toolhome 0.5.0

package/dist/server/security/oauth-server.js

@@ -0,0 +1,544 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { request as httpsRequest } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+import { SignJWT, jwtVerify } from 'jose';
+import { z } from 'zod';
+import { AppError } from '../domain/errors.js';
+const authorizationSchema = z.object({
+    response_type: z.literal('code'),
+    client_id: z.string().min(1).max(8_192),
+    redirect_uri: z.url().max(2_048),
+    code_challenge: z
+        .string()
+        .min(43)
+        .max(128)
+        .regex(/^[A-Za-z0-9_-]+$/),
+    code_challenge_method: z.literal('S256'),
+    state: z.string().max(2_048).optional(),
+    resource: z.url().max(2_048),
+    scope: z.string().max(256).default('mcp:use'),
+});
+const allowedScopes = new Set(['mcp:use']);
+const maxTransientEntries = 1_000;
+const nonPublicIpv4Subnets = [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.0.2.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['198.51.100.0', 24],
+    ['203.0.113.0', 24],
+    ['224.0.0.0', 4],
+    ['240.0.0.0', 4],
+];
+const nonPublicIpv6Subnets = [
+    ['::ffff:0:0', 96],
+    ['64:ff9b:1::', 48],
+    ['100::', 64],
+    ['2001:2::', 48],
+    ['2001:10::', 28],
+    ['2001:20::', 28],
+    ['2001:db8::', 32],
+    ['fc00::', 7],
+    ['fe80::', 10],
+    ['fec0::', 10],
+    ['ff00::', 8],
+];
+const nonPublicAddresses = createNonPublicBlockList();
+const clientMetadataSchema = z
+    .object({
+    client_name: z.string().max(120).default('MCP client'),
+    redirect_uris: z.array(z.url().max(2_048)).min(1).max(16),
+    token_endpoint_auth_method: z.literal('none').default('none'),
+})
+    .passthrough()
+    .superRefine((metadata, context) => {
+    for (const [index, value] of metadata.redirect_uris.entries()) {
+        if (!isSafeRedirectUri(value)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['redirect_uris', index],
+                message: 'Redirect URI scheme is not allowed',
+            });
+        }
+    }
+});
+const registeredClientSchema = z.object({
+    issuedAt: z.number().int().nonnegative(),
+    metadata: clientMetadataSchema,
+});
+const accessClaimsSchema = z.object({
+    sub: z.string(),
+    clientId: z.string(),
+    scope: z.string(),
+    resource: z.string(),
+    tokenKind: z.literal('access'),
+});
+const refreshClaimsSchema = accessClaimsSchema.extend({ tokenKind: z.literal('refresh') });
+const registeredClientPrefix = 'mch_client_v1.';
+export class OAuthServer {
+    #publicUrl;
+    #controlAuth;
+    #key;
+    #registrationKey;
+    #issuer;
+    #pending = new Map();
+    #codes = new Map();
+    constructor(publicUrl, masterKey, controlAuth) {
+        this.#publicUrl = publicUrl;
+        this.#controlAuth = controlAuth;
+        this.#key = createHash('sha256').update(`toolhome.oauth:${masterKey}`).digest();
+        this.#registrationKey = createHash('sha256')
+            .update(`toolhome.oauth.registration:${masterKey}`)
+            .digest();
+        this.#issuer = new URL('/', this.#publicUrl).toString().replace(/\/$/, '');
+    }
+    authorizationServerMetadata() {
+        return {
+            issuer: this.#issuer,
+            authorization_endpoint: new URL('/oauth/authorize', this.#publicUrl).toString(),
+            token_endpoint: new URL('/oauth/token', this.#publicUrl).toString(),
+            registration_endpoint: new URL('/oauth/register', this.#publicUrl).toString(),
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            scopes_supported: ['mcp:use'],
+            authorization_response_iss_parameter_supported: true,
+            client_id_metadata_document_supported: true,
+        };
+    }
+    protectedResourceMetadata(resource) {
+        return {
+            resource: resource.toString(),
+            authorization_servers: [this.#issuer],
+            scopes_supported: ['mcp:use'],
+            bearer_methods_supported: ['header'],
+        };
+    }
+    mcpResource(slug) {
+        const path = slug === null ? '/mcp' : `/mcp/${encodeURIComponent(slug)}`;
+        const resource = new URL(path, this.#publicUrl);
+        resource.search = '';
+        resource.hash = '';
+        return resource;
+    }
+    resourceMetadataUrl(resource) {
+        const path = resource.pathname === '/' ? '' : resource.pathname;
+        return new URL(`/.well-known/oauth-protected-resource${path}`, this.#publicUrl).toString();
+    }
+    async beginAuthorization(url) {
+        this.#prune();
+        const input = authorizationSchema.parse(Object.fromEntries(url.searchParams));
+        const resource = this.#assertResource(input.resource);
+        const scope = this.#assertScope(input.scope);
+        const metadata = await this.#resolveClient(input.client_id);
+        if (!metadata.redirect_uris.includes(input.redirect_uri)) {
+            throw new AppError('invalid_redirect_uri', 'redirect_uri is not registered', 400);
+        }
+        const pending = {
+            ...input,
+            resource,
+            scope,
+            id: randomBytes(24).toString('base64url'),
+            clientName: metadata.client_name,
+            expiresAt: Date.now() + 5 * 60_000,
+        };
+        if (this.#pending.size + this.#codes.size >= maxTransientEntries) {
+            throw new AppError('temporarily_unavailable', 'Too many authorization requests', 503);
+        }
+        this.#pending.set(pending.id, pending);
+        return new Response(this.#authorizationPage(pending), {
+            status: 200,
+            headers: {
+                'content-type': 'text/html; charset=utf-8',
+                'cache-control': 'no-store',
+                'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; form-action 'self'; base-uri 'none'",
+            },
+        });
+    }
+    approveAuthorization(form) {
+        this.#prune();
+        const requestId = z.string().parse(form.get('request_id'));
+        const controlKey = z.string().min(1).parse(form.get('control_key'));
+        const decision = z.enum(['approve', 'deny']).parse(form.get('decision'));
+        this.#controlAuth.authenticate('control', controlKey);
+        const pending = this.#pending.get(requestId);
+        if (!pending || pending.expiresAt <= Date.now()) {
+            throw new AppError('authorization_expired', 'Authorization request expired', 400);
+        }
+        this.#pending.delete(requestId);
+        const redirect = new URL(pending.redirect_uri);
+        if (decision === 'deny') {
+            redirect.searchParams.set('error', 'access_denied');
+        }
+        else {
+            const code = randomBytes(32).toString('base64url');
+            this.#codes.set(code, { ...pending, code, expiresAt: Date.now() + 5 * 60_000 });
+            redirect.searchParams.set('code', code);
+        }
+        redirect.searchParams.set('iss', this.#issuer);
+        if (pending.state)
+            redirect.searchParams.set('state', pending.state);
+        return Response.redirect(redirect, 302);
+    }
+    async token(form) {
+        this.#prune();
+        const grantType = z.string().parse(form.get('grant_type'));
+        if (grantType === 'authorization_code')
+            return this.#authorizationCodeToken(form);
+        if (grantType === 'refresh_token')
+            return this.#refreshToken(form);
+        return oauthError('unsupported_grant_type', 'Unsupported grant_type', 400);
+    }
+    register(value) {
+        const parsed = clientMetadataSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new AppError('invalid_client_metadata', 'OAuth client metadata is invalid', 400);
+        }
+        const metadata = parsed.data;
+        const issuedAt = Math.floor(Date.now() / 1_000);
+        const body = Buffer.from(JSON.stringify(registeredClientSchema.parse({ issuedAt, metadata })), 'utf8').toString('base64url');
+        const clientId = `${registeredClientPrefix}${body}.${this.#registrationMac(body)}`;
+        if (clientId.length > 8_192) {
+            throw new AppError('invalid_client_metadata', 'OAuth client metadata is too large', 400);
+        }
+        return {
+            ...metadata,
+            client_id: clientId,
+            client_id_issued_at: issuedAt,
+            token_endpoint_auth_method: 'none',
+        };
+    }
+    async verifyAccessToken(token, expectedResource) {
+        try {
+            const verified = await jwtVerify(token, this.#key, {
+                algorithms: ['HS256'],
+                issuer: this.#issuer,
+                audience: expectedResource.toString(),
+            });
+            const claims = accessClaimsSchema.parse(verified.payload);
+            if (claims.resource !== expectedResource.toString())
+                throw new Error('resource mismatch');
+            const scopes = claims.scope.split(/\s+/).filter(Boolean);
+            if (!scopes.includes('mcp:use'))
+                throw new Error('required scope missing');
+            return {
+                token,
+                clientId: claims.clientId,
+                scopes,
+                ...(verified.payload.exp === undefined ? {} : { expiresAt: verified.payload.exp }),
+                resource: expectedResource,
+                extra: { credentialKind: 'oauth' },
+            };
+        }
+        catch {
+            throw new AppError('invalid_token', 'OAuth access token is invalid or expired', 401);
+        }
+    }
+    async #authorizationCodeToken(form) {
+        const code = z.string().parse(form.get('code'));
+        const clientId = z.string().parse(form.get('client_id'));
+        const redirectUri = z.url().parse(form.get('redirect_uri'));
+        const verifier = z.string().min(43).max(128).parse(form.get('code_verifier'));
+        const entry = this.#codes.get(code);
+        this.#codes.delete(code);
+        if (!entry || entry.expiresAt <= Date.now())
+            return oauthError('invalid_grant', 'Code expired', 400);
+        if (entry.client_id !== clientId || entry.redirect_uri !== redirectUri) {
+            return oauthError('invalid_grant', 'Client or redirect mismatch', 400);
+        }
+        const challenge = createHash('sha256').update(verifier).digest('base64url');
+        if (challenge !== entry.code_challenge)
+            return oauthError('invalid_grant', 'PKCE failed', 400);
+        return this.#tokenResponse(entry.client_id, entry.scope, entry.resource);
+    }
+    async #refreshToken(form) {
+        const token = z.string().parse(form.get('refresh_token'));
+        const clientId = z.string().parse(form.get('client_id'));
+        try {
+            const verified = await jwtVerify(token, this.#key, {
+                algorithms: ['HS256'],
+                issuer: this.#issuer,
+                audience: 'toolhome-oauth-refresh',
+            });
+            const claims = refreshClaimsSchema.parse(verified.payload);
+            if (claims.clientId !== clientId)
+                return oauthError('invalid_grant', 'Client mismatch', 400);
+            return this.#tokenResponse(claims.clientId, claims.scope, claims.resource);
+        }
+        catch {
+            return oauthError('invalid_grant', 'Refresh token invalid', 400);
+        }
+    }
+    async #tokenResponse(clientId, scope, resource) {
+        const subject = createHash('sha256').update(clientId).digest('hex');
+        const accessToken = await new SignJWT({
+            clientId,
+            scope,
+            resource,
+            tokenKind: 'access',
+        })
+            .setProtectedHeader({ alg: 'HS256', typ: 'at+jwt' })
+            .setSubject(subject)
+            .setIssuer(this.#issuer)
+            .setAudience(resource)
+            .setIssuedAt()
+            .setExpirationTime('1h')
+            .sign(this.#key);
+        const refreshToken = await new SignJWT({
+            clientId,
+            scope,
+            resource,
+            tokenKind: 'refresh',
+        })
+            .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
+            .setSubject(subject)
+            .setIssuer(this.#issuer)
+            .setAudience('toolhome-oauth-refresh')
+            .setIssuedAt()
+            .setExpirationTime('30d')
+            .sign(this.#key);
+        return new Response(JSON.stringify({
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: 3600,
+            refresh_token: refreshToken,
+            scope,
+        }), {
+            status: 200,
+            headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+        });
+    }
+    async #resolveClient(clientId) {
+        const registered = this.#registeredClient(clientId);
+        if (registered)
+            return registered;
+        let url;
+        try {
+            url = new URL(clientId);
+        }
+        catch {
+            throw new AppError('invalid_client', 'Unknown OAuth client', 400);
+        }
+        if (url.protocol !== 'https:' ||
+            url.pathname === '/' ||
+            url.username !== '' ||
+            url.password !== '' ||
+            url.hash !== '') {
+            throw new AppError('invalid_client', 'Client metadata URL must use HTTPS and a non-root path', 400);
+        }
+        const addresses = await resolveSafeMetadataAddresses(url.hostname);
+        let text;
+        try {
+            text = await requestClientMetadata(url, addresses, 64 * 1024);
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            throw new AppError('invalid_client', 'Client metadata unavailable', 400);
+        }
+        let value;
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            throw new AppError('invalid_client', 'Client metadata is not valid JSON', 400);
+        }
+        const metadata = clientMetadataSchema.safeParse(value);
+        if (!metadata.success) {
+            throw new AppError('invalid_client', 'Client metadata is invalid', 400);
+        }
+        return metadata.data;
+    }
+    #registeredClient(clientId) {
+        if (!clientId.startsWith(registeredClientPrefix))
+            return null;
+        const value = clientId.slice(registeredClientPrefix.length);
+        const [body, mac, extra] = value.split('.');
+        if (!body || !mac || extra !== undefined) {
+            throw new AppError('invalid_client', 'Registered OAuth client is invalid', 400);
+        }
+        const actual = Buffer.from(this.#registrationMac(body), 'base64url');
+        const expected = Buffer.from(mac, 'base64url');
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+            throw new AppError('invalid_client', 'Registered OAuth client is invalid', 400);
+        }
+        try {
+            return registeredClientSchema.parse(JSON.parse(Buffer.from(body, 'base64url').toString('utf8'))).metadata;
+        }
+        catch {
+            throw new AppError('invalid_client', 'Registered OAuth client is invalid', 400);
+        }
+    }
+    #registrationMac(body) {
+        return createHmac('sha256', this.#registrationKey).update(body).digest('base64url');
+    }
+    #assertResource(resource) {
+        const value = new URL(resource);
+        const isMcpPath = value.pathname === '/mcp' || /^\/mcp\/[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.pathname);
+        if (value.origin !== this.#publicUrl.origin ||
+            !isMcpPath ||
+            value.search !== '' ||
+            value.hash !== '') {
+            throw new AppError('invalid_target', 'OAuth resource must be a ToolHome endpoint', 400);
+        }
+        return value.toString();
+    }
+    #assertScope(scope) {
+        const requested = scope.split(/\s+/).filter(Boolean);
+        if (requested.length === 0 || requested.some((value) => !allowedScopes.has(value))) {
+            throw new AppError('invalid_scope', 'Only the mcp:use scope is supported', 400);
+        }
+        return [...new Set(requested)].join(' ');
+    }
+    #prune() {
+        const timestamp = Date.now();
+        for (const [id, pending] of this.#pending)
+            if (pending.expiresAt <= timestamp)
+                this.#pending.delete(id);
+        for (const [code, entry] of this.#codes)
+            if (entry.expiresAt <= timestamp)
+                this.#codes.delete(code);
+    }
+    #authorizationPage(request) {
+        return `<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Authorize ToolHome</title><style>body{font:16px system-ui;background:#f4f5f2;color:#18211c;display:grid;place-items:center;min-height:100vh;margin:0}.card{width:min(430px,calc(100% - 40px));background:#fff;border:1px solid #d8ddd8;border-radius:16px;padding:30px}h1{margin-top:0;font-size:24px}p{color:#59635d;line-height:1.6}dl{background:#f6f7f5;border:1px solid #e3e6e3;padding:16px;border-radius:10px}dt{font-size:12px;color:#707a74}dd{margin:3px 0 12px;word-break:break-all}input{width:100%;box-sizing:border-box;padding:12px;border:1px solid #cbd2cc;border-radius:8px;margin:7px 0 16px}.actions{display:flex;gap:10px}.actions button{flex:1;padding:11px;border:1px solid #1f6845;border-radius:8px;background:#1f6845;color:white;font-weight:700}.actions .deny{border-color:#d7dcd8;background:#fff;color:#465149}</style><div class="card"><h1>授权 MCP Client</h1><p><strong>${escapeHtml(request.clientName)}</strong> 请求访问你的 ToolHome。</p><dl><dt>Resource</dt><dd>${escapeHtml(request.resource)}</dd><dt>Scope</dt><dd>${escapeHtml(request.scope)}</dd><dt>Redirect</dt><dd>${escapeHtml(request.redirect_uri)}</dd></dl><form method="post" action="/oauth/authorize"><input type="hidden" name="request_id" value="${escapeHtml(request.id)}"><label>Control API Key<input type="password" name="control_key" autocomplete="off" required></label><div class="actions"><button class="deny" name="decision" value="deny">拒绝</button><button name="decision" value="approve">允许</button></div></form></div></html>`;
+    }
+}
+function oauthError(error, description, status) {
+    return new Response(JSON.stringify({ error, error_description: description }), {
+        status,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+    });
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+function isLoopback(hostname) {
+    const normalized = normalizeHostname(hostname);
+    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
+}
+function isSafeRedirectUri(value) {
+    const url = new URL(value);
+    if (url.hash !== '' || url.username !== '' || url.password !== '')
+        return false;
+    if (url.protocol === 'https:')
+        return true;
+    if (url.protocol === 'http:')
+        return isLoopback(url.hostname);
+    const privateScheme = url.protocol.slice(0, -1);
+    return privateScheme.includes('.') && /^[a-z][a-z0-9+.-]*$/.test(privateScheme);
+}
+async function resolveSafeMetadataAddresses(hostname) {
+    const normalized = normalizeHostname(hostname);
+    let addresses;
+    try {
+        addresses =
+            isIP(normalized) === 0
+                ? await lookup(normalized, { all: true, verbatim: true })
+                : [{ address: normalized, family: isIP(normalized) }];
+    }
+    catch {
+        throw new AppError('invalid_client', 'Client metadata host cannot be resolved', 400);
+    }
+    if (addresses.length === 0 || addresses.some(({ address }) => isPrivateAddress(address))) {
+        throw new AppError('invalid_client', 'Client metadata host is not publicly routable', 400);
+    }
+    return addresses;
+}
+function isPrivateAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return nonPublicAddresses.check(address, 'ipv4');
+    if (family === 6)
+        return nonPublicAddresses.check(address, 'ipv6');
+    return true;
+}
+function normalizeHostname(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+function createNonPublicBlockList() {
+    const list = new BlockList();
+    for (const [network, prefix] of nonPublicIpv4Subnets) {
+        list.addSubnet(network, prefix, 'ipv4');
+    }
+    list.addAddress('::', 'ipv6');
+    list.addAddress('::1', 'ipv6');
+    for (const [network, prefix] of nonPublicIpv6Subnets) {
+        list.addSubnet(network, prefix, 'ipv6');
+    }
+    return list;
+}
+async function requestClientMetadata(url, addresses, limit) {
+    const deadline = Date.now() + 5_000;
+    let lastError = null;
+    for (const address of addresses) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            break;
+        try {
+            return await requestClientMetadataAddress(url, address, limit, remaining);
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            lastError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    throw lastError ?? new Error('Client metadata unavailable');
+}
+function requestClientMetadataAddress(url, address, limit, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const hostname = normalizeHostname(url.hostname);
+        const request = httpsRequest({
+            hostname: address.address,
+            family: address.family,
+            port: url.port === '' ? 443 : Number(url.port),
+            method: 'GET',
+            path: `${url.pathname}${url.search}`,
+            headers: { accept: 'application/json', host: url.host },
+            timeout: timeoutMs,
+            ...(isIP(hostname) === 0 ? { servername: hostname } : {}),
+        }, (response) => {
+            if (!response.statusCode || response.statusCode < 200 || response.statusCode >= 300) {
+                response.resume();
+                reject(new Error(`Client metadata returned HTTP ${response.statusCode ?? 0}`));
+                return;
+            }
+            const declared = Number(response.headers['content-length']);
+            if (Number.isFinite(declared) && declared > limit) {
+                response.destroy();
+                reject(new AppError('invalid_client', 'Client metadata too large', 400));
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            response.on('data', (chunk) => {
+                size += chunk.byteLength;
+                if (size > limit) {
+                    response.destroy();
+                    reject(new AppError('invalid_client', 'Client metadata too large', 400));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+            response.on('error', reject);
+        });
+        request.on('timeout', () => request.destroy(new Error('Client metadata timed out')));
+        request.on('error', reject);
+        request.end();
+    });
+}
+//# sourceMappingURL=oauth-server.js.map

package/dist/server/security/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../../src/security/oauth-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAG/C,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IAChC,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,kBAAkB,CAAC;IAC5B,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,oBAAoB,GAA4B;IACpD,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACjB,CAAC;AACF,MAAM,oBAAoB,GAA4B;IACpD,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,OAAO,EAAE,EAAE,CAAC;IACb,CAAC,UAAU,EAAE,EAAE,CAAC;IAChB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACd,CAAC;AACF,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACtD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzD,0BAA0B,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC9D,CAAC;KACD,WAAW,EAAE;KACb,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC;gBAC9B,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,QAAQ,EAAE,oBAAoB;CAC/B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAC3F,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAahD,MAAM,OAAO,WAAW;IACb,UAAU,CAAM;IAChB,YAAY,CAAc;IAC1B,IAAI,CAAa;IACjB,gBAAgB,CAAS;IACzB,OAAO,CAAS;IAChB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACnD,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEvD,YAAY,SAAc,EAAE,SAAiB,EAAE,WAAwB;QACrE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,+BAA+B,SAAS,EAAE,CAAC;aAClD,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,2BAA2B;QACzB,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,sBAAsB,EAAE,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;YAC/E,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;YACnE,qBAAqB,EAAE,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;YAC7E,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,gBAAgB,EAAE,CAAC,SAAS,CAAC;YAC7B,8CAA8C,EAAE,IAAI;YACpD,qCAAqC,EAAE,IAAI;SAC5C,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,QAAa;QACrC,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACrC,gBAAgB,EAAE,CAAC,SAAS,CAAC;YAC7B,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,IAAmB;QAC7B,MAAM,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QACnB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,mBAAmB,CAAC,QAAa;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChE,OAAO,IAAI,GAAG,CAAC,wCAAwC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAQ;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAyB;YACpC,GAAG,KAAK;YACR,QAAQ;YACR,KAAK;YACL,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzC,UAAU,EAAE,QAAQ,CAAC,WAAW;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM;SACnC,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACjE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE;YACpD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,eAAe,EAAE,UAAU;gBAC3B,yBAAyB,EACvB,4GAA4G;aAC/G;SACF,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,IAAc;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;YAChF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,KAAK;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAc;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,oBAAoB;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,SAAS,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,UAAU,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CACtB,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,EACpE,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,GAAG,sBAAsB,GAAG,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,IAAI,QAAQ,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO;YACL,GAAG,QAAQ;YACX,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,QAAQ;YAC7B,0BAA0B,EAAE,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,gBAAqB;QAC1D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE;aACtC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,CAAC,QAAQ,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3E,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM;gBACN,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAClF,QAAQ,EAAE,gBAAgB;gBAC1B,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE;aACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,0CAA0C,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAc;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YACzC,OAAO,UAAU,CAAC,eAAe,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YACvE,OAAO,UAAU,CAAC,eAAe,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,KAAK,CAAC,cAAc;YAAE,OAAO,UAAU,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAc;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,QAAQ,EAAE,wBAAwB;aACnC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,UAAU,CAAC,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,UAAU,CAAC,eAAe,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,KAAa,EAAE,QAAgB;QACpE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,QAAQ;YACR,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,QAAQ;SACpB,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aACnD,UAAU,CAAC,OAAO,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAC;YACrC,QAAQ;YACR,KAAK;YACL,QAAQ;YACR,SAAS,EAAE,SAAS;SACrB,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAChD,UAAU,CAAC,OAAO,CAAC;aACnB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,wBAAwB,CAAC;aACrC,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;YAChB,aAAa,EAAE,YAAY;YAC3B,KAAK;SACN,CAAC,EACF;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;SAC7E,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,KAAK,GAAG;YACpB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wDAAwD,EACxD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,iBAAiB,CAAC,QAAgB;QAChC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC;YACH,OAAO,sBAAsB,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC5D,CAAC,QAAQ,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtF,CAAC;IAED,eAAe,CAAC,QAAgB;QAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxF,IACE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM;YACvC,CAAC,SAAS;YACV,KAAK,CAAC,MAAM,KAAK,EAAE;YACnB,KAAK,CAAC,IAAI,KAAK,EAAE,EACjB,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,4CAA4C,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM;QACJ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ;YACvC,IAAI,OAAO,CAAC,SAAS,IAAI,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,KAAK,CAAC,SAAS,IAAI,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,kBAAkB,CAAC,OAA6B;QAC9C,OAAO,+9BAA+9B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,0DAA0D,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,yGAAyG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,uQAAuQ,CAAC;IACnlD,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAc;IACpE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,EAAE;QAC7E,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAClF,CAAC;AAOD,KAAK,UAAU,4BAA4B,CAAC,QAAgB;IAC1D,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS;YACP,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACzD,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/F,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAQ,EACR,SAA4B,EAC5B,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,SAAS,GAAiB,IAAI,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,4BAA4B,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC3C,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,4BAA4B,CACnC,GAAQ,EACR,OAAwB,EACxB,KAAa,EACb,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,YAAY,CAC1B;YACE,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAC9C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;YACvD,OAAO,EAAE,SAAS;YAClB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBACpF,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;gBAClD,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;oBACjB,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/security/secret-box.d.ts

@@ -0,0 +1,7 @@
+export declare class SecretBox {
+    #private;
+    constructor(masterKey: string);
+    encrypt(value: unknown): string;
+    decrypt(value: string): unknown;
+}
+//# sourceMappingURL=secret-box.d.ts.map

package/dist/server/security/secret-box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.d.ts","sourceRoot":"","sources":["../../../src/security/secret-box.ts"],"names":[],"mappings":"AAEA,qBAAa,SAAS;;IAGpB,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO9B;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW9B;CACF"}

package/dist/server/security/secret-box.js

@@ -0,0 +1,27 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+export class SecretBox {
+    #key;
+    constructor(masterKey) {
+        this.#key = createHash('sha256').update(masterKey, 'utf8').digest();
+    }
+    encrypt(value) {
+        const nonce = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.#key, nonce);
+        const plaintext = Buffer.from(JSON.stringify(value), 'utf8');
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return Buffer.concat([Buffer.from([1]), nonce, tag, encrypted]).toString('base64url');
+    }
+    decrypt(value) {
+        const payload = Buffer.from(value, 'base64url');
+        if (payload[0] !== 1 || payload.length < 30)
+            throw new Error('Invalid encrypted payload');
+        const nonce = payload.subarray(1, 13);
+        const tag = payload.subarray(13, 29);
+        const encrypted = payload.subarray(29);
+        const decipher = createDecipheriv('aes-256-gcm', this.#key, nonce);
+        decipher.setAuthTag(tag);
+        return JSON.parse(Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8'));
+    }
+}
+//# sourceMappingURL=secret-box.js.map

package/dist/server/security/secret-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.js","sourceRoot":"","sources":["../../../src/security/secret-box.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,OAAO,SAAS;IACX,IAAI,CAAS;IAEtB,YAAY,SAAiB;QAC3B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,KAAc;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CACf,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/E,CAAC;IACJ,CAAC;CACF"}

package/dist/server/security/secure-action.d.ts

@@ -0,0 +1,21 @@
+import type { SecureActionRecord } from '../domain/models.js';
+import type { Store } from '../storage/store.js';
+/**
+ * One-time, short-lived, principal-bound actions used for URL-mode secret
+ * elicitation. The URL only ever carries the action id + an HMAC signature;
+ * the secret itself never leaves the user's browser/control session and never
+ * travels through tool arguments or results.
+ */
+export declare class SecureActionService {
+    #private;
+    constructor(store: Store, masterKey: string, publicUrl: URL);
+    create(kind: 'market_install', target: string, principalId: string, ttlMs?: number): {
+        action: SecureActionRecord;
+        token: string;
+        url: string;
+    };
+    /** Verify token + expiry + one-time use; the token carries the principal binding. */
+    verify(id: string, token: string, principalId?: string): SecureActionRecord;
+    complete(id: string, token: string, principalId: string | undefined, values: Record<string, string>): SecureActionRecord;
+}
+//# sourceMappingURL=secure-action.d.ts.map

package/dist/server/security/secure-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-action.d.ts","sourceRoot":"","sources":["../../../src/security/secure-action.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAIjD;;;;;GAKG;AACH,qBAAa,mBAAmB;;IAK9B,YAAY,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAI1D;IAED,MAAM,CACJ,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,SAAgB,GACpB;QAAE,MAAM,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAY5D;IAED,qFAAqF;IACrF,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAW1E;IAED,QAAQ,CACN,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,kBAAkB,CAGpB;CAyBF"}