache");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+}
+export function applyAuthorizationSecurityHeaders(res) {
+    noStore(res);
+    res.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'");
+}
+function sendDirectError(res, error) {
+    applyAuthorizationSecurityHeaders(res);
+    const status = error instanceof OAuthProtocolError ? error.statusCode : 400;
+    res.status(status).json({ error: authorizeErrorCode(error), error_description: authorizeErrorMessage(error) });
+}
+function redirectError(res, redirectUri, identity, error, state) {
+    const target = new URL(redirectUri);
+    target.searchParams.set("error", authorizeErrorCode(error));
+    target.searchParams.set("error_description", authorizeErrorMessage(error));
+    if (state)
+        target.searchParams.set("state", state);
+    target.searchParams.set("iss", identity.issuer);
+    applyAuthorizationSecurityHeaders(res);
+    res.redirect(302, target.href);
+}
+function exactContentType(req) {
+    const raw = req.headers["content-type"];
+    if (typeof raw !== "string")
+        return false;
+    const parts = raw.split(";").map((part) => part.trim().toLocaleLowerCase("en-US"));
+    return parts[0] === "application/x-www-form-urlencoded" && parts.slice(1).every((part) => part === "charset=utf-8");
+}
+function parseAuthorizationInput(req) {
+    if (req.method === "GET") {
+        const queryIndex = req.originalUrl.indexOf("?");
+        return parseBoundedOAuthParameters(queryIndex < 0 ? "" : req.originalUrl.slice(queryIndex + 1));
+    }
+    if (!exactContentType(req) || !Buffer.isBuffer(req.body)) {
+        throw new OAuthProtocolError("invalid_request", "Authorization POST requires application/x-www-form-urlencoded.");
+    }
+    return parseBoundedOAuthParameters(req.body.toString("utf8"));
+}
+function parseScope(input, enabledScopes) {
+    if (input === undefined || input === "")
+        return Object.freeze([...enabledScopes]);
+    if (utf8Bytes(input) > 256 || /\s{2,}|[^\x20-\x7e]/.test(input)) {
+        throw new OAuthProtocolError("invalid_scope", "Requested OAuth scope is invalid.");
+    }
+    const values = input.split(" ");
+    const unique = new Set(values);
+    const known = new Set(KNOWN_OAUTH_SCOPES);
+    if (unique.size !== values.length || values.some((value) => !known.has(value))) {
+        throw new OAuthProtocolError("invalid_scope", "Requested OAuth scope is invalid.");
+    }
+    const effective = enabledScopes.filter((scope) => unique.has(scope));
+    if (effective.length === 0) {
+        throw new OAuthProtocolError("invalid_scope", "Requested OAuth scope is not enabled.");
+    }
+    return Object.freeze(effective);
+}
+function canonicalSdkParameters(input) {
+    return {
+        response_type: "code",
+        client_id: input.clientId,
+        redirect_uri: input.redirectUri,
+        state: input.state,
+        resource: input.resource,
+        scope: input.scopes.join(" "),
+        code_challenge: input.codeChallenge,
+        code_challenge_method: "S256"
+    };
+}
+function rejectLimited(res, decision) {
+    applyAuthorizationSecurityHeaders(res);
+    res.setHeader("Retry-After", String(decision.retryAfterSeconds));
+    res.status(429).json({ error: "temporarily_unavailable" });
+}
+function isAuditUnavailable(error) {
+    return error instanceof AuthConfigurationError && error.code === "OAUTH_AUDIT_FAILURE";
+}
+function sendAuditUnavailable(res) {
+    applyAuthorizationSecurityHeaders(res);
+    res.status(503).json({
+        error: "temporarily_unavailable",
+        recovery_action: "Run `codexgpt doctor` locally, repair the audit store, and retry."
+    });
+}
+export function createAuthorizationGuard(options) {
+    const deploymentLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.authorizeDeployment, { now: options.now });
+    const clientLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.authorizeClient, { now: options.now });
+    return async (req, res, next) => {
+        if (req.method !== "GET" && req.method !== "POST") {
+            next();
+            return;
+        }
+        const deploymentDecision = deploymentLimit.consume("deployment");
+        if (!deploymentDecision.allowed) {
+            rejectLimited(res, deploymentDecision);
+            return;
+        }
+        let parameters;
+        try {
+            if (req.headers.authorization !== undefined) {
+                throw new OAuthProtocolError("invalid_request", "Client authentication is not accepted on authorization requests.");
+            }
+            parameters = parseAuthorizationInput(req);
+        }
+        catch (error) {
+            sendDirectError(res, error);
+            return;
+        }
+        const clientId = parameters.client_id;
+        const redirectUri = parameters.redirect_uri;
+        try {
+            if (!clientId || !/^client_[A-Za-z0-9_-]{43}$/.test(clientId)) {
+                throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+            }
+            const client = await options.clients.getClient(clientId);
+            if (!client)
+                throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+            if (!redirectUri || client.redirect_uris.length !== 1 || redirectUri !== client.redirect_uris[0]) {
+                throw new OAuthProtocolError("invalid_request", "The redirect URI is invalid.");
+            }
+        }
+        catch (error) {
+            sendDirectError(res, error);
+            return;
+        }
+        const clientDecision = clientLimit.consume(clientId);
+        if (!clientDecision.allowed) {
+            rejectLimited(res, clientDecision);
+            return;
+        }
+        try {
+            if (parameters.response_type !== "code")
+                throw new OAuthProtocolError("invalid_request", "response_type must be code.");
+            const state = parameters.state;
+            if (!state || utf8Bytes(state) < 8 || utf8Bytes(state) > 1024 || /[\u0000-\u001f\u007f]/u.test(state)) {
+                throw new OAuthProtocolError("invalid_request", "OAuth state is invalid.");
+            }
+            if (parameters.resource !== options.identity.resource)
+                throw new OAuthProtocolError("invalid_target", "The OAuth resource is invalid.");
+            if (parameters.code_challenge_method !== "S256" || !/^[A-Za-z0-9_-]{43}$/.test(parameters.code_challenge ?? "")) {
+                throw new OAuthProtocolError("invalid_request", "PKCE S256 is required.");
+            }
+            const forbidden = ["client_secret", "client_assertion", "client_assertion_type", "grant_type", "request", "request_uri"];
+            if (forbidden.some((key) => parameters[key] !== undefined))
+                throw new OAuthProtocolError("invalid_request", "Forbidden authorization parameters were supplied.");
+            const scopes = parseScope(parameters.scope, options.enabledScopes);
+            const canonical = Object.freeze({
+                clientId,
+                redirectUri,
+                state,
+                resource: options.identity.resource,
+                scopes,
+                codeChallenge: parameters.code_challenge
+            });
+            res.locals[AUTHORIZATION_LOCALS] = canonical;
+            const sdk = canonicalSdkParameters(canonical);
+            if (req.method === "POST")
+                req.body = sdk;
+            else
+                req.url = `/authorize?${new URLSearchParams(sdk).toString()}`;
+            next();
+        }
+        catch (error) {
+            redirectError(res, redirectUri, options.identity, error, parameters.state);
+        }
+    };
+}
+function htmlEscape(value) {
+    return value
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function pkceChallenge(verifier) {
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)) {
+        throw new OAuthProtocolError("invalid_grant", "Authorization code is invalid.");
+    }
+    return createHash("sha256").update(verifier, "ascii").digest("base64url");
+}
+function normalizeRefreshScopes(scopes) {
+    if (scopes.length < 1 || scopes.length > 3 || new Set(scopes).size !== scopes.length) {
+        throw new OAuthProtocolError("invalid_scope", "Refresh scope is invalid.");
+    }
+    if (scopes.some((scope) => !["codexgpt:read", "codexgpt:write", "codexgpt:execute"].includes(scope))) {
+        throw new OAuthProtocolError("invalid_scope", "Refresh scope is invalid.");
+    }
+    const normalized = ["codexgpt:read", "codexgpt:write", "codexgpt:execute"]
+        .filter((scope) => scopes.includes(scope));
+    if (normalized.some((scope, index) => scope !== scopes[index])) {
+        throw new OAuthProtocolError("invalid_scope", "Refresh scope is invalid.");
+    }
+    return Object.freeze(normalized);
+}
+function waitingPage(input) {
+    return `<!doctype html><html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CodexGPT authorization</title></head><body><main><h1>Authorization pending</h1><p>Client: ${htmlEscape(input.clientLabel)}</p><p>Correlation code: <strong>${htmlEscape(input.correlationCode)}</strong></p><p>Requested scopes: ${htmlEscape(input.scopes.join(" "))}</p><p>Approve or deny this request from the current-user CodexGPT CLI.</p><p id="status">Waiting for local approval...</p></main><script>const id=${JSON.stringify(input.pendingId)};const status=document.getElementById('status');async function poll(){try{const response=await fetch('/authorize/status/'+encodeURIComponent(id),{cache:'no-store',credentials:'same-origin'});if(!response.ok){status.textContent='Authorization is unavailable. Start a new connection.';return;}const body=await response.json();if(body.status==='pending'){setTimeout(poll,2500);return;}window.location.assign('/authorize/continue/'+encodeURIComponent(id));}catch{setTimeout(poll,2500);}}setTimeout(poll,2500);</script></body></html>`;
+}
+export class CodexOAuthProvider {
+    clientsStore;
+    skipLocalPkceValidation = true;
+    #clients;
+    #authorizations;
+    #tokens;
+    #identity;
+    constructor(identity, clients, authorizations, tokens) {
+        this.clientsStore = Object.freeze({ getClient: (clientId) => clients.getClient(clientId) });
+        this.#clients = clients;
+        this.#authorizations = authorizations;
+        this.#tokens = tokens;
+        this.#identity = Object.freeze({ ...identity });
+    }
+    async authorize(_client, _params, res) {
+        const canonical = res.locals[AUTHORIZATION_LOCALS];
+        if (!canonical)
+            throw new OAuthProtocolError("invalid_request", "Canonical authorization input is unavailable.");
+        let created;
+        try {
+            created = await this.#authorizations.create(canonical);
+        }
+        catch (error) {
+            if (isAuditUnavailable(error)) {
+                redirectError(res, canonical.redirectUri, this.#identity, new OAuthProtocolError("temporarily_unavailable", "OAuth audit is unavailable. Run `codexgpt doctor` locally and retry.", 503), canonical.state);
+                return;
+            }
+            throw error;
+        }
+        applyAuthorizationSecurityHeaders(res);
+        res.setHeader("Set-Cookie", `${OAUTH_BROWSER_COOKIE}=${created.browserBinding}; Path=/; Max-Age=300; Secure; HttpOnly; SameSite=Lax`);
+        res.status(200).type("html").send(waitingPage({
+            pendingId: created.pendingId,
+            correlationCode: created.correlationCode,
+            clientLabel: created.clientLabel,
+            scopes: created.scopes
+        }));
+    }
+    challengeForAuthorizationCode(client, authorizationCode) {
+        return this.#authorizations.challengeForAuthorizationCode(client.client_id, authorizationCode);
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri, resource) {
+        if (!codeVerifier || !redirectUri || !resource)
+            throw new OAuthProtocolError("invalid_request", "Authorization code exchange is incomplete.");
+        const challenge = pkceChallenge(codeVerifier);
+        return await this.#authorizations.exchangeAuthorizationCode({
+            clientId: client.client_id,
+            authorizationCode,
+            redirectUri,
+            resource: resource.href,
+            codeChallenge: challenge
+        }, async (consumed) => await this.#tokens.exchangeAuthorizationCode({
+            authorizationCode,
+            clientId: consumed.clientId,
+            resource: consumed.resource,
+            scopes: consumed.scopes
+        }));
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        if (!resource)
+            throw new OAuthProtocolError("invalid_target", "The OAuth resource is required.");
+        return await this.#tokens.exchangeRefreshToken({
+            clientId: client.client_id,
+            refreshToken,
+            resource: resource.href,
+            scopes: scopes === undefined ? undefined : normalizeRefreshScopes(scopes)
+        });
+    }
+    async verifyAccessToken(token) {
+        return (await this.#tokens.verifyAccessToken(token)).authInfo;
+    }
+    async revokeToken(client, request) {
+        await this.#tokens.revoke({ token: request.token, clientId: client.client_id });
+    }
+    async approvedClient(clientId) {
+        const record = this.#clients.getRecord(clientId);
+        const client = await this.#clients.getClient(clientId);
+        if (!record || record.status !== "approved" || !client) {
+            throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+        }
+        return client;
+    }
+}
+function cookieBinding(req) {
+    const raw = req.headers.cookie;
+    if (typeof raw !== "string" || utf8Bytes(raw) > 4096)
+        return null;
+    const matches = raw.split(";")
+        .map((part) => part.trim())
+        .filter((part) => part.startsWith(`${OAUTH_BROWSER_COOKIE}=`));
+    if (matches.length !== 1)
+        return null;
+    const value = matches[0].slice(OAUTH_BROWSER_COOKIE.length + 1);
+    return /^[A-Za-z0-9_-]{43}$/.test(value) ? value : null;
+}
+export function createAuthorizationStatusHandler(options) {
+    const deploymentLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.statusDeployment, { now: options.now });
+    const bindingLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.statusBinding, { now: options.now });
+    return async (req, res) => {
+        applyAuthorizationSecurityHeaders(res);
+        const binding = cookieBinding(req);
+        const deploymentDecision = deploymentLimit.consume("deployment");
+        const bindingDecision = bindingLimit.consume(binding ?? "invalid");
+        if (!deploymentDecision.allowed || !bindingDecision.allowed) {
+            rejectLimited(res, !deploymentDecision.allowed ? deploymentDecision : bindingDecision);
+            return;
+        }
+        try {
+            if (!binding)
+                throw new OAuthProtocolError("invalid_request", "Authorization result is unavailable.", 404);
+            const pendingId = Array.isArray(req.params.pendingId) ? "" : req.params.pendingId ?? "";
+            const status = await options.authorizations.status(pendingId, binding);
+            res.status(200).json({ status });
+        }
+        catch (error) {
+            if (isAuditUnavailable(error)) {
+                sendAuditUnavailable(res);
+                return;
+            }
+            res.status(404).json(UNKNOWN_SAFE_ERROR);
+        }
+    };
+}
+export function createAuthorizationContinueHandler(options) {
+    const deploymentLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.continueDeployment, { now: options.now });
+    const bindingLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.continueBinding, { now: options.now });
+    return async (req, res) => {
+        applyAuthorizationSecurityHeaders(res);
+        const binding = cookieBinding(req);
+        const deploymentDecision = deploymentLimit.consume("deployment");
+        const bindingDecision = bindingLimit.consume(binding ?? "invalid");
+        if (!deploymentDecision.allowed || !bindingDecision.allowed) {
+            rejectLimited(res, !deploymentDecision.allowed ? deploymentDecision : bindingDecision);
+            return;
+        }
+        try {
+            if (!binding)
+                throw new OAuthProtocolError("invalid_request", "Authorization result is unavailable.", 404);
+            const pendingId = Array.isArray(req.params.pendingId) ? "" : req.params.pendingId ?? "";
+            const result = await options.authorizations.continue(pendingId, binding);
+            res.setHeader("Set-Cookie", result.clearCookie);
+            res.redirect(302, result.location);
+        }
+        catch (error) {
+            if (isAuditUnavailable(error)) {
+                sendAuditUnavailable(res);
+                return;
+            }
+            res.status(404).json(UNKNOWN_SAFE_ERROR);
+        }
+    };
+}
+const TOKEN_STANDARD_PARAMETERS = new Set([
+    "grant_type",
+    "client_id",
+    "client_secret",
+    "client_assertion",
+    "client_assertion_type",
+    "code",
+    "code_verifier",
+    "redirect_uri",
+    "refresh_token",
+    "scope",
+    "resource",
+    "state"
+]);
+const REVOKE_STANDARD_PARAMETERS = new Set([
+    "token",
+    "token_type_hint",
+    "client_id",
+    "client_secret",
+    "client_assertion",
+    "client_assertion_type"
+]);
+function applyMachineSecurityHeaders(res) {
+    noStore(res);
+    res.setHeader("Access-Control-Allow-Origin", "*");
+}
+function parseMachineForm(req) {
+    if (!exactContentType(req) || !Buffer.isBuffer(req.body)) {
+        throw new OAuthProtocolError("invalid_request", "OAuth machine requests require application/x-www-form-urlencoded.");
+    }
+    if (req.headers.authorization !== undefined) {
+        throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+    }
+    return parseBoundedOAuthParameters(req.body.toString("utf8"));
+}
+function rejectForbiddenClientAuthentication(parameters) {
+    if (parameters.client_secret !== undefined ||
+        parameters.client_assertion !== undefined ||
+        parameters.client_assertion_type !== undefined) {
+        throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+    }
+}
+function requireClientId(parameters) {
+    const clientId = parameters.client_id;
+    if (!clientId || !/^client_[A-Za-z0-9_-]{43}$/.test(clientId)) {
+        throw new OAuthProtocolError("invalid_client", "The OAuth client is invalid.");
+    }
+    return clientId;
+}
+function requireExactResource(parameters, identity) {
+    if (!parameters.resource || parameters.resource !== identity.resource) {
+        throw new OAuthProtocolError("invalid_target", "The OAuth resource is invalid.");
+    }
+    return new URL(parameters.resource);
+}
+function rejectUnexpectedStandardParameters(parameters, allowed, standard) {
+    for (const key of Object.keys(parameters)) {
+        if (standard.has(key) && !allowed.has(key)) {
+            throw new OAuthProtocolError("invalid_request", "OAuth request parameters are invalid.");
+        }
+    }
+}
+function protocolErrorShape(error) {
+    if (!error || typeof error !== "object")
+        return null;
+    const value = error;
+    if (typeof value.oauthCode !== "string" ||
+        typeof value.statusCode !== "number" ||
+        !Number.isInteger(value.statusCode) || value.statusCode < 400 || value.statusCode > 599 ||
+        typeof value.message !== "string") {
+        return null;
+    }
+    return { oauthCode: value.oauthCode, statusCode: value.statusCode, message: value.message };
+}
+function machineError(res, error) {
+    applyMachineSecurityHeaders(res);
+    const protocol = protocolErrorShape(error);
+    if (protocol) {
+        res.status(protocol.statusCode).json({ error: protocol.oauthCode, error_description: protocol.message });
+        return;
+    }
+    res.status(503).json({ error: "temporarily_unavailable" });
+}
+export function createTokenEndpointHandler(identity, options) {
+    const deploymentLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.tokenDeployment, { now: options.now });
+    const clientLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.tokenClient, { now: options.now });
+    return async (req, res) => {
+        applyMachineSecurityHeaders(res);
+        const deploymentDecision = deploymentLimit.consume("deployment");
+        if (!deploymentDecision.allowed) {
+            res.setHeader("Retry-After", String(deploymentDecision.retryAfterSeconds));
+            res.status(429).json({ error: "temporarily_unavailable" });
+            return;
+        }
+        try {
+            const parameters = parseMachineForm(req);
+            rejectForbiddenClientAuthentication(parameters);
+            const clientId = requireClientId(parameters);
+            const clientDecision = clientLimit.consume(clientId);
+            if (!clientDecision.allowed) {
+                res.setHeader("Retry-After", String(clientDecision.retryAfterSeconds));
+                res.status(429).json({ error: "temporarily_unavailable" });
+                return;
+            }
+            const client = await options.provider.approvedClient(clientId);
+            const resource = requireExactResource(parameters, identity);
+            let tokens;
+            if (parameters.grant_type === "authorization_code") {
+                rejectUnexpectedStandardParameters(parameters, new Set(["grant_type", "client_id", "code", "code_verifier", "redirect_uri", "resource"]), TOKEN_STANDARD_PARAMETERS);
+                if (!parameters.code || !/^[A-Za-z0-9_-]{43}$/.test(parameters.code) ||
+                    !parameters.code_verifier || !/^[A-Za-z0-9._~-]{43,128}$/.test(parameters.code_verifier) ||
+                    !parameters.redirect_uri || parameters.redirect_uri.length > 2048) {
+                    throw new OAuthProtocolError("invalid_request", "Authorization code exchange parameters are invalid.");
+                }
+                tokens = await options.provider.exchangeAuthorizationCode(client, parameters.code, parameters.code_verifier, parameters.redirect_uri, resource);
+            }
+            else if (parameters.grant_type === "refresh_token") {
+                rejectUnexpectedStandardParameters(parameters, new Set(["grant_type", "client_id", "refresh_token", "scope", "resource"]), TOKEN_STANDARD_PARAMETERS);
+                if (!parameters.refresh_token || utf8Bytes(parameters.refresh_token) > 512) {
+                    throw new OAuthProtocolError("invalid_request", "Refresh token is invalid.");
+                }
+                const scopes = parameters.scope === undefined || parameters.scope === ""
+                    ? undefined
+                    : normalizeRefreshScopes(parameters.scope.split(" "));
+                tokens = await options.provider.exchangeRefreshToken(client, parameters.refresh_token, scopes ? [...scopes] : undefined, resource);
+            }
+            else {
+                throw new OAuthProtocolError("invalid_request", "The OAuth grant type is invalid.");
+            }
+            res.status(200).json(tokens);
+        }
+        catch (error) {
+            machineError(res, error);
+        }
+    };
+}
+export function createRevocationEndpointHandler(options) {
+    const deploymentLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.revokeDeployment, { now: options.now });
+    const clientLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.revokeClient, { now: options.now });
+    return async (req, res) => {
+        applyMachineSecurityHeaders(res);
+        const deploymentDecision = deploymentLimit.consume("deployment");
+        if (!deploymentDecision.allowed) {
+            res.setHeader("Retry-After", String(deploymentDecision.retryAfterSeconds));
+            res.status(429).json({ error: "temporarily_unavailable" });
+            return;
+        }
+        try {
+            const parameters = parseMachineForm(req);
+            rejectForbiddenClientAuthentication(parameters);
+            rejectUnexpectedStandardParameters(parameters, new Set(["token", "token_type_hint", "client_id"]), REVOKE_STANDARD_PARAMETERS);
+            const clientId = requireClientId(parameters);
+            const clientDecision = clientLimit.consume(clientId);
+            if (!clientDecision.allowed) {
+                res.setHeader("Retry-After", String(clientDecision.retryAfterSeconds));
+                res.status(429).json({ error: "temporarily_unavailable" });
+                return;
+            }
+            const client = await options.provider.approvedClient(clientId);
+            if (!parameters.token || utf8Bytes(parameters.token) > 8192) {
+                throw new OAuthProtocolError("invalid_request", "Revocation token is invalid.");
+            }
+            if (parameters.token_type_hint !== undefined &&
+                parameters.token_type_hint !== "access_token" &&
+                parameters.token_type_hint !== "refresh_token") {
+                throw new OAuthProtocolError("invalid_request", "Revocation token type hint is invalid.");
+            }
+            await options.provider.revokeToken(client, {
+                token: parameters.token,
+                ...(parameters.token_type_hint ? { token_type_hint: parameters.token_type_hint } : {})
+            });
+            res.status(200).send("");
+        }
+        catch (error) {
+            machineError(res, error);
+        }
+    };
+}
+//# sourceMappingURL=oauthProvider.js.map

package/dist/auth/oauthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthProvider.js","sourceRoot":"","sources":["../../src/auth/oauthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,OAAO,EAEL,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAiD,MAAM,YAAY,CAAC;AAE/F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;AAUjF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,0BAA0B,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,yBAAyB,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,2BAA2B,EAAE,CAAC;YACzG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACnF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC;AACvG,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,GAAa;IAC7D,OAAO,CAAC,GAAG,CAAC,CAAC;IACb,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,4JAA4J,CAC7J,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAa,EAAE,KAAc;IACpD,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,aAAa,CAAC,GAAa,EAAE,WAAmB,EAAE,QAAiC,EAAE,KAAc,EAAE,KAAc;IAC1H,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACvC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,mCAAmC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,2BAA2B,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,gEAAgE,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB,EAAE,aAAoC;IACjF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAoC;IAClE,OAAO;QACL,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,qBAAqB,EAAE,MAAM;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAa,EAAE,QAA2B;IAC/D,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;AACzF,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAa;IACzC,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,yBAAyB;QAChC,eAAe,EAAE,mEAAmE;KACrF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,eAAe,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrH,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7G,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,UAA4C,CAAC;QACjD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,kEAAkE,CAAC,CAAC;YACtH,CAAC;YACD,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;YAC5F,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;YACxH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;YACxI,IAAI,UAAU,CAAC,qBAAqB,KAAK,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChH,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACzH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;YACjK,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACnE,MAAM,SAAS,GAAkC,MAAM,CAAC,MAAM,CAAC;gBAC7D,QAAQ;gBACR,WAAW;gBACX,KAAK;gBACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBACnC,MAAM;gBACN,aAAa,EAAE,UAAU,CAAC,cAAc;aACzC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;YAC7C,MAAM,GAAG,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;;gBACrC,GAAG,CAAC,GAAG,GAAG,cAAc,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnE,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAyB;IACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACrF,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;SACvE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAiB,CAAC;IAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,KAKpB;IACC,OAAO,oQAAoQ,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,oCAAoC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,qCAAqC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,sJAAsJ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,khBAAkhB,CAAC;AAC9nC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,YAAY,CAAC;IACb,uBAAuB,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAmB;IAC3B,eAAe,CAAqB;IACpC,OAAO,CAAoB;IAC3B,SAAS,CAA0B;IAE5C,YACE,QAAiC,EACjC,OAAyB,EACzB,cAAkC,EAClC,MAAyB;QAEzB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAmC,EAAE,OAA4B,EAAE,GAAa;QAC9F,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAA8C,CAAC;QAChG,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QACjH,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,aAAa,CACX,GAAG,EACH,SAAS,CAAC,WAAW,EACrB,IAAI,CAAC,SAAS,EACd,IAAI,kBAAkB,CACpB,yBAAyB,EACzB,sEAAsE,EACtE,GAAG,CACJ,EACD,SAAS,CAAC,KAAK,CAChB,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,CACX,YAAY,EACZ,GAAG,oBAAoB,IAAI,OAAO,CAAC,cAAc,uDAAuD,CACzG,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,6BAA6B,CAAC,MAAkC,EAAE,iBAAyB;QACzF,OAAO,IAAI,CAAC,eAAe,CAAC,6BAA6B,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,YAAqB,EACrB,WAAoB,EACpB,QAAc;QAEd,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QAC9I,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC;YAC1D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,iBAAiB;YACjB,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,aAAa,EAAE,SAAS;SACzB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC;YAClE,iBAAiB;YACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;QACjG,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,YAAY;YACZ,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;SAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,oBAAoB,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,OAAkC;IACjF,MAAM,eAAe,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClH,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5G,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,kBAAkB,CAAC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5D,aAAa,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC3G,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACxF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,OAAkC;IACnF,MAAM,eAAe,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpH,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9G,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,kBAAkB,CAAC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5D,aAAa,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC3G,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACxF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACzE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAOD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,uBAAuB;IACvB,MAAM;IACN,eAAe;IACf,cAAc;IACd,eAAe;IACf,OAAO;IACP,UAAU;IACV,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,iBAAiB;IACjB,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,uBAAuB;CACxB,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAAC,GAAa;IAChD,OAAO,CAAC,GAAG,CAAC,CAAC;IACb,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mCAAmC,CAAC,UAA4C;IACvF,IACE,UAAU,CAAC,aAAa,KAAK,SAAS;QACtC,UAAU,CAAC,gBAAgB,KAAK,SAAS;QACzC,UAAU,CAAC,qBAAqB,KAAK,SAAS,EAC9C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAA4C;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;IACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,UAA4C,EAAE,QAAiC;IAC3G,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,kCAAkC,CACzC,UAA4C,EAC5C,OAA4B,EAC5B,QAA6B;IAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IAKxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,KAAyE,CAAC;IACxF,IACE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG;QACvF,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,KAAc;IACjD,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAiC,EACjC,OAA0B;IAE1B,MAAM,eAAe,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACzG,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,mCAAmC,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5D,IAAI,MAAmB,CAAC;YACxB,IAAI,UAAU,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBACnD,kCAAkC,CAChC,UAAU,EACV,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,EACzF,yBAAyB,CAC1B,CAAC;gBACF,IACE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;oBAChE,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;oBACxF,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,EACjE,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAC;gBACzG,CAAC;gBACD,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CACvD,MAAM,EACN,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,YAAY,EACvB,QAAQ,CACT,CAAC;YACJ,CAAC;iBAAM,IAAI,UAAU,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;gBACrD,kCAAkC,CAChC,UAAU,EACV,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,EAC1E,yBAAyB,CAC1B,CAAC;gBACF,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,GAAG,EAAE,CAAC;oBAC3E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,EAAE;oBACtE,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxD,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAClD,MAAM,EACN,UAAU,CAAC,aAAa,EACxB,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAChC,QAAQ,CACT,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,OAA0B;IAE1B,MAAM,eAAe,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClH,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1G,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,mCAAmC,CAAC,UAAU,CAAC,CAAC;YAChD,kCAAkC,CAChC,UAAU,EACV,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,EAClD,0BAA0B,CAC3B,CAAC;YACF,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;gBAC5D,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAC;YAClF,CAAC;YACD,IACE,UAAU,CAAC,eAAe,KAAK,SAAS;gBACxC,UAAU,CAAC,eAAe,KAAK,cAAc;gBAC7C,UAAU,CAAC,eAAe,KAAK,eAAe,EAC9C,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE;gBACzC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvF,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}