noodleseed-cli 0.1.4

package/node_modules/@noodle-borg/transport-http/dist/handler.js

@@ -0,0 +1,387 @@
+import { handleStatelessHttp, JSON_RPC } from '@noodle-borg/protocol';
+import { bearerToken, CALLER_REALM, verifyCallerKey } from './caller-auth.js';
+import { applySecurityHeaders, effectiveProto, enforceHttps, } from './front-door.js';
+import { noopLogger } from './logging.js';
+const DEFAULT_ENDPOINT = '/mcp';
+const DEFAULT_MAX_BODY = 1 << 20;
+/**
+ * Build a `node:http` request listener that serves one {@link ServedArtifact} over the MCP **Streamable
+ * HTTP** transport (the remote transport). This is the security/HTTP front-door: it validates origin,
+ * method, content negotiation, and body size, then hands the parsed JSON-RPC body to the official
+ * `@modelcontextprotocol/sdk` stateless transport ([ADR 0021]), which owns framing and version
+ * negotiation. It is **stateless** — no `MCP-Session-Id` is issued. Server-initiated streaming (SSE)
+ * is not offered, so `GET` returns `405`.
+ */
+export function createMcpHttpHandler(target, options = {}) {
+    const endpoint = options.endpoint ?? DEFAULT_ENDPOINT;
+    const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY;
+    const logger = options.logger ?? noopLogger;
+    const tls = options.tls ?? {};
+    return (req, res) => {
+        const start = Date.now();
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls)) {
+            logRequest(logger, 'single', req, res, start);
+            return;
+        }
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        if (url.pathname !== endpoint) {
+            sendJson(res, 404, rpcError(JSON_RPC.INVALID_REQUEST, 'not found'));
+            logRequest(logger, 'single', req, res, start);
+            return;
+        }
+        void guard(res, serveRequest(req, res, target, {
+            callerKeyHash: options.callerKeyHash,
+            accessMode: undefined,
+            ownerSubject: undefined,
+            org: undefined,
+            verifyOwnerToken: options.verifyOwnerToken,
+            authorizeDataPlaneIdentity: options.authorizeDataPlaneIdentity,
+            verifyCallerKeyForTenant: options.verifyCallerKeyForTenant,
+            admissionGate: options.admissionGate,
+            logger,
+            trustProxy: tls.trustProxy ?? false,
+        }, 'single', maxBody, options.allowedOrigins)).then(() => logRequest(logger, 'single', req, res, start));
+    };
+}
+const SERVER_PATH = /^\/([^/]+)\/mcp$/;
+const TENANT_PROD_PATH = /^\/o\/([^/]+)\/([^/]+)\/mcp$/;
+const TENANT_ENV_PATH = /^\/o\/([^/]+)\/([^/]+)\/([^/]+)\/mcp$/;
+/**
+ * Build a `node:http` request listener that serves **many** tenants over MCP Streamable HTTP, routing
+ * by tenant paths. Each request reuses the same stateless pipeline as
+ * {@link createMcpHttpHandler}; an unknown path or unknown server id returns `404`.
+ */
+export function createMcpRouter(lookup, options = {}) {
+    const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY;
+    const logger = options.logger ?? noopLogger;
+    const tls = options.tls ?? {};
+    return (req, res) => {
+        const start = Date.now();
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls)) {
+            logRequest(logger, '?', req, res, start);
+            return;
+        }
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        const route = parseRoute(url.pathname);
+        // The resolver is async (it may point-read the store + recompile on a cache miss — ADR 0036). A
+        // resolved `undefined` (no such server) is a `404`; a resolver throw (store/compile error) falls
+        // through to `guard`'s `500`. Caller-key auth is still checked inside `serveRequest`, after resolution.
+        void guard(res, (async () => {
+            const target = route?.kind === 'tenant' && options.tenantLookup
+                ? await options.tenantLookup(route.ref)
+                : route?.kind === 'deployment'
+                    ? await lookup(route.deploymentId)
+                    : undefined;
+            if (!target) {
+                sendJson(res, 404, rpcError(JSON_RPC.INVALID_REQUEST, 'not found'));
+                return;
+            }
+            const routeId = route?.kind === 'tenant'
+                ? route.logId
+                : route?.kind === 'deployment'
+                    ? route.deploymentId
+                    : '?';
+            const tenant = route?.kind === 'tenant' ? route.ref : undefined;
+            await serveRequest(req, res, target.served, {
+                callerKeyHash: target.callerKeyHash,
+                accessMode: target.accessMode,
+                ownerSubject: target.ownerSubject,
+                org: target.org,
+                verifyOwnerToken: options.verifyOwnerToken,
+                authorizeDataPlaneIdentity: options.authorizeDataPlaneIdentity,
+                verifyCallerKeyForTenant: options.verifyCallerKeyForTenant,
+                admissionGate: options.admissionGate,
+                logger,
+                trustProxy: tls.trustProxy ?? false,
+            }, routeId, maxBody, options.allowedOrigins, tenant);
+        })()).then(() => logRequest(logger, route?.logId ?? '?', req, res, start));
+    };
+}
+function parseRoute(pathname) {
+    const tenantEnv = TENANT_ENV_PATH.exec(pathname);
+    if (tenantEnv) {
+        const org = safeDecode(tenantEnv[1]);
+        const app = safeDecode(tenantEnv[2]);
+        const env = safeDecode(tenantEnv[3]);
+        if (org === null || app === null || env === null)
+            return null;
+        return { kind: 'tenant', ref: { org, app, env }, logId: `${org}/${app}/${env}` };
+    }
+    const tenantProd = TENANT_PROD_PATH.exec(pathname);
+    if (tenantProd) {
+        const org = safeDecode(tenantProd[1]);
+        const app = safeDecode(tenantProd[2]);
+        if (org === null || app === null)
+            return null;
+        return { kind: 'tenant', ref: { org, app, env: 'prod' }, logId: `${org}/${app}/prod` };
+    }
+    const deployment = SERVER_PATH.exec(pathname);
+    if (deployment) {
+        const deploymentId = safeDecode(deployment[1]);
+        if (deploymentId === null)
+            return null;
+        return { kind: 'deployment', deploymentId, logId: deploymentId };
+    }
+    return null;
+}
+/**
+ * Emit one `mcp.request` lifecycle line. Only safe scalars (id, method, status, latency) — never the
+ * Authorization header, caller key, body, or JSON-RPC params.
+ */
+function logRequest(logger, routeId, req, res, start) {
+    logger.info('mcp.request', {
+        serverId: routeId,
+        method: req.method ?? 'UNKNOWN',
+        status: res.statusCode,
+        latencyMs: Date.now() - start,
+    });
+}
+function safeDecode(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+function guard(res, fn) {
+    return fn.catch(() => {
+        if (!res.headersSent)
+            sendJson(res, 500, rpcError(JSON_RPC.INTERNAL_ERROR, 'internal error'));
+    });
+}
+/**
+ * The shared, stateless front-door (origin → method → auth → content-type → accept → body) for one resolved
+ * tenant. After the guards pass, the parsed JSON-RPC body is handed to the SDK transport, which writes
+ * the full response (including `202` for a notification). Path matching is done by the caller.
+ */
+async function serveRequest(req, res, target, auth, routeId, maxBody, allowed, tenant) {
+    const origin = header(req, 'origin');
+    if (origin !== undefined && !originAllowed(origin, allowed)) {
+        return sendJson(res, 403, rpcError(JSON_RPC.INVALID_REQUEST, 'origin not allowed'));
+    }
+    if (req.method !== 'POST') {
+        // No server-initiated SSE stream this phase: GET/DELETE/other are not allowed.
+        res.setHeader('Allow', 'POST');
+        return sendJson(res, 405, rpcError(JSON_RPC.INVALID_REQUEST, 'method not allowed'));
+    }
+    // Auth gate, before reading the body so an unauthenticated caller never has its payload buffered and the
+    // SDK transport is never constructed for it. Modes: shared per-server caller key (default), or
+    // identity-based OAuth access where a verified token is checked against the deployment's access policy.
+    if (isIdentityMode(auth.accessMode)) {
+        if (await denyIdentityMode(req, res, auth))
+            return;
+    }
+    else if (tenant !== undefined && auth.verifyCallerKeyForTenant !== undefined) {
+        if (!(await auth.verifyCallerKeyForTenant({
+            tenant,
+            token: bearerToken(req),
+            cachedCallerKeyHash: auth.callerKeyHash,
+        }))) {
+            return sendUnauthorized(res);
+        }
+    }
+    else if (auth.callerKeyHash !== undefined) {
+        if (!verifyCallerKey(bearerToken(req), auth.callerKeyHash))
+            return sendUnauthorized(res);
+    }
+    // Content negotiation (Accept / Content-Type) is owned by the SDK transport ([ADR 0021]); it returns
+    // `406`/`415` for non-compliant requests. The front-door only guards origin, method, and body size.
+    const body = await readBody(req, maxBody);
+    if (!body.ok)
+        return sendJson(res, 413, rpcError(JSON_RPC.INVALID_REQUEST, 'request body too large'));
+    let parsed;
+    try {
+        parsed = JSON.parse(body.text);
+    }
+    catch {
+        return sendJson(res, 400, rpcError(JSON_RPC.PARSE_ERROR, 'invalid JSON'));
+    }
+    const contexts = admissionContexts(parsed, {
+        routeId,
+        ...(tenant !== undefined ? tenant : {}),
+        ...(auth.accessMode !== undefined ? { accessMode: auth.accessMode } : {}),
+    });
+    for (const context of contexts) {
+        const decision = auth.admissionGate
+            ? await auth.admissionGate(context)
+            : { allow: true };
+        auth.logger.info('mcp.admission', {
+            routeId: context.routeId,
+            method: context.method,
+            category: context.category,
+            ...(context.name !== undefined ? { name: context.name } : {}),
+            ...(context.org !== undefined ? { org: context.org } : {}),
+            ...(context.app !== undefined ? { app: context.app } : {}),
+            ...(context.env !== undefined ? { env: context.env } : {}),
+            ...(context.accessMode !== undefined ? { accessMode: context.accessMode } : {}),
+            decision: decision.allow ? 'allow' : 'deny',
+            ...(decision.reason !== undefined ? { reason: decision.reason } : {}),
+        });
+        if (!decision.allow) {
+            return sendJson(res, decision.status ?? 403, rpcError(JSON_RPC.INVALID_REQUEST, decision.reason));
+        }
+    }
+    // The SDK stateless transport owns JSON-RPC framing, version negotiation, and the response (200 for a
+    // request, 202 for a notification). We pass the already-read body so the body-size guard still applies.
+    await handleStatelessHttp(target, req, res, parsed);
+}
+function admissionContexts(parsed, base) {
+    const items = Array.isArray(parsed) ? parsed : [parsed];
+    return items.map((item) => {
+        const method = rpcMethod(item);
+        const name = rpcTargetName(item, method);
+        return {
+            ...base,
+            method,
+            category: admissionCategory(method),
+            ...(name !== undefined ? { name } : {}),
+        };
+    });
+}
+function rpcMethod(value) {
+    if (typeof value !== 'object' || value === null)
+        return 'unknown';
+    const method = value.method;
+    return typeof method === 'string' ? method : 'unknown';
+}
+function rpcTargetName(value, method) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const params = value.params;
+    if (typeof params !== 'object' || params === null)
+        return undefined;
+    const name = params.name;
+    if (typeof name === 'string')
+        return name;
+    const uri = params.uri;
+    return typeof uri === 'string' && method.startsWith('resources/') ? uri : undefined;
+}
+function admissionCategory(method) {
+    if (method === 'tools/list' ||
+        method === 'resources/list' ||
+        method === 'resources/templates/list' ||
+        method === 'prompts/list') {
+        return 'discovery';
+    }
+    if (method === 'resources/read' || method === 'prompts/get' || method.startsWith('completion/')) {
+        return 'read';
+    }
+    if (method === 'tools/call')
+        return 'execute';
+    return 'protocol';
+}
+function header(req, name) {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+function originAllowed(origin, allowed) {
+    if (allowed === undefined)
+        return true;
+    return typeof allowed === 'function' ? allowed(origin) : allowed.includes(origin);
+}
+async function readBody(req, max) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buf = chunk;
+        size += buf.length;
+        if (size > max)
+            return { ok: false };
+        chunks.push(buf);
+    }
+    return { ok: true, text: Buffer.concat(chunks).toString('utf8') };
+}
+function sendJson(res, status, body) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(body));
+}
+/**
+ * A `401` with a bearer challenge and a transport-level JSON-RPC error body. For owner-only endpoints,
+ * `resourceMetadataUrl` is included so an MCP client can discover the authorization server (RFC 9728 /
+ * the MCP authorization spec); for caller-key endpoints the plain realm challenge is sent.
+ */
+function sendUnauthorized(res, resourceMetadataUrl) {
+    const challenge = resourceMetadataUrl !== undefined
+        ? `Bearer realm="mrdn", resource_metadata="${resourceMetadataUrl}"`
+        : CALLER_REALM;
+    res.writeHead(401, {
+        'content-type': 'application/json; charset=utf-8',
+        'www-authenticate': challenge,
+    });
+    res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'unauthorized')));
+}
+/** A `403` with a transport-level JSON-RPC error body (authenticated, but not authorized). */
+function sendForbidden(res) {
+    sendJson(res, 403, rpcError(JSON_RPC.INVALID_REQUEST, 'forbidden'));
+}
+/**
+ * Identity gate (OA-1/OA-3): require a verified token and authorize it against the deployment access mode.
+ * Returns `true`
+ * when it has written a denial (`401` with a protected-resource-metadata challenge, or `403`), `false` when
+ * the request may proceed. Fails closed — a missing token or no configured verifier yields `401`.
+ */
+async function denyIdentityMode(req, res, auth) {
+    const challenge = protectedResourceMetadataUrl(req, auth.trustProxy);
+    const token = bearerToken(req);
+    if (token === null || auth.verifyOwnerToken === undefined) {
+        sendUnauthorized(res, challenge);
+        return true;
+    }
+    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth.trustProxy));
+    if (identity === null) {
+        sendUnauthorized(res, challenge);
+        return true;
+    }
+    if (auth.accessMode === 'owner-only') {
+        if (auth.ownerSubject === undefined) {
+            sendUnauthorized(res, challenge);
+            return true;
+        }
+        if (identity.subject !== auth.ownerSubject) {
+            sendForbidden(res);
+            return true;
+        }
+        return false;
+    }
+    if (auth.accessMode === 'org-members' &&
+        (auth.org === undefined ||
+            auth.authorizeDataPlaneIdentity === undefined ||
+            !(await auth.authorizeDataPlaneIdentity({
+                accessMode: auth.accessMode,
+                org: auth.org,
+                subject: identity.subject,
+                ...(identity.email !== undefined ? { email: identity.email } : {}),
+            })))) {
+        sendForbidden(res);
+        return true;
+    }
+    return false;
+}
+function isIdentityMode(mode) {
+    return mode === 'owner-only' || mode === 'org-members';
+}
+/** The public origin + path for this request, honouring the trusted forwarded-proto when configured. */
+function requestUrl(req, trustProxy) {
+    const proto = effectiveProto(req, trustProxy);
+    const host = header(req, 'host') ?? 'localhost';
+    const pathname = new URL(req.url ?? '/', `${proto}://${host}`).pathname;
+    return { origin: `${proto}://${host}`, pathname };
+}
+/** The canonical resource identifier (the tenant MCP URL) a token must be audience-bound to (RFC 8707). */
+function resourceUrl(req, trustProxy) {
+    const { origin, pathname } = requestUrl(req, trustProxy);
+    return `${origin}${pathname}`;
+}
+/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
+function protectedResourceMetadataUrl(req, trustProxy) {
+    const { origin, pathname } = requestUrl(req, trustProxy);
+    return `${origin}/.well-known/oauth-protected-resource${pathname}`;
+}
+/** A transport-level JSON-RPC error response with no id (per the Streamable HTTP spec). */
+function rpcError(code, message) {
+    return { jsonrpc: '2.0', id: null, error: { code, message } };
+}
+//# sourceMappingURL=handler.js.map

package/node_modules/@noodle-borg/transport-http/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAuB,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAe,UAAU,EAAE,MAAM,cAAc,CAAC;AAyGvD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAsB,EACtB,UAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YACpE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CACR,GAAG,EACH,YAAY,CACV,GAAG,EACH,GAAG,EACH,MAAM,EACN;YACE,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,SAAS;YACvB,GAAG,EAAE,SAAS;YACd,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;YAC9D,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,MAAM;YACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;SACpC,EACD,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,cAAc,CACvB,CACF,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AA2BD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AACxD,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAoB,EACpB,UAAyE,EAAE;IAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,gGAAgG;QAChG,iGAAiG;QACjG,wGAAwG;QACxG,KAAK,KAAK,CACR,GAAG,EACH,CAAC,KAAK,IAAI,EAAE;YACV,MAAM,MAAM,GACV,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY;gBAC9C,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;gBACvC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAClC,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GACX,KAAK,EAAE,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,YAAY;oBAC5B,CAAC,CAAC,KAAK,CAAC,YAAY;oBACpB,CAAC,CAAC,GAAG,CAAC;YACZ,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,YAAY,CAChB,GAAG,EACH,GAAG,EACH,MAAM,CAAC,MAAM,EACb;gBACE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;gBAC9D,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;gBAC1D,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,MAAM;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK;aACpC,EACD,OAAO,EACP,OAAO,EACP,OAAO,CAAC,cAAc,EACtB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,QAAgB;IAKhB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAW,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAW,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAW,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,MAAc,EACd,OAAe,EACf,GAAoB,EACpB,GAAmB,EACnB,KAAa;IAEb,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;QACzB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;QAC/B,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAmB,EAAE,EAAiB;IACnD,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,MAAsB,EACtB,IAAe,EACf,OAAe,EACf,OAAe,EACf,OAAiC,EACjC,MAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,yGAAyG;IACzG,+FAA+F;IAC/F,wGAAwG;IACxG,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO;IACrD,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAC/E,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC;YACpC,MAAM;YACN,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;YACvB,mBAAmB,EAAE,IAAI,CAAC,aAAa;SACxC,CAAC,CAAC,EACH,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IAED,qGAAqG;IACrG,oGAAoG;IACpG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE1F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACzC,OAAO;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACnC,CAAC,CAAE,EAAE,KAAK,EAAE,IAAI,EAAY,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,QAAQ,CACb,GAAG,EACH,QAAQ,CAAC,MAAM,IAAI,GAAG,EACtB,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sGAAsG;IACtG,wGAAwG;IACxG,MAAM,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAe,EACf,IAA4D;IAE5D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,IAAI;YACP,MAAM;YACN,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC;YACnC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAI,KAAuC,CAAC,MAAM,CAAC;IAC/D,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,MAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAI,KAAuC,CAAC,MAAM,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,IAAI,GAAI,MAA8D,CAAC,IAAI,CAAC;IAClF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAI,MAAqC,CAAC,GAAG,CAAC;IACvD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,IACE,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,gBAAgB;QAC3B,MAAM,KAAK,0BAA0B;QACrC,MAAM,KAAK,cAAc,EACzB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAChG,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,GAAoB,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,OAAiC;IACtE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAoB,EACpB,GAAW;IAEX,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,mBAA4B;IACzE,MAAM,SAAS,GACb,mBAAmB,KAAK,SAAS;QAC/B,CAAC,CAAC,2CAA2C,mBAAmB,GAAG;QACnE,CAAC,CAAC,YAAY,CAAC;IACnB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAmB;IACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAoB,EACpB,GAAmB,EACnB,IAAe;IAEf,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,IAAI,CAAC,UAAU,KAAK,aAAa;QACjC,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS;YACrB,IAAI,CAAC,0BAA0B,KAAK,SAAS;YAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC;gBACtC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC,CAAC,CAAC,EACN,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAA4B;IAClD,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,aAAa,CAAC;AACzD,CAAC;AAED,wGAAwG;AACxG,SAAS,UAAU,CACjB,GAAoB,EACpB,UAAmB;IAEnB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,2GAA2G;AAC3G,SAAS,WAAW,CAAC,GAAoB,EAAE,UAAmB;IAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,yGAAyG;AACzG,SAAS,4BAA4B,CAAC,GAAoB,EAAE,UAAmB;IAC7E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO,GAAG,MAAM,wCAAwC,QAAQ,EAAE,CAAC;AACrE,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAChE,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { bearerToken, CALLER_REALM, hashCallerKey, mintCallerKey, verifyCallerKey, } from './caller-auth.js';
+export { applySecurityHeaders, effectiveProto, enforceHttps, type TlsPosture, } from './front-door.js';
+export { type AccessMode, type AdmissionCategory, type AdmissionContext, type AdmissionDecision, type AdmissionGate, type CallerKeyTenantVerifier, createMcpHttpHandler, createMcpRouter, type DataPlaneIdentityAuthorizer, type HttpHandlerOptions, type OriginPolicy, type OwnerTokenVerifier, type ServedTarget, type ServerLookup, } from './handler.js';
+export { createLogger, type LogFields, type Logger, type LoggerOptions, type LogLevel, type LogSink, noopLogger, stdoutSink, } from './logging.js';
+export { type RunningServer, type ServeOptions, serveHttp } from './serve.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,oBAAoB,EACpB,eAAe,EACf,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,UAAU,EACV,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/index.js

@@ -0,0 +1,6 @@
+export { bearerToken, CALLER_REALM, hashCallerKey, mintCallerKey, verifyCallerKey, } from './caller-auth.js';
+export { applySecurityHeaders, effectiveProto, enforceHttps, } from './front-door.js';
+export { createMcpHttpHandler, createMcpRouter, } from './handler.js';
+export { createLogger, noopLogger, stdoutSink, } from './logging.js';
+export { serveHttp } from './serve.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/transport-http/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAOL,oBAAoB,EACpB,eAAe,GAOhB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EAMZ,UAAU,EACV,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAyC,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/logging.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Minimal structured (JSON-line) logging for the runtime front-door + deploy plane (Slice 27, ADR 0031).
+ *
+ * A precursor to full OpenTelemetry (ADR 0024, Phase 4); it shares that decision's **hard redaction**
+ * intent but pulls in no dependency. Safety is structural: every record is a **flat bag of scalars**
+ * built by hand from an allowlist at the call site, and non-scalar values are dropped to `[unloggable]`
+ * — so a stray token-bearing object can never be stringified into a line, and no call site ever logs a
+ * header map, request body, secret, caller key, or continuation token.
+ */
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+/** A flat bag of **pre-redacted scalar** fields. Never pass raw secrets, tokens, headers, or bodies. */
+export interface LogFields {
+    readonly [key: string]: string | number | boolean | null | undefined;
+}
+/** Destination for a finished log line. The default writes one compact JSON line + `\n` to stdout. */
+export type LogSink = (line: string) => void;
+export declare const stdoutSink: LogSink;
+export interface LoggerOptions {
+    /** Minimum level to emit; lower levels are dropped. Default `info`. */
+    readonly level?: LogLevel;
+    /** Where lines go. Default {@link stdoutSink}. */
+    readonly sink?: LogSink;
+    /** Clock for the `ts` field (injectable for deterministic tests). Default `Date.now`. */
+    readonly clock?: () => number;
+    /** Static fields merged into every record (e.g. a service name). */
+    readonly base?: LogFields;
+}
+export interface Logger {
+    readonly level: LogLevel;
+    log(level: LogLevel, event: string, fields?: LogFields): void;
+    debug(event: string, fields?: LogFields): void;
+    info(event: string, fields?: LogFields): void;
+    warn(event: string, fields?: LogFields): void;
+    error(event: string, fields?: LogFields): void;
+    /** A logger with extra base fields (e.g. a per-request id) merged in. */
+    child(extra: LogFields): Logger;
+}
+export declare function createLogger(options?: LoggerOptions): Logger;
+/** A logger that drops everything — the default so opting out (and existing callers) cost nothing. */
+export declare const noopLogger: Logger;
+//# sourceMappingURL=logging.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAI3D,wGAAwG;AACxG,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;CACtE;AAED,sGAAsG;AACtG,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE7C,eAAO,MAAM,UAAU,EAAE,OAExB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,yFAAyF;IACzF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9D,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9C,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC/C,yEAAyE;IACzE,KAAK,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;CACjC;AAaD,wBAAgB,YAAY,CAAC,OAAO,GAAE,aAAkB,GAAG,MAAM,CAiChE;AAID,sGAAsG;AACtG,eAAO,MAAM,UAAU,EAAE,MAQxB,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/logging.js

@@ -0,0 +1,71 @@
+/**
+ * Minimal structured (JSON-line) logging for the runtime front-door + deploy plane (Slice 27, ADR 0031).
+ *
+ * A precursor to full OpenTelemetry (ADR 0024, Phase 4); it shares that decision's **hard redaction**
+ * intent but pulls in no dependency. Safety is structural: every record is a **flat bag of scalars**
+ * built by hand from an allowlist at the call site, and non-scalar values are dropped to `[unloggable]`
+ * — so a stray token-bearing object can never be stringified into a line, and no call site ever logs a
+ * header map, request body, secret, caller key, or continuation token.
+ */
+const LEVEL_ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
+export const stdoutSink = (line) => {
+    process.stdout.write(`${line}\n`);
+};
+/** Keys the record owns; a field may not overwrite them. */
+const RESERVED = new Set(['ts', 'level', 'event']);
+/** Coerce a field value to a loggable scalar; anything non-scalar becomes a marker (never serialized). */
+function scalar(value) {
+    if (value === null || value === undefined)
+        return '';
+    const type = typeof value;
+    if (type === 'string' || type === 'number' || type === 'boolean')
+        return value;
+    return '[unloggable]';
+}
+export function createLogger(options = {}) {
+    const level = options.level ?? 'info';
+    const sink = options.sink ?? stdoutSink;
+    const clock = options.clock ?? Date.now;
+    const base = options.base ?? {};
+    function emit(lvl, event, fields) {
+        if (LEVEL_ORDER[lvl] < LEVEL_ORDER[level])
+            return;
+        const record = {
+            ts: new Date(clock()).toISOString(),
+            level: lvl,
+            event,
+        };
+        for (const [key, value] of Object.entries(base)) {
+            if (!RESERVED.has(key) && value !== undefined)
+                record[key] = scalar(value);
+        }
+        if (fields) {
+            for (const [key, value] of Object.entries(fields)) {
+                if (!RESERVED.has(key) && value !== undefined)
+                    record[key] = scalar(value);
+            }
+        }
+        sink(JSON.stringify(record));
+    }
+    return {
+        level,
+        log: emit,
+        debug: (event, fields) => emit('debug', event, fields),
+        info: (event, fields) => emit('info', event, fields),
+        warn: (event, fields) => emit('warn', event, fields),
+        error: (event, fields) => emit('error', event, fields),
+        child: (extra) => createLogger({ level, sink, clock, base: { ...base, ...extra } }),
+    };
+}
+const noop = () => undefined;
+/** A logger that drops everything — the default so opting out (and existing callers) cost nothing. */
+export const noopLogger = {
+    level: 'error',
+    log: noop,
+    debug: noop,
+    info: noop,
+    warn: noop,
+    error: noop,
+    child: () => noopLogger,
+};
+//# sourceMappingURL=logging.js.map

package/node_modules/@noodle-borg/transport-http/dist/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,GAA6B,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAU3F,MAAM,CAAC,MAAM,UAAU,GAAY,CAAC,IAAI,EAAE,EAAE;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC;AAwBF,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD,0GAA0G;AAC1G,SAAS,MAAM,CAAC,KAAmD;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAyB,EAAE;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAEhC,SAAS,IAAI,CAAC,GAAa,EAAE,KAAa,EAAE,MAAkB;QAC5D,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC;YAAE,OAAO;QAClD,MAAM,MAAM,GAA8C;YACxD,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,GAAG;YACV,KAAK;SACN,CAAC;QACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,KAAK;QACL,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QACtD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;QACpD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;QACpD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QACtD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;AAEnC,sGAAsG;AACtG,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU;CACxB,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/serve.d.ts

@@ -0,0 +1,22 @@
+import { type Server } from 'node:http';
+import type { ServedArtifact } from '@noodle-borg/protocol';
+import { type HttpHandlerOptions } from './handler.js';
+export interface ServeOptions extends HttpHandlerOptions {
+    readonly target: ServedArtifact;
+    /** Port to bind. Default `0` (an ephemeral port — read the bound port from the result). */
+    readonly port?: number;
+    /** Host/interface to bind. Default `127.0.0.1` (localhost) per the transport security guidance. */
+    readonly host?: string;
+}
+export interface RunningServer {
+    readonly http: Server;
+    readonly url: string;
+    readonly port: number;
+    close(): Promise<void>;
+}
+/**
+ * Start a `node:http` server serving a {@link ServedArtifact} over Streamable HTTP. Binds `127.0.0.1`
+ * by default; a real remote deployment binds `0.0.0.0` behind a reverse proxy **and** Phase-3 auth.
+ */
+export declare function serveHttp(options: ServeOptions): Promise<RunningServer>;
+//# sourceMappingURL=serve.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE7E,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IACtD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAkBvE"}

package/node_modules/@noodle-borg/transport-http/dist/serve.js

@@ -0,0 +1,25 @@
+import { createServer } from 'node:http';
+import { createMcpHttpHandler } from './handler.js';
+/**
+ * Start a `node:http` server serving a {@link ServedArtifact} over Streamable HTTP. Binds `127.0.0.1`
+ * by default; a real remote deployment binds `0.0.0.0` behind a reverse proxy **and** Phase-3 auth.
+ */
+export function serveHttp(options) {
+    const host = options.host ?? '127.0.0.1';
+    const endpoint = options.endpoint ?? '/mcp';
+    const http = createServer(createMcpHttpHandler(options.target, options));
+    return new Promise((resolve, reject) => {
+        http.once('error', reject);
+        http.listen(options.port ?? 0, host, () => {
+            const address = http.address();
+            const port = typeof address === 'object' && address ? address.port : (options.port ?? 0);
+            resolve({
+                http,
+                port,
+                url: `http://${host}:${port}${endpoint}`,
+                close: () => new Promise((res, rej) => http.close((e) => (e ? rej(e) : res()))),
+            });
+        });
+    });
+}
+//# sourceMappingURL=serve.js.map

package/node_modules/@noodle-borg/transport-http/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAA2B,MAAM,cAAc,CAAC;AAiB7E;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACzF,OAAO,CAAC;gBACN,IAAI;gBACJ,IAAI;gBACJ,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,GAAG,QAAQ,EAAE;gBACxC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aACtF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}