{"version":3,"sources":["../src/index.ts","../src/oauth-server.ts","../src/http-server.ts","../src/storage/memory-storage.ts","../src/utils/pkce.ts","../src/utils/tokens.ts"],"sourcesContent":["/**\n * Production-ready OAuth 2.1 Server Package\n * \n * A complete OAuth 2.1 implementation with PKCE support for Model Context Protocol (MCP)\n * \n * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13\n * @see https://modelcontextprotocol.io/specification/draft/basic/authorization\n */\n\n// Core OAuth server\nexport { MCPOAuthServer } from './oauth-server.js'\nexport { MCPOAuthHttpServer, registerOAuthEndpoints } from './http-server.js'\n\n// Storage implementations\nexport { MemoryStorage } from './storage/memory-storage.js'\n\n// Utilities\nexport * from './utils/pkce.js'\nexport * from './utils/tokens.js'\n\n// Types and interfaces\nexport * from './types.js'\n\n// Default configuration for production use\nexport const DEFAULT_OAUTH_CONFIG = {\n  // Server configuration\n  issuer: process.env.OAUTH_ISSUER || 'http://localhost:3000',\n  serverUrl: process.env.OAUTH_SERVER_URL || 'http://localhost:3000',\n  \n  // Endpoints\n  authorizationEndpoint: '/authorize',\n  tokenEndpoint: '/token',\n  userinfoEndpoint: '/userinfo',\n  jwksEndpoint: '/.well-known/jwks.json',\n  revocationEndpoint: '/revoke',\n  introspectionEndpoint: '/introspect',\n  \n  // MCP-specific settings\n  requireResourceIndicator: false, // Made optional for easier development\n  requirePkce: true,\n  allowRefreshTokens: true,\n  \n  // Dynamic client registration\n  allowDynamicClientRegistration: true,\n  \n  // Token lifetimes (in seconds)\n  accessTokenLifetime: 3600, // 1 hour\n  refreshTokenLifetime: 2592000, // 30 days\n  authorizationCodeLifetime: 600, // 10 minutes\n  \n  // Supported features\n  supportedGrantTypes: [\n    'authorization_code',\n    'refresh_token',\n    'client_credentials'\n  ],\n  supportedResponseTypes: ['code'],\n  supportedScopes: [\n    'read',\n    'write',\n    'admin',\n    'openid',\n    'profile',\n    'email'\n  ],\n  supportedCodeChallengeMethods: ['S256', 'plain'],\n  \n  // Security\n  jwtSecret: process.env.OAUTH_JWT_SECRET || 'your-super-secret-jwt-key-change-in-production',\n  jwtAlgorithm: 'HS256',\n  \n  // HTTP server configuration\n  http: {\n    cors: {\n      origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : true,\n      credentials: true,\n      exposedHeaders: [\"mcp-session-id\"],\n      allowedHeaders: [\"Content-Type\", \"mcp-session-id\", \"accept\", \"last-event-id\", \"Authorization\"],\n      methods: [\"GET\", \"POST\", \"PUT\", \"DELETE\", \"OPTIONS\"]\n    },\n    trustProxy: process.env.TRUST_PROXY === 'true',\n    jsonLimit: '10mb',\n    urlencodedLimit: '10mb',\n    enableCompression: true,\n    enableHelmet: true,\n    enableRateLimit: true,\n    rateLimitConfig: {\n      windowMs: 15 * 60 * 1000, // 15 minutes\n      max: 100, // limit each IP to 100 requests per windowMs\n      message: 'Too many requests from this IP, please try again later.',\n      standardHeaders: true,\n      legacyHeaders: false\n    }\n  }\n}\n\n/**\n * Create a production-ready OAuth server with proper configuration\n */\nexport function createProductionOAuthServer(config: Partial<typeof DEFAULT_OAUTH_CONFIG> = {}) {\n  const finalConfig = { ...DEFAULT_OAUTH_CONFIG, ...config }\n  \n  // Ensure serverUrl is properly set\n  if (!finalConfig.serverUrl) {\n    finalConfig.serverUrl = finalConfig.issuer\n  }\n  \n  // Build full endpoint URLs\n  const baseUrl = finalConfig.serverUrl.replace(/\\/$/, '')\n  finalConfig.authorizationEndpoint = `${baseUrl}${finalConfig.authorizationEndpoint}`\n  finalConfig.tokenEndpoint = `${baseUrl}${finalConfig.tokenEndpoint}`\n  finalConfig.userinfoEndpoint = `${baseUrl}${finalConfig.userinfoEndpoint}`\n  finalConfig.jwksEndpoint = `${baseUrl}${finalConfig.jwksEndpoint}`\n  finalConfig.revocationEndpoint = `${baseUrl}${finalConfig.revocationEndpoint}`\n  finalConfig.introspectionEndpoint = `${baseUrl}${finalConfig.introspectionEndpoint}`\n  \n  return finalConfig\n}\n\n/**\n * Create a demo client for testing\n */\nexport function createDemoClient() {\n  return {\n    id: 'demo-client',\n    secret: 'demo-secret',\n    name: 'Demo Client',\n    type: 'confidential' as const,\n    redirectUris: ['http://localhost:3001/callback'],\n    scopes: ['read', 'write', 'admin'],\n    grantTypes: ['authorization_code', 'refresh_token', 'client_credentials'],\n    createdAt: new Date(),\n    updatedAt: new Date()\n  }\n} ","import { SignJWT, jwtVerify } from 'jose'\nimport { randomBytes, createHash } from 'crypto'\nimport type { \n  MCPOAuthConfig, \n  MCPOAuthConfigInput, \n  MCPOAuthStorage,\n  OAuthClient,\n  OAuthUser,\n  AuthorizationCode,\n  AccessToken,\n  RefreshToken,\n  AuthorizationRequest,\n  TokenRequest,\n  TokenResponse,\n  TokenIntrospectionResponse,\n  UserInfoResponse,\n  OAuthError,\n  MCPProtectedResourceMetadata,\n  MCPAuthorizationServerMetadata,\n  ClientRegistrationRequest,\n  ClientRegistrationResponse,\n  UserAuthContext,\n  UserAuthCallbacks\n} from './types.js'\n\nconst DEFAULTS = {\n  supportedScopes: ['read', 'write', 'openid', 'profile', 'email'],\n  supportedGrantTypes: ['authorization_code', 'refresh_token', 'client_credentials'],\n  supportedResponseTypes: ['code'],\n  supportedCodeChallengeMethods: ['S256', 'plain'],\n};\n\nfunction normalizeConfig(config: any) {\n  return {\n    ...config,\n    supportedScopes: config.supportedScopes ?? DEFAULTS.supportedScopes,\n    supportedGrantTypes: config.supportedGrantTypes ?? DEFAULTS.supportedGrantTypes,\n    supportedResponseTypes: config.supportedResponseTypes ?? DEFAULTS.supportedResponseTypes,\n    supportedCodeChallengeMethods: config.supportedCodeChallengeMethods ?? DEFAULTS.supportedCodeChallengeMethods,\n  };\n}\n\nexport class MCPOAuthServer {\n  private config: MCPOAuthConfig\n  private storage: MCPOAuthStorage\n\n  constructor(config: MCPOAuthConfigInput, storage: MCPOAuthStorage) {\n    // Fill in required fields with defaults if missing\n    const baseServerUrl = config.serverUrl || config.issuer;\n    const fullConfig: MCPOAuthConfig = normalizeConfig({\n      ...config,\n      serverUrl: baseServerUrl,\n      authorizationEndpoint: config.authorizationEndpoint ?? config.issuer + \"/authorize\",\n      tokenEndpoint: config.tokenEndpoint ?? config.issuer + \"/token\",\n      userinfoEndpoint: config.userinfoEndpoint ?? config.issuer + \"/userinfo\",\n      jwksEndpoint: config.jwksEndpoint ?? config.issuer + \"/.well-known/jwks.json\",\n      introspectionEndpoint: config.introspectionEndpoint ?? config.issuer + \"/introspect\",\n      revocationEndpoint: config.revocationEndpoint ?? config.issuer + \"/revoke\",\n      requireResourceIndicator: config.requireResourceIndicator ?? false,\n      requirePkce: config.requirePkce ?? false,\n      allowRefreshTokens: config.allowRefreshTokens ?? false,\n      allowDynamicClientRegistration: config.allowDynamicClientRegistration ?? false,\n      accessTokenLifetime: config.accessTokenLifetime ?? 3600,\n      refreshTokenLifetime: config.refreshTokenLifetime ?? 3600,\n      authorizationCodeLifetime: config.authorizationCodeLifetime ?? 600,\n      supportedGrantTypes: config.supportedGrantTypes ?? DEFAULTS.supportedGrantTypes,\n      supportedResponseTypes: config.supportedResponseTypes ?? DEFAULTS.supportedResponseTypes,\n      supportedScopes: config.supportedScopes ?? DEFAULTS.supportedScopes,\n      supportedCodeChallengeMethods: config.supportedCodeChallengeMethods ?? DEFAULTS.supportedCodeChallengeMethods,\n      jwtAlgorithm: config.jwtAlgorithm ?? 'HS256',\n      http: config.http,\n    });\n    this.config = fullConfig;\n    this.storage = storage;\n  }\n\n  // ===== USER AUTHENTICATION =====\n\n  /**\n   * Handles user authentication during the authorization flow.\n   * This method should be called before generating authorization codes.\n   */\n  async authenticateUserForAuthFlow(\n    credentials: { username: string; password: string } | null,\n    sessionData: any,\n    context: UserAuthContext\n  ): Promise<OAuthUser | null> {\n    // If custom authentication callbacks are provided, use them\n    if (this.config.auth) {\n      // First, try to get current user from session\n      if (this.config.auth.getCurrentUser) {\n        const currentUser = await this.config.auth.getCurrentUser(sessionData, context)\n        if (currentUser) {\n          return currentUser\n        }\n      }\n\n      // If credentials provided, try to authenticate\n      if (credentials && this.config.auth.authenticateUser) {\n        return await this.config.auth.authenticateUser(credentials, context)\n      }\n    }\n\n    // Fallback: For demo/development purposes, return demo user if no auth callbacks\n    // In production, this should require proper authentication\n    if (!this.config.auth && credentials?.username === 'demo@example.com') {\n      const demoUser = await this.storage.getUser('demo-user')\n      return demoUser\n    }\n\n    return null\n  }\n\n  /**\n   * Renders the login page for user authentication.\n   */\n  async renderLoginPage(context: UserAuthContext, error?: string): Promise<string> {\n    if (this.config.auth?.renderLoginPage) {\n      const result = await this.config.auth.renderLoginPage(context, error)\n      if (typeof result === 'string') {\n        return result\n      }\n      // Handle redirect case in the HTTP layer\n    }\n\n    // Default basic login page\n    return this.generateDefaultLoginPage(context, error)\n  }\n\n  /**\n   * Handles consent/authorization for authenticated users.\n   */\n  async handleUserConsent(user: OAuthUser, context: UserAuthContext): Promise<boolean> {\n    if (this.config.auth?.renderConsentPage) {\n      const result = await this.config.auth.renderConsentPage(user, context)\n      if (typeof result === 'boolean') {\n        return result\n      }\n      // Handle custom page/redirect case in the HTTP layer\n      return true // Default to approved for now\n    }\n\n    // Default: auto-approve consent\n    return true\n  }\n\n  private generateDefaultLoginPage(context: UserAuthContext, error?: string): string {\n    const errorHtml = error ? `<div style=\"color: red; margin-bottom: 16px;\">${error}</div>` : ''\n    \n    return `\n      <!DOCTYPE html>\n      <html>\n        <head>\n          <title>Login - OAuth Authorization</title>\n          <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n          <style>\n            body { font-family: system-ui, sans-serif; max-width: 400px; margin: 50px auto; padding: 20px; }\n            .form-group { margin-bottom: 16px; }\n            label { display: block; margin-bottom: 4px; font-weight: bold; }\n            input { width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px; }\n            button { background: #007bff; color: white; padding: 10px 20px; border: none; border-radius: 4px; cursor: pointer; }\n            button:hover { background: #0056b3; }\n            .client-info { background: #f8f9fa; padding: 16px; border-radius: 4px; margin-bottom: 20px; }\n          </style>\n        </head>\n        <body>\n          <div class=\"client-info\">\n            <h3>Authorization Request</h3>\n            <p><strong>Client:</strong> ${context.clientId}</p>\n            <p><strong>Scope:</strong> ${context.scope || 'Default'}</p>\n          </div>\n          \n          ${errorHtml}\n          \n          <form method=\"POST\" action=\"/authorize\">\n            <input type=\"hidden\" name=\"response_type\" value=\"code\">\n            <input type=\"hidden\" name=\"client_id\" value=\"${context.clientId}\">\n            <input type=\"hidden\" name=\"redirect_uri\" value=\"${context.redirectUri}\">\n            <input type=\"hidden\" name=\"scope\" value=\"${context.scope || ''}\">\n            <input type=\"hidden\" name=\"resource\" value=\"${context.resource || ''}\">\n            \n            <div class=\"form-group\">\n              <label for=\"username\">Username or Email:</label>\n              <input type=\"text\" id=\"username\" name=\"username\" required>\n            </div>\n            \n            <div class=\"form-group\">\n              <label for=\"password\">Password:</label>\n              <input type=\"password\" id=\"password\" name=\"password\" required>\n            </div>\n            \n            <button type=\"submit\">Login & Authorize</button>\n          </form>\n        </body>\n      </html>\n    `\n  }\n\n  // ===== AUTHORIZATION ENDPOINT =====\n  \n  async handleAuthorizationRequest(\n    params: AuthorizationRequest, \n    credentials?: { username: string; password: string },\n    sessionData?: any,\n    requestContext?: { ipAddress: string; userAgent?: string }\n  ): Promise<{ redirectUrl: string } | { loginPage: string } | OAuthError> {\n    try {\n      // Validate required MCP parameters\n      if (this.config.requireResourceIndicator && !params.resource) {\n        return { error: 'invalid_request', error_description: 'resource parameter is required' }\n      }\n\n      // Use default resource if not provided and not required\n      if (!params.resource && !this.config.requireResourceIndicator) {\n        params.resource = this.config.serverUrl\n      }\n\n      if (this.config.requirePkce && !params.code_challenge) {\n        return { error: 'invalid_request', error_description: 'code_challenge parameter is required' }\n      }\n\n      // Validate client\n      const client = await this.storage.getClient(params.client_id)\n      if (!client) {\n        return { error: 'invalid_client', error_description: 'Client not found' }\n      }\n\n      // Validate redirect URI (allow sub-paths)\n      if (\n        client.redirectUris.length > 0 &&\n        !client.redirectUris.some((base) => params.redirect_uri.startsWith(base))\n      ) {\n        return {\n          error: 'invalid_request',\n          error_description: 'Invalid redirect URI',\n        };\n      }\n\n      // Validate grant type support\n      if (!client.grantTypes.includes('authorization_code')) {\n        return { error: 'unauthorized_client', error_description: 'Client not authorized for authorization_code grant' }\n      }\n\n      // Validate scope\n      if (params.scope && !this.validateScope(params.scope, client.scopes)) {\n        return { error: 'invalid_scope', error_description: 'Invalid scope' }\n      }\n\n      // Create authentication context\n      const authContext: UserAuthContext = {\n        clientId: params.client_id,\n        scope: params.scope,\n        resource: params.resource,\n        redirectUri: params.redirect_uri,\n        ipAddress: requestContext?.ipAddress || '0.0.0.0',\n        userAgent: requestContext?.userAgent\n      }\n\n      // Authenticate user\n      const user = await this.authenticateUserForAuthFlow(credentials || null, sessionData, authContext)\n      \n      if (!user) {\n        // User not authenticated, return login page\n        const loginPage = await this.renderLoginPage(authContext)\n        return { loginPage }\n      }\n\n      // Check user consent\n      const hasConsent = await this.handleUserConsent(user, authContext)\n      if (!hasConsent) {\n        return { error: 'access_denied', error_description: 'User denied authorization' }\n      }\n\n      // Generate authorization code\n      const code = this.generateCode()\n      const expiresAt = new Date(Date.now() + this.config.authorizationCodeLifetime * 1000)\n\n      const authCode: AuthorizationCode = {\n        code,\n        clientId: params.client_id,\n        userId: user.id, // Now using the actual authenticated user ID\n        redirectUri: params.redirect_uri,\n        scope: params.scope || 'read',\n        resource: params.resource,\n        codeChallenge: params.code_challenge,\n        codeChallengeMethod: params.code_challenge_method,\n        expiresAt,\n        createdAt: new Date()\n      }\n\n      await this.storage.createAuthorizationCode(authCode)\n\n      // Build redirect URL\n      const redirectUrl = new URL(params.redirect_uri)\n      redirectUrl.searchParams.set('code', code)\n      if (params.state) {\n        redirectUrl.searchParams.set('state', params.state)\n      }\n\n      return { redirectUrl: redirectUrl.toString() }\n    } catch (error) {\n      console.error('Authorization request error:', error)\n      return { error: 'server_error', error_description: 'Internal server error' }\n    }\n  }\n\n  // ===== TOKEN ENDPOINT =====\n\n  async handleTokenRequest(params: TokenRequest): Promise<TokenResponse | OAuthError> {\n    try {\n      // Validate required MCP parameters\n      if (this.config.requireResourceIndicator && !params.resource) {\n        return { error: 'invalid_request', error_description: 'resource parameter is required' }\n      }\n\n      // Use default resource if not provided and not required\n      if (!params.resource && !this.config.requireResourceIndicator) {\n        params.resource = this.config.serverUrl\n      }\n\n      switch (params.grant_type) {\n        case 'authorization_code':\n          return this.handleAuthorizationCodeGrant(params)\n        case 'refresh_token':\n          return this.handleRefreshTokenGrant(params)\n        case 'client_credentials':\n          return this.handleClientCredentialsGrant(params)\n        default:\n          return { error: 'unsupported_grant_type', error_description: 'Grant type not supported' }\n      }\n    } catch (error) {\n      console.error('Token request error:', error)\n      return { error: 'server_error', error_description: 'Internal server error' }\n    }\n  }\n\n  private async handleAuthorizationCodeGrant(params: TokenRequest): Promise<TokenResponse | OAuthError> {\n    if (!params.code) {\n      return { error: 'invalid_request', error_description: 'code parameter is required' }\n    }\n\n    if (this.config.requirePkce && !params.code_verifier) {\n      return { error: 'invalid_request', error_description: 'code_verifier parameter is required' }\n    }\n\n    // Get and validate authorization code\n    const authCode = await this.storage.getAuthorizationCode(params.code)\n    if (!authCode) {\n      return { error: 'invalid_grant', error_description: 'Invalid authorization code' }\n    }\n\n    if (authCode.expiresAt < new Date()) {\n      await this.storage.deleteAuthorizationCode(params.code)\n      return { error: 'invalid_grant', error_description: 'Authorization code expired' }\n    }\n\n    // Validate client\n    const client = await this.storage.getClient(authCode.clientId)\n    if (!client) {\n      return { error: 'invalid_client', error_description: 'Client not found' }\n    }\n\n    // Validate PKCE\n    if (authCode.codeChallenge) {\n      if (!params.code_verifier) {\n        return { error: 'invalid_request', error_description: 'code_verifier is required' }\n      }\n\n      const expectedChallenge = authCode.codeChallengeMethod === 'S256' \n        ? this.generateCodeChallenge(params.code_verifier)\n        : params.code_verifier\n\n      if (authCode.codeChallenge !== expectedChallenge) {\n        return { error: 'invalid_grant', error_description: 'Invalid code verifier' }\n      }\n    }\n\n    // Validate redirect URI if provided\n    if (params.redirect_uri && params.redirect_uri !== authCode.redirectUri) {\n      return { error: 'invalid_grant', error_description: 'Redirect URI mismatch' }\n    }\n\n    // Clean up authorization code\n    await this.storage.deleteAuthorizationCode(params.code)\n\n    // Generate access token\n    const audience = params.resource || authCode.resource || this.config.serverUrl;\n    const accessToken = await this.generateAccessToken(client.id, authCode.userId, authCode.scope, audience)\n    \n    // Generate refresh token if enabled\n    let refreshToken: string | undefined\n    if (this.config.allowRefreshTokens) {\n      refreshToken = await this.generateRefreshToken(accessToken.token, client.id, authCode.userId, authCode.scope, audience)\n    }\n\n    return {\n      access_token: accessToken.token,\n      token_type: 'Bearer',\n      expires_in: this.config.accessTokenLifetime,\n      refresh_token: refreshToken,\n      scope: authCode.scope\n    }\n  }\n\n  private async handleRefreshTokenGrant(params: TokenRequest): Promise<TokenResponse | OAuthError> {\n    if (!params.refresh_token) {\n      return { error: 'invalid_request', error_description: 'refresh_token parameter is required' }\n    }\n\n    // Get and validate refresh token\n    const refreshToken = await this.storage.getRefreshToken(params.refresh_token)\n    if (!refreshToken) {\n      return { error: 'invalid_grant', error_description: 'Invalid refresh token' }\n    }\n\n    if (refreshToken.expiresAt < new Date()) {\n      await this.storage.deleteRefreshToken(params.refresh_token)\n      return { error: 'invalid_grant', error_description: 'Refresh token expired' }\n    }\n\n    // Validate client\n    const client = await this.storage.getClient(refreshToken.clientId)\n    if (!client) {\n      return { error: 'invalid_client', error_description: 'Client not found' }\n    }\n\n    // Validate resource indicator\n    if (params.resource && refreshToken.audience && params.resource !== refreshToken.audience) {\n      return { error: 'invalid_grant', error_description: 'Resource indicator mismatch' }\n    }\n\n    // Clean up old tokens\n    await this.storage.deleteRefreshToken(params.refresh_token)\n    await this.storage.deleteRefreshTokensByAccessToken(refreshToken.accessTokenId)\n\n    // Generate new tokens\n    const accessToken = await this.generateAccessToken(client.id, refreshToken.userId, refreshToken.scope, params.resource)\n    \n    let newRefreshToken: string | undefined\n    if (this.config.allowRefreshTokens) {\n      newRefreshToken = await this.generateRefreshToken(accessToken.token, client.id, refreshToken.userId, refreshToken.scope, params.resource)\n    }\n\n    return {\n      access_token: accessToken.token,\n      token_type: 'Bearer',\n      expires_in: this.config.accessTokenLifetime,\n      refresh_token: newRefreshToken,\n      scope: refreshToken.scope\n    }\n  }\n\n  private async handleClientCredentialsGrant(params: TokenRequest): Promise<TokenResponse | OAuthError> {\n    // Validate client credentials\n    const client = await this.storage.getClient(params.client_id)\n    if (!client) {\n      return { error: 'invalid_client', error_description: 'Client not found' }\n    }\n\n    if (client.type === 'confidential' && client.secret !== params.client_secret) {\n      return { error: 'invalid_client', error_description: 'Invalid client secret' }\n    }\n\n    if (!client.grantTypes.includes('client_credentials')) {\n      return { error: 'unauthorized_client', error_description: 'Client not authorized for client_credentials grant' }\n    }\n\n    // Generate access token (no refresh token for client credentials)\n    const accessToken = await this.generateAccessToken(client.id, undefined, params.scope || 'read', params.resource)\n\n    return {\n      access_token: accessToken.token,\n      token_type: 'Bearer',\n      expires_in: this.config.accessTokenLifetime,\n      scope: accessToken.scope\n    }\n  }\n\n  // ===== TOKEN INTROSPECTION =====\n\n  async introspectToken(token: string): Promise<TokenIntrospectionResponse> {\n    try {\n      const accessToken = await this.storage.getAccessToken(token)\n      if (!accessToken || accessToken.expiresAt < new Date()) {\n        return { active: false }\n      }\n\n      const client = await this.storage.getClient(accessToken.clientId)\n      const user = accessToken.userId ? await this.storage.getUser(accessToken.userId) : undefined\n\n      return {\n        active: true,\n        scope: accessToken.scope,\n        client_id: accessToken.clientId,\n        username: user?.username,\n        exp: Math.floor(accessToken.expiresAt.getTime() / 1000),\n        aud: accessToken.audience // MCP-specific: audience for validation\n      }\n    } catch (error) {\n      console.error('Token introspection error:', error)\n      return { active: false }\n    }\n  }\n\n  // ===== TOKEN REVOCATION =====\n\n  async revokeToken(token: string, clientId: string): Promise<{ success: boolean }> {\n    try {\n      const accessToken = await this.storage.getAccessToken(token)\n      if (!accessToken || accessToken.clientId !== clientId) {\n        return { success: false }\n      }\n\n      await this.storage.deleteAccessToken(token)\n      await this.storage.deleteRefreshTokensByAccessToken(token)\n\n      return { success: true }\n    } catch (error) {\n      console.error('Token revocation error:', error)\n      return { success: false }\n    }\n  }\n\n  // ===== USER INFO =====\n\n  async getUserInfo(token: string): Promise<UserInfoResponse | OAuthError> {\n    try {\n      const accessToken = await this.storage.getAccessToken(token)\n      if (!accessToken || accessToken.expiresAt < new Date()) {\n        return { error: 'invalid_token', error_description: 'Invalid or expired token' }\n      }\n\n      if (!accessToken.userId) {\n        return { error: 'invalid_token', error_description: 'Token does not contain user information' }\n      }\n\n      const user = await this.storage.getUser(accessToken.userId)\n      if (!user) {\n        return { error: 'invalid_token', error_description: 'User not found' }\n      }\n\n      return {\n        sub: user.id,\n        name: user.username,\n        email: user.email,\n        scope: accessToken.scope\n      }\n    } catch (error) {\n      console.error('User info error:', error)\n      return { error: 'server_error', error_description: 'Internal server error' }\n    }\n  }\n\n  // ===== DYNAMIC CLIENT REGISTRATION (RFC 7591) =====\n\n  async registerClient(request: ClientRegistrationRequest): Promise<ClientRegistrationResponse | OAuthError> {\n    try {\n      if (!this.config.allowDynamicClientRegistration) {\n        return { error: 'access_denied', error_description: 'Dynamic client registration is not supported' }\n      }\n\n      // Validate required fields\n      if (!request.redirect_uris || request.redirect_uris.length === 0) {\n        return { error: 'invalid_redirect_uri', error_description: 'redirect_uris is required' }\n      }\n\n      // Generate client ID and secret\n      const clientId = this.generateClientId()\n      const clientSecret = this.generateClientSecret()\n\n      // Create client object\n      const client: OAuthClient = {\n        id: clientId,\n        secret: clientSecret,\n        name: request.client_name || `Dynamic Client ${clientId}`,\n        type: 'confidential', // Default to confidential for dynamic registration\n        redirectUris: request.redirect_uris,\n        scopes: request.scope ? request.scope.split(' ') : ['read'],\n        grantTypes: request.grant_types || ['authorization_code'],\n        createdAt: new Date(),\n        updatedAt: new Date()\n      }\n\n      // Store client\n      await this.storage.createClient(client)\n\n      // Return registration response\n      const response: ClientRegistrationResponse = {\n        client_id: clientId,\n        client_secret: clientSecret,\n        client_id_issued_at: Math.floor(Date.now() / 1000),\n        client_secret_expires_at: 0, // No expiration for now\n        redirect_uris: request.redirect_uris,\n        client_name: request.client_name,\n        client_uri: request.client_uri,\n        logo_uri: request.logo_uri,\n        scope: request.scope,\n        grant_types: request.grant_types,\n        response_types: request.response_types,\n        token_endpoint_auth_method: request.token_endpoint_auth_method,\n        token_endpoint_auth_signing_alg: request.token_endpoint_auth_signing_alg,\n        contacts: request.contacts,\n        policy_uri: request.policy_uri,\n        terms_of_service_uri: request.terms_of_service_uri,\n        jwks_uri: request.jwks_uri,\n        jwks: request.jwks,\n        software_id: request.software_id,\n        software_version: request.software_version\n      }\n\n      return response\n    } catch (error) {\n      console.error('Client registration error:', error)\n      return { error: 'server_error', error_description: 'Internal server error' }\n    }\n  }\n\n  // ===== MCP METADATA ENDPOINTS =====\n\n  getProtectedResourceMetadata(): MCPProtectedResourceMetadata {\n    return {\n      resource: this.config.serverUrl,\n      authorization_servers: [this.config.issuer],\n      scopes_supported: [...this.config.supportedScopes],\n      bearer_methods_supported: ['Authorization header']\n    }\n  }\n\n  getAuthorizationServerMetadata(): MCPAuthorizationServerMetadata {\n    return {\n      issuer: this.config.issuer,\n      authorization_endpoint: this.config.authorizationEndpoint,\n      token_endpoint: this.config.tokenEndpoint,\n      userinfo_endpoint: this.config.userinfoEndpoint,\n      jwks_uri: this.config.jwksEndpoint,\n      revocation_endpoint: this.config.revocationEndpoint,\n      introspection_endpoint: this.config.introspectionEndpoint,\n      registration_endpoint: this.config.allowDynamicClientRegistration ? `${this.config.issuer}/register` : undefined,\n      grant_types_supported: [...this.config.supportedGrantTypes],\n      response_types_supported: [...this.config.supportedResponseTypes],\n      scopes_supported: [...this.config.supportedScopes],\n      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'none'],\n      code_challenge_methods_supported: [...this.config.supportedCodeChallengeMethods],\n      resource_indicators_supported: this.config.requireResourceIndicator\n    }\n  }\n\n  // ===== UTILITY METHODS =====\n\n  private generateCode(): string {\n    return randomBytes(32).toString('base64url')\n  }\n\n  private generateCodeChallenge(verifier: string): string {\n    return createHash('sha256').update(verifier).digest('base64url')\n  }\n\n  private generateClientId(): string {\n    return `client_${randomBytes(16).toString('hex')}`\n  }\n\n  private generateClientSecret(): string {\n    return randomBytes(32).toString('base64url')\n  }\n\n  private async generateAccessToken(clientId: string, userId?: string, scope?: string, audience?: string): Promise<AccessToken> {\n    const now = Math.floor(Date.now() / 1000)\n\n    const payload: Record<string, any> = {\n      iss: this.config.issuer,\n      sub: userId || clientId,\n      aud: audience || this.config.serverUrl,\n      iat: now,\n      exp: now + this.config.accessTokenLifetime,\n      scope: scope || 'read',\n      client_id: clientId,\n    }\n\n    const secret = new TextEncoder().encode(this.config.jwtSecret)\n\n    const jwt = await new SignJWT(payload)\n      .setProtectedHeader({ alg: this.config.jwtAlgorithm || 'HS256' })\n      .sign(secret)\n\n    const accessToken: AccessToken = {\n      token: jwt,\n      clientId,\n      userId,\n      scope: payload.scope,\n      expiresAt: new Date((now + this.config.accessTokenLifetime) * 1000),\n      createdAt: new Date(),\n      audience: payload.aud,\n    }\n\n    await this.storage.createAccessToken(accessToken)\n    return accessToken\n  }\n\n  private async generateRefreshToken(accessTokenId: string, clientId: string, userId?: string, scope?: string, audience?: string): Promise<string> {\n    const token = randomBytes(32).toString('base64url')\n    const expiresAt = new Date(Date.now() + this.config.refreshTokenLifetime * 1000)\n\n    const refreshToken: RefreshToken = {\n      token,\n      accessTokenId,\n      clientId,\n      userId,\n      scope: scope || 'read',\n      expiresAt,\n      createdAt: new Date(),\n      audience // MCP-specific: store audience for validation\n    }\n\n    await this.storage.createRefreshToken(refreshToken)\n    return token\n  }\n\n  private validateScope(requestedScope: string, allowedScopes: string[]): boolean {\n    const requestedScopes = requestedScope.split(' ')\n    return requestedScopes.every(scope => allowedScopes.includes(scope))\n  }\n\n  // ===== CLEANUP =====\n\n  async cleanup(): Promise<void> {\n    await Promise.all([\n      this.storage.cleanupExpiredCodes(),\n      this.storage.cleanupExpiredTokens(),\n      this.storage.cleanupExpiredRefreshTokens()\n    ])\n  }\n\n  // ===== ADMIN METHODS =====\n\n  async getStats() {\n    return this.storage.getStats()\n  }\n\n  // Public methods for admin access\n  async listClients() {\n    return this.storage.listClients()\n  }\n\n  async listUsers() {\n    return this.storage.listUsers()\n  }\n} ","import express from 'express'\nimport cors, { CorsOptions } from 'cors'\nimport compression from 'compression'\nimport helmet from 'helmet'\nimport rateLimit from 'express-rate-limit'\nimport { MCPOAuthServer } from './oauth-server.js'\nimport type { MCPOAuthConfig, HTTPServerConfig } from './types.js'\n\nexport function registerOAuthEndpoints(app: express.Application, oauthServer: MCPOAuthServer, basePath = \"\") {\n  const renderSuccessPage = (redirectUrl: string) => `<!DOCTYPE html>\n  <html>\n    <head>\n      <meta charset=\"utf-8\" />\n      <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n      <title>Authorization successful</title>\n      <meta http-equiv=\"refresh\" content=\"1;url=${redirectUrl}\">\n      <style>\n        :root { --primary:#2563eb; --bg:#f9fafb; --card-bg:#ffffff; --border:#e5e7eb; --radius:10px; --font:system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; }\n        body { margin:0; background:var(--bg); display:flex; align-items:center; justify-content:center; height:100vh; font-family:var(--font); }\n        .card { width:100%; max-width:480px; background:var(--card-bg); padding:28px 32px; border:1px solid var(--border); border-radius:var(--radius); box-shadow:0 10px 30px rgba(0,0,0,0.06); text-align:center; }\n        h1 { margin:0 0 8px; font-size:22px; }\n        p { color:#4b5563; font-size:14px; margin:0 0 14px; }\n        a { color:var(--primary); text-decoration:none; }\n      </style>\n    </head>\n    <body>\n      <div class=\"card\">\n        <h1>Authorization successful</h1>\n        <p>You can close this window. Redirecting you back to your application…</p>\n        <p><a href=\"${redirectUrl}\">Continue</a></p>\n      </div>\n      <script>setTimeout(function(){ location.replace(${JSON.stringify(redirectUrl)}); }, 900);</script>\n    </body>\n  </html>`\n  // Authorization endpoint (GET - show login page or redirect)\n  app.get(`${basePath}/authorize`, async (req, res) => {\n    try {\n      const q = req.query as Record<string, any>\n      const first = (v: any) => Array.isArray(v) ? v[0] : v\n      const params = {\n        response_type: first(q.response_type) as 'code',\n        client_id: first(q.client_id) as string,\n        redirect_uri: first(q.redirect_uri) as string,\n        scope: first(q.scope) as string,\n        state: first(q.state) as string,\n        resource: first(q.resource) as string,\n        code_challenge: first(q.code_challenge) as string,\n        code_challenge_method: first(q.code_challenge_method) as 'S256' | 'plain'\n      }\n\n      const requestContext = {\n        ipAddress: (req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() || req.ip || (req.connection as any).remoteAddress || '0.0.0.0',\n        userAgent: req.headers['user-agent']\n      }\n\n      const result = await oauthServer.handleAuthorizationRequest(params, undefined, (req as any).session, requestContext)\n      \n      if ('error' in result) {\n        return res.status(400).json(result)\n      }\n      \n      if ('loginPage' in result) {\n        return res.type('html').send(result.loginPage)\n      }\n      \n      if ('redirectUrl' in result) {\n        res.type('html').send(renderSuccessPage(result.redirectUrl))\n      }\n    } catch (error) {\n      console.error('Authorization error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // Authorization endpoint (POST - handle login form submission)\n  app.post(`${basePath}/authorize`, async (req, res) => {\n    try {\n      const b = req.body as Record<string, any>\n      const first = (v: any) => Array.isArray(v) ? v[0] : v\n      const params = {\n        response_type: first(b.response_type) as 'code',\n        client_id: first(b.client_id) as string,\n        redirect_uri: first(b.redirect_uri) as string,\n        scope: first(b.scope) as string,\n        state: first(b.state) as string,\n        resource: first(b.resource) as string,\n        code_challenge: first(b.code_challenge) as string,\n        code_challenge_method: first(b.code_challenge_method) as 'S256' | 'plain'\n      }\n\n      const credentials = first(b.username) && first(b.password) ? {\n        username: first(b.username) as string,\n        password: first(b.password) as string\n      } : undefined\n\n      const requestContext = {\n        ipAddress: (req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() || req.ip || (req.connection as any).remoteAddress || '0.0.0.0',\n        userAgent: req.headers['user-agent']\n      }\n\n      const result = await oauthServer.handleAuthorizationRequest(params, credentials, (req as any).session, requestContext)\n      \n      if ('error' in result) {\n        return res.status(400).json(result)\n      }\n      \n      if ('loginPage' in result) {\n        return res.type('html').send(result.loginPage)\n      }\n      \n      if ('redirectUrl' in result) {\n        res.type('html').send(renderSuccessPage(result.redirectUrl))\n      }\n    } catch (error) {\n      console.error('Authorization error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // Token endpoint\n  app.post(`${basePath}/token`, async (req, res) => {\n    try {\n      const params = {\n        grant_type: req.body.grant_type as 'authorization_code' | 'refresh_token' | 'client_credentials',\n        client_id: req.body.client_id as string,\n        client_secret: req.body.client_secret as string,\n        code: req.body.code as string,\n        redirect_uri: req.body.redirect_uri as string,\n        refresh_token: req.body.refresh_token as string,\n        scope: req.body.scope as string,\n        resource: req.body.resource as string,\n        code_verifier: req.body.code_verifier as string\n      }\n      const result = await oauthServer.handleTokenRequest(params)\n      if ('error' in result) {\n        return res.status(400).json(result)\n      }\n      res.json(result)\n    } catch (error) {\n      console.error('Token error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // Token introspection endpoint\n  app.post(`${basePath}/introspect`, async (req, res) => {\n    try {\n      const { token } = req.body\n      if (!token) {\n        return res.status(400).json({ error: 'invalid_request', error_description: 'token parameter is required' })\n      }\n\n      const result = await oauthServer.introspectToken(token)\n      res.json(result)\n    } catch (error) {\n      console.error('Introspection error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // Token revocation endpoint\n  app.post(`${basePath}/revoke`, async (req, res) => {\n    try {\n      const { token, client_id } = req.body\n      if (!token || !client_id) {\n        return res.status(400).json({ error: 'invalid_request', error_description: 'token and client_id parameters are required' })\n      }\n\n      const result = await oauthServer.revokeToken(token, client_id)\n      res.json(result)\n    } catch (error) {\n      console.error('Revocation error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // User info endpoint\n  app.get(`${basePath}/userinfo`, async (req, res) => {\n    try {\n      const authHeader = req.headers.authorization\n      if (!authHeader || !authHeader.startsWith('Bearer ')) {\n        return res.status(401).json({ error: 'invalid_token', error_description: 'Bearer token required' })\n      }\n\n      const token = authHeader.substring(7)\n      const result = await oauthServer.getUserInfo(token)\n      \n      if ('error' in result) {\n        return res.status(401).json(result)\n      }\n\n      res.json(result)\n    } catch (error) {\n      console.error('User info error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // Dynamic client registration endpoint (RFC 7591)\n  app.post(`${basePath}/register`, async (req, res) => {\n    try {\n      const result = await oauthServer.registerClient(req.body)\n      \n      if ('error' in result) {\n        return res.status(400).json(result)\n      }\n\n      res.status(201).json(result)\n    } catch (error) {\n      console.error('Client registration error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // ===== DISCOVERY ENDPOINTS =====\n\n  // OAuth Authorization Server Metadata (RFC 8414)\n  app.get(`${basePath}/.well-known/oauth-authorization-server`, (req, res) => {\n    const metadata = oauthServer.getAuthorizationServerMetadata()\n    res.json(metadata)\n  })\n\n  // JWKS endpoint\n  app.get(`${basePath}/.well-known/jwks.json`, (req, res) => {\n    // For now, return empty JWKS since we're using HMAC\n    // In production, you'd use RSA keys\n    res.json({ keys: [] })\n  })\n\n  // MCP Protected Resource Metadata (RFC 9728) - FIXED ENDPOINT\n  app.get(`${basePath}/.well-known/oauth-protected-resource`, (req, res) => {\n    const metadata = oauthServer.getProtectedResourceMetadata()\n    res.json(metadata)\n  })\n\n  // ===== ADMIN ENDPOINTS =====\n\n  // Health check\n  app.get(`${basePath}/health`, (req, res) => {\n    res.json({\n      status: 'ok',\n      service: 'mcp-oauth-server',\n      version: '1.0.0',\n      timestamp: new Date().toISOString()\n    })\n  })\n\n  // List clients\n  app.get(`${basePath}/admin/clients`, async (req, res) => {\n    try {\n      const clients = await oauthServer.listClients()\n      res.json(clients)\n    } catch (error) {\n      console.error('List clients error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // List users\n  app.get(`${basePath}/admin/users`, async (req, res) => {\n    try {\n      const users = await oauthServer.listUsers()\n      res.json(users)\n    } catch (error) {\n      console.error('List users error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // Server stats\n  app.get(`${basePath}/admin/stats`, async (req, res) => {\n    try {\n      const stats = await oauthServer.getStats()\n      res.json(stats)\n    } catch (error) {\n      console.error('Stats error:', error)\n      res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n    }\n  })\n\n  // 404 handler\n  // app.use(`${basePath}/*`, (req, res) => {\n  //   res.status(404).json({ \n  //     error: 'not_found', \n  //     error_description: 'Endpoint not found',\n  //     path: req.originalUrl\n  //   })\n  // })\n}\n\nexport class MCPOAuthHttpServer {\n  private app: express.Application\n  private oauthServer: MCPOAuthServer\n  private config: MCPOAuthConfig\n\n  constructor(oauthServer: MCPOAuthServer, config: MCPOAuthConfig) {\n    this.oauthServer = oauthServer\n    this.config = config\n    this.app = express()\n    this.setupMiddleware()\n    this.setupRoutes()\n    this.setupErrorHandling()\n  }\n\n  private setupMiddleware(): void {\n    const httpConfig = this.config.http || {}\n    \n    // Trust proxy (important for production behind load balancers)\n    if (httpConfig.trustProxy !== undefined) {\n      this.app.set('trust proxy', httpConfig.trustProxy)\n    }\n\n    // Security headers\n    if (httpConfig.enableHelmet !== false) {\n      this.app.use(helmet({\n        contentSecurityPolicy: {\n          directives: {\n            defaultSrc: [\"'self'\"],\n            styleSrc: [\"'self'\", \"'unsafe-inline'\"],\n            scriptSrc: [\"'self'\"],\n            imgSrc: [\"'self'\", \"data:\", \"https:\"],\n          },\n        },\n      }))\n    }\n\n    // Compression\n    if (httpConfig.enableCompression !== false) {\n      this.app.use(compression())\n    }\n\n    // Rate limiting\n    if (httpConfig.enableRateLimit !== false) {\n      const rateLimitConfig = httpConfig.rateLimitConfig || {}\n      const limiter = rateLimit({\n        windowMs: rateLimitConfig.windowMs || 15 * 60 * 1000, // 15 minutes\n        max: rateLimitConfig.max || 100, // limit each IP to 100 requests per windowMs\n        message: rateLimitConfig.message || 'Too many requests from this IP, please try again later.',\n        standardHeaders: rateLimitConfig.standardHeaders !== false, // Return rate limit info in the `RateLimit-*` headers\n        legacyHeaders: rateLimitConfig.legacyHeaders !== false, // Disable the `X-RateLimit-*` headers\n      })\n      this.app.use(limiter)\n    }\n\n    // CORS configuration - use provided config or sensible defaults\n    const corsConfig: CorsOptions = httpConfig.cors || {\n      origin: true, // Allow all origins by default\n      credentials: true,\n      exposedHeaders: [\"mcp-session-id\"],\n      allowedHeaders: [\"Content-Type\", \"mcp-session-id\", \"accept\", \"last-event-id\", \"Authorization\"],\n      methods: [\"GET\", \"POST\", \"PUT\", \"DELETE\", \"OPTIONS\"]\n    }\n    this.app.use(cors(corsConfig))\n\n    // JSON parsing with configurable limits\n    this.app.use(express.json({ \n      limit: httpConfig.jsonLimit || '10mb' \n    }))\n    this.app.use(express.urlencoded({ \n      extended: true, \n      limit: httpConfig.urlencodedLimit || '10mb' \n    }))\n  }\n\n  private setupRoutes(): void {\n    // ===== OAUTH 2.1 ENDPOINTS =====\n\n    // Authorization endpoint\n    this.app.get('/authorize', async (req, res) => {\n      try {\n        const params = {\n          response_type: req.query.response_type as 'code',\n          client_id: req.query.client_id as string,\n          redirect_uri: req.query.redirect_uri as string,\n          scope: req.query.scope as string,\n          state: req.query.state as string,\n          resource: req.query.resource as string,\n          code_challenge: req.query.code_challenge as string,\n          code_challenge_method: req.query.code_challenge_method as 'S256' | 'plain'\n        }\n\n        const requestContext = {\n          ipAddress: req.ip || req.connection.remoteAddress || '0.0.0.0',\n          userAgent: req.headers['user-agent']\n        }\n\n        const result = await this.oauthServer.handleAuthorizationRequest(params, undefined, (req as any).session, requestContext)\n        \n        if ('error' in result) {\n          return res.status(400).json(result)\n        }\n        \n        if ('loginPage' in result) {\n          return res.type('html').send(result.loginPage)\n        }\n        \n        if ('redirectUrl' in result) {\n          res.redirect(result.redirectUrl)\n        }\n      } catch (error) {\n        console.error('Authorization error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // Authorization endpoint (POST - handle login form submission)\n    this.app.post('/authorize', async (req, res) => {\n      try {\n        const params = {\n          response_type: req.body.response_type as 'code',\n          client_id: req.body.client_id as string,\n          redirect_uri: req.body.redirect_uri as string,\n          scope: req.body.scope as string,\n          state: req.body.state as string,\n          resource: req.body.resource as string,\n          code_challenge: req.body.code_challenge as string,\n          code_challenge_method: req.body.code_challenge_method as 'S256' | 'plain'\n        }\n\n        const credentials = req.body.username && req.body.password ? {\n          username: req.body.username as string,\n          password: req.body.password as string\n        } : undefined\n\n        const requestContext = {\n          ipAddress: req.ip || req.connection.remoteAddress || '0.0.0.0',\n          userAgent: req.headers['user-agent']\n        }\n\n        const result = await this.oauthServer.handleAuthorizationRequest(params, credentials, (req as any).session, requestContext)\n        \n        if ('error' in result) {\n          return res.status(400).json(result)\n        }\n        \n        if ('loginPage' in result) {\n          return res.type('html').send(result.loginPage)\n        }\n        \n        if ('redirectUrl' in result) {\n          res.redirect(result.redirectUrl)\n        }\n      } catch (error) {\n        console.error('Authorization error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // Token endpoint\n    this.app.post('/token', async (req, res) => {\n      try {\n        const params = {\n          grant_type: req.body.grant_type as 'authorization_code' | 'refresh_token' | 'client_credentials',\n          client_id: req.body.client_id as string,\n          client_secret: req.body.client_secret as string,\n          code: req.body.code as string,\n          redirect_uri: req.body.redirect_uri as string,\n          refresh_token: req.body.refresh_token as string,\n          scope: req.body.scope as string,\n          resource: req.body.resource as string,\n          code_verifier: req.body.code_verifier as string\n        }\n\n        const result = await this.oauthServer.handleTokenRequest(params)\n        \n        if ('error' in result) {\n          return res.status(400).json(result)\n        }\n\n        res.json(result)\n      } catch (error) {\n        console.error('Token error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // Token introspection endpoint\n    this.app.post('/introspect', async (req, res) => {\n      try {\n        const { token } = req.body\n        if (!token) {\n          return res.status(400).json({ error: 'invalid_request', error_description: 'token parameter is required' })\n        }\n\n        const result = await this.oauthServer.introspectToken(token)\n        res.json(result)\n      } catch (error) {\n        console.error('Introspection error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // Token revocation endpoint\n    this.app.post('/revoke', async (req, res) => {\n      try {\n        const { token, client_id } = req.body\n        if (!token || !client_id) {\n          return res.status(400).json({ error: 'invalid_request', error_description: 'token and client_id parameters are required' })\n        }\n\n        const result = await this.oauthServer.revokeToken(token, client_id)\n        res.json(result)\n      } catch (error) {\n        console.error('Revocation error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // User info endpoint\n    this.app.get('/userinfo', async (req, res) => {\n      try {\n        const authHeader = req.headers.authorization\n        if (!authHeader || !authHeader.startsWith('Bearer ')) {\n          return res.status(401).json({ error: 'invalid_token', error_description: 'Bearer token required' })\n        }\n\n        const token = authHeader.substring(7)\n        const result = await this.oauthServer.getUserInfo(token)\n        \n        if ('error' in result) {\n          return res.status(401).json(result)\n        }\n\n        res.json(result)\n      } catch (error) {\n        console.error('User info error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // Dynamic client registration endpoint (RFC 7591)\n    this.app.post('/register', async (req, res) => {\n      try {\n        const result = await this.oauthServer.registerClient(req.body)\n        \n        if ('error' in result) {\n          return res.status(400).json(result)\n        }\n\n        res.status(201).json(result)\n      } catch (error) {\n        console.error('Client registration error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // ===== DISCOVERY ENDPOINTS =====\n\n    // OAuth Authorization Server Metadata (RFC 8414)\n    this.app.get('/.well-known/oauth-authorization-server', (req, res) => {\n      const metadata = this.oauthServer.getAuthorizationServerMetadata()\n      res.json(metadata)\n    })\n\n    // JWKS endpoint\n    this.app.get('/.well-known/jwks.json', (req, res) => {\n      // For now, return empty JWKS since we're using HMAC\n      // In production, you'd use RSA keys\n      res.json({ keys: [] })\n    })\n\n    // MCP Protected Resource Metadata (RFC 9728) - FIXED ENDPOINT\n    this.app.get('/.well-known/oauth-protected-resource', (req, res) => {\n      const metadata = this.oauthServer.getProtectedResourceMetadata()\n      res.json(metadata)\n    })\n\n    // ===== ADMIN ENDPOINTS =====\n\n    // Health check\n    this.app.get('/health', (req, res) => {\n      res.json({\n        status: 'ok',\n        service: 'mcp-oauth-server',\n        version: '1.0.0',\n        timestamp: new Date().toISOString()\n      })\n    })\n\n    // List clients\n    this.app.get('/admin/clients', async (req, res) => {\n      try {\n        const clients = await this.oauthServer.listClients()\n        res.json(clients)\n      } catch (error) {\n        console.error('List clients error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // List users\n    this.app.get('/admin/users', async (req, res) => {\n      try {\n        const users = await this.oauthServer.listUsers()\n        res.json(users)\n      } catch (error) {\n        console.error('List users error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // Server stats\n    this.app.get('/admin/stats', async (req, res) => {\n      try {\n        const stats = await this.oauthServer.getStats()\n        res.json(stats)\n      } catch (error) {\n        console.error('Stats error:', error)\n        res.status(500).json({ error: 'server_error', error_description: 'Internal server error' })\n      }\n    })\n\n    // 404 handler\n    // this.app.use('*', (req, res) => {\n    //   res.status(404).json({ \n    //     error: 'not_found', \n    //     error_description: 'Endpoint not found',\n    //     path: req.originalUrl\n    //   })\n    // })\n  }\n\n  private setupErrorHandling(): void {\n    // Global error handler\n    this.app.use((error: any, req: express.Request, res: express.Response, next: express.NextFunction) => {\n      console.error('Unhandled error:', error)\n      \n      // Don't leak error details in production\n      const isDevelopment = process.env.NODE_ENV === 'development'\n      \n      res.status(500).json({\n        error: 'server_error',\n        error_description: isDevelopment ? error.message : 'Internal server error',\n        ...(isDevelopment && { stack: error.stack })\n      })\n    })\n  }\n\n  getApp(): express.Application {\n    return this.app\n  }\n\n  async start(port: number): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const server = this.app.listen(port, () => {\n        console.log(`MCP OAuth Server running on port ${port}`)\n        console.log(`Health check: http://localhost:${port}/health`)\n        console.log(`Authorization endpoint: http://localhost:${port}/authorize`)\n        console.log(`Token endpoint: http://localhost:${port}/token`)\n        console.log(`Discovery: http://localhost:${port}/.well-known/oauth-authorization-server`)\n        resolve()\n      })\n\n      server.on('error', (error) => {\n        console.error('Failed to start server:', error)\n        reject(error)\n      })\n    })\n  }\n} ","import type { \n  MCPOAuthStorage,\n  OAuthClient,\n  OAuthUser,\n  AuthorizationCode,\n  AccessToken,\n  RefreshToken\n} from '../types.js'\n\nexport class MemoryStorage implements MCPOAuthStorage {\n  private clients = new Map<string, OAuthClient>()\n  private users = new Map<string, OAuthUser>()\n  private authorizationCodes = new Map<string, AuthorizationCode>()\n  private accessTokens = new Map<string, AccessToken>()\n  private refreshTokens = new Map<string, RefreshToken>()\n\n  // ===== CLIENT MANAGEMENT =====\n\n  async createClient(client: OAuthClient): Promise<void> {\n    this.clients.set(client.id, client)\n  }\n\n  async getClient(clientId: string): Promise<OAuthClient | null> {\n    return this.clients.get(clientId) || null\n  }\n\n  async listClients(): Promise<OAuthClient[]> {\n    return Array.from(this.clients.values())\n  }\n\n  async updateClient(clientId: string, updates: Partial<OAuthClient>): Promise<void> {\n    const client = this.clients.get(clientId)\n    if (client) {\n      this.clients.set(clientId, { ...client, ...updates, updatedAt: new Date() })\n    }\n  }\n\n  async deleteClient(clientId: string): Promise<void> {\n    this.clients.delete(clientId)\n  }\n\n  // ===== USER MANAGEMENT =====\n\n  async createUser(user: OAuthUser): Promise<void> {\n    this.users.set(user.id, user)\n  }\n\n  async getUser(userId: string): Promise<OAuthUser | null> {\n    return this.users.get(userId) || null\n  }\n\n  async getUserByUsername(username: string): Promise<OAuthUser | null> {\n    for (const user of this.users.values()) {\n      if (user.username === username) {\n        return user\n      }\n    }\n    return null\n  }\n\n  async listUsers(): Promise<OAuthUser[]> {\n    return Array.from(this.users.values())\n  }\n\n  async updateUser(userId: string, updates: Partial<OAuthUser>): Promise<void> {\n    const user = this.users.get(userId)\n    if (user) {\n      this.users.set(userId, { ...user, ...updates, updatedAt: new Date() })\n    }\n  }\n\n  async deleteUser(userId: string): Promise<void> {\n    this.users.delete(userId)\n  }\n\n  // ===== AUTHORIZATION CODES =====\n\n  async createAuthorizationCode(code: AuthorizationCode): Promise<void> {\n    this.authorizationCodes.set(code.code, code)\n  }\n\n  async getAuthorizationCode(code: string): Promise<AuthorizationCode | null> {\n    return this.authorizationCodes.get(code) || null\n  }\n\n  async deleteAuthorizationCode(code: string): Promise<void> {\n    this.authorizationCodes.delete(code)\n  }\n\n  async cleanupExpiredCodes(): Promise<void> {\n    const now = new Date()\n    for (const [code, authCode] of this.authorizationCodes.entries()) {\n      if (authCode.expiresAt < now) {\n        this.authorizationCodes.delete(code)\n      }\n    }\n  }\n\n  // ===== ACCESS TOKENS =====\n\n  async createAccessToken(token: AccessToken): Promise<void> {\n    this.accessTokens.set(token.token, token)\n  }\n\n  async getAccessToken(token: string): Promise<AccessToken | null> {\n    return this.accessTokens.get(token) || null\n  }\n\n  async deleteAccessToken(token: string): Promise<void> {\n    this.accessTokens.delete(token)\n  }\n\n  async cleanupExpiredTokens(): Promise<void> {\n    const now = new Date()\n    for (const [token, accessToken] of this.accessTokens.entries()) {\n      if (accessToken.expiresAt < now) {\n        this.accessTokens.delete(token)\n      }\n    }\n  }\n\n  // ===== REFRESH TOKENS =====\n\n  async createRefreshToken(token: RefreshToken): Promise<void> {\n    this.refreshTokens.set(token.token, token)\n  }\n\n  async getRefreshToken(token: string): Promise<RefreshToken | null> {\n    return this.refreshTokens.get(token) || null\n  }\n\n  async deleteRefreshToken(token: string): Promise<void> {\n    this.refreshTokens.delete(token)\n  }\n\n  async deleteRefreshTokensByAccessToken(accessTokenId: string): Promise<void> {\n    for (const [token, refreshToken] of this.refreshTokens.entries()) {\n      if (refreshToken.accessTokenId === accessTokenId) {\n        this.refreshTokens.delete(token)\n      }\n    }\n  }\n\n  async cleanupExpiredRefreshTokens(): Promise<void> {\n    const now = new Date()\n    for (const [token, refreshToken] of this.refreshTokens.entries()) {\n      if (refreshToken.expiresAt < now) {\n        this.refreshTokens.delete(token)\n      }\n    }\n  }\n\n  // ===== UTILITY METHODS =====\n\n  getStats() {\n    return {\n      clients: this.clients.size,\n      users: this.users.size,\n      authorizationCodes: this.authorizationCodes.size,\n      accessTokens: this.accessTokens.size,\n      refreshTokens: this.refreshTokens.size\n    }\n  }\n} ","import crypto from 'crypto'\nimport { CodeChallengeMethod } from '../types.js'\n\n/**\n * PKCE (Proof Key for Code Exchange) utilities\n * @see https://datatracker.ietf.org/doc/html/rfc7636\n */\n\n/**\n * Generate a random code verifier\n * @param length Length of the code verifier (43-128 characters)\n * @returns A random code verifier\n */\nexport function generateCodeVerifier(length: number = 64): string {\n  if (length < 43 || length > 128) {\n    throw new Error('Code verifier length must be between 43 and 128 characters')\n  }\n  \n  const bytes = crypto.randomBytes(length)\n  return bytes.toString('base64url')\n}\n\n/**\n * Generate a code challenge from a code verifier\n * @param codeVerifier The code verifier\n * @param method The code challenge method ('S256' or 'plain')\n * @returns The code challenge\n */\nexport function generateCodeChallenge(\n  codeVerifier: string, \n  method: CodeChallengeMethod = 'S256'\n): string {\n  if (method === 'plain') {\n    return codeVerifier\n  }\n  \n  if (method === 'S256') {\n    const hash = crypto.createHash('sha256')\n    hash.update(codeVerifier)\n    return hash.digest('base64url')\n  }\n  \n  throw new Error(`Unsupported code challenge method: ${method}`)\n}\n\n/**\n * Verify a code verifier against a code challenge\n * @param codeVerifier The code verifier\n * @param codeChallenge The code challenge\n * @param method The code challenge method\n * @returns True if the code verifier matches the challenge\n */\nexport function verifyCodeChallenge(\n  codeVerifier: string,\n  codeChallenge: string,\n  method: CodeChallengeMethod\n): boolean {\n  const expectedChallenge = generateCodeChallenge(codeVerifier, method)\n  return expectedChallenge === codeChallenge\n}\n\n/**\n * Validate code verifier format\n * @param codeVerifier The code verifier to validate\n * @returns True if the code verifier is valid\n */\nexport function isValidCodeVerifier(codeVerifier: string): boolean {\n  // Must be 43-128 characters\n  if (codeVerifier.length < 43 || codeVerifier.length > 128) {\n    return false\n  }\n  \n  // Must only contain characters: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n  const validChars = /^[A-Za-z0-9\\-._~]+$/\n  return validChars.test(codeVerifier)\n}\n\n/**\n * Validate code challenge format\n * @param codeChallenge The code challenge to validate\n * @returns True if the code challenge is valid\n */\nexport function isValidCodeChallenge(codeChallenge: string): boolean {\n  // Must be 43-128 characters\n  if (codeChallenge.length < 43 || codeChallenge.length > 128) {\n    return false\n  }\n  \n  // Must only contain characters: [A-Z] / [a-z] / [0-9] / \"-\" / \".\" / \"_\" / \"~\"\n  const validChars = /^[A-Za-z0-9\\-._~]+$/\n  return validChars.test(codeChallenge)\n}\n\n/**\n * Generate a complete PKCE pair\n * @param method The code challenge method\n * @param verifierLength Length of the code verifier\n * @returns Object containing code verifier and challenge\n */\nexport function generatePkcePair(\n  method: CodeChallengeMethod = 'S256',\n  verifierLength: number = 64\n): { codeVerifier: string; codeChallenge: string } {\n  const codeVerifier = generateCodeVerifier(verifierLength)\n  const codeChallenge = generateCodeChallenge(codeVerifier, method)\n  \n  return {\n    codeVerifier,\n    codeChallenge\n  }\n} ","import crypto from 'crypto'\nimport { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose'\nimport { AccessToken, RefreshToken, TokenType } from '../types.js'\n\n/**\n * Token utilities for OAuth 2.1\n */\n\n/**\n * Generate a random token\n * @param length Length of the token\n * @returns A random token\n */\nexport function generateRandomToken(length: number = 32): string {\n  const bytes = crypto.randomBytes(length)\n  return bytes.toString('base64url')\n}\n\n/**\n * Generate a secure access token\n * @param length Length of the token\n * @returns A secure access token\n */\nexport function generateAccessToken(length: number = 32): string {\n  return generateRandomToken(length)\n}\n\n/**\n * Generate a secure refresh token\n * @param length Length of the token\n * @returns A secure refresh token\n */\nexport function generateRefreshToken(length: number = 64): string {\n  return generateRandomToken(length)\n}\n\n/**\n * Generate a secure authorization code\n * @param length Length of the code\n * @returns A secure authorization code\n */\nexport function generateAuthorizationCode(length: number = 32): string {\n  return generateRandomToken(length)\n}\n\n/**\n * Create a JWT access token\n * @param payload The token payload\n * @param privateKey The private key for signing\n * @param algorithm The signing algorithm\n * @param expiresIn Expiration time in seconds\n * @returns A signed JWT token\n */\nexport async function createJwtToken(\n  payload: Record<string, any>,\n  privateKey: string,\n  algorithm: string = 'RS256',\n  expiresIn: number = 3600\n): Promise<string> {\n  const key = await importPKCS8(privateKey, algorithm)\n  \n  const jwt = new SignJWT(payload)\n    .setProtectedHeader({ alg: algorithm })\n    .setIssuedAt()\n    .setExpirationTime(Math.floor(Date.now() / 1000) + expiresIn)\n  \n  return await jwt.sign(key)\n}\n\n/**\n * Verify a JWT token\n * @param token The JWT token to verify\n * @param publicKey The public key for verification\n * @param algorithm The signing algorithm\n * @returns The decoded token payload\n */\nexport async function verifyJwtToken(\n  token: string,\n  publicKey: string,\n  algorithm: string = 'RS256'\n): Promise<Record<string, any>> {\n  const key = await importSPKI(publicKey, algorithm)\n  \n  const { payload } = await jwtVerify(token, key, {\n    algorithms: [algorithm]\n  })\n  \n  return payload\n}\n\n/**\n * Check if a token is expired\n * @param token The token to check\n * @returns True if the token is expired\n */\nexport function isTokenExpired(token: AccessToken | RefreshToken): boolean {\n  return new Date() > token.expiresAt\n}\n\n/**\n * Get token expiration time in seconds from now\n * @param token The token to check\n * @returns Seconds until expiration, negative if expired\n */\nexport function getTokenExpirationSeconds(token: AccessToken | RefreshToken): number {\n  const now = Math.floor(Date.now() / 1000)\n  const expiresAt = Math.floor(token.expiresAt.getTime() / 1000)\n  return expiresAt - now\n}\n\n/**\n * Create a token response object\n * @param accessToken The access token\n * @param tokenType The token type\n * @param expiresIn Expiration time in seconds\n * @param refreshToken Optional refresh token\n * @param scope Optional scope\n * @returns A token response object\n */\nexport function createTokenResponse(\n  accessToken: string,\n  tokenType: TokenType = 'Bearer',\n  expiresIn: number,\n  refreshToken?: string,\n  scope?: string\n) {\n  const response: any = {\n    access_token: accessToken,\n    token_type: tokenType,\n    expires_in: expiresIn\n  }\n  \n  if (refreshToken) {\n    response.refresh_token = refreshToken\n  }\n  \n  if (scope) {\n    response.scope = scope\n  }\n  \n  return response\n}\n\n/**\n * Parse scope string into array\n * @param scope The scope string\n * @returns Array of scopes\n */\nexport function parseScope(scope?: string): string[] {\n  if (!scope) return []\n  return scope.split(' ').filter(s => s.trim().length > 0)\n}\n\n/**\n * Join scope array into string\n * @param scopes Array of scopes\n * @returns Scope string\n */\nexport function joinScope(scopes: string[]): string {\n  return scopes.join(' ')\n}\n\n/**\n * Validate scope against allowed scopes\n * @param requestedScope The requested scope\n * @param allowedScopes The allowed scopes\n * @returns True if the scope is valid\n */\nexport function validateScope(requestedScope: string[], allowedScopes: string[]): boolean {\n  return requestedScope.every(scope => allowedScopes.includes(scope))\n}\n\n/**\n * Get intersection of requested and allowed scopes\n * @param requestedScope The requested scope\n * @param allowedScopes The allowed scopes\n * @returns Intersection of scopes\n */\nexport function getScopeIntersection(requestedScope: string[], allowedScopes: string[]): string[] {\n  return requestedScope.filter(scope => allowedScopes.includes(scope))\n} "],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAmC;AACnC,oBAAwC;AAwBxC,IAAM,WAAW;AAAA,EACf,iBAAiB,CAAC,QAAQ,SAAS,UAAU,WAAW,OAAO;AAAA,EAC/D,qBAAqB,CAAC,sBAAsB,iBAAiB,oBAAoB;AAAA,EACjF,wBAAwB,CAAC,MAAM;AAAA,EAC/B,+BAA+B,CAAC,QAAQ,OAAO;AACjD;AAEA,SAAS,gBAAgB,QAAa;AACpC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,iBAAiB,OAAO,mBAAmB,SAAS;AAAA,IACpD,qBAAqB,OAAO,uBAAuB,SAAS;AAAA,IAC5D,wBAAwB,OAAO,0BAA0B,SAAS;AAAA,IAClE,+BAA+B,OAAO,iCAAiC,SAAS;AAAA,EAClF;AACF;AAEO,IAAM,iBAAN,MAAqB;AAAA,EAClB;AAAA,EACA;AAAA,EAER,YAAY,QAA6B,SAA0B;AAEjE,UAAM,gBAAgB,OAAO,aAAa,OAAO;AACjD,UAAM,aAA6B,gBAAgB;AAAA,MACjD,GAAG;AAAA,MACH,WAAW;AAAA,MACX,uBAAuB,OAAO,yBAAyB,OAAO,SAAS;AAAA,MACvE,eAAe,OAAO,iBAAiB,OAAO,SAAS;AAAA,MACvD,kBAAkB,OAAO,oBAAoB,OAAO,SAAS;AAAA,MAC7D,cAAc,OAAO,gBAAgB,OAAO,SAAS;AAAA,MACrD,uBAAuB,OAAO,yBAAyB,OAAO,SAAS;AAAA,MACvE,oBAAoB,OAAO,sBAAsB,OAAO,SAAS;AAAA,MACjE,0BAA0B,OAAO,4BAA4B;AAAA,MAC7D,aAAa,OAAO,eAAe;AAAA,MACnC,oBAAoB,OAAO,sBAAsB;AAAA,MACjD,gCAAgC,OAAO,kCAAkC;AAAA,MACzE,qBAAqB,OAAO,uBAAuB;AAAA,MACnD,sBAAsB,OAAO,wBAAwB;AAAA,MACrD,2BAA2B,OAAO,6BAA6B;AAAA,MAC/D,qBAAqB,OAAO,uBAAuB,SAAS;AAAA,MAC5D,wBAAwB,OAAO,0BAA0B,SAAS;AAAA,MAClE,iBAAiB,OAAO,mBAAmB,SAAS;AAAA,MACpD,+BAA+B,OAAO,iCAAiC,SAAS;AAAA,MAChF,cAAc,OAAO,gBAAgB;AAAA,MACrC,MAAM,OAAO;AAAA,IACf,CAAC;AACD,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BACJ,aACA,aACA,SAC2B;AAE3B,QAAI,KAAK,OAAO,MAAM;AAEpB,UAAI,KAAK,OAAO,KAAK,gBAAgB;AACnC,cAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe,aAAa,OAAO;AAC9E,YAAI,aAAa;AACf,iBAAO;AAAA,QACT;AAAA,MACF;AAGA,UAAI,eAAe,KAAK,OAAO,KAAK,kBAAkB;AACpD,eAAO,MAAM,KAAK,OAAO,KAAK,iBAAiB,aAAa,OAAO;AAAA,MACrE;AAAA,IACF;AAIA,QAAI,CAAC,KAAK,OAAO,QAAQ,aAAa,aAAa,oBAAoB;AACrE,YAAM,WAAW,MAAM,KAAK,QAAQ,QAAQ,WAAW;AACvD,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAA0B,OAAiC;AAC/E,QAAI,KAAK,OAAO,MAAM,iBAAiB;AACrC,YAAM,SAAS,MAAM,KAAK,OAAO,KAAK,gBAAgB,SAAS,KAAK;AACpE,UAAI,OAAO,WAAW,UAAU;AAC9B,eAAO;AAAA,MACT;AAAA,IAEF;AAGA,WAAO,KAAK,yBAAyB,SAAS,KAAK;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,MAAiB,SAA4C;AACnF,QAAI,KAAK,OAAO,MAAM,mBAAmB;AACvC,YAAM,SAAS,MAAM,KAAK,OAAO,KAAK,kBAAkB,MAAM,OAAO;AACrE,UAAI,OAAO,WAAW,WAAW;AAC/B,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AAAA,EAEQ,yBAAyB,SAA0B,OAAwB;AACjF,UAAM,YAAY,QAAQ,iDAAiD,KAAK,WAAW;AAE3F,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0CAmB+B,QAAQ,QAAQ;AAAA,yCACjB,QAAQ,SAAS,SAAS;AAAA;AAAA;AAAA,YAGvD,SAAS;AAAA;AAAA;AAAA;AAAA,2DAIsC,QAAQ,QAAQ;AAAA,8DACb,QAAQ,WAAW;AAAA,uDAC1B,QAAQ,SAAS,EAAE;AAAA,0DAChB,QAAQ,YAAY,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB9E;AAAA;AAAA,EAIA,MAAM,2BACJ,QACA,aACA,aACA,gBACuE;AACvE,QAAI;AAEF,UAAI,KAAK,OAAO,4BAA4B,CAAC,OAAO,UAAU;AAC5D,eAAO,EAAE,OAAO,mBAAmB,mBAAmB,iCAAiC;AAAA,MACzF;AAGA,UAAI,CAAC,OAAO,YAAY,CAAC,KAAK,OAAO,0BAA0B;AAC7D,eAAO,WAAW,KAAK,OAAO;AAAA,MAChC;AAEA,UAAI,KAAK,OAAO,eAAe,CAAC,OAAO,gBAAgB;AACrD,eAAO,EAAE,OAAO,mBAAmB,mBAAmB,uCAAuC;AAAA,MAC/F;AAGA,YAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,OAAO,SAAS;AAC5D,UAAI,CAAC,QAAQ;AACX,eAAO,EAAE,OAAO,kBAAkB,mBAAmB,mBAAmB;AAAA,MAC1E;AAGA,UACE,OAAO,aAAa,SAAS,KAC7B,CAAC,OAAO,aAAa,KAAK,CAAC,SAAS,OAAO,aAAa,WAAW,IAAI,CAAC,GACxE;AACA,eAAO;AAAA,UACL,OAAO;AAAA,UACP,mBAAmB;AAAA,QACrB;AAAA,MACF;AAGA,UAAI,CAAC,OAAO,WAAW,SAAS,oBAAoB,GAAG;AACrD,eAAO,EAAE,OAAO,uBAAuB,mBAAmB,qDAAqD;AAAA,MACjH;AAGA,UAAI,OAAO,SAAS,CAAC,KAAK,cAAc,OAAO,OAAO,OAAO,MAAM,GAAG;AACpE,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,gBAAgB;AAAA,MACtE;AAGA,YAAM,cAA+B;AAAA,QACnC,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,gBAAgB,aAAa;AAAA,QACxC,WAAW,gBAAgB;AAAA,MAC7B;AAGA,YAAM,OAAO,MAAM,KAAK,4BAA4B,eAAe,MAAM,aAAa,WAAW;AAEjG,UAAI,CAAC,MAAM;AAET,cAAM,YAAY,MAAM,KAAK,gBAAgB,WAAW;AACxD,eAAO,EAAE,UAAU;AAAA,MACrB;AAGA,YAAM,aAAa,MAAM,KAAK,kBAAkB,MAAM,WAAW;AACjE,UAAI,CAAC,YAAY;AACf,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,4BAA4B;AAAA,MAClF;AAGA,YAAM,OAAO,KAAK,aAAa;AAC/B,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,4BAA4B,GAAI;AAEpF,YAAM,WAA8B;AAAA,QAClC;AAAA,QACA,UAAU,OAAO;AAAA,QACjB,QAAQ,KAAK;AAAA;AAAA,QACb,aAAa,OAAO;AAAA,QACpB,OAAO,OAAO,SAAS;AAAA,QACvB,UAAU,OAAO;AAAA,QACjB,eAAe,OAAO;AAAA,QACtB,qBAAqB,OAAO;AAAA,QAC5B;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB;AAEA,YAAM,KAAK,QAAQ,wBAAwB,QAAQ;AAGnD,YAAM,cAAc,IAAI,IAAI,OAAO,YAAY;AAC/C,kBAAY,aAAa,IAAI,QAAQ,IAAI;AACzC,UAAI,OAAO,OAAO;AAChB,oBAAY,aAAa,IAAI,SAAS,OAAO,KAAK;AAAA,MACpD;AAEA,aAAO,EAAE,aAAa,YAAY,SAAS,EAAE;AAAA,IAC/C,SAAS,OAAO;AACd,cAAQ,MAAM,gCAAgC,KAAK;AACnD,aAAO,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,mBAAmB,QAA2D;AAClF,QAAI;AAEF,UAAI,KAAK,OAAO,4BAA4B,CAAC,OAAO,UAAU;AAC5D,eAAO,EAAE,OAAO,mBAAmB,mBAAmB,iCAAiC;AAAA,MACzF;AAGA,UAAI,CAAC,OAAO,YAAY,CAAC,KAAK,OAAO,0BAA0B;AAC7D,eAAO,WAAW,KAAK,OAAO;AAAA,MAChC;AAEA,cAAQ,OAAO,YAAY;AAAA,QACzB,KAAK;AACH,iBAAO,KAAK,6BAA6B,MAAM;AAAA,QACjD,KAAK;AACH,iBAAO,KAAK,wBAAwB,MAAM;AAAA,QAC5C,KAAK;AACH,iBAAO,KAAK,6BAA6B,MAAM;AAAA,QACjD;AACE,iBAAO,EAAE,OAAO,0BAA0B,mBAAmB,2BAA2B;AAAA,MAC5F;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,wBAAwB,KAAK;AAC3C,aAAO,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB;AAAA,IAC7E;AAAA,EACF;AAAA,EAEA,MAAc,6BAA6B,QAA2D;AACpG,QAAI,CAAC,OAAO,MAAM;AAChB,aAAO,EAAE,OAAO,mBAAmB,mBAAmB,6BAA6B;AAAA,IACrF;AAEA,QAAI,KAAK,OAAO,eAAe,CAAC,OAAO,eAAe;AACpD,aAAO,EAAE,OAAO,mBAAmB,mBAAmB,sCAAsC;AAAA,IAC9F;AAGA,UAAM,WAAW,MAAM,KAAK,QAAQ,qBAAqB,OAAO,IAAI;AACpE,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,OAAO,iBAAiB,mBAAmB,6BAA6B;AAAA,IACnF;AAEA,QAAI,SAAS,YAAY,oBAAI,KAAK,GAAG;AACnC,YAAM,KAAK,QAAQ,wBAAwB,OAAO,IAAI;AACtD,aAAO,EAAE,OAAO,iBAAiB,mBAAmB,6BAA6B;AAAA,IACnF;AAGA,UAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,SAAS,QAAQ;AAC7D,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,OAAO,kBAAkB,mBAAmB,mBAAmB;AAAA,IAC1E;AAGA,QAAI,SAAS,eAAe;AAC1B,UAAI,CAAC,OAAO,eAAe;AACzB,eAAO,EAAE,OAAO,mBAAmB,mBAAmB,4BAA4B;AAAA,MACpF;AAEA,YAAM,oBAAoB,SAAS,wBAAwB,SACvD,KAAK,sBAAsB,OAAO,aAAa,IAC/C,OAAO;AAEX,UAAI,SAAS,kBAAkB,mBAAmB;AAChD,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB;AAAA,MAC9E;AAAA,IACF;AAGA,QAAI,OAAO,gBAAgB,OAAO,iBAAiB,SAAS,aAAa;AACvE,aAAO,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB;AAAA,IAC9E;AAGA,UAAM,KAAK,QAAQ,wBAAwB,OAAO,IAAI;AAGtD,UAAM,WAAW,OAAO,YAAY,SAAS,YAAY,KAAK,OAAO;AACrE,UAAM,cAAc,MAAM,KAAK,oBAAoB,OAAO,IAAI,SAAS,QAAQ,SAAS,OAAO,QAAQ;AAGvG,QAAI;AACJ,QAAI,KAAK,OAAO,oBAAoB;AAClC,qBAAe,MAAM,KAAK,qBAAqB,YAAY,OAAO,OAAO,IAAI,SAAS,QAAQ,SAAS,OAAO,QAAQ;AAAA,IACxH;AAEA,WAAO;AAAA,MACL,cAAc,YAAY;AAAA,MAC1B,YAAY;AAAA,MACZ,YAAY,KAAK,OAAO;AAAA,MACxB,eAAe;AAAA,MACf,OAAO,SAAS;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAc,wBAAwB,QAA2D;AAC/F,QAAI,CAAC,OAAO,eAAe;AACzB,aAAO,EAAE,OAAO,mBAAmB,mBAAmB,sCAAsC;AAAA,IAC9F;AAGA,UAAM,eAAe,MAAM,KAAK,QAAQ,gBAAgB,OAAO,aAAa;AAC5E,QAAI,CAAC,cAAc;AACjB,aAAO,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB;AAAA,IAC9E;AAEA,QAAI,aAAa,YAAY,oBAAI,KAAK,GAAG;AACvC,YAAM,KAAK,QAAQ,mBAAmB,OAAO,aAAa;AAC1D,aAAO,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB;AAAA,IAC9E;AAGA,UAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,aAAa,QAAQ;AACjE,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,OAAO,kBAAkB,mBAAmB,mBAAmB;AAAA,IAC1E;AAGA,QAAI,OAAO,YAAY,aAAa,YAAY,OAAO,aAAa,aAAa,UAAU;AACzF,aAAO,EAAE,OAAO,iBAAiB,mBAAmB,8BAA8B;AAAA,IACpF;AAGA,UAAM,KAAK,QAAQ,mBAAmB,OAAO,aAAa;AAC1D,UAAM,KAAK,QAAQ,iCAAiC,aAAa,aAAa;AAG9E,UAAM,cAAc,MAAM,KAAK,oBAAoB,OAAO,IAAI,aAAa,QAAQ,aAAa,OAAO,OAAO,QAAQ;AAEtH,QAAI;AACJ,QAAI,KAAK,OAAO,oBAAoB;AAClC,wBAAkB,MAAM,KAAK,qBAAqB,YAAY,OAAO,OAAO,IAAI,aAAa,QAAQ,aAAa,OAAO,OAAO,QAAQ;AAAA,IAC1I;AAEA,WAAO;AAAA,MACL,cAAc,YAAY;AAAA,MAC1B,YAAY;AAAA,MACZ,YAAY,KAAK,OAAO;AAAA,MACxB,eAAe;AAAA,MACf,OAAO,aAAa;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,6BAA6B,QAA2D;AAEpG,UAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,OAAO,SAAS;AAC5D,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,OAAO,kBAAkB,mBAAmB,mBAAmB;AAAA,IAC1E;AAEA,QAAI,OAAO,SAAS,kBAAkB,OAAO,WAAW,OAAO,eAAe;AAC5E,aAAO,EAAE,OAAO,kBAAkB,mBAAmB,wBAAwB;AAAA,IAC/E;AAEA,QAAI,CAAC,OAAO,WAAW,SAAS,oBAAoB,GAAG;AACrD,aAAO,EAAE,OAAO,uBAAuB,mBAAmB,qDAAqD;AAAA,IACjH;AAGA,UAAM,cAAc,MAAM,KAAK,oBAAoB,OAAO,IAAI,QAAW,OAAO,SAAS,QAAQ,OAAO,QAAQ;AAEhH,WAAO;AAAA,MACL,cAAc,YAAY;AAAA,MAC1B,YAAY;AAAA,MACZ,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,YAAY;AAAA,IACrB;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,gBAAgB,OAAoD;AACxE,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,QAAQ,eAAe,KAAK;AAC3D,UAAI,CAAC,eAAe,YAAY,YAAY,oBAAI,KAAK,GAAG;AACtD,eAAO,EAAE,QAAQ,MAAM;AAAA,MACzB;AAEA,YAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,YAAY,QAAQ;AAChE,YAAM,OAAO,YAAY,SAAS,MAAM,KAAK,QAAQ,QAAQ,YAAY,MAAM,IAAI;AAEnF,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO,YAAY;AAAA,QACnB,WAAW,YAAY;AAAA,QACvB,UAAU,MAAM;AAAA,QAChB,KAAK,KAAK,MAAM,YAAY,UAAU,QAAQ,IAAI,GAAI;AAAA,QACtD,KAAK,YAAY;AAAA;AAAA,MACnB;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,8BAA8B,KAAK;AACjD,aAAO,EAAE,QAAQ,MAAM;AAAA,IACzB;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,YAAY,OAAe,UAAiD;AAChF,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,QAAQ,eAAe,KAAK;AAC3D,UAAI,CAAC,eAAe,YAAY,aAAa,UAAU;AACrD,eAAO,EAAE,SAAS,MAAM;AAAA,MAC1B;AAEA,YAAM,KAAK,QAAQ,kBAAkB,KAAK;AAC1C,YAAM,KAAK,QAAQ,iCAAiC,KAAK;AAEzD,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB,SAAS,OAAO;AACd,cAAQ,MAAM,2BAA2B,KAAK;AAC9C,aAAO,EAAE,SAAS,MAAM;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,YAAY,OAAuD;AACvE,QAAI;AACF,YAAM,cAAc,MAAM,KAAK,QAAQ,eAAe,KAAK;AAC3D,UAAI,CAAC,eAAe,YAAY,YAAY,oBAAI,KAAK,GAAG;AACtD,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,2BAA2B;AAAA,MACjF;AAEA,UAAI,CAAC,YAAY,QAAQ;AACvB,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,0CAA0C;AAAA,MAChG;AAEA,YAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,YAAY,MAAM;AAC1D,UAAI,CAAC,MAAM;AACT,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,iBAAiB;AAAA,MACvE;AAEA,aAAO;AAAA,QACL,KAAK,KAAK;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK;AAAA,QACZ,OAAO,YAAY;AAAA,MACrB;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,oBAAoB,KAAK;AACvC,aAAO,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,eAAe,SAAsF;AACzG,QAAI;AACF,UAAI,CAAC,KAAK,OAAO,gCAAgC;AAC/C,eAAO,EAAE,OAAO,iBAAiB,mBAAmB,+CAA+C;AAAA,MACrG;AAGA,UAAI,CAAC,QAAQ,iBAAiB,QAAQ,cAAc,WAAW,GAAG;AAChE,eAAO,EAAE,OAAO,wBAAwB,mBAAmB,4BAA4B;AAAA,MACzF;AAGA,YAAM,WAAW,KAAK,iBAAiB;AACvC,YAAM,eAAe,KAAK,qBAAqB;AAG/C,YAAM,SAAsB;AAAA,QAC1B,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,MAAM,QAAQ,eAAe,kBAAkB,QAAQ;AAAA,QACvD,MAAM;AAAA;AAAA,QACN,cAAc,QAAQ;AAAA,QACtB,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;AAAA,QAC1D,YAAY,QAAQ,eAAe,CAAC,oBAAoB;AAAA,QACxD,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB;AAGA,YAAM,KAAK,QAAQ,aAAa,MAAM;AAGtC,YAAM,WAAuC;AAAA,QAC3C,WAAW;AAAA,QACX,eAAe;AAAA,QACf,qBAAqB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,QACjD,0BAA0B;AAAA;AAAA,QAC1B,eAAe,QAAQ;AAAA,QACvB,aAAa,QAAQ;AAAA,QACrB,YAAY,QAAQ;AAAA,QACpB,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,aAAa,QAAQ;AAAA,QACrB,gBAAgB,QAAQ;AAAA,QACxB,4BAA4B,QAAQ;AAAA,QACpC,iCAAiC,QAAQ;AAAA,QACzC,UAAU,QAAQ;AAAA,QAClB,YAAY,QAAQ;AAAA,QACpB,sBAAsB,QAAQ;AAAA,QAC9B,UAAU,QAAQ;AAAA,QAClB,MAAM,QAAQ;AAAA,QACd,aAAa,QAAQ;AAAA,QACrB,kBAAkB,QAAQ;AAAA,MAC5B;AAEA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,8BAA8B,KAAK;AACjD,aAAO,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA,EAIA,+BAA6D;AAC3D,WAAO;AAAA,MACL,UAAU,KAAK,OAAO;AAAA,MACtB,uBAAuB,CAAC,KAAK,OAAO,MAAM;AAAA,MAC1C,kBAAkB,CAAC,GAAG,KAAK,OAAO,eAAe;AAAA,MACjD,0BAA0B,CAAC,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,iCAAiE;AAC/D,WAAO;AAAA,MACL,QAAQ,KAAK,OAAO;AAAA,MACpB,wBAAwB,KAAK,OAAO;AAAA,MACpC,gBAAgB,KAAK,OAAO;AAAA,MAC5B,mBAAmB,KAAK,OAAO;AAAA,MAC/B,UAAU,KAAK,OAAO;AAAA,MACtB,qBAAqB,KAAK,OAAO;AAAA,MACjC,wBAAwB,KAAK,OAAO;AAAA,MACpC,uBAAuB,KAAK,OAAO,iCAAiC,GAAG,KAAK,OAAO,MAAM,cAAc;AAAA,MACvG,uBAAuB,CAAC,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC1D,0BAA0B,CAAC,GAAG,KAAK,OAAO,sBAAsB;AAAA,MAChE,kBAAkB,CAAC,GAAG,KAAK,OAAO,eAAe;AAAA,MACjD,uCAAuC,CAAC,uBAAuB,sBAAsB,MAAM;AAAA,MAC3F,kCAAkC,CAAC,GAAG,KAAK,OAAO,6BAA6B;AAAA,MAC/E,+BAA+B,KAAK,OAAO;AAAA,IAC7C;AAAA,EACF;AAAA;AAAA,EAIQ,eAAuB;AAC7B,eAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA,EAEQ,sBAAsB,UAA0B;AACtD,eAAO,0BAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,WAAW;AAAA,EACjE;AAAA,EAEQ,mBAA2B;AACjC,WAAO,cAAU,2BAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAAA,EAClD;AAAA,EAEQ,uBAA+B;AACrC,eAAO,2BAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAC7C;AAAA,EAEA,MAAc,oBAAoB,UAAkB,QAAiB,OAAgB,UAAyC;AAC5H,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAExC,UAAM,UAA+B;AAAA,MACnC,KAAK,KAAK,OAAO;AAAA,MACjB,KAAK,UAAU;AAAA,MACf,KAAK,YAAY,KAAK,OAAO;AAAA,MAC7B,KAAK;AAAA,MACL,KAAK,MAAM,KAAK,OAAO;AAAA,MACvB,OAAO,SAAS;AAAA,MAChB,WAAW;AAAA,IACb;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,KAAK,OAAO,SAAS;AAE7D,UAAM,MAAM,MAAM,IAAI,oBAAQ,OAAO,EAClC,mBAAmB,EAAE,KAAK,KAAK,OAAO,gBAAgB,QAAQ,CAAC,EAC/D,KAAK,MAAM;AAEd,UAAM,cAA2B;AAAA,MAC/B,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,OAAO,QAAQ;AAAA,MACf,WAAW,IAAI,MAAM,MAAM,KAAK,OAAO,uBAAuB,GAAI;AAAA,MAClE,WAAW,oBAAI,KAAK;AAAA,MACpB,UAAU,QAAQ;AAAA,IACpB;AAEA,UAAM,KAAK,QAAQ,kBAAkB,WAAW;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,qBAAqB,eAAuB,UAAkB,QAAiB,OAAgB,UAAoC;AAC/I,UAAM,YAAQ,2BAAY,EAAE,EAAE,SAAS,WAAW;AAClD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,uBAAuB,GAAI;AAE/E,UAAM,eAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,SAAS;AAAA,MAChB;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,MACpB;AAAA;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,mBAAmB,YAAY;AAClD,WAAO;AAAA,EACT;AAAA,EAEQ,cAAc,gBAAwB,eAAkC;AAC9E,UAAM,kBAAkB,eAAe,MAAM,GAAG;AAChD,WAAO,gBAAgB,MAAM,WAAS,cAAc,SAAS,KAAK,CAAC;AAAA,EACrE;AAAA;AAAA,EAIA,MAAM,UAAyB;AAC7B,UAAM,QAAQ,IAAI;AAAA,MAChB,KAAK,QAAQ,oBAAoB;AAAA,MACjC,KAAK,QAAQ,qBAAqB;AAAA,MAClC,KAAK,QAAQ,4BAA4B;AAAA,IAC3C,CAAC;AAAA,EACH;AAAA;AAAA,EAIA,MAAM,WAAW;AACf,WAAO,KAAK,QAAQ,SAAS;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,cAAc;AAClB,WAAO,KAAK,QAAQ,YAAY;AAAA,EAClC;AAAA,EAEA,MAAM,YAAY;AAChB,WAAO,KAAK,QAAQ,UAAU;AAAA,EAChC;AACF;;;AC1uBA,qBAAoB;AACpB,kBAAkC;AAClC,yBAAwB;AACxB,oBAAmB;AACnB,gCAAsB;AAIf,SAAS,uBAAuB,KAA0B,aAA6B,WAAW,IAAI;AAC3G,QAAM,oBAAoB,CAAC,gBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kDAMH,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAcvC,WAAW;AAAA;AAAA,wDAEuB,KAAK,UAAU,WAAW,CAAC;AAAA;AAAA;AAIjF,MAAI,IAAI,GAAG,QAAQ,cAAc,OAAO,KAAK,QAAQ;AACnD,QAAI;AACF,YAAM,IAAI,IAAI;AACd,YAAM,QAAQ,CAAC,MAAW,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACpD,YAAM,SAAS;AAAA,QACb,eAAe,MAAM,EAAE,aAAa;AAAA,QACpC,WAAW,MAAM,EAAE,SAAS;AAAA,QAC5B,cAAc,MAAM,EAAE,YAAY;AAAA,QAClC,OAAO,MAAM,EAAE,KAAK;AAAA,QACpB,OAAO,MAAM,EAAE,KAAK;AAAA,QACpB,UAAU,MAAM,EAAE,QAAQ;AAAA,QAC1B,gBAAgB,MAAM,EAAE,cAAc;AAAA,QACtC,uBAAuB,MAAM,EAAE,qBAAqB;AAAA,MACtD;AAEA,YAAM,iBAAiB;AAAA,QACrB,WAAY,IAAI,QAAQ,iBAAiB,GAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK,IAAI,MAAO,IAAI,WAAmB,iBAAiB;AAAA,QACnI,WAAW,IAAI,QAAQ,YAAY;AAAA,MACrC;AAEA,YAAM,SAAS,MAAM,YAAY,2BAA2B,QAAQ,QAAY,IAAY,SAAS,cAAc;AAEnH,UAAI,WAAW,QAAQ;AACrB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,MACpC;AAEA,UAAI,eAAe,QAAQ;AACzB,eAAO,IAAI,KAAK,MAAM,EAAE,KAAK,OAAO,SAAS;AAAA,MAC/C;AAEA,UAAI,iBAAiB,QAAQ;AAC3B,YAAI,KAAK,MAAM,EAAE,KAAK,kBAAkB,OAAO,WAAW,CAAC;AAAA,MAC7D;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,QAAQ,cAAc,OAAO,KAAK,QAAQ;AACpD,QAAI;AACF,YAAM,IAAI,IAAI;AACd,YAAM,QAAQ,CAAC,MAAW,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACpD,YAAM,SAAS;AAAA,QACb,eAAe,MAAM,EAAE,aAAa;AAAA,QACpC,WAAW,MAAM,EAAE,SAAS;AAAA,QAC5B,cAAc,MAAM,EAAE,YAAY;AAAA,QAClC,OAAO,MAAM,EAAE,KAAK;AAAA,QACpB,OAAO,MAAM,EAAE,KAAK;AAAA,QACpB,UAAU,MAAM,EAAE,QAAQ;AAAA,QAC1B,gBAAgB,MAAM,EAAE,cAAc;AAAA,QACtC,uBAAuB,MAAM,EAAE,qBAAqB;AAAA,MACtD;AAEA,YAAM,cAAc,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,IAAI;AAAA,QAC3D,UAAU,MAAM,EAAE,QAAQ;AAAA,QAC1B,UAAU,MAAM,EAAE,QAAQ;AAAA,MAC5B,IAAI;AAEJ,YAAM,iBAAiB;AAAA,QACrB,WAAY,IAAI,QAAQ,iBAAiB,GAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK,IAAI,MAAO,IAAI,WAAmB,iBAAiB;AAAA,QACnI,WAAW,IAAI,QAAQ,YAAY;AAAA,MACrC;AAEA,YAAM,SAAS,MAAM,YAAY,2BAA2B,QAAQ,aAAc,IAAY,SAAS,cAAc;AAErH,UAAI,WAAW,QAAQ;AACrB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,MACpC;AAEA,UAAI,eAAe,QAAQ;AACzB,eAAO,IAAI,KAAK,MAAM,EAAE,KAAK,OAAO,SAAS;AAAA,MAC/C;AAEA,UAAI,iBAAiB,QAAQ;AAC3B,YAAI,KAAK,MAAM,EAAE,KAAK,kBAAkB,OAAO,WAAW,CAAC;AAAA,MAC7D;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,QAAQ,UAAU,OAAO,KAAK,QAAQ;AAChD,QAAI;AACF,YAAM,SAAS;AAAA,QACb,YAAY,IAAI,KAAK;AAAA,QACrB,WAAW,IAAI,KAAK;AAAA,QACpB,eAAe,IAAI,KAAK;AAAA,QACxB,MAAM,IAAI,KAAK;AAAA,QACf,cAAc,IAAI,KAAK;AAAA,QACvB,eAAe,IAAI,KAAK;AAAA,QACxB,OAAO,IAAI,KAAK;AAAA,QAChB,UAAU,IAAI,KAAK;AAAA,QACnB,eAAe,IAAI,KAAK;AAAA,MAC1B;AACA,YAAM,SAAS,MAAM,YAAY,mBAAmB,MAAM;AAC1D,UAAI,WAAW,QAAQ;AACrB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,MACpC;AACA,UAAI,KAAK,MAAM;AAAA,IACjB,SAAS,OAAO;AACd,cAAQ,MAAM,gBAAgB,KAAK;AACnC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,QAAQ,eAAe,OAAO,KAAK,QAAQ;AACrD,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,IAAI;AACtB,UAAI,CAAC,OAAO;AACV,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,mBAAmB,8BAA8B,CAAC;AAAA,MAC5G;AAEA,YAAM,SAAS,MAAM,YAAY,gBAAgB,KAAK;AACtD,UAAI,KAAK,MAAM;AAAA,IACjB,SAAS,OAAO;AACd,cAAQ,MAAM,wBAAwB,KAAK;AAC3C,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,QAAQ,WAAW,OAAO,KAAK,QAAQ;AACjD,QAAI;AACF,YAAM,EAAE,OAAO,UAAU,IAAI,IAAI;AACjC,UAAI,CAAC,SAAS,CAAC,WAAW;AACxB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,mBAAmB,8CAA8C,CAAC;AAAA,MAC5H;AAEA,YAAM,SAAS,MAAM,YAAY,YAAY,OAAO,SAAS;AAC7D,UAAI,KAAK,MAAM;AAAA,IACjB,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,QAAQ,aAAa,OAAO,KAAK,QAAQ;AAClD,QAAI;AACF,YAAM,aAAa,IAAI,QAAQ;AAC/B,UAAI,CAAC,cAAc,CAAC,WAAW,WAAW,SAAS,GAAG;AACpD,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAAA,MACpG;AAEA,YAAM,QAAQ,WAAW,UAAU,CAAC;AACpC,YAAM,SAAS,MAAM,YAAY,YAAY,KAAK;AAElD,UAAI,WAAW,QAAQ;AACrB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,MACpC;AAEA,UAAI,KAAK,MAAM;AAAA,IACjB,SAAS,OAAO;AACd,cAAQ,MAAM,oBAAoB,KAAK;AACvC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,KAAK,GAAG,QAAQ,aAAa,OAAO,KAAK,QAAQ;AACnD,QAAI;AACF,YAAM,SAAS,MAAM,YAAY,eAAe,IAAI,IAAI;AAExD,UAAI,WAAW,QAAQ;AACrB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,MACpC;AAEA,UAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,IAC7B,SAAS,OAAO;AACd,cAAQ,MAAM,8BAA8B,KAAK;AACjD,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAKD,MAAI,IAAI,GAAG,QAAQ,2CAA2C,CAAC,KAAK,QAAQ;AAC1E,UAAM,WAAW,YAAY,+BAA+B;AAC5D,QAAI,KAAK,QAAQ;AAAA,EACnB,CAAC;AAGD,MAAI,IAAI,GAAG,QAAQ,0BAA0B,CAAC,KAAK,QAAQ;AAGzD,QAAI,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAAA,EACvB,CAAC;AAGD,MAAI,IAAI,GAAG,QAAQ,yCAAyC,CAAC,KAAK,QAAQ;AACxE,UAAM,WAAW,YAAY,6BAA6B;AAC1D,QAAI,KAAK,QAAQ;AAAA,EACnB,CAAC;AAKD,MAAI,IAAI,GAAG,QAAQ,WAAW,CAAC,KAAK,QAAQ;AAC1C,QAAI,KAAK;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,CAAC;AAAA,EACH,CAAC;AAGD,MAAI,IAAI,GAAG,QAAQ,kBAAkB,OAAO,KAAK,QAAQ;AACvD,QAAI;AACF,YAAM,UAAU,MAAM,YAAY,YAAY;AAC9C,UAAI,KAAK,OAAO;AAAA,IAClB,SAAS,OAAO;AACd,cAAQ,MAAM,uBAAuB,KAAK;AAC1C,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,QAAQ,gBAAgB,OAAO,KAAK,QAAQ;AACrD,QAAI;AACF,YAAM,QAAQ,MAAM,YAAY,UAAU;AAC1C,UAAI,KAAK,KAAK;AAAA,IAChB,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB,KAAK;AACxC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAGD,MAAI,IAAI,GAAG,QAAQ,gBAAgB,OAAO,KAAK,QAAQ;AACrD,QAAI;AACF,YAAM,QAAQ,MAAM,YAAY,SAAS;AACzC,UAAI,KAAK,KAAK;AAAA,IAChB,SAAS,OAAO;AACd,cAAQ,MAAM,gBAAgB,KAAK;AACnC,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAUH;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,aAA6B,QAAwB;AAC/D,SAAK,cAAc;AACnB,SAAK,SAAS;AACd,SAAK,UAAM,eAAAA,SAAQ;AACnB,SAAK,gBAAgB;AACrB,SAAK,YAAY;AACjB,SAAK,mBAAmB;AAAA,EAC1B;AAAA,EAEQ,kBAAwB;AAC9B,UAAM,aAAa,KAAK,OAAO,QAAQ,CAAC;AAGxC,QAAI,WAAW,eAAe,QAAW;AACvC,WAAK,IAAI,IAAI,eAAe,WAAW,UAAU;AAAA,IACnD;AAGA,QAAI,WAAW,iBAAiB,OAAO;AACrC,WAAK,IAAI,QAAI,cAAAC,SAAO;AAAA,QAClB,uBAAuB;AAAA,UACrB,YAAY;AAAA,YACV,YAAY,CAAC,QAAQ;AAAA,YACrB,UAAU,CAAC,UAAU,iBAAiB;AAAA,YACtC,WAAW,CAAC,QAAQ;AAAA,YACpB,QAAQ,CAAC,UAAU,SAAS,QAAQ;AAAA,UACtC;AAAA,QACF;AAAA,MACF,CAAC,CAAC;AAAA,IACJ;AAGA,QAAI,WAAW,sBAAsB,OAAO;AAC1C,WAAK,IAAI,QAAI,mBAAAC,SAAY,CAAC;AAAA,IAC5B;AAGA,QAAI,WAAW,oBAAoB,OAAO;AACxC,YAAM,kBAAkB,WAAW,mBAAmB,CAAC;AACvD,YAAM,cAAU,0BAAAC,SAAU;AAAA,QACxB,UAAU,gBAAgB,YAAY,KAAK,KAAK;AAAA;AAAA,QAChD,KAAK,gBAAgB,OAAO;AAAA;AAAA,QAC5B,SAAS,gBAAgB,WAAW;AAAA,QACpC,iBAAiB,gBAAgB,oBAAoB;AAAA;AAAA,QACrD,eAAe,gBAAgB,kBAAkB;AAAA;AAAA,MACnD,CAAC;AACD,WAAK,IAAI,IAAI,OAAO;AAAA,IACtB;AAGA,UAAM,aAA0B,WAAW,QAAQ;AAAA,MACjD,QAAQ;AAAA;AAAA,MACR,aAAa;AAAA,MACb,gBAAgB,CAAC,gBAAgB;AAAA,MACjC,gBAAgB,CAAC,gBAAgB,kBAAkB,UAAU,iBAAiB,eAAe;AAAA,MAC7F,SAAS,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS;AAAA,IACrD;AACA,SAAK,IAAI,QAAI,YAAAC,SAAK,UAAU,CAAC;AAG7B,SAAK,IAAI,IAAI,eAAAJ,QAAQ,KAAK;AAAA,MACxB,OAAO,WAAW,aAAa;AAAA,IACjC,CAAC,CAAC;AACF,SAAK,IAAI,IAAI,eAAAA,QAAQ,WAAW;AAAA,MAC9B,UAAU;AAAA,MACV,OAAO,WAAW,mBAAmB;AAAA,IACvC,CAAC,CAAC;AAAA,EACJ;AAAA,EAEQ,cAAoB;AAI1B,SAAK,IAAI,IAAI,cAAc,OAAO,KAAK,QAAQ;AAC7C,UAAI;AACF,cAAM,SAAS;AAAA,UACb,eAAe,IAAI,MAAM;AAAA,UACzB,WAAW,IAAI,MAAM;AAAA,UACrB,cAAc,IAAI,MAAM;AAAA,UACxB,OAAO,IAAI,MAAM;AAAA,UACjB,OAAO,IAAI,MAAM;AAAA,UACjB,UAAU,IAAI,MAAM;AAAA,UACpB,gBAAgB,IAAI,MAAM;AAAA,UAC1B,uBAAuB,IAAI,MAAM;AAAA,QACnC;AAEA,cAAM,iBAAiB;AAAA,UACrB,WAAW,IAAI,MAAM,IAAI,WAAW,iBAAiB;AAAA,UACrD,WAAW,IAAI,QAAQ,YAAY;AAAA,QACrC;AAEA,cAAM,SAAS,MAAM,KAAK,YAAY,2BAA2B,QAAQ,QAAY,IAAY,SAAS,cAAc;AAExH,YAAI,WAAW,QAAQ;AACrB,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,QACpC;AAEA,YAAI,eAAe,QAAQ;AACzB,iBAAO,IAAI,KAAK,MAAM,EAAE,KAAK,OAAO,SAAS;AAAA,QAC/C;AAEA,YAAI,iBAAiB,QAAQ;AAC3B,cAAI,SAAS,OAAO,WAAW;AAAA,QACjC;AAAA,MACF,SAAS,OAAO;AACd,gBAAQ,MAAM,wBAAwB,KAAK;AAC3C,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,KAAK,cAAc,OAAO,KAAK,QAAQ;AAC9C,UAAI;AACF,cAAM,SAAS;AAAA,UACb,eAAe,IAAI,KAAK;AAAA,UACxB,WAAW,IAAI,KAAK;AAAA,UACpB,cAAc,IAAI,KAAK;AAAA,UACvB,OAAO,IAAI,KAAK;AAAA,UAChB,OAAO,IAAI,KAAK;AAAA,UAChB,UAAU,IAAI,KAAK;AAAA,UACnB,gBAAgB,IAAI,KAAK;AAAA,UACzB,uBAAuB,IAAI,KAAK;AAAA,QAClC;AAEA,cAAM,cAAc,IAAI,KAAK,YAAY,IAAI,KAAK,WAAW;AAAA,UAC3D,UAAU,IAAI,KAAK;AAAA,UACnB,UAAU,IAAI,KAAK;AAAA,QACrB,IAAI;AAEJ,cAAM,iBAAiB;AAAA,UACrB,WAAW,IAAI,MAAM,IAAI,WAAW,iBAAiB;AAAA,UACrD,WAAW,IAAI,QAAQ,YAAY;AAAA,QACrC;AAEA,cAAM,SAAS,MAAM,KAAK,YAAY,2BAA2B,QAAQ,aAAc,IAAY,SAAS,cAAc;AAE1H,YAAI,WAAW,QAAQ;AACrB,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,QACpC;AAEA,YAAI,eAAe,QAAQ;AACzB,iBAAO,IAAI,KAAK,MAAM,EAAE,KAAK,OAAO,SAAS;AAAA,QAC/C;AAEA,YAAI,iBAAiB,QAAQ;AAC3B,cAAI,SAAS,OAAO,WAAW;AAAA,QACjC;AAAA,MACF,SAAS,OAAO;AACd,gBAAQ,MAAM,wBAAwB,KAAK;AAC3C,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,KAAK,UAAU,OAAO,KAAK,QAAQ;AAC1C,UAAI;AACF,cAAM,SAAS;AAAA,UACb,YAAY,IAAI,KAAK;AAAA,UACrB,WAAW,IAAI,KAAK;AAAA,UACpB,eAAe,IAAI,KAAK;AAAA,UACxB,MAAM,IAAI,KAAK;AAAA,UACf,cAAc,IAAI,KAAK;AAAA,UACvB,eAAe,IAAI,KAAK;AAAA,UACxB,OAAO,IAAI,KAAK;AAAA,UAChB,UAAU,IAAI,KAAK;AAAA,UACnB,eAAe,IAAI,KAAK;AAAA,QAC1B;AAEA,cAAM,SAAS,MAAM,KAAK,YAAY,mBAAmB,MAAM;AAE/D,YAAI,WAAW,QAAQ;AACrB,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,QACpC;AAEA,YAAI,KAAK,MAAM;AAAA,MACjB,SAAS,OAAO;AACd,gBAAQ,MAAM,gBAAgB,KAAK;AACnC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,KAAK,eAAe,OAAO,KAAK,QAAQ;AAC/C,UAAI;AACF,cAAM,EAAE,MAAM,IAAI,IAAI;AACtB,YAAI,CAAC,OAAO;AACV,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,mBAAmB,8BAA8B,CAAC;AAAA,QAC5G;AAEA,cAAM,SAAS,MAAM,KAAK,YAAY,gBAAgB,KAAK;AAC3D,YAAI,KAAK,MAAM;AAAA,MACjB,SAAS,OAAO;AACd,gBAAQ,MAAM,wBAAwB,KAAK;AAC3C,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,KAAK,WAAW,OAAO,KAAK,QAAQ;AAC3C,UAAI;AACF,cAAM,EAAE,OAAO,UAAU,IAAI,IAAI;AACjC,YAAI,CAAC,SAAS,CAAC,WAAW;AACxB,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,mBAAmB,8CAA8C,CAAC;AAAA,QAC5H;AAEA,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,OAAO,SAAS;AAClE,YAAI,KAAK,MAAM;AAAA,MACjB,SAAS,OAAO;AACd,gBAAQ,MAAM,qBAAqB,KAAK;AACxC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,IAAI,aAAa,OAAO,KAAK,QAAQ;AAC5C,UAAI;AACF,cAAM,aAAa,IAAI,QAAQ;AAC/B,YAAI,CAAC,cAAc,CAAC,WAAW,WAAW,SAAS,GAAG;AACpD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,mBAAmB,wBAAwB,CAAC;AAAA,QACpG;AAEA,cAAM,QAAQ,WAAW,UAAU,CAAC;AACpC,cAAM,SAAS,MAAM,KAAK,YAAY,YAAY,KAAK;AAEvD,YAAI,WAAW,QAAQ;AACrB,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,QACpC;AAEA,YAAI,KAAK,MAAM;AAAA,MACjB,SAAS,OAAO;AACd,gBAAQ,MAAM,oBAAoB,KAAK;AACvC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,KAAK,aAAa,OAAO,KAAK,QAAQ;AAC7C,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,YAAY,eAAe,IAAI,IAAI;AAE7D,YAAI,WAAW,QAAQ;AACrB,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,QACpC;AAEA,YAAI,OAAO,GAAG,EAAE,KAAK,MAAM;AAAA,MAC7B,SAAS,OAAO;AACd,gBAAQ,MAAM,8BAA8B,KAAK;AACjD,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAKD,SAAK,IAAI,IAAI,2CAA2C,CAAC,KAAK,QAAQ;AACpE,YAAM,WAAW,KAAK,YAAY,+BAA+B;AACjE,UAAI,KAAK,QAAQ;AAAA,IACnB,CAAC;AAGD,SAAK,IAAI,IAAI,0BAA0B,CAAC,KAAK,QAAQ;AAGnD,UAAI,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAAA,IACvB,CAAC;AAGD,SAAK,IAAI,IAAI,yCAAyC,CAAC,KAAK,QAAQ;AAClE,YAAM,WAAW,KAAK,YAAY,6BAA6B;AAC/D,UAAI,KAAK,QAAQ;AAAA,IACnB,CAAC;AAKD,SAAK,IAAI,IAAI,WAAW,CAAC,KAAK,QAAQ;AACpC,UAAI,KAAK;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,CAAC;AAAA,IACH,CAAC;AAGD,SAAK,IAAI,IAAI,kBAAkB,OAAO,KAAK,QAAQ;AACjD,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,YAAY,YAAY;AACnD,YAAI,KAAK,OAAO;AAAA,MAClB,SAAS,OAAO;AACd,gBAAQ,MAAM,uBAAuB,KAAK;AAC1C,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,IAAI,gBAAgB,OAAO,KAAK,QAAQ;AAC/C,UAAI;AACF,cAAM,QAAQ,MAAM,KAAK,YAAY,UAAU;AAC/C,YAAI,KAAK,KAAK;AAAA,MAChB,SAAS,OAAO;AACd,gBAAQ,MAAM,qBAAqB,KAAK;AACxC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAGD,SAAK,IAAI,IAAI,gBAAgB,OAAO,KAAK,QAAQ;AAC/C,UAAI;AACF,cAAM,QAAQ,MAAM,KAAK,YAAY,SAAS;AAC9C,YAAI,KAAK,KAAK;AAAA,MAChB,SAAS,OAAO;AACd,gBAAQ,MAAM,gBAAgB,KAAK;AACnC,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,mBAAmB,wBAAwB,CAAC;AAAA,MAC5F;AAAA,IACF,CAAC;AAAA,EAUH;AAAA,EAEQ,qBAA2B;AAEjC,SAAK,IAAI,IAAI,CAAC,OAAY,KAAsB,KAAuB,SAA+B;AACpG,cAAQ,MAAM,oBAAoB,KAAK;AAGvC,YAAM,gBAAgB,QAAQ,IAAI,aAAa;AAE/C,UAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACnB,OAAO;AAAA,QACP,mBAAmB,gBAAgB,MAAM,UAAU;AAAA,QACnD,GAAI,iBAAiB,EAAE,OAAO,MAAM,MAAM;AAAA,MAC5C,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEA,SAA8B;AAC5B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,MAAM,MAA6B;AACvC,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,SAAS,KAAK,IAAI,OAAO,MAAM,MAAM;AACzC,gBAAQ,IAAI,oCAAoC,IAAI,EAAE;AACtD,gBAAQ,IAAI,kCAAkC,IAAI,SAAS;AAC3D,gBAAQ,IAAI,4CAA4C,IAAI,YAAY;AACxE,gBAAQ,IAAI,oCAAoC,IAAI,QAAQ;AAC5D,gBAAQ,IAAI,+BAA+B,IAAI,yCAAyC;AACxF,gBAAQ;AAAA,MACV,CAAC;AAED,aAAO,GAAG,SAAS,CAAC,UAAU;AAC5B,gBAAQ,MAAM,2BAA2B,KAAK;AAC9C,eAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF;;;AC1oBO,IAAM,gBAAN,MAA+C;AAAA,EAC5C,UAAU,oBAAI,IAAyB;AAAA,EACvC,QAAQ,oBAAI,IAAuB;AAAA,EACnC,qBAAqB,oBAAI,IAA+B;AAAA,EACxD,eAAe,oBAAI,IAAyB;AAAA,EAC5C,gBAAgB,oBAAI,IAA0B;AAAA;AAAA,EAItD,MAAM,aAAa,QAAoC;AACrD,SAAK,QAAQ,IAAI,OAAO,IAAI,MAAM;AAAA,EACpC;AAAA,EAEA,MAAM,UAAU,UAA+C;AAC7D,WAAO,KAAK,QAAQ,IAAI,QAAQ,KAAK;AAAA,EACvC;AAAA,EAEA,MAAM,cAAsC;AAC1C,WAAO,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,aAAa,UAAkB,SAA8C;AACjF,UAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ;AACxC,QAAI,QAAQ;AACV,WAAK,QAAQ,IAAI,UAAU,EAAE,GAAG,QAAQ,GAAG,SAAS,WAAW,oBAAI,KAAK,EAAE,CAAC;AAAA,IAC7E;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,UAAiC;AAClD,SAAK,QAAQ,OAAO,QAAQ;AAAA,EAC9B;AAAA;AAAA,EAIA,MAAM,WAAW,MAAgC;AAC/C,SAAK,MAAM,IAAI,KAAK,IAAI,IAAI;AAAA,EAC9B;AAAA,EAEA,MAAM,QAAQ,QAA2C;AACvD,WAAO,KAAK,MAAM,IAAI,MAAM,KAAK;AAAA,EACnC;AAAA,EAEA,MAAM,kBAAkB,UAA6C;AACnE,eAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;AACtC,UAAI,KAAK,aAAa,UAAU;AAC9B,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAkC;AACtC,WAAO,MAAM,KAAK,KAAK,MAAM,OAAO,CAAC;AAAA,EACvC;AAAA,EAEA,MAAM,WAAW,QAAgB,SAA4C;AAC3E,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM;AAClC,QAAI,MAAM;AACR,WAAK,MAAM,IAAI,QAAQ,EAAE,GAAG,MAAM,GAAG,SAAS,WAAW,oBAAI,KAAK,EAAE,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,QAA+B;AAC9C,SAAK,MAAM,OAAO,MAAM;AAAA,EAC1B;AAAA;AAAA,EAIA,MAAM,wBAAwB,MAAwC;AACpE,SAAK,mBAAmB,IAAI,KAAK,MAAM,IAAI;AAAA,EAC7C;AAAA,EAEA,MAAM,qBAAqB,MAAiD;AAC1E,WAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,wBAAwB,MAA6B;AACzD,SAAK,mBAAmB,OAAO,IAAI;AAAA,EACrC;AAAA,EAEA,MAAM,sBAAqC;AACzC,UAAM,MAAM,oBAAI,KAAK;AACrB,eAAW,CAAC,MAAM,QAAQ,KAAK,KAAK,mBAAmB,QAAQ,GAAG;AAChE,UAAI,SAAS,YAAY,KAAK;AAC5B,aAAK,mBAAmB,OAAO,IAAI;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,kBAAkB,OAAmC;AACzD,SAAK,aAAa,IAAI,MAAM,OAAO,KAAK;AAAA,EAC1C;AAAA,EAEA,MAAM,eAAe,OAA4C;AAC/D,WAAO,KAAK,aAAa,IAAI,KAAK,KAAK;AAAA,EACzC;AAAA,EAEA,MAAM,kBAAkB,OAA8B;AACpD,SAAK,aAAa,OAAO,KAAK;AAAA,EAChC;AAAA,EAEA,MAAM,uBAAsC;AAC1C,UAAM,MAAM,oBAAI,KAAK;AACrB,eAAW,CAAC,OAAO,WAAW,KAAK,KAAK,aAAa,QAAQ,GAAG;AAC9D,UAAI,YAAY,YAAY,KAAK;AAC/B,aAAK,aAAa,OAAO,KAAK;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,mBAAmB,OAAoC;AAC3D,SAAK,cAAc,IAAI,MAAM,OAAO,KAAK;AAAA,EAC3C;AAAA,EAEA,MAAM,gBAAgB,OAA6C;AACjE,WAAO,KAAK,cAAc,IAAI,KAAK,KAAK;AAAA,EAC1C;AAAA,EAEA,MAAM,mBAAmB,OAA8B;AACrD,SAAK,cAAc,OAAO,KAAK;AAAA,EACjC;AAAA,EAEA,MAAM,iCAAiC,eAAsC;AAC3E,eAAW,CAAC,OAAO,YAAY,KAAK,KAAK,cAAc,QAAQ,GAAG;AAChE,UAAI,aAAa,kBAAkB,eAAe;AAChD,aAAK,cAAc,OAAO,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,8BAA6C;AACjD,UAAM,MAAM,oBAAI,KAAK;AACrB,eAAW,CAAC,OAAO,YAAY,KAAK,KAAK,cAAc,QAAQ,GAAG;AAChE,UAAI,aAAa,YAAY,KAAK;AAChC,aAAK,cAAc,OAAO,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIA,WAAW;AACT,WAAO;AAAA,MACL,SAAS,KAAK,QAAQ;AAAA,MACtB,OAAO,KAAK,MAAM;AAAA,MAClB,oBAAoB,KAAK,mBAAmB;AAAA,MAC5C,cAAc,KAAK,aAAa;AAAA,MAChC,eAAe,KAAK,cAAc;AAAA,IACpC;AAAA,EACF;AACF;;;ACnKA,IAAAK,iBAAmB;AAaZ,SAAS,qBAAqB,SAAiB,IAAY;AAChE,MAAI,SAAS,MAAM,SAAS,KAAK;AAC/B,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,QAAQ,eAAAC,QAAO,YAAY,MAAM;AACvC,SAAO,MAAM,SAAS,WAAW;AACnC;AAQO,SAAS,sBACd,cACA,SAA8B,QACtB;AACR,MAAI,WAAW,SAAS;AACtB,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,QAAQ;AACrB,UAAM,OAAO,eAAAA,QAAO,WAAW,QAAQ;AACvC,SAAK,OAAO,YAAY;AACxB,WAAO,KAAK,OAAO,WAAW;AAAA,EAChC;AAEA,QAAM,IAAI,MAAM,sCAAsC,MAAM,EAAE;AAChE;AASO,SAAS,oBACd,cACA,eACA,QACS;AACT,QAAM,oBAAoB,sBAAsB,cAAc,MAAM;AACpE,SAAO,sBAAsB;AAC/B;AAOO,SAAS,oBAAoB,cAA+B;AAEjE,MAAI,aAAa,SAAS,MAAM,aAAa,SAAS,KAAK;AACzD,WAAO;AAAA,EACT;AAGA,QAAM,aAAa;AACnB,SAAO,WAAW,KAAK,YAAY;AACrC;AAOO,SAAS,qBAAqB,eAAgC;AAEnE,MAAI,cAAc,SAAS,MAAM,cAAc,SAAS,KAAK;AAC3D,WAAO;AAAA,EACT;AAGA,QAAM,aAAa;AACnB,SAAO,WAAW,KAAK,aAAa;AACtC;AAQO,SAAS,iBACd,SAA8B,QAC9B,iBAAyB,IACwB;AACjD,QAAM,eAAe,qBAAqB,cAAc;AACxD,QAAM,gBAAgB,sBAAsB,cAAc,MAAM;AAEhE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;;;AC9GA,IAAAC,iBAAmB;AACnB,IAAAC,eAA4D;AAYrD,SAAS,oBAAoB,SAAiB,IAAY;AAC/D,QAAM,QAAQ,eAAAC,QAAO,YAAY,MAAM;AACvC,SAAO,MAAM,SAAS,WAAW;AACnC;AAOO,SAAS,oBAAoB,SAAiB,IAAY;AAC/D,SAAO,oBAAoB,MAAM;AACnC;AAOO,SAAS,qBAAqB,SAAiB,IAAY;AAChE,SAAO,oBAAoB,MAAM;AACnC;AAOO,SAAS,0BAA0B,SAAiB,IAAY;AACrE,SAAO,oBAAoB,MAAM;AACnC;AAUA,eAAsB,eACpB,SACA,YACA,YAAoB,SACpB,YAAoB,MACH;AACjB,QAAM,MAAM,UAAM,0BAAY,YAAY,SAAS;AAEnD,QAAM,MAAM,IAAI,qBAAQ,OAAO,EAC5B,mBAAmB,EAAE,KAAK,UAAU,CAAC,EACrC,YAAY,EACZ,kBAAkB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,SAAS;AAE9D,SAAO,MAAM,IAAI,KAAK,GAAG;AAC3B;AASA,eAAsB,eACpB,OACA,WACA,YAAoB,SACU;AAC9B,QAAM,MAAM,UAAM,yBAAW,WAAW,SAAS;AAEjD,QAAM,EAAE,QAAQ,IAAI,UAAM,wBAAU,OAAO,KAAK;AAAA,IAC9C,YAAY,CAAC,SAAS;AAAA,EACxB,CAAC;AAED,SAAO;AACT;AAOO,SAAS,eAAe,OAA4C;AACzE,SAAO,oBAAI,KAAK,IAAI,MAAM;AAC5B;AAOO,SAAS,0BAA0B,OAA2C;AACnF,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,YAAY,KAAK,MAAM,MAAM,UAAU,QAAQ,IAAI,GAAI;AAC7D,SAAO,YAAY;AACrB;AAWO,SAAS,oBACd,aACA,YAAuB,UACvB,WACA,cACA,OACA;AACA,QAAM,WAAgB;AAAA,IACpB,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,EACd;AAEA,MAAI,cAAc;AAChB,aAAS,gBAAgB;AAAA,EAC3B;AAEA,MAAI,OAAO;AACT,aAAS,QAAQ;AAAA,EACnB;AAEA,SAAO;AACT;AAOO,SAAS,WAAW,OAA0B;AACnD,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,MAAM,MAAM,GAAG,EAAE,OAAO,OAAK,EAAE,KAAK,EAAE,SAAS,CAAC;AACzD;AAOO,SAAS,UAAU,QAA0B;AAClD,SAAO,OAAO,KAAK,GAAG;AACxB;AAQO,SAAS,cAAc,gBAA0B,eAAkC;AACxF,SAAO,eAAe,MAAM,WAAS,cAAc,SAAS,KAAK,CAAC;AACpE;AAQO,SAAS,qBAAqB,gBAA0B,eAAmC;AAChG,SAAO,eAAe,OAAO,WAAS,cAAc,SAAS,KAAK,CAAC;AACrE;;;AL5JO,IAAM,uBAAuB;AAAA;AAAA,EAElC,QAAQ,QAAQ,IAAI,gBAAgB;AAAA,EACpC,WAAW,QAAQ,IAAI,oBAAoB;AAAA;AAAA,EAG3C,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,oBAAoB;AAAA,EACpB,uBAAuB;AAAA;AAAA,EAGvB,0BAA0B;AAAA;AAAA,EAC1B,aAAa;AAAA,EACb,oBAAoB;AAAA;AAAA,EAGpB,gCAAgC;AAAA;AAAA,EAGhC,qBAAqB;AAAA;AAAA,EACrB,sBAAsB;AAAA;AAAA,EACtB,2BAA2B;AAAA;AAAA;AAAA,EAG3B,qBAAqB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,wBAAwB,CAAC,MAAM;AAAA,EAC/B,iBAAiB;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,+BAA+B,CAAC,QAAQ,OAAO;AAAA;AAAA,EAG/C,WAAW,QAAQ,IAAI,oBAAoB;AAAA,EAC3C,cAAc;AAAA;AAAA,EAGd,MAAM;AAAA,IACJ,MAAM;AAAA,MACJ,QAAQ,QAAQ,IAAI,cAAc,QAAQ,IAAI,YAAY,MAAM,GAAG,IAAI;AAAA,MACvE,aAAa;AAAA,MACb,gBAAgB,CAAC,gBAAgB;AAAA,MACjC,gBAAgB,CAAC,gBAAgB,kBAAkB,UAAU,iBAAiB,eAAe;AAAA,MAC7F,SAAS,CAAC,OAAO,QAAQ,OAAO,UAAU,SAAS;AAAA,IACrD;AAAA,IACA,YAAY,QAAQ,IAAI,gBAAgB;AAAA,IACxC,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,MACf,UAAU,KAAK,KAAK;AAAA;AAAA,MACpB,KAAK;AAAA;AAAA,MACL,SAAS;AAAA,MACT,iBAAiB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAKO,SAAS,4BAA4B,SAA+C,CAAC,GAAG;AAC7F,QAAM,cAAc,EAAE,GAAG,sBAAsB,GAAG,OAAO;AAGzD,MAAI,CAAC,YAAY,WAAW;AAC1B,gBAAY,YAAY,YAAY;AAAA,EACtC;AAGA,QAAM,UAAU,YAAY,UAAU,QAAQ,OAAO,EAAE;AACvD,cAAY,wBAAwB,GAAG,OAAO,GAAG,YAAY,qBAAqB;AAClF,cAAY,gBAAgB,GAAG,OAAO,GAAG,YAAY,aAAa;AAClE,cAAY,mBAAmB,GAAG,OAAO,GAAG,YAAY,gBAAgB;AACxE,cAAY,eAAe,GAAG,OAAO,GAAG,YAAY,YAAY;AAChE,cAAY,qBAAqB,GAAG,OAAO,GAAG,YAAY,kBAAkB;AAC5E,cAAY,wBAAwB,GAAG,OAAO,GAAG,YAAY,qBAAqB;AAElF,SAAO;AACT;AAKO,SAAS,mBAAmB;AACjC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,MAAM;AAAA,IACN,cAAc,CAAC,gCAAgC;AAAA,IAC/C,QAAQ,CAAC,QAAQ,SAAS,OAAO;AAAA,IACjC,YAAY,CAAC,sBAAsB,iBAAiB,oBAAoB;AAAA,IACxE,WAAW,oBAAI,KAAK;AAAA,IACpB,WAAW,oBAAI,KAAK;AAAA,EACtB;AACF;","names":["express","helmet","compression","rateLimit","cors","import_crypto","crypto","import_crypto","import_jose","crypto"]}