db-mcp 2.0.0 → 3.0.1

package/dist/auth/scopes/enforcement.d.ts

@@ -0,0 +1,27 @@
+import type { ToolGroup } from "../../types/index.js";
+export declare function registerToolScopes(map: Map<string, string[]>): void;
+/**
+ * Check if a scope grants access to a specific tool
+ */
+export declare function scopeGrantsToolAccess(scope: string, toolName: string): boolean;
+/**
+ * Check if any of the scopes grants access to a tool
+ */
+export declare function scopesGrantToolAccess(scopes: string[], toolName: string): boolean;
+/**
+ * Get the required minimum scope for a tool group
+ */
+export declare function getRequiredScopeForGroup(group: ToolGroup): string;
+/**
+ * Get the required minimum scope for a tool
+ */
+export declare function getRequiredScopeForTool(toolName: string): string;
+/**
+ * Get tool groups accessible with given scopes
+ */
+export declare function getAccessibleToolGroups(scopes: string[]): ToolGroup[];
+/**
+ * Get all tools accessible with given scopes
+ */
+export declare function getAccessibleTools(scopes: string[]): string[];
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/auth/scopes/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAgBtD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAInE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAiCT;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EAAE,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEjE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYhE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAWrE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAmB7D"}

package/dist/auth/scopes/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./constants.js";
+export * from "./mapping.js";
+export * from "./validation.js";
+export * from "./enforcement.js";
+export * from "./display.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/scopes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC"}

package/dist/auth/scopes/mapping.d.ts

@@ -0,0 +1,39 @@
+import type { ToolGroup } from "../../types/index.js";
+import { type StandardScope } from "./constants.js";
+/**
+ * Declarative mapping from tool group to required minimum scope.
+ * Single source of truth — all other scope-group arrays derive from this.
+ */
+export declare const TOOL_GROUP_SCOPES: Record<ToolGroup, StandardScope>;
+/**
+ * Get the required scope for a tool group.
+ */
+export declare function getScopeForToolGroup(group: ToolGroup): StandardScope;
+/**
+ * Tool groups accessible with read scope (read-only operations)
+ */
+export declare const READ_SCOPE_GROUPS: ToolGroup[];
+/**
+ * Tool groups accessible with write scope (read + write operations)
+ */
+export declare const WRITE_SCOPE_GROUPS: ToolGroup[];
+/**
+ * Tool groups accessible with admin scope (all operations)
+ */
+export declare const ADMIN_SCOPE_GROUPS: ToolGroup[];
+export declare const ADMIN_TOOLS: ReadonlySet<string>;
+/**
+ * Read-only tools: tools that only read data (SELECT, metadata, pure functions).
+ * Used by `read` scope to allowlist tool access. Fail-closed: unlisted = denied.
+ *
+ * Sourced from actual tool names in TOOL_GROUPS (tool-constants.ts).
+ */
+export declare const READ_ONLY_TOOLS: ReadonlySet<string>;
+/**
+ * Write tools: tools that modify data but don't require admin scope.
+ * Used by `getRequiredScopeForTool()` for per-tool scope reporting.
+ *
+ * Sourced from actual tool names in TOOL_GROUPS (tool-constants.ts).
+ */
+export declare const WRITE_TOOLS: ReadonlySet<string>;
+//# sourceMappingURL=mapping.d.ts.map

package/dist/auth/scopes/mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapping.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG5D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAY9D,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,CAEpE;AAgBD;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,EAAgC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAAiC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,EAAiC,CAAC;AA6C5E,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CACV,CAAC;AAEnC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CA+F9C,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAsD1C,CAAC"}

package/dist/auth/scopes/validation.d.ts

@@ -0,0 +1,27 @@
+export declare function isValidScope(scope: string): boolean;
+/**
+ * Check if granted scopes include the required scope.
+ * Respects the scope hierarchy: full ⊃ admin ⊃ write ⊃ read
+ */
+export declare function hasScope(grantedScopes: string[], requiredScope: string): boolean;
+/**
+ * Check if granted scopes include any of the required scopes
+ */
+export declare function hasAnyScope(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Check if granted scopes include all of the required scopes
+ */
+export declare function hasAllScopes(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Check if scopes include admin access
+ */
+export declare function hasAdminScope(scopes: string[]): boolean;
+/**
+ * Check if scopes include write access
+ */
+export declare function hasWriteScope(scopes: string[]): boolean;
+/**
+ * Check if scopes include read access
+ */
+export declare function hasReadScope(scopes: string[]): boolean;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/scopes/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/scopes/validation.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,aAAa,EAAE,MAAM,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CA0BT;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,aAAa,EAAE,MAAM,EAAE,EACvB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EAAE,EACvB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAEtD"}

package/dist/auth/token-validator.d.ts

@@ -0,0 +1,63 @@
+/**
+ * db-mcp - Token Validator
+ *
+ * JWT access token validation using JWKS for signature verification.
+ * Supports RSA and EC algorithms commonly used with OAuth 2.1.
+ */
+import type { TokenValidationResult, TokenValidatorConfig } from "./types.js";
+import { InvalidTokenError, TokenExpiredError, InvalidSignatureError } from "./errors.js";
+/**
+ * JWT Token Validator
+ *
+ * Validates OAuth 2.1 access tokens using JWKS for signature verification.
+ */
+export declare class TokenValidator {
+    /** Default algorithms accepted when none are explicitly configured */
+    private static readonly DEFAULT_ALGORITHMS;
+    /** Resolved configuration with all defaults applied */
+    private readonly jwksUri;
+    private readonly issuer;
+    private readonly audience;
+    private readonly clockTolerance;
+    private readonly jwksCacheTtl;
+    private readonly algorithms;
+    private jwks;
+    private jwksExpiry;
+    constructor(config: TokenValidatorConfig);
+    /**
+     * Validate an access token
+     *
+     * @param token - The JWT access token
+     * @returns Validation result with claims or error
+     */
+    validate(token: string): Promise<TokenValidationResult>;
+    /**
+     * Get or refresh the JWKS
+     */
+    private getJwks;
+    /**
+     * Extract and normalize token claims
+     */
+    private extractClaims;
+    /**
+     * Handle validation errors and convert to TokenValidationResult
+     */
+    private handleValidationError;
+    /**
+     * Refresh the JWKS cache
+     */
+    refreshJwks(): void;
+    /**
+     * Clear the JWKS cache
+     */
+    clearCache(): void;
+    /**
+     * Convert a validation error to the appropriate OAuth error class
+     */
+    static toOAuthError(result: TokenValidationResult): InvalidTokenError | TokenExpiredError | InvalidSignatureError;
+}
+/**
+ * Create a Token Validator instance
+ */
+export declare function createTokenValidator(config: TokenValidatorConfig): TokenValidator;
+//# sourceMappingURL=token-validator.d.ts.map

package/dist/auth/token-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-validator.d.ts","sourceRoot":"","sources":["../../src/auth/token-validator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAErB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EAEtB,MAAM,aAAa,CAAC;AAUrB;;;;GAIG;AACH,qBAAa,cAAc;IACzB,sEAAsE;IACtE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAOxC;IAEF,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;IAEtC,OAAO,CAAC,IAAI,CAAqC;IACjD,OAAO,CAAC,UAAU,CAAK;gBAEX,MAAM,EAAE,oBAAoB;IAiCxC;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAiC7D;;OAEG;IACH,OAAO,CAAC,OAAO;IAoCf;;OAEG;IACH,OAAO,CAAC,aAAa;IAiDrB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyE7B;;OAEG;IACH,WAAW,IAAI,IAAI;IAOnB;;OAEG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACH,MAAM,CAAC,YAAY,CACjB,MAAM,EAAE,qBAAqB,GAC5B,iBAAiB,GAAG,iBAAiB,GAAG,qBAAqB;CAWjE;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CAEhB"}

package/dist/auth/transport-agnostic.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Transport-Agnostic Auth Utilities
+ *
+ * Non-Express-specific auth utilities for use by any transport
+ * (stdio, HTTP, WebSocket, etc.).
+ *
+ * Re-exports from the middleware module for discoverability.
+ */
+export { extractBearerToken } from "./middleware/extraction.js";
+export { createAuthenticatedContext, validateAuth, formatOAuthError, type AuthenticatedContext, } from "./middleware/core.js";
+//# sourceMappingURL=transport-agnostic.d.ts.map

package/dist/auth/transport-agnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-agnostic.d.ts","sourceRoot":"","sources":["../../src/auth/transport-agnostic.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,257 @@
+/**
+ * db-mcp - OAuth Types
+ *
+ * Type definitions for OAuth 2.1 components including
+ * RFC 9728, RFC 8414, and RFC 7591 compliance.
+ */
+/**
+ * OAuth 2.1 Protected Resource Metadata (RFC 9728)
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9728
+ */
+export interface ProtectedResourceMetadata {
+    /** Resource identifier (canonical URI) */
+    resource: string;
+    /** Authorization servers that can issue tokens for this resource */
+    authorization_servers?: string[];
+    /** JWKS URI for token verification (optional, usually from auth server) */
+    jwks_uri?: string;
+    /** Scopes supported by this resource */
+    scopes_supported?: string[];
+    /** Bearer token presentation methods supported */
+    bearer_methods_supported?: ("header" | "body" | "query")[];
+    /** Resource signing algorithms supported */
+    resource_signing_alg_values_supported?: string[];
+    /** Resource documentation URL */
+    resource_documentation?: string;
+    /** Resource policy URI */
+    resource_policy_uri?: string;
+    /** Resource terms of service URI */
+    resource_tos_uri?: string;
+}
+/**
+ * OAuth 2.1 Authorization Server Metadata (RFC 8414)
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8414
+ */
+export interface AuthorizationServerMetadata {
+    /** Authorization server issuer identifier */
+    issuer: string;
+    /** Authorization endpoint URL */
+    authorization_endpoint?: string;
+    /** Token endpoint URL */
+    token_endpoint: string;
+    /** JWKS URI */
+    jwks_uri?: string;
+    /** Registration endpoint (RFC 7591) */
+    registration_endpoint?: string;
+    /** Scopes supported */
+    scopes_supported?: string[];
+    /** Response types supported */
+    response_types_supported?: string[];
+    /** Response modes supported */
+    response_modes_supported?: string[];
+    /** Grant types supported */
+    grant_types_supported?: string[];
+    /** Token endpoint auth methods supported */
+    token_endpoint_auth_methods_supported?: string[];
+    /** Token endpoint auth signing algorithms */
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    /** Service documentation URL */
+    service_documentation?: string;
+    /** UI locales supported */
+    ui_locales_supported?: string[];
+    /** OP policy URI */
+    op_policy_uri?: string;
+    /** OP terms of service URI */
+    op_tos_uri?: string;
+    /** Revocation endpoint */
+    revocation_endpoint?: string;
+    /** Revocation endpoint auth methods */
+    revocation_endpoint_auth_methods_supported?: string[];
+    /** Introspection endpoint */
+    introspection_endpoint?: string;
+    /** Introspection endpoint auth methods */
+    introspection_endpoint_auth_methods_supported?: string[];
+    /** Code challenge methods supported (PKCE) */
+    code_challenge_methods_supported?: string[];
+}
+/**
+ * OAuth 2.1 Dynamic Client Registration Request (RFC 7591)
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7591
+ */
+export interface ClientRegistrationRequest {
+    /** Redirect URIs */
+    redirect_uris?: string[];
+    /** Token endpoint auth method */
+    token_endpoint_auth_method?: string;
+    /** Grant types requested */
+    grant_types?: string[];
+    /** Response types requested */
+    response_types?: string[];
+    /** Client name */
+    client_name?: string;
+    /** Client URI */
+    client_uri?: string;
+    /** Logo URI */
+    logo_uri?: string;
+    /** Scopes requested */
+    scope?: string;
+    /** Contacts */
+    contacts?: string[];
+    /** Terms of service URI */
+    tos_uri?: string;
+    /** Policy URI */
+    policy_uri?: string;
+    /** JWKS URI for client authentication */
+    jwks_uri?: string;
+    /** JWKS document for client authentication */
+    jwks?: JWKSDocument;
+    /** Software ID */
+    software_id?: string;
+    /** Software version */
+    software_version?: string;
+    /** Software statement (signed JWT) */
+    software_statement?: string;
+}
+/**
+ * OAuth 2.1 Dynamic Client Registration Response (RFC 7591)
+ */
+export interface ClientRegistrationResponse {
+    /** Client identifier */
+    client_id: string;
+    /** Client secret (for confidential clients) */
+    client_secret?: string;
+    /** Client secret expiration timestamp */
+    client_secret_expires_at?: number;
+    /** Registration access token */
+    registration_access_token?: string;
+    /** Registration client URI */
+    registration_client_uri?: string;
+    /** Client ID issued at timestamp */
+    client_id_issued_at?: number;
+    /** All other fields from the request */
+    [key: string]: unknown;
+}
+/**
+ * JSON Web Key (JWK)
+ */
+export interface JWK {
+    /** Key type (e.g., 'RSA', 'EC') */
+    kty: string;
+    /** Key use ('sig' for signature, 'enc' for encryption) */
+    use?: string;
+    /** Key operations */
+    key_ops?: string[];
+    /** Algorithm */
+    alg?: string;
+    /** Key ID */
+    kid?: string;
+    /** X.509 URL */
+    x5u?: string;
+    /** X.509 certificate chain */
+    x5c?: string[];
+    /** X.509 certificate SHA-1 thumbprint */
+    x5t?: string;
+    /** X.509 certificate SHA-256 thumbprint */
+    "x5t#S256"?: string;
+    /** RSA modulus */
+    n?: string;
+    /** RSA public exponent */
+    e?: string;
+    /** EC curve */
+    crv?: string;
+    /** EC x coordinate */
+    x?: string;
+    /** EC y coordinate */
+    y?: string;
+}
+/**
+ * JSON Web Key Set (JWKS)
+ */
+export interface JWKSDocument {
+    /** Array of JWK keys */
+    keys: JWK[];
+}
+/**
+ * Result of token validation
+ */
+export interface TokenValidationResult {
+    /** Whether the token is valid */
+    valid: boolean;
+    /** Validated claims (if valid) */
+    claims?: TokenClaims;
+    /** Error message (if invalid) */
+    error?: string;
+    /** Error code (if invalid) */
+    errorCode?: string;
+}
+/**
+ * Validated token claims
+ * Extended from the base TokenClaims in types/index.ts
+ */
+export interface TokenClaims {
+    /** Subject (user ID) */
+    sub: string;
+    /** Granted scopes (parsed from space-delimited string) */
+    scopes: string[];
+    /** Token expiration time (Unix timestamp) */
+    exp: number;
+    /** Token issued at time (Unix timestamp) */
+    iat: number;
+    /** Token issuer */
+    iss?: string | undefined;
+    /** Token audience */
+    aud?: string | string[] | undefined;
+    /** Not before time (Unix timestamp) */
+    nbf?: number | undefined;
+    /** JWT ID */
+    jti?: string | undefined;
+    /** Client ID */
+    client_id?: string | undefined;
+    /** Additional claims */
+    [key: string]: unknown;
+}
+/**
+ * Resource server configuration
+ */
+export interface ResourceServerConfig {
+    /** Resource identifier (canonical server URI) */
+    resource: string;
+    /** Authorization servers that can issue tokens */
+    authorizationServers: string[];
+    /** Scopes supported by this resource */
+    scopesSupported: string[];
+    /** Bearer token methods accepted (default: ['header']) */
+    bearerMethodsSupported?: ("header" | "body" | "query")[];
+}
+/**
+ * Token validator configuration
+ */
+export interface TokenValidatorConfig {
+    /** JWKS URI for key discovery */
+    jwksUri: string;
+    /** Expected issuer */
+    issuer: string;
+    /** Expected audience */
+    audience: string;
+    /** Clock tolerance in seconds (default: 60) */
+    clockTolerance?: number | undefined;
+    /** JWKS cache TTL in seconds (default: 3600) */
+    jwksCacheTtl?: number | undefined;
+    /** Supported algorithms (default: ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512']) */
+    algorithms?: string[] | undefined;
+}
+/**
+ * Authorization server discovery configuration
+ */
+export interface AuthServerDiscoveryConfig {
+    /** Authorization server URL (issuer) */
+    authServerUrl: string;
+    /** Cache TTL in seconds (default: 3600) */
+    cacheTtl?: number | undefined;
+    /** Request timeout in milliseconds (default: 5000) */
+    timeout?: number | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IAEjB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,kDAAkD;IAClD,wBAAwB,CAAC,EAAE,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IAE3D,4CAA4C;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjD,iCAAiC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,0BAA0B;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IAEf,iCAAiC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,yBAAyB;IACzB,cAAc,EAAE,MAAM,CAAC;IAEvB,eAAe;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,uBAAuB;IACvB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,+BAA+B;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpC,+BAA+B;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpC,4BAA4B;IAC5B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjC,4CAA4C;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjD,6CAA6C;IAC7C,gDAAgD,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5D,gCAAgC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,2BAA2B;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhC,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,0BAA0B;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,uCAAuC;IACvC,0CAA0C,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtD,6BAA6B;IAC7B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,0CAA0C;IAC1C,6CAA6C,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzD,8CAA8C;IAC9C,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7C;AAMD;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,iCAAiC;IACjC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAEpC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,eAAe;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,eAAe;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,YAAY,CAAC;IAEpB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uBAAuB;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,sCAAsC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,yCAAyC;IACzC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAElC,gCAAgC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC,8BAA8B;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,oCAAoC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,wCAAwC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IAEZ,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,qBAAqB;IACrB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,gBAAgB;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,gBAAgB;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,kBAAkB;IAClB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,CAAC,CAAC,EAAE,MAAM,CAAC;IAGX,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wBAAwB;IACxB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IAEf,kCAAkC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IAEZ,0DAA0D;IAC1D,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IAEZ,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IAEZ,mBAAmB;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAEpC,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzB,gBAAgB;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE/B,wBAAwB;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IAEjB,kDAAkD;IAClD,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAE/B,wCAAwC;IACxC,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAEhB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IAEjB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAElC,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAC;IAEtB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9B,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B"}