@antseed/cli 0.1.179 → 0.1.181

package/dist/gateway/auth/db.js

@@ -0,0 +1,390 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * Auth tables share the gateway database but track their own schema version.
+ * Append-only once shipped; v1 has not shipped yet, so columns still go
+ * straight into it.
+ */
+const MIGRATIONS = [
+    `
+  CREATE TABLE auth_sessions (
+    id TEXT PRIMARY KEY,
+    kind TEXT NOT NULL CHECK (kind IN ('member', 'key')),
+    member_id TEXT,
+    key_id TEXT,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    last_seen_at INTEGER NOT NULL,
+    user_agent TEXT,
+    ip TEXT,
+    -- When the session's sign-in happened (a passkey, wallet or SSO proof);
+    -- sensitive actions need a recent one.
+    authenticated_at INTEGER,
+    -- Which credential proved that sign-in, so a sensitive action can insist
+    -- on a proof other than the credential it concerns.
+    authenticated_credential_id TEXT
+  );
+  CREATE INDEX auth_sessions_member ON auth_sessions(member_id);
+  CREATE INDEX auth_sessions_key ON auth_sessions(key_id);
+  CREATE TABLE auth_credentials (
+    id TEXT PRIMARY KEY,
+    member_id TEXT NOT NULL,
+    kind TEXT NOT NULL CHECK (kind IN ('passkey', 'wallet', 'oidc')),
+    label TEXT NOT NULL,
+    webauthn_id TEXT UNIQUE,
+    public_key BLOB,
+    counter INTEGER,
+    transports TEXT,
+    wallet_address TEXT UNIQUE,
+    oidc_issuer TEXT,
+    oidc_subject TEXT,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER,
+    UNIQUE (oidc_issuer, oidc_subject)
+  );
+  CREATE INDEX auth_credentials_member ON auth_credentials(member_id);
+  CREATE TABLE auth_enrollments (
+    token_hash TEXT PRIMARY KEY,
+    member_id TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_setup_tokens (
+    token_hash TEXT PRIMARY KEY,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    used_at INTEGER
+  );
+  CREATE TABLE auth_challenges (
+    challenge TEXT PRIMARY KEY,
+    kind TEXT NOT NULL CHECK (kind IN ('register', 'login')),
+    member_id TEXT,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_wallet_nonces (
+    nonce TEXT PRIMARY KEY,
+    address TEXT NOT NULL,
+    message TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_oidc_states (
+    state_hash TEXT PRIMARY KEY,
+    nonce TEXT NOT NULL,
+    code_verifier TEXT NOT NULL,
+    enrollment_hash TEXT,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+  );
+  CREATE TABLE auth_meta (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  );
+  `,
+];
+export const SESSION_IDLE_MS = 12 * 60 * 60 * 1000;
+export const SESSION_ABSOLUTE_MS = 14 * 24 * 60 * 60 * 1000;
+const ENROLLMENT_TTL_MS = 15 * 60 * 1000;
+export const SETUP_TOKEN_TTL_MS = 60 * 60 * 1000;
+/** How recent a sign-in must be for sensitive actions (operator authorizations). */
+export const FRESH_SIGN_IN_MS = 5 * 60 * 1000;
+/**
+ * A wallet credential must be this old before it can be authorized as a
+ * workspace wallet's operator: a stolen session that links its own wallet
+ * can't turn it into an operator before the owner notices (the add is audited).
+ */
+export const OPERATOR_WALLET_MIN_AGE_MS = 24 * 60 * 60 * 1000;
+/** Unauthenticated endpoints write challenges and nonces; keep at most this many live rows of each. */
+export const MAX_PENDING_TICKETS = 5000;
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+export const WALLET_NONCE_TTL_MS = 10 * 60 * 1000;
+export const OIDC_STATE_TTL_MS = 10 * 60 * 1000;
+/** Sessions record activity at most this often, so reads don't write on every request. */
+const SESSION_TOUCH_MS = 60 * 1000;
+export function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+export function randomToken(bytes = 32) {
+    return randomBytes(bytes).toString('base64url');
+}
+/** Auth's own rows: sessions, credentials and short-lived login tickets. Secrets are stored as SHA-256 hashes. */
+export class AuthDb {
+    _db;
+    _now;
+    constructor(_db, _now) {
+        this._db = _db;
+        this._now = _now;
+        this._migrate();
+    }
+    /**
+     * The version is read and bumped inside one IMMEDIATE transaction (it holds
+     * the write lock), so processes opening the database at once never apply a
+     * migration twice.
+     */
+    _migrate() {
+        const current = this._db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'auth_schema_version'").get()
+            ? this._db.prepare('SELECT version FROM auth_schema_version').get()?.version
+            : undefined;
+        if (current !== undefined && current >= MIGRATIONS.length)
+            return;
+        this._db.transaction(() => {
+            this._db.exec('CREATE TABLE IF NOT EXISTS auth_schema_version (version INTEGER NOT NULL)');
+            const row = this._db.prepare('SELECT version FROM auth_schema_version').get();
+            if (!row)
+                this._db.prepare('INSERT INTO auth_schema_version (version) VALUES (0)').run();
+            for (let index = row?.version ?? 0; index < MIGRATIONS.length; index += 1) {
+                this._db.exec(MIGRATIONS[index]);
+                this._db.prepare('UPDATE auth_schema_version SET version = ?').run(index + 1);
+            }
+        }).immediate();
+    }
+    transaction(fn) {
+        return this._db.transaction(fn)();
+    }
+    /** Drops expired tickets and sessions; cheap enough to run on every login. */
+    sweep() {
+        const now = this._now();
+        this._db.prepare('DELETE FROM auth_sessions WHERE expires_at <= ? OR last_seen_at <= ?').run(now, now - SESSION_IDLE_MS);
+        for (const table of ['auth_enrollments', 'auth_challenges', 'auth_wallet_nonces', 'auth_oidc_states']) {
+            this._db.prepare(`DELETE FROM ${table} WHERE expires_at <= ?`).run(now);
+        }
+    }
+    // ── Meta ────────────────────────────────────────────────────────────────
+    getMeta(key) {
+        const row = this._db.prepare('SELECT value FROM auth_meta WHERE key = ?').get(key);
+        return row?.value ?? null;
+    }
+    setMeta(key, value) {
+        this._db.prepare('INSERT INTO auth_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(key, value);
+    }
+    // ── Sessions ────────────────────────────────────────────────────────────
+    /** Returns the cookie value; only its hash is stored. */
+    createSession(principal, client, credentialId = null) {
+        const secret = randomToken(32);
+        const now = this._now();
+        this._db.prepare(`
+      INSERT INTO auth_sessions (id, kind, member_id, key_id, created_at, expires_at, last_seen_at, user_agent, ip, authenticated_at, authenticated_credential_id)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(sha256Hex(secret), principal.kind, principal.kind === 'member' ? principal.memberId : null, principal.kind === 'key' ? principal.keyId : null, now, now + SESSION_ABSOLUTE_MS, now, client.userAgent?.slice(0, 300) ?? null, client.ip, now, credentialId);
+        return secret;
+    }
+    /** Resolves a live session by cookie value and records activity; null when unknown, idle or expired. */
+    findSession(secret) {
+        const id = sha256Hex(secret);
+        const row = this._db.prepare('SELECT * FROM auth_sessions WHERE id = ?').get(id);
+        if (!row)
+            return null;
+        const now = this._now();
+        if (row.expires_at <= now || row.last_seen_at + SESSION_IDLE_MS <= now) {
+            this.deleteSession(id);
+            return null;
+        }
+        if (now - row.last_seen_at >= SESSION_TOUCH_MS) {
+            this._db.prepare('UPDATE auth_sessions SET last_seen_at = ? WHERE id = ?').run(now, id);
+            row.last_seen_at = now;
+        }
+        return row;
+    }
+    deleteSession(id) {
+        this._db.prepare('DELETE FROM auth_sessions WHERE id = ?').run(id);
+    }
+    /** Records a new sign-in proof on an existing session (re-authentication); false when the session is gone. */
+    markAuthenticated(id, credentialId) {
+        return this._db.prepare('UPDATE auth_sessions SET authenticated_at = ?, authenticated_credential_id = ? WHERE id = ?')
+            .run(this._now(), credentialId, id).changes > 0;
+    }
+    deleteSessionBySecret(secret) {
+        this.deleteSession(sha256Hex(secret));
+    }
+    deleteMemberSessions(memberId) {
+        return this._db.prepare('DELETE FROM auth_sessions WHERE member_id = ?').run(memberId).changes;
+    }
+    /** Ends a member's sessions except `keepId` (the caller's own, when they act on themselves). */
+    deleteMemberSessionsExcept(memberId, keepId) {
+        if (!keepId)
+            return this.deleteMemberSessions(memberId);
+        return this._db.prepare('DELETE FROM auth_sessions WHERE member_id = ? AND id != ?').run(memberId, keepId).changes;
+    }
+    deleteKeySessions(keyId) {
+        return this._db.prepare('DELETE FROM auth_sessions WHERE key_id = ?').run(keyId).changes;
+    }
+    // ── Credentials ─────────────────────────────────────────────────────────
+    addCredential(memberId, credential) {
+        const id = `cred_${randomBytes(8).toString('hex')}`;
+        const now = this._now();
+        const insert = this._db.prepare(`
+      INSERT INTO auth_credentials
+        (id, member_id, kind, label, webauthn_id, public_key, counter, transports, wallet_address, oidc_issuer, oidc_subject, created_at, last_used_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+        if (credential.kind === 'passkey') {
+            insert.run(id, memberId, 'passkey', credential.label, credential.webauthnId, Buffer.from(credential.publicKey), credential.counter, JSON.stringify(credential.transports), null, null, null, now, now);
+        }
+        else if (credential.kind === 'wallet') {
+            insert.run(id, memberId, 'wallet', credential.label, null, null, null, null, credential.address.toLowerCase(), null, null, now, now);
+        }
+        else {
+            insert.run(id, memberId, 'oidc', credential.label, null, null, null, null, null, credential.issuer, credential.subject, now, now);
+        }
+        return this.getCredential(id);
+    }
+    getCredential(id) {
+        return this._db.prepare('SELECT * FROM auth_credentials WHERE id = ?').get(id) ?? null;
+    }
+    listCredentials(memberId) {
+        return this._db.prepare('SELECT * FROM auth_credentials WHERE member_id = ? ORDER BY created_at, id').all(memberId);
+    }
+    countCredentials(memberId) {
+        return this._db.prepare('SELECT COUNT(*) AS count FROM auth_credentials WHERE member_id = ?').get(memberId).count;
+    }
+    deleteCredential(memberId, id) {
+        return this._db.prepare('DELETE FROM auth_credentials WHERE id = ? AND member_id = ?').run(id, memberId).changes > 0;
+    }
+    findPasskey(webauthnId) {
+        return this._db.prepare("SELECT * FROM auth_credentials WHERE kind = 'passkey' AND webauthn_id = ?").get(webauthnId) ?? null;
+    }
+    findWallet(address) {
+        return this._db.prepare("SELECT * FROM auth_credentials WHERE kind = 'wallet' AND wallet_address = ?").get(address.toLowerCase()) ?? null;
+    }
+    findOidc(issuer, subject) {
+        return this._db.prepare("SELECT * FROM auth_credentials WHERE kind = 'oidc' AND oidc_issuer = ? AND oidc_subject = ?").get(issuer, subject) ?? null;
+    }
+    touchCredential(id, counter) {
+        if (counter === undefined) {
+            this._db.prepare('UPDATE auth_credentials SET last_used_at = ? WHERE id = ?').run(this._now(), id);
+        }
+        else {
+            this._db.prepare('UPDATE auth_credentials SET last_used_at = ?, counter = ? WHERE id = ?').run(this._now(), counter, id);
+        }
+    }
+    // ── Enrollments ─────────────────────────────────────────────────────────
+    createEnrollment(memberId) {
+        const secret = randomToken(32);
+        const now = this._now();
+        this._db.prepare('INSERT INTO auth_enrollments (token_hash, member_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
+            .run(sha256Hex(secret), memberId, now, now + ENROLLMENT_TTL_MS);
+        return secret;
+    }
+    /** Member id of a live enrollment, without consuming it. */
+    peekEnrollment(secret) {
+        const row = this._db.prepare('SELECT member_id, expires_at FROM auth_enrollments WHERE token_hash = ?').get(sha256Hex(secret));
+        return row && row.expires_at > this._now() ? row.member_id : null;
+    }
+    consumeEnrollment(secret) {
+        const memberId = this.peekEnrollment(secret);
+        if (memberId)
+            this._db.prepare('DELETE FROM auth_enrollments WHERE token_hash = ?').run(sha256Hex(secret));
+        return memberId;
+    }
+    // ── Setup tokens ────────────────────────────────────────────────────────
+    /** Only the newest setup link works: issuing one retires unused earlier ones. */
+    createSetupToken() {
+        const secret = randomToken(32);
+        const now = this._now();
+        this.transaction(() => {
+            this._db.prepare('DELETE FROM auth_setup_tokens WHERE used_at IS NULL').run();
+            this._db.prepare('INSERT INTO auth_setup_tokens (token_hash, created_at, expires_at) VALUES (?, ?, ?)')
+                .run(sha256Hex(secret), now, now + SETUP_TOKEN_TTL_MS);
+        });
+        return secret;
+    }
+    consumeSetupToken(secret) {
+        const now = this._now();
+        return this._db.prepare('UPDATE auth_setup_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?')
+            .run(now, sha256Hex(secret), now).changes > 0;
+    }
+    // ── WebAuthn challenges ─────────────────────────────────────────────────
+    /** Drops expired rows of a ticket table, then the oldest ones beyond the cap. */
+    _capTickets(table, key) {
+        const now = this._now();
+        this._db.prepare(`DELETE FROM ${table} WHERE expires_at <= ?`).run(now);
+        const count = this._db.prepare(`SELECT COUNT(*) AS count FROM ${table}`).get().count;
+        if (count >= MAX_PENDING_TICKETS) {
+            this._db.prepare(`DELETE FROM ${table} WHERE ${key} IN (SELECT ${key} FROM ${table} ORDER BY created_at LIMIT ?)`).run(count - MAX_PENDING_TICKETS + 1);
+        }
+    }
+    saveChallenge(challenge, kind, memberId) {
+        this._capTickets('auth_challenges', 'challenge');
+        const now = this._now();
+        this._db.prepare('INSERT INTO auth_challenges (challenge, kind, member_id, created_at, expires_at) VALUES (?, ?, ?, ?, ?)')
+            .run(challenge, kind, memberId, now, now + CHALLENGE_TTL_MS);
+    }
+    /** Single use: the row is deleted whether or not the response then verifies. */
+    takeChallenge(challenge, kind) {
+        const row = this._db.prepare('SELECT member_id, expires_at FROM auth_challenges WHERE challenge = ? AND kind = ?').get(challenge, kind);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_challenges WHERE challenge = ?').run(challenge);
+        return row.expires_at > this._now() ? { memberId: row.member_id } : null;
+    }
+    // ── Wallet nonces ───────────────────────────────────────────────────────
+    saveWalletNonce(nonce, address, message, expiresAt) {
+        this._capTickets('auth_wallet_nonces', 'nonce');
+        this._db.prepare('INSERT INTO auth_wallet_nonces (nonce, address, message, created_at, expires_at) VALUES (?, ?, ?, ?, ?)')
+            .run(nonce, address.toLowerCase(), message, this._now(), expiresAt);
+    }
+    takeWalletNonce(nonce) {
+        const row = this._db.prepare('SELECT address, message, expires_at FROM auth_wallet_nonces WHERE nonce = ?').get(nonce);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_wallet_nonces WHERE nonce = ?').run(nonce);
+        return row.expires_at > this._now() ? { address: row.address, message: row.message } : null;
+    }
+    // ── OIDC states ─────────────────────────────────────────────────────────
+    saveOidcState(state, input) {
+        const now = this._now();
+        this._db.prepare('INSERT INTO auth_oidc_states (state_hash, nonce, code_verifier, enrollment_hash, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?)')
+            .run(sha256Hex(state), input.nonce, input.codeVerifier, input.enrollment === null ? null : sha256Hex(input.enrollment), now, now + OIDC_STATE_TTL_MS);
+    }
+    takeOidcState(state) {
+        const hash = sha256Hex(state);
+        const row = this._db.prepare('SELECT nonce, code_verifier, enrollment_hash, expires_at FROM auth_oidc_states WHERE state_hash = ?').get(hash);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_oidc_states WHERE state_hash = ?').run(hash);
+        return row.expires_at > this._now() ? { nonce: row.nonce, codeVerifier: row.code_verifier, enrollmentHash: row.enrollment_hash } : null;
+    }
+    /** Consumes an enrollment by its stored hash (the OIDC state carries the hash, not the secret). */
+    consumeEnrollmentHash(hash) {
+        const row = this._db.prepare('SELECT member_id, expires_at FROM auth_enrollments WHERE token_hash = ?').get(hash);
+        if (!row)
+            return null;
+        this._db.prepare('DELETE FROM auth_enrollments WHERE token_hash = ?').run(hash);
+        return row.expires_at > this._now() ? row.member_id : null;
+    }
+}
+/** The sign-in behind a console session: when it happened and with which credential (null: unknown, e.g. older sessions). */
+export function sessionSignIn(db, sessionId) {
+    try {
+        const row = db.prepare('SELECT authenticated_at, created_at, authenticated_credential_id FROM auth_sessions WHERE id = ?').get(sessionId);
+        return row ? { authenticatedAt: row.authenticated_at ?? row.created_at, credentialId: row.authenticated_credential_id } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A member's wallet credentials (lower-case addresses) with when each was added, plus how many credentials they have in all. */
+export function memberWalletCredentials(db, memberId) {
+    try {
+        const rows = db.prepare('SELECT id, kind, wallet_address, created_at FROM auth_credentials WHERE member_id = ?').all(memberId);
+        return {
+            wallets: rows.filter((row) => row.kind === 'wallet' && row.wallet_address)
+                .map((row) => ({ id: row.id, address: row.wallet_address.toLowerCase(), createdAt: row.created_at })),
+            total: rows.length,
+        };
+    }
+    catch {
+        return { wallets: [], total: 0 };
+    }
+}
+/** Lower-case addresses of the wallets a member has proven (SIWE) as sign-in methods. */
+export function memberWalletAddresses(db, memberId) {
+    try {
+        const rows = db.prepare("SELECT wallet_address FROM auth_credentials WHERE member_id = ? AND kind = 'wallet' AND wallet_address IS NOT NULL").all(memberId);
+        return rows.map((row) => row.wallet_address.toLowerCase());
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=db.js.map

package/dist/gateway/auth/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/gateway/auth/db.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,GAAsB;IACpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3D,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACxC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAChD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7D,uGAAuG;AACvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AACvC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC/C,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACjD,CAAC;AAmCD,kHAAkH;AAClH,MAAM,OAAO,MAAM;IACY;IAAyC;IAAtE,YAA6B,GAAsB,EAAmB,IAAkB;QAA3D,QAAG,GAAH,GAAG,CAAmB;QAAmB,SAAI,GAAJ,IAAI,CAAc;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACK,QAAQ;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mFAAmF,CAAC,CAAC,GAAG,EAAE;YACzH,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAsC,EAAE,OAAO;YACjH,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,MAAM;YAAE,OAAM;QACjE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAA;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAqC,CAAA;YAChH,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,EAAE,CAAA;YACxF,KAAK,IAAI,KAAK,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;gBACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;IAChB,CAAC;IAED,WAAW,CAAI,EAAW;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAA;IACnC,CAAC;IAED,8EAA8E;IAC9E,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sEAAsE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,CAAC,CAAA;QACxH,KAAK,MAAM,KAAK,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAED,2EAA2E;IAE3E,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,GAAG,CAAkC,CAAA;QACnH,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAA;IAC3B,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wGAAwG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5I,CAAC;IAED,2EAA2E;IAE3E,yDAAyD;IACzD,aAAa,CACX,SAAgF,EAChF,MAAuD,EACvD,eAA8B,IAAI;QAElC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;KAGhB,CAAC,CAAC,GAAG,CACJ,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,EACjC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EACvD,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EACjD,GAAG,EAAE,GAAG,GAAG,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,CAC3G,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,wGAAwG;IACxG,WAAW,CAAC,MAAc;QACxB,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,EAAE,CAA2B,CAAA;QAC1G,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,GAAG,eAAe,IAAI,GAAG,EAAE,CAAC;YACvE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACvF,GAAG,CAAC,YAAY,GAAG,GAAG,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,8GAA8G;IAC9G,iBAAiB,CAAC,EAAU,EAAE,YAA2B;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6FAA6F,CAAC;aACnH,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,qBAAqB,CAAC,MAAc;QAClC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,oBAAoB,CAAC,QAAgB;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAA;IAChG,CAAC;IAED,gGAAgG;IAChG,0BAA0B,CAAC,QAAgB,EAAE,MAAqB;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAA;IACpH,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAA;IAC1F,CAAC;IAED,2EAA2E;IAE3E,aAAa,CAAC,QAAgB,EAAE,UAAyB;QACvD,MAAM,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;;KAI/B,CAAC,CAAA;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,EAChI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtE,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACtI,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QACnI,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,EAAE,CAAE,CAAA;IAChC,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,EAAE,CAA+B,IAAI,IAAI,CAAA;IACvH,CAAC;IAED,eAAe,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAoB,CAAA;IACxI,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAuB,CAAC,KAAK,CAAA;IAC1I,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,EAAU;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;IACtH,CAAC;IAED,WAAW,CAAC,UAAkB;QAC5B,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,GAAG,CAAC,UAAU,CAA+B,IAAI,IAAI,CAAA;IAC7J,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAA+B,IAAI,IAAI,CAAA;IAC1K,CAAC;IAED,QAAQ,CAAC,MAAc,EAAE,OAAe;QACtC,OAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6FAA6F,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAA+B,IAAI,IAAI,CAAA;IACpL,CAAC;IAED,eAAe,CAAC,EAAU,EAAE,OAAgB;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACpG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;IAED,2EAA2E;IAE3E,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kGAAkG,CAAC;aACjH,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAA;QACjE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,4DAA4D;IAC5D,cAAc,CAAC,MAAc;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CACtE,CAAA;QACvD,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IACnE,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1G,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,2EAA2E;IAE3E,iFAAiF;IACjF,gBAAgB;QACd,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,qFAAqF,CAAC;iBACpG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,kBAAkB,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,sGAAsG,CAAC;aAC5H,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;IACjD,CAAC;IAED,2EAA2E;IAE3E,iFAAiF;IACzE,WAAW,CAAC,KAA+C,EAAE,GAA0B;QAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACvE,MAAM,KAAK,GAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAA;QAC3G,IAAI,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,UAAU,GAAG,eAAe,GAAG,SAAS,KAAK,+BAA+B,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,mBAAmB,GAAG,CAAC,CAAC,CAAA;QACzJ,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAA0B,EAAE,QAAuB;QAClF,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yGAAyG,CAAC;aACxH,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,gBAAgB,CAAC,CAAA;IAChE,CAAC;IAED,gFAAgF;IAChF,aAAa,CAAC,SAAiB,EAAE,IAA0B;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CACxE,CAAA;QAC9D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAClF,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,CAAC;IAED,2EAA2E;IAE3E,eAAe,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe,EAAE,SAAiB;QAChF,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yGAAyG,CAAC;aACxH,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAA;IACvE,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,GAAG,CAAC,KAAK,CAC/C,CAAA;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7E,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,CAAC;IAED,2EAA2E;IAE3E,aAAa,CAAC,KAAa,EAAE,KAAyE;QACpG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oIAAoI,CAAC;aACnJ,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAA;IACzJ,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,qGAAqG,CAAC,CAAC,GAAG,CAAC,IAAI,CAClC,CAAA;QAC1G,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/E,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACzI,CAAC;IAED,mGAAmG;IACnG,qBAAqB,CAAC,IAAY;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,IAAI,CACzD,CAAA;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/E,OAAO,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5D,CAAC;CACF;AAED,6HAA6H;AAC7H,MAAM,UAAU,aAAa,CAAC,EAAqB,EAAE,SAAiB;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,kGAAkG,CAAC,CAAC,GAAG,CAAC,SAAS,CACvB,CAAA;QACjH,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAChI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,iIAAiI;AACjI,MAAM,UAAU,uBAAuB,CAAC,EAAqB,EAAE,QAAgB;IAC7E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,uFAAuF,CAAC,CAAC,GAAG,CAAC,QAAQ,CACrC,CAAA;QACxF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC;iBACvE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,cAAe,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YACxG,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAClC,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,EAAqB,EAAE,QAAgB;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,oHAAoH,CAAC,CAAC,GAAG,CAAC,QAAQ,CACvH,CAAA;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/gateway/auth/hardening.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hardening.test.d.ts.map

package/dist/gateway/auth/hardening.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.test.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/hardening.test.ts"],"names":[],"mappings":""}

package/dist/gateway/auth/hardening.test.js

@@ -0,0 +1,155 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from 'jose';
+import { GatewayStore } from '../store.js';
+import { AuthDb, MAX_PENDING_TICKETS, memberWalletAddresses, sessionSignIn, SETUP_TOKEN_TTL_MS, sha256Hex } from './db.js';
+import { clientIp } from './http.js';
+import { startHarness } from './test-helpers.js';
+let harness = null;
+let dataDir = null;
+afterEach(async () => {
+    await harness?.close();
+    harness = null;
+    if (dataDir)
+        rmSync(dataDir, { recursive: true, force: true });
+    dataDir = null;
+});
+function realStore() {
+    dataDir = mkdtempSync(join(tmpdir(), 'antseed-auth-hard-'));
+    const dir = dataDir;
+    return (now) => new GatewayStore(dir, now);
+}
+function bearer(secret) {
+    return { headers: { authorization: `Bearer ${secret}` }, socket: { remoteAddress: '127.0.0.1' } };
+}
+async function cloudflareHarness(extraEnv = {}) {
+    const { privateKey, publicKey } = await generateKeyPair('RS256');
+    const jwks = createLocalJWKSet({ keys: [{ ...(await exportJWK(publicKey)), kid: 'cf1', alg: 'RS256' }] });
+    harness = await startHarness({
+        makeStore: realStore(),
+        env: { ANTSEED_CF_ACCESS_TEAM_DOMAIN: 'myteam.cloudflareaccess.com', ANTSEED_CF_ACCESS_AUD: 'aud-1', ...extraEnv },
+        authOptions: { cloudflareAccessKeys: jwks },
+    });
+    const h = harness;
+    return (email) => new SignJWT({ email }).setProtectedHeader({ alg: 'RS256', kid: 'cf1' })
+        .setIssuer('https://myteam.cloudflareaccess.com').setAudience('aud-1').setSubject(`sub-${email}`)
+        .setIssuedAt(Math.floor(h.clock.now / 1000)).setExpirationTime(Math.floor(h.clock.now / 1000) + 300).sign(privateKey);
+}
+describe('console auth hardening', () => {
+    it('refuses expired management tokens and tokens whose creator lost the admin role', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        const store = harness.store;
+        const owner = store.createOwner({ label: 'Owner', email: null });
+        const cli = store.createAdminToken({ label: 'cli', scope: 'admin', createdBy: null, expiresAt: null });
+        assert.equal((await harness.auth.authenticate(bearer(cli.secret)))?.kind, 'token');
+        const lapsing = store.createAdminToken({ label: 'lapsing', scope: 'read', createdBy: owner.id, expiresAt: harness.clock.now + 1000 });
+        assert.equal((await harness.auth.authenticate(bearer(lapsing.secret)))?.kind, 'token');
+        harness.clock.now += 1000;
+        assert.equal(await harness.auth.authenticate(bearer(lapsing.secret)), null);
+        const { invite, token } = store.createInvite({ label: 'Adm', email: null, orgRole: 'admin', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: owner.id });
+        store.consumeInvite(sha256Hex(token), harness.clock.now);
+        const byAdmin = store.createAdminToken({ label: 'adm', scope: 'admin', createdBy: invite.memberId, expiresAt: null });
+        assert.equal((await harness.auth.authenticate(bearer(byAdmin.secret)))?.kind, 'token');
+        // Demoted without going through the console route (which would also revoke): auth still refuses it.
+        store.updateMember(invite.memberId, { orgRole: 'member' });
+        assert.equal(await harness.auth.authenticate(bearer(byAdmin.secret)), null);
+        store.updateMember(invite.memberId, { orgRole: 'admin' });
+        store.setMemberStatus(invite.memberId, 'disabled');
+        assert.equal(await harness.auth.authenticate(bearer(byAdmin.secret)), null);
+    });
+    it('setup links last one hour', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        assert.equal(SETUP_TOKEN_TTL_MS, 60 * 60 * 1000);
+        const token = harness.auth.createSetupLink().split('#')[1];
+        harness.clock.now += SETUP_TOKEN_TTL_MS + 1;
+        const setup = await harness.browser().request('POST', '/auth/setup', { token });
+        assert.equal(setup.status, 400);
+        const store = harness.store;
+        assert.deepEqual(store.listAudit({ action: 'auth' }).entries.map((entry) => [entry.action, entry.details['method']]), [['auth.sign_in_failed', 'setup']]);
+    });
+    it('an owner signing in through Cloudflare Access completes setup', async () => {
+        const sign = await cloudflareHarness();
+        const token = harness.auth.createSetupLink().split('#')[1];
+        const setup = await harness.browser().request('POST', '/auth/setup', { token, email: 'owner@acme.example' });
+        assert.equal(setup.status, 200);
+        assert.equal(harness.auth.authConfig().setupRequired, true, 'no credential yet: the setup owner may still re-claim');
+        const me = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('owner@acme.example') });
+        assert.equal(me.status, 200, JSON.stringify(me.body));
+        assert.equal(harness.auth.authConfig().setupRequired, false);
+        assert.throws(() => harness.auth.createSetupLink());
+    });
+    it('SSO activates an invited member only while their invite is live', async () => {
+        const sign = await cloudflareHarness();
+        const store = harness.store;
+        store.createOwner({ label: 'Owner', email: null });
+        const lapsed = store.createInvite({ label: 'Late', email: 'late@acme.example', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 1000, createdBy: null });
+        harness.clock.now += 2000;
+        const refused = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('late@acme.example') });
+        assert.equal(refused.status, 401);
+        assert.equal(store.getMember(lapsed.invite.memberId).status, 'invited');
+        const cancelled = store.createInvite({ label: 'Gone', email: 'gone@acme.example', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: null });
+        store.deleteInvite(cancelled.invite.id);
+        assert.equal((await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('gone@acme.example') })).status, 401);
+        const live = store.createInvite({ label: 'Ok', email: 'ok@acme.example', orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: null });
+        const me = await harness.browser().request('GET', '/auth/me', undefined, { 'cf-access-jwt-assertion': await sign('ok@acme.example') });
+        assert.equal(me.status, 200, JSON.stringify(me.body));
+        assert.equal(store.getMember(live.invite.memberId).status, 'active');
+        assert.notEqual(store.getInvite(live.invite.id).usedAt, null, 'the invite is consumed');
+    });
+    it('records sign-ins and failed sign-ins, and stamps sessions with their sign-in time', async () => {
+        harness = await startHarness({ makeStore: realStore() });
+        const store = harness.store;
+        store.createOwner({ label: 'Owner', email: null });
+        const wallet = Wallet.createRandom();
+        const invite = store.createInvite({ label: 'Dana', email: null, orgRole: 'member', workspaces: [], expiresAt: harness.clock.now + 60_000, createdBy: null });
+        const browser = harness.browser();
+        const enrollment = (await browser.request('POST', '/auth/invite', { token: invite.token })).body.enrollment;
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const signedIn = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment });
+        assert.equal(signedIn.status, 200, JSON.stringify(signedIn.body));
+        const other = Wallet.createRandom();
+        const second = (await harness.browser().request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        assert.equal((await harness.browser().request('POST', '/auth/wallet/verify', { message: second, signature: await other.signMessage(second) })).status, 401);
+        const entries = store.listAudit({ action: 'auth' }).entries;
+        assert.deepEqual(entries.map((entry) => entry.action), ['auth.sign_in_failed', 'auth.sign_in', 'auth.credential_add', 'auth.invite_accept']);
+        assert.deepEqual(entries[0].details, { method: 'wallet', code: 'bad_signature' });
+        assert.deepEqual(entries[1].actor, { kind: 'member', id: invite.invite.memberId, label: 'Dana' });
+        assert.equal(entries[1].ip, '127.0.0.1');
+        const session = store.database.prepare('SELECT id FROM auth_sessions WHERE member_id = ?').get(invite.invite.memberId);
+        assert.equal(sessionSignIn(store.database, session.id)?.authenticatedAt, harness.clock.now);
+        assert.equal(sessionSignIn(store.database, 'unknown'), null);
+        assert.deepEqual(memberWalletAddresses(store.database, invite.invite.memberId), [wallet.address.toLowerCase()]);
+    });
+    it('caps pending passkey challenges and wallet nonces', () => {
+        const clock = { now: 1_000_000 };
+        const store = realStore()(() => clock.now);
+        try {
+            const db = new AuthDb(store.database, () => clock.now);
+            for (let index = 0; index < MAX_PENDING_TICKETS + 25; index += 1) {
+                clock.now += 1;
+                db.saveChallenge(`challenge-${index}`, 'login', null);
+            }
+            const count = store.database.prepare('SELECT COUNT(*) FROM auth_challenges').pluck().get();
+            assert.equal(count, MAX_PENDING_TICKETS);
+            assert.equal(db.takeChallenge('challenge-0', 'login'), null, 'the oldest went first');
+            assert.notEqual(db.takeChallenge(`challenge-${MAX_PENDING_TICKETS + 24}`, 'login'), null);
+            db.saveWalletNonce('n1', `0x${'ab'.repeat(20)}`, 'msg', clock.now - 1);
+            db.saveWalletNonce('n2', `0x${'ab'.repeat(20)}`, 'msg', clock.now + 1000);
+            assert.equal(store.database.prepare('SELECT COUNT(*) FROM auth_wallet_nonces').pluck().get(), 1, 'expired nonces are swept on insert');
+        }
+        finally {
+            store.close();
+        }
+    });
+    it('believes CF-Connecting-IP only in Cloudflare tunnel mode', () => {
+        const req = (remoteAddress, headers) => ({ socket: { remoteAddress }, headers });
+        assert.equal(clientIp(req('127.0.0.1', { 'cf-connecting-ip': '198.51.100.1' })), '127.0.0.1');
+        assert.equal(clientIp(req('127.0.0.1', { 'cf-connecting-ip': '198.51.100.1' }), { trustCloudflare: true }), '198.51.100.1');
+        assert.equal(clientIp(req('203.0.113.4', { 'cf-connecting-ip': '198.51.100.1' }), { trustCloudflare: true }), '203.0.113.4');
+    });
+});
+//# sourceMappingURL=hardening.test.js.map

package/dist/gateway/auth/hardening.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardening.test.js","sourceRoot":"","sources":["../../../src/gateway/auth/hardening.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAY,MAAM,MAAM,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC1H,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,YAAY,EAAgB,MAAM,mBAAmB,CAAA;AAE9D,IAAI,OAAO,GAAmB,IAAI,CAAA;AAClC,IAAI,OAAO,GAAkB,IAAI,CAAA;AACjC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;IACtB,OAAO,GAAG,IAAI,CAAA;IACd,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,OAAO,GAAG,IAAI,CAAA;AAChB,CAAC,CAAC,CAAA;AAEF,SAAS,SAAS;IAChB,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAA;IACnB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAW,CAAA;AAC5G,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAmC,EAAE;IACpE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAS,CAAC,EAAE,CAAC,CAAA;IAChH,OAAO,GAAG,MAAM,YAAY,CAAC;QAC3B,SAAS,EAAE,SAAS,EAAE;QACtB,GAAG,EAAE,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE;QAClH,WAAW,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;KAC5C,CAAC,CAAA;IACF,MAAM,CAAC,GAAG,OAAO,CAAA;IACjB,OAAO,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAC9F,SAAS,CAAC,qCAAqC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,EAAE,CAAC;SAChG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AACzH,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAElF,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAA;QACrI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACtF,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAA;QACzB,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAE3E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QACzK,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACrH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QACtF,oGAAoG;QACpG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC3E,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QACzD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC3D,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,kBAAkB,GAAG,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3J,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC5D,MAAM,KAAK,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAC7G,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,OAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAA;QACrH,MAAM,EAAE,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAC1I,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,OAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAQ,CAAC,KAAgC,CAAA;QACvD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1K,OAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAA;QAC1B,MAAM,OAAO,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;QAC9I,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAExE,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/K,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE1J,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtK,MAAM,EAAE,GAAG,MAAM,OAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACvI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAA;QACtD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5J,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAC3G,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QAC5I,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACnC,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QACxH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE3J,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAA;QAC3D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC5I,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;QAClF,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAClG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAmB,CAAA;QACxI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3F,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5D,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACjH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;QAChC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,mBAAmB,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACjE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAA;gBACd,EAAE,CAAC,aAAa,CAAC,aAAa,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;YACvD,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAY,CAAA;YACpG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;YACxC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAA;YACrF,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,aAAa,mBAAmB,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAA;YACzF,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YACtE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;YACzE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,oCAAoC,CAAC,CAAA;QACxI,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,CAAC,aAAqB,EAAE,OAA+B,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAU,CAAA;QACzH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAC7F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,cAAc,CAAC,CAAA;QAC3H,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAA;IAC9H,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}