@atlasauth/nextjs 0.10.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/README.md +1 -1
- package/dist/mount.d.ts +18 -3
- package/dist/mount.js +38 -6
- package/dist/mount.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,11 +2,22 @@
|
|
|
2
2
|
|
|
3
3
|
## Unreleased
|
|
4
4
|
|
|
5
|
+
## 0.11.0 — 2026-11-04
|
|
6
|
+
|
|
7
|
+
### Changed (behaviour-changing)
|
|
8
|
+
|
|
9
|
+
- `createMountHandler` sends Atlas only what Atlas uses. By default the only cookies forwarded are `__session`, `__client` and `__atlas_*`, and the only headers are browser basics plus the ones Atlas reads; your app's own cookies and internal headers stay on your side. To send something else, pass `forwardCookies(name)` or `forwardHeaders(name)`, which replace the defaults: `forwardCookies: () => true` and `forwardHeaders: () => true` restore the old behaviour. Hop-by-hop headers, `X-Forwarded-*`, and `X-Atlas-*` other than `X-Atlas-SDK` are dropped whatever a hook returns. Client IP handling is unchanged.
|
|
10
|
+
|
|
11
|
+
### Fixed
|
|
12
|
+
|
|
13
|
+
- `createMountHandler` forwards `X-Atlas-SDK`, so SDK version advisories now reach browsers behind a mount.
|
|
14
|
+
|
|
5
15
|
## 0.10.0 — 2026-11-04
|
|
6
16
|
|
|
7
17
|
### Security
|
|
8
18
|
|
|
9
19
|
- `createMountHandler` no longer trusts a browser-supplied client IP. It used the leftmost `X-Forwarded-For` entry (or `X-Real-IP`) as `X-Atlas-Client-IP`, which Atlas uses for rate limits, lockouts, risk checks and audit logs, so a visitor could pick their own IP. It now takes the `X-Forwarded-For` entry `trustedProxyHops` places from the right (default `1`: the one your nearest proxy appended), never reads `X-Real-IP`, and drops values that are not IP addresses.
|
|
20
|
+
- `createMountHandler` takes `X-Forwarded-Proto` from the nearest proxy's (last) entry, `http` or `https` only, so a browser-sent value cannot downgrade the scheme.
|
|
10
21
|
|
|
11
22
|
### Added
|
|
12
23
|
|
package/README.md
CHANGED
|
@@ -139,7 +139,7 @@ Set `ATLAS_UPSTREAM` (your instance's Frontend API host, from the domain's `inst
|
|
|
139
139
|
|
|
140
140
|
Use a base path without a leading underscore, such as `/atlas`. The App Router treats folders starting with `_` as private and never routes them, so the default `/__atlas` doesn't work in Next.js.
|
|
141
141
|
|
|
142
|
-
The handler forwards the method, path, query and body, drops any incoming `X-Atlas
|
|
142
|
+
The handler forwards the method, path, query and body. By default only the cookies `__session`, `__client` and `__atlas_*` and an allowlist of headers reach Atlas, so your app's own cookies and internal headers don't; `forwardCookies(name)` and `forwardHeaders(name)` replace those lists. It always drops any incoming `X-Atlas-*` (except `X-Atlas-SDK`), `X-Forwarded-*`, `Forwarded` and `X-Real-IP` headers, sets `X-Atlas-Forwarded-Host` and `X-Atlas-Proxy-Secret` itself, and returns every `Set-Cookie` and redirect unchanged. The client IP (`X-Atlas-Client-IP` and `X-Forwarded-For`) is the incoming `X-Forwarded-For` entry `trustedProxyHops` places from the right (default `1`: the entry your nearest proxy appended; entries further left are browser-controlled and ignored; `0` forwards none), or whatever `clientIp(request)` returns when you pass it; values that are not IP addresses are dropped. Without `ATLAS_UPSTREAM` or `ATLAS_PROXY_SECRET` the mount answers 503 and logs the missing variable once. Both handlers are also exported from `@atlasauth/nextjs`.
|
|
143
143
|
|
|
144
144
|
## Routing rules
|
|
145
145
|
|
package/dist/mount.d.ts
CHANGED
|
@@ -41,6 +41,18 @@ export interface AtlasMountOptions {
|
|
|
41
41
|
* browser-controlled and never used. `0` forwards no client IP.
|
|
42
42
|
*/
|
|
43
43
|
trustedProxyHops?: number;
|
|
44
|
+
/**
|
|
45
|
+
* Which request cookies reach Atlas, replacing the default: `__session`,
|
|
46
|
+
* `__client` and `__atlas_*`. Your app's own cookies stay on your side.
|
|
47
|
+
*/
|
|
48
|
+
forwardCookies?: (name: string) => boolean;
|
|
49
|
+
/**
|
|
50
|
+
* Which request headers reach Atlas (the name is lowercase), replacing the
|
|
51
|
+
* default list of browser basics and what Atlas reads. It can't let through
|
|
52
|
+
* hop-by-hop headers, `X-Forwarded-*`, or `X-Atlas-*` other than `X-Atlas-SDK`:
|
|
53
|
+
* Atlas trusts those from your proxy, so they are never taken from the browser.
|
|
54
|
+
*/
|
|
55
|
+
forwardHeaders?: (name: string) => boolean;
|
|
44
56
|
fetchImpl?: typeof fetch;
|
|
45
57
|
}
|
|
46
58
|
type Handler = (request: Request) => Promise<Response>;
|
|
@@ -55,9 +67,12 @@ export interface AtlasMountHandlers {
|
|
|
55
67
|
}
|
|
56
68
|
/**
|
|
57
69
|
* App Router handlers that forward the mount to Atlas: method, path (base
|
|
58
|
-
* included: Atlas reads the prefix from it), query and streamed body unchanged
|
|
59
|
-
*
|
|
60
|
-
*
|
|
70
|
+
* included: Atlas reads the prefix from it), query and streamed body unchanged.
|
|
71
|
+
* Only allowlisted request headers and cookies go upstream: browser basics, what
|
|
72
|
+
* Atlas reads, and the cookies `__session`, `__client` and `__atlas_*`
|
|
73
|
+
* (`forwardHeaders` and `forwardCookies` replace those lists). Hop-by-hop headers
|
|
74
|
+
* and every incoming `X-Atlas-*` (except `X-Atlas-SDK`), `X-Forwarded-*`,
|
|
75
|
+
* `Forwarded` and `X-Real-IP` header are always dropped, then set as: `X-Atlas-Forwarded-Host`
|
|
61
76
|
* from `Host`; `X-Atlas-Proxy-Secret` from config; `X-Atlas-Client-IP` and
|
|
62
77
|
* `X-Forwarded-For` from `options.clientIp`, else the incoming `X-Forwarded-For`
|
|
63
78
|
* entry `trustedProxyHops` (default 1) from the right, omitted when absent or not
|
package/dist/mount.js
CHANGED
|
@@ -27,7 +27,23 @@ function readEnv() {
|
|
|
27
27
|
return globalThis.process?.env ?? {};
|
|
28
28
|
}
|
|
29
29
|
const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'host', 'content-length']);
|
|
30
|
-
|
|
30
|
+
/** Hop-by-hop headers and the ones Atlas believes from a proxy or edge: never taken from the browser, whatever `forwardHeaders` says. */
|
|
31
|
+
const neverForwardHeader = (name) => HOP_BY_HOP.has(name) ||
|
|
32
|
+
name.startsWith('proxy-') ||
|
|
33
|
+
(name.startsWith('x-atlas-') && name !== 'x-atlas-sdk' && name !== 'x-atlas-app-version') ||
|
|
34
|
+
name.startsWith('x-forwarded-') ||
|
|
35
|
+
['forwarded', 'x-real-ip', 'cf-connecting-ip', 'true-client-ip', 'ssl-client-cert', 'x-client-cert'].includes(name);
|
|
36
|
+
const FORWARDED_HEADERS = new Set([
|
|
37
|
+
'accept', 'authorization', 'cache-control', 'content-encoding', 'content-type', 'cookie', 'last-event-id', 'origin', 'pragma', 'range', 'referer', 'user-agent',
|
|
38
|
+
'if-match', 'if-modified-since', 'if-none-match', 'if-range', 'if-unmodified-since',
|
|
39
|
+
// Sent by the Atlas SDKs.
|
|
40
|
+
'atlas-attestation', 'x-atlas-sdk', 'x-atlas-app-version', 'x-publishable-key', 'x-refresh-token',
|
|
41
|
+
// Read by the Frontend API and OpenID Provider routes under the mount.
|
|
42
|
+
'dpop', 'idempotency-key', 'mcp-session-id', 'oauth-client-attestation', 'oauth-client-attestation-pop', 'pca-action', 'workload-identity-token', 'workload-proof-token',
|
|
43
|
+
]);
|
|
44
|
+
const forwardHeaderByDefault = (name) => FORWARDED_HEADERS.has(name) || name.startsWith('accept-') || name.startsWith('access-control-request-') || name.startsWith('sec-fetch-') || name.startsWith('sec-ch-');
|
|
45
|
+
/** What Atlas reads and sets. Exact `__session` / `__client`: other vendors' `__session_*` and `__client_uat` are not ours to receive. */
|
|
46
|
+
const forwardCookieByDefault = (name) => name === '__session' || name === '__client' || name.startsWith('__atlas_');
|
|
31
47
|
const DROP_RESPONSE = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'te', 'trailer', 'content-encoding', 'content-length', 'set-cookie']);
|
|
32
48
|
const NULL_BODY_STATUS = new Set([101, 204, 205, 304]);
|
|
33
49
|
function setCookies(headers) {
|
|
@@ -79,11 +95,22 @@ function normaliseBase(raw) {
|
|
|
79
95
|
throw new Error('@atlasauth/nextjs createMountHandler: basePath must not be "/"');
|
|
80
96
|
return base;
|
|
81
97
|
}
|
|
98
|
+
/** The `Cookie` header with only the allowed cookies, or undefined when none is left. */
|
|
99
|
+
function filterCookies(header, allow) {
|
|
100
|
+
const kept = header
|
|
101
|
+
.split(';')
|
|
102
|
+
.map((part) => part.trim())
|
|
103
|
+
.filter((part) => part && allow(part.split('=', 1)[0].trim()));
|
|
104
|
+
return kept.length ? kept.join('; ') : undefined;
|
|
105
|
+
}
|
|
82
106
|
/**
|
|
83
107
|
* App Router handlers that forward the mount to Atlas: method, path (base
|
|
84
|
-
* included: Atlas reads the prefix from it), query and streamed body unchanged
|
|
85
|
-
*
|
|
86
|
-
*
|
|
108
|
+
* included: Atlas reads the prefix from it), query and streamed body unchanged.
|
|
109
|
+
* Only allowlisted request headers and cookies go upstream: browser basics, what
|
|
110
|
+
* Atlas reads, and the cookies `__session`, `__client` and `__atlas_*`
|
|
111
|
+
* (`forwardHeaders` and `forwardCookies` replace those lists). Hop-by-hop headers
|
|
112
|
+
* and every incoming `X-Atlas-*` (except `X-Atlas-SDK`), `X-Forwarded-*`,
|
|
113
|
+
* `Forwarded` and `X-Real-IP` header are always dropped, then set as: `X-Atlas-Forwarded-Host`
|
|
87
114
|
* from `Host`; `X-Atlas-Proxy-Secret` from config; `X-Atlas-Client-IP` and
|
|
88
115
|
* `X-Forwarded-For` from `options.clientIp`, else the incoming `X-Forwarded-For`
|
|
89
116
|
* entry `trustedProxyHops` (default 1) from the right, omitted when absent or not
|
|
@@ -117,9 +144,14 @@ function createMountHandler(options = {}) {
|
|
|
117
144
|
const origin = new URL(/^https?:\/\//i.test(upstream) ? upstream : `https://${upstream}`).origin;
|
|
118
145
|
const target = `${origin}${url.pathname}${url.search}`;
|
|
119
146
|
const headers = new Headers();
|
|
147
|
+
const forwardHeader = options.forwardHeaders ?? forwardHeaderByDefault;
|
|
120
148
|
request.headers.forEach((value, key) => {
|
|
121
|
-
|
|
122
|
-
|
|
149
|
+
const name = key.toLowerCase();
|
|
150
|
+
if (neverForwardHeader(name) || !forwardHeader(name))
|
|
151
|
+
return;
|
|
152
|
+
const kept = name === 'cookie' ? filterCookies(value, options.forwardCookies ?? forwardCookieByDefault) : value;
|
|
153
|
+
if (kept !== undefined)
|
|
154
|
+
headers.set(key, kept);
|
|
123
155
|
});
|
|
124
156
|
headers.set('x-atlas-forwarded-host', request.headers.get('host') ?? url.host);
|
|
125
157
|
headers.set('x-atlas-proxy-secret', proxySecret);
|
package/dist/mount.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;
|
|
1
|
+
{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAsJH,gDAmEC;AASD,kDAcC;AA5OD,SAAS,OAAO;IACd,OAAQ,UAA0C,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC;AAmDD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACpI,yIAAyI;AACzI,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,EAAE,CAC1C,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;IACpB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,qBAAqB,CAAC;IACzF,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;IAC/B,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY;IAC/J,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,qBAAqB;IACnF,0BAA0B;IAC1B,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB;IACjG,uEAAuE;IACvE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,YAAY,EAAE,yBAAyB,EAAE,sBAAsB;CACzK,CAAC,CAAC;AACH,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9C,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACzK,0IAA0I;AAC1I,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC5H,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AACjK,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEvD,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,CAAC,GAAG,OAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,SAAS;QAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;SAC5B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,wDAAwD;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,OAAgB,EAAE,OAA0B;IAC5D,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,kEAAkE;AAClE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;IACxD,IAAI,IAAI,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CAAC,MAAc,EAAE,KAAgC;IACrE,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,kBAAkB,CAAC,UAA6B,EAAE;IAChE,MAAM,MAAM,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,kBAAkB,CAAC;QAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,CAAC;gBACvB,OAAO,CAAC,KAAK,CACX,CAAC,QAAQ;oBACP,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,gGAAgG,CACrG,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE;gBAC7C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE;aACtF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;QAEzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjG,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,IAAI,sBAAsB,CAAC;QACvE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC7D,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAChH,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,+GAA+G;QAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE;YACrD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACxC,QAAQ,EAAE,QAAQ;YAClB,8CAA8C;YAC9C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxB,CAAC,CAAC;QAElB,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClH,CAAC;AAID;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,UAAkD,EAAE;IAGtF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO;YACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC,kBAAkB,CAAC;YACrE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,MAAM,KAAK,GACT,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBACxD,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACrI,CAAC;KACF,CAAC;AACJ,CAAC"}
|