runbios-mcp 0.2.1-dev.62

package/dist/http/oauth.js

@@ -0,0 +1,486 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { Router } from "express";
+/* ─── Canonical scopes (mirror services/iam-service/internal/handler/apikey_scopes.go) ─── */
+export const CANONICAL_SCOPES = [
+    "models:read",
+    "datasets:read",
+    "datasets:write",
+    "training:read",
+    "training:write",
+    "deployments:read",
+    "deployments:write",
+    "billing:read",
+    "analytics:read",
+    "integrations:read",
+    "integrations:write",
+    // Data-plane scope for the OpenAI-compatible serverless inference API. The
+    // gateway enforces it in the unified /v1 dispatcher, not the /api route
+    // allowlist, but it is a first-class canonical scope (part of the read-only
+    // and full-access presets in IAM), so a grant may request and hold it.
+    "serverless",
+];
+const CANONICAL_SCOPE_SET = new Set(CANONICAL_SCOPES);
+/**
+ * Validates a scope list: non-empty, every scope canonical, no duplicates.
+ * Returns the scopes in catalog order (deterministic, like the Go side), or
+ * null when invalid.
+ */
+export function normalizeScopes(scopes) {
+    if (!Array.isArray(scopes) || scopes.length === 0)
+        return null;
+    const seen = new Set();
+    for (const raw of scopes) {
+        if (typeof raw !== "string")
+            return null;
+        const scope = raw.trim();
+        if (!scope || !CANONICAL_SCOPE_SET.has(scope) || seen.has(scope))
+            return null;
+        seen.add(scope);
+    }
+    return CANONICAL_SCOPES.filter((s) => seen.has(s));
+}
+/** Splits a space-separated scope parameter (RFC 6749 §3.3). */
+export function parseScopeParam(scope) {
+    return scope.split(" ").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/* ─── Small crypto helpers ─── */
+export function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+/** Constant-time string equality (hash both sides to normalize length). */
+export function timingSafeEqualStr(a, b) {
+    const da = createHash("sha256").update(a).digest();
+    const db = createHash("sha256").update(b).digest();
+    return timingSafeEqual(da, db);
+}
+export function newRawToken(prefix) {
+    return prefix + randomBytes(32).toString("base64url");
+}
+export function newId(prefix) {
+    return `${prefix}_${randomBytes(12).toString("hex")}`;
+}
+/* ─── PKCE (RFC 7636, S256 only) ─── */
+const PKCE_VERIFIER_RE = /^[A-Za-z0-9\-._~]{43,128}$/;
+export function verifyPkceS256(codeVerifier, codeChallenge) {
+    if (!PKCE_VERIFIER_RE.test(codeVerifier))
+        return false;
+    const computed = createHash("sha256").update(codeVerifier).digest("base64url");
+    return timingSafeEqualStr(computed, codeChallenge);
+}
+/* ─── Redirect URI validation ─── */
+/**
+ * Registered redirect URIs must be https, or http with a loopback hostname
+ * (localhost / 127.0.0.1) for native clients, and must not carry a fragment.
+ */
+export function isValidRedirectUri(uri) {
+    if (typeof uri !== "string" || uri.length === 0 || uri.length > 2000)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.hash)
+        return false;
+    if (parsed.protocol === "https:")
+        return true;
+    if (parsed.protocol === "http:") {
+        return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    }
+    return false;
+}
+/* ─── Token lifetimes ─── */
+export const ACCESS_TOKEN_TTL_S = 3600;
+export const REFRESH_TOKEN_TTL_MS = 30 * 24 * 3600_000;
+export const AUTH_CODE_TTL_MS = 10 * 60_000;
+export const AUTH_REQUEST_TTL_MS = 15 * 60_000;
+export async function validateAccessToken(store, rawToken) {
+    if (!rawToken.startsWith("mcp_at_"))
+        return null;
+    const token = await store.getToken(sha256Hex(rawToken));
+    if (!token || token.kind !== "access" || token.revoked_at)
+        return null;
+    if (token.expires_at.getTime() <= Date.now())
+        return null;
+    const grant = await store.getGrant(token.grant_id);
+    if (!grant || grant.revoked_at)
+        return null;
+    // Throttled usage stamp: at most once a minute per grant, best-effort.
+    void store.touchGrantLastUsed(grant.id, 60_000).catch(() => { });
+    return { token, grant };
+}
+export async function issueTokenPair(store, grantId, familyId = newId("fam")) {
+    const accessToken = newRawToken("mcp_at_");
+    const refreshToken = newRawToken("mcp_rt_");
+    const refreshTokenHash = sha256Hex(refreshToken);
+    const now = Date.now();
+    await store.insertToken({
+        token_hash: sha256Hex(accessToken),
+        kind: "access",
+        grant_id: grantId,
+        family_id: familyId,
+        expires_at: new Date(now + ACCESS_TOKEN_TTL_S * 1000),
+    });
+    await store.insertToken({
+        token_hash: refreshTokenHash,
+        kind: "refresh",
+        grant_id: grantId,
+        family_id: familyId,
+        expires_at: new Date(now + REFRESH_TOKEN_TTL_MS),
+    });
+    return { accessToken, refreshToken, refreshTokenHash };
+}
+/* ─── In-memory sliding-window rate limiter (defense in depth) ─── */
+export class SlidingWindowLimiter {
+    limit;
+    windowMs;
+    now;
+    hits = new Map();
+    constructor(limit, windowMs, now = Date.now) {
+        this.limit = limit;
+        this.windowMs = windowMs;
+        this.now = now;
+    }
+    allow(key) {
+        const t = this.now();
+        const cutoff = t - this.windowMs;
+        const alive = (this.hits.get(key) ?? []).filter((x) => x > cutoff);
+        if (alive.length >= this.limit) {
+            this.hits.set(key, alive);
+            return false;
+        }
+        alive.push(t);
+        this.hits.set(key, alive);
+        if (this.hits.size > 10_000) {
+            for (const [k, v] of this.hits) {
+                if (!v.some((x) => x > cutoff))
+                    this.hits.delete(k);
+            }
+        }
+        return true;
+    }
+}
+const SUPPORTED_AUTH_METHODS = new Set(["none", "client_secret_basic", "client_secret_post"]);
+const SUPPORTED_GRANT_TYPES = new Set(["authorization_code", "refresh_token"]);
+const SUPPORTED_RESPONSE_TYPES = new Set(["code"]);
+function str(value) {
+    return typeof value === "string" ? value : "";
+}
+function oauthError(res, status, error, description) {
+    res.status(status).set("Cache-Control", "no-store").json({ error, error_description: description });
+}
+function htmlBadRequest(res, message) {
+    res
+        .status(400)
+        .set("Content-Type", "text/html; charset=utf-8")
+        .send(`<!doctype html><html><head><meta charset="utf-8"><title>Connection error</title>` +
+        `<meta name="viewport" content="width=device-width, initial-scale=1"></head>` +
+        `<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;color:#111">` +
+        `<h1 style="font-size:1.25rem">We can't complete this connection</h1>` +
+        `<p>${message}</p>` +
+        `<p>Close this page and start the connection again from your MCP client.</p>` +
+        `</body></html>`);
+}
+function redirectWithError(res, redirectUri, error, description, state) {
+    const url = new URL(redirectUri);
+    url.searchParams.set("error", error);
+    if (description)
+        url.searchParams.set("error_description", description);
+    if (state)
+        url.searchParams.set("state", state);
+    res.redirect(302, url.toString());
+}
+function parseBasicAuth(header) {
+    if (!header || !header.startsWith("Basic "))
+        return null;
+    let decoded;
+    try {
+        decoded = Buffer.from(header.slice(6), "base64").toString("utf8");
+    }
+    catch {
+        return null;
+    }
+    const idx = decoded.indexOf(":");
+    if (idx < 0)
+        return null;
+    const decode = (v) => {
+        try {
+            return decodeURIComponent(v);
+        }
+        catch {
+            return v;
+        }
+    };
+    return { clientId: decode(decoded.slice(0, idx)), clientSecret: decode(decoded.slice(idx + 1)) };
+}
+async function authenticateClient(store, req) {
+    const body = (req.body ?? {});
+    const basic = parseBasicAuth(req.header("authorization"));
+    const clientId = basic?.clientId || str(body.client_id);
+    const usedBasic = Boolean(basic);
+    if (!clientId)
+        return { failed: true, usedBasic };
+    const client = await store.getClient(clientId);
+    if (!client || client.disabled_at)
+        return { failed: true, usedBasic };
+    if (client.token_endpoint_auth_method === "none") {
+        return { client, usedBasic };
+    }
+    const secret = basic?.clientSecret || str(body.client_secret);
+    if (!secret || !client.client_secret_hash || !timingSafeEqualStr(sha256Hex(secret), client.client_secret_hash)) {
+        return { failed: true, usedBasic };
+    }
+    return { client, usedBasic };
+}
+export function createOAuthRouter(deps) {
+    const { store, cfg, audit } = deps;
+    const registerLimiter = deps.registerLimiter ?? new SlidingWindowLimiter(10, 3600_000);
+    const tokenLimiter = deps.tokenLimiter ?? new SlidingWindowLimiter(60, 60_000);
+    const router = Router();
+    /* ─── RFC 7591 dynamic client registration ─── */
+    router.post("/mcp/oauth/register", async (req, res) => {
+        if (!registerLimiter.allow(req.ip ?? "unknown")) {
+            res.status(429).json({ error: "slow_down" });
+            return;
+        }
+        const body = (req.body ?? {});
+        const redirectUris = body.redirect_uris;
+        if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+            oauthError(res, 400, "invalid_redirect_uri", "redirect_uris must be a non-empty array");
+            return;
+        }
+        for (const uri of redirectUris) {
+            if (typeof uri !== "string" || !isValidRedirectUri(uri)) {
+                oauthError(res, 400, "invalid_redirect_uri", "each redirect_uri must be https, or http on localhost/127.0.0.1, with no fragment");
+                return;
+            }
+        }
+        let clientName = str(body.client_name).trim();
+        if (!clientName)
+            clientName = "MCP client";
+        if (clientName.length > 100)
+            clientName = clientName.slice(0, 100);
+        const authMethod = str(body.token_endpoint_auth_method) || "none";
+        if (!SUPPORTED_AUTH_METHODS.has(authMethod)) {
+            oauthError(res, 400, "invalid_client_metadata", "token_endpoint_auth_method must be one of: none, client_secret_basic, client_secret_post");
+            return;
+        }
+        if (body.grant_types !== undefined) {
+            const grantTypes = Array.isArray(body.grant_types) ? body.grant_types : null;
+            if (!grantTypes || grantTypes.some((g) => typeof g !== "string" || !SUPPORTED_GRANT_TYPES.has(g))) {
+                oauthError(res, 400, "invalid_client_metadata", "grant_types may only contain authorization_code and refresh_token");
+                return;
+            }
+        }
+        if (body.response_types !== undefined) {
+            const responseTypes = Array.isArray(body.response_types) ? body.response_types : null;
+            if (!responseTypes || responseTypes.some((r) => typeof r !== "string" || !SUPPORTED_RESPONSE_TYPES.has(r))) {
+                oauthError(res, 400, "invalid_client_metadata", "response_types may only contain code");
+                return;
+            }
+        }
+        const clientId = newId("client");
+        let clientSecret;
+        let clientSecretHash = null;
+        if (authMethod === "client_secret_basic" || authMethod === "client_secret_post") {
+            clientSecret = randomBytes(32).toString("base64url");
+            clientSecretHash = sha256Hex(clientSecret);
+        }
+        await store.insertClient({
+            client_id: clientId,
+            client_secret_hash: clientSecretHash,
+            client_name: clientName,
+            redirect_uris: redirectUris,
+            token_endpoint_auth_method: authMethod,
+        });
+        audit.emit("oauth_client_registered", { client_id: clientId, client_name: clientName });
+        res.status(201).set("Cache-Control", "no-store").json({
+            client_id: clientId,
+            ...(clientSecret ? { client_secret: clientSecret, client_secret_expires_at: 0 } : {}),
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+            client_name: clientName,
+            redirect_uris: redirectUris,
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: authMethod,
+        });
+    });
+    /* ─── Authorization endpoint ─── */
+    router.get("/mcp/oauth/authorize", async (req, res) => {
+        const q = req.query;
+        const clientId = str(q.client_id);
+        const redirectUri = str(q.redirect_uri);
+        const state = str(q.state);
+        // Unknown client or unregistered redirect_uri: render an error page.
+        // Never redirect to an unverified target (open-redirect prevention).
+        const client = clientId ? await store.getClient(clientId) : null;
+        if (!client || client.disabled_at) {
+            htmlBadRequest(res, "The application that sent you here is not registered with Run BiOS.");
+            return;
+        }
+        if (!redirectUri || !client.redirect_uris.includes(redirectUri)) {
+            htmlBadRequest(res, "The application used a return address that does not match its registration.");
+            return;
+        }
+        // From here the redirect target is trusted: report errors per RFC 6749.
+        if (str(q.response_type) !== "code") {
+            redirectWithError(res, redirectUri, "unsupported_response_type", "response_type must be code", state);
+            return;
+        }
+        const codeChallenge = str(q.code_challenge);
+        const codeChallengeMethod = str(q.code_challenge_method);
+        if (!codeChallenge || codeChallengeMethod !== "S256") {
+            redirectWithError(res, redirectUri, "invalid_request", "PKCE with code_challenge_method=S256 is required", state);
+            return;
+        }
+        const scopeParam = str(q.scope);
+        if (scopeParam) {
+            const requested = parseScopeParam(scopeParam);
+            if (requested.length === 0 || requested.some((s) => !CANONICAL_SCOPE_SET.has(s))) {
+                redirectWithError(res, redirectUri, "invalid_scope", "unknown scope requested", state);
+                return;
+            }
+        }
+        const id = newId("req");
+        await store.insertRequest({
+            id,
+            client_id: client.client_id,
+            redirect_uri: redirectUri,
+            scope: scopeParam,
+            state,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+            status: "pending",
+            expires_at: new Date(Date.now() + AUTH_REQUEST_TTL_MS),
+        });
+        res.redirect(302, `${cfg.consoleBaseUrl}/connect/mcp?request=${encodeURIComponent(id)}`);
+    });
+    /* ─── Token endpoint ─── */
+    router.post("/mcp/oauth/token", async (req, res) => {
+        if (!tokenLimiter.allow(req.ip ?? "unknown")) {
+            res.status(429).json({ error: "slow_down" });
+            return;
+        }
+        res.set("Cache-Control", "no-store");
+        res.set("Pragma", "no-cache");
+        const body = (req.body ?? {});
+        const grantType = str(body.grant_type);
+        const auth = await authenticateClient(store, req);
+        if (auth.failed || !auth.client) {
+            if (auth.usedBasic)
+                res.set("WWW-Authenticate", 'Basic realm="mcp"');
+            oauthError(res, 401, "invalid_client", "client authentication failed");
+            return;
+        }
+        const client = auth.client;
+        if (grantType === "authorization_code") {
+            await handleAuthorizationCodeGrant(req, res, client);
+            return;
+        }
+        if (grantType === "refresh_token") {
+            await handleRefreshTokenGrant(req, res, client);
+            return;
+        }
+        oauthError(res, 400, "unsupported_grant_type", "grant_type must be authorization_code or refresh_token");
+    });
+    async function revokeGrantEverything(grantId, reason) {
+        await store.revokeTokensForGrant(grantId);
+        await store.revokeGrant(grantId);
+        audit.emit("oauth_grant_revoked", { grant_id: grantId, reason });
+    }
+    async function handleAuthorizationCodeGrant(req, res, client) {
+        const body = (req.body ?? {});
+        const code = str(body.code);
+        const codeVerifier = str(body.code_verifier);
+        const redirectUri = str(body.redirect_uri);
+        if (!code || !codeVerifier || !redirectUri) {
+            oauthError(res, 400, "invalid_request", "code, code_verifier, and redirect_uri are required");
+            return;
+        }
+        const codeHash = sha256Hex(code);
+        const prior = await store.getCode(codeHash);
+        if (!prior) {
+            oauthError(res, 400, "invalid_grant", "authorization code is invalid or expired");
+            return;
+        }
+        if (prior.used_at) {
+            // OAuth 2.1: a replayed code revokes everything issued from it.
+            await revokeGrantEverything(prior.grant_id, "authorization_code_replay");
+            oauthError(res, 400, "invalid_grant", "authorization code is invalid or expired");
+            return;
+        }
+        const consumed = await store.consumeCode(codeHash);
+        if (!consumed) {
+            // Lost a race with a concurrent redemption: also a replay.
+            await revokeGrantEverything(prior.grant_id, "authorization_code_replay");
+            oauthError(res, 400, "invalid_grant", "authorization code is invalid or expired");
+            return;
+        }
+        const valid = consumed.expires_at.getTime() > Date.now() &&
+            consumed.client_id === client.client_id &&
+            consumed.redirect_uri === redirectUri &&
+            consumed.code_challenge_method === "S256" &&
+            verifyPkceS256(codeVerifier, consumed.code_challenge);
+        if (!valid) {
+            oauthError(res, 400, "invalid_grant", "authorization code is invalid or expired");
+            return;
+        }
+        const grant = await store.getGrant(consumed.grant_id);
+        if (!grant || grant.revoked_at) {
+            oauthError(res, 400, "invalid_grant", "authorization grant is no longer valid");
+            return;
+        }
+        const pair = await issueTokenPair(store, grant.id);
+        res.status(200).json({
+            access_token: pair.accessToken,
+            token_type: "Bearer",
+            expires_in: ACCESS_TOKEN_TTL_S,
+            refresh_token: pair.refreshToken,
+            scope: grant.scopes.join(" "),
+        });
+    }
+    async function handleRefreshTokenGrant(req, res, client) {
+        const body = (req.body ?? {});
+        const rawRefresh = str(body.refresh_token);
+        if (!rawRefresh) {
+            oauthError(res, 400, "invalid_request", "refresh_token is required");
+            return;
+        }
+        const row = await store.getToken(sha256Hex(rawRefresh));
+        if (!row || row.kind !== "refresh") {
+            oauthError(res, 400, "invalid_grant", "refresh token is invalid or expired");
+            return;
+        }
+        const grant = await store.getGrant(row.grant_id);
+        if (!grant || grant.client_id !== client.client_id) {
+            oauthError(res, 400, "invalid_grant", "refresh token is invalid or expired");
+            return;
+        }
+        if (row.revoked_at) {
+            // Rotation reuse: revoke the whole family and the grant.
+            await store.revokeFamily(row.family_id);
+            await revokeGrantEverything(grant.id, "refresh_token_reuse");
+            audit.emit("oauth_refresh_reuse_detected", { grant_id: grant.id, family_id: row.family_id });
+            oauthError(res, 400, "invalid_grant", "refresh token is invalid or expired");
+            return;
+        }
+        if (grant.revoked_at || row.expires_at.getTime() <= Date.now()) {
+            oauthError(res, 400, "invalid_grant", "refresh token is invalid or expired");
+            return;
+        }
+        const pair = await issueTokenPair(store, grant.id, row.family_id);
+        await store.revokeToken(row.token_hash, pair.refreshTokenHash);
+        audit.emit("oauth_token_refreshed", { grant_id: grant.id });
+        res.status(200).json({
+            access_token: pair.accessToken,
+            token_type: "Bearer",
+            expires_in: ACCESS_TOKEN_TTL_S,
+            refresh_token: pair.refreshToken,
+            scope: grant.scopes.join(" "),
+        });
+    }
+    return router;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/http/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/http/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAK9D,8FAA8F;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,oBAAoB;IACpB,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,YAAY;CACJ,CAAC;AAEX,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,kCAAkC;AAElC,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,CAAS;IACrD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,MAAc;IAClC,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,wCAAwC;AAExC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,aAAqB;IACxE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/E,OAAO,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED,qCAAqC;AAErC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6BAA6B;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAS/C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAe,EACf,QAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5C,uEAAuE;IACvE,KAAK,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAe,EACf,OAAe,EACf,WAAmB,KAAK,CAAC,KAAK,CAAC;IAE/B,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,CAAC,WAAW,CAAC;QACtB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC;QAClC,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,kBAAkB,GAAG,IAAI,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,WAAW,CAAC;QACtB,UAAU,EAAE,gBAAgB;QAC5B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AACzD,CAAC;AAED,sEAAsE;AAEtE,MAAM,OAAO,oBAAoB;IAIZ;IACA;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEpD,YACmB,KAAa,EACb,QAAgB,EAChB,MAAoB,IAAI,CAAC,GAAG;QAF5B,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;QAChB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK,CAAC,GAAW;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAYD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC9F,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC;AAC/E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEnD,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa,EAAE,WAAmB;IACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,cAAc,CAAC,GAAa,EAAE,OAAe;IACpD,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC;SAC/C,IAAI,CACH,kFAAkF;QAChF,6EAA6E;QAC7E,4GAA4G;QAC5G,sEAAsE;QACtE,MAAM,OAAO,MAAM;QACnB,6EAA6E;QAC7E,gBAAgB,CACnB,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAa,EACb,WAAmB,EACnB,KAAa,EACb,WAAmB,EACnB,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,WAAW;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACpC,CAAC;AAQD,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAe,EAAE,GAAY;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAElD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEtE,IAAI,MAAM,CAAC,0BAA0B,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,EAAE,YAAY,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/G,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,kDAAkD;IAElD,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAEzD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,yCAAyC,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,UAAU,CACR,GAAG,EACH,GAAG,EACH,sBAAsB,EACtB,mFAAmF,CACpF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU;YAAE,UAAU,GAAG,YAAY,CAAC;QAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;YAAE,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAEnE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC;QAClE,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,UAAU,CACR,GAAG,EACH,GAAG,EACH,yBAAyB,EACzB,0FAA0F,CAC3F,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,mEAAmE,CAAC,CAAC;gBACrH,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3G,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IAAI,UAAU,KAAK,qBAAqB,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChF,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,KAAK,CAAC,YAAY,CAAC;YACvB,SAAS,EAAE,QAAQ;YACnB,kBAAkB,EAAE,gBAAgB;YACpC,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAwB;YACvC,0BAA0B,EAAE,UAAU;SACvC,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAExF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YACpD,SAAS,EAAE,QAAQ;YACnB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClD,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,UAAU;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oCAAoC;IAEpC,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAgC,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3B,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,EAAE,qEAAqE,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,cAAc,CAAC,GAAG,EAAE,6EAA6E,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,MAAM,EAAE,CAAC;YACpC,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;YACrD,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,kDAAkD,EAAE,KAAK,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACvF,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,KAAK,CAAC,aAAa,CAAC;YACxB,EAAE;YACF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,UAAU;YACjB,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;SACvD,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,cAAc,wBAAwB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,4BAA4B;IAE5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;YACrE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3B,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,wDAAwD,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAAc;QAClE,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,4BAA4B,CACzC,GAAY,EACZ,GAAa,EACb,MAAsB;QAEtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,gEAAgE;YAChE,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;YACzE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,2DAA2D;YAC3D,MAAM,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;YACzE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GACT,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAC1C,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YACvC,QAAQ,CAAC,YAAY,KAAK,WAAW;YACrC,QAAQ,CAAC,qBAAqB,KAAK,MAAM;YACzC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC/B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,wCAAwC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,uBAAuB,CACpC,GAAY,EACZ,GAAa,EACb,MAAsB;QAEtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,yDAAyD;YACzD,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7F,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/D,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/http/serviceHostGuard.d.ts

@@ -0,0 +1,31 @@
+/**
+ * ECS boot guard for internal service peers.
+ *
+ * Mirrors the Go services' MissingServiceHostsInECS contract exactly:
+ *  1. Fires ONLY under ECS (detected via ECS_CONTAINER_METADATA_URI_V4 or
+ *     ECS_CONTAINER_METADATA_URI). Under local dev / unit tests it is a
+ *     complete no-op — localhost is the correct answer locally.
+ *  2. Non-fatal: callers log a loud ERROR per problem and keep booting. A
+ *     listed peer may be unused at runtime, so crashing is unsafe.
+ *  3. For each internal peer it checks the ACTUAL env var the service reads:
+ *       - UNSET/empty                       -> ERROR (falls back to localhost)
+ *       - value contains localhost/127.0.0.1 -> ERROR
+ *
+ * Dependency-free (stdlib only) so it is trivially unit-testable in isolation.
+ */
+/** True when running inside an ECS task (task metadata endpoint is injected). */
+export declare function runningInEcs(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Returns one entry per misconfigured internal peer. Always empty when not
+ * running under ECS.
+ */
+export declare function checkServiceHosts(env?: NodeJS.ProcessEnv): Array<{
+    envVar: string;
+    reason: string;
+}>;
+/**
+ * Logs one ERROR line per problem via console.error. No-op when there are no
+ * problems (including when not under ECS). Never throws.
+ */
+export declare function logServiceHostProblems(env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=serviceHostGuard.d.ts.map

package/dist/http/serviceHostGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceHostGuard.d.ts","sourceRoot":"","sources":["../../src/http/serviceHostGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAI1E;AAOD;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B3C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAIjF"}

package/dist/http/serviceHostGuard.js

@@ -0,0 +1,68 @@
+/**
+ * ECS boot guard for internal service peers.
+ *
+ * Mirrors the Go services' MissingServiceHostsInECS contract exactly:
+ *  1. Fires ONLY under ECS (detected via ECS_CONTAINER_METADATA_URI_V4 or
+ *     ECS_CONTAINER_METADATA_URI). Under local dev / unit tests it is a
+ *     complete no-op — localhost is the correct answer locally.
+ *  2. Non-fatal: callers log a loud ERROR per problem and keep booting. A
+ *     listed peer may be unused at runtime, so crashing is unsafe.
+ *  3. For each internal peer it checks the ACTUAL env var the service reads:
+ *       - UNSET/empty                       -> ERROR (falls back to localhost)
+ *       - value contains localhost/127.0.0.1 -> ERROR
+ *
+ * Dependency-free (stdlib only) so it is trivially unit-testable in isolation.
+ */
+/** True when running inside an ECS task (task metadata endpoint is injected). */
+export function runningInEcs(env = process.env) {
+    const v4 = (env.ECS_CONTAINER_METADATA_URI_V4 ?? "").trim();
+    const v3 = (env.ECS_CONTAINER_METADATA_URI ?? "").trim();
+    return v4.length > 0 || v3.length > 0;
+}
+function pointsAtLocalhost(value) {
+    const v = value.toLowerCase();
+    return v.includes("localhost") || v.includes("127.0.0.1");
+}
+/**
+ * Returns one entry per misconfigured internal peer. Always empty when not
+ * running under ECS.
+ */
+export function checkServiceHosts(env = process.env) {
+    if (!runningInEcs(env))
+        return [];
+    const problems = [];
+    // Required peer: the api-gateway. UNSET/empty falls back to "localhost".
+    const apiGateway = (env.API_GATEWAY_HOST ?? "").trim();
+    if (apiGateway === "") {
+        problems.push({
+            envVar: "API_GATEWAY_HOST",
+            reason: "API_GATEWAY_HOST is UNSET under ECS - internal calls fall back to localhost and will fail; set it to the peer's Service Connect DNS name",
+        });
+    }
+    else if (pointsAtLocalhost(apiGateway)) {
+        problems.push({
+            envVar: "API_GATEWAY_HOST",
+            reason: "API_GATEWAY_HOST points at localhost/127.0.0.1 under ECS",
+        });
+    }
+    // Optional peer: audit-service. UNSET means audit is intentionally disabled,
+    // so do NOT warn. Only warn if SET but pointing at localhost/127.0.0.1.
+    const auditHost = (env.AUDIT_SERVICE_HOST ?? "").trim();
+    if (auditHost !== "" && pointsAtLocalhost(auditHost)) {
+        problems.push({
+            envVar: "AUDIT_SERVICE_HOST",
+            reason: "AUDIT_SERVICE_HOST points at localhost/127.0.0.1 under ECS",
+        });
+    }
+    return problems;
+}
+/**
+ * Logs one ERROR line per problem via console.error. No-op when there are no
+ * problems (including when not under ECS). Never throws.
+ */
+export function logServiceHostProblems(env = process.env) {
+    for (const problem of checkServiceHosts(env)) {
+        console.error(`[service-host-guard] ${problem.reason}`);
+    }
+}
+//# sourceMappingURL=serviceHostGuard.js.map

package/dist/http/serviceHostGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceHostGuard.js","sourceRoot":"","sources":["../../src/http/serviceHostGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,QAAQ,GAA8C,EAAE,CAAC;IAE/D,yEAAyE;IACzE,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EACJ,0IAA0I;SAC7I,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,0DAA0D;SACnE,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,SAAS,KAAK,EAAE,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,4DAA4D;SACrE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}