@chatcops/server 0.5.0 → 0.6.0

package/dist/security/session-token.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Session token signing and verification using compact JWS with HS256 and Web Crypto (crypto.subtle).
+ */
+export interface SessionClaims {
+    v: 1;
+    sid: string;
+    cid: string;
+    org: string;
+    iat: number;
+    exp: number;
+    uid?: string;
+    tier?: string;
+}
+export type VerifySessionResult = {
+    ok: true;
+    claims: SessionClaims;
+} | {
+    ok: false;
+    code: 'malformed' | 'bad_signature' | 'expired' | 'origin_mismatch' | 'conversation_mismatch';
+};
+export interface VerifySessionOptions {
+    origin: string | null;
+    conversationId: string;
+    now?: number;
+    clockSkewSec?: number;
+}
+/**
+ * Strict, unpadded base64url encoding.
+ */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+/**
+ * Strict, unpadded base64url decoding. Rejects padding ('='), non-base64url characters,
+ * invalid lengths (len % 4 === 1), and non-canonical trailing bits.
+ */
+export declare function base64UrlDecode(str: string): Uint8Array;
+/**
+ * Imports an HMAC-SHA256 key for signing and verifying session tokens.
+ * Rejects secrets shorter than 32 UTF-8 bytes with a clear error.
+ * Does not access crypto.subtle at module load time.
+ */
+export declare function importSessionKey(secret: string | Uint8Array): Promise<CryptoKey>;
+/**
+ * Signs session claims using the first key in keys and sets kid to '0'.
+ */
+export declare function signSession(claims: SessionClaims | (Omit<SessionClaims, 'v'> & {
+    v?: 1;
+}), keys: CryptoKey[]): Promise<string>;
+/**
+ * Verifies a compact JWS signature over `header.payload` using HS256 and the provided key(s).
+ * Does not validate SessionClaims.
+ */
+export declare function verifySessionSignature(token: string, keys: CryptoKey[]): Promise<boolean>;
+/**
+ * Verifies a session token.
+ * 1. Checks compact JWS format (header.payload.signature) and base64url decoding.
+ * 2. Verifies header alg is HS256 (rejects none and any other algorithm).
+ * 3. Verifies signature over the exact original header.payload bytes via verifySessionSignature.
+ * 4. Only after signature verification succeeds, validates session claims:
+ *    v must be 1; sid, cid, org must be strings; uid and tier (if present) must be strings;
+ *    iat and exp must be valid numeric seconds.
+ * 5. Constructs returned claims exclusively from validated fields (never spreads untrusted payload).
+ * 6. Enforces expiration with clock skew (default 60s), exact origin matching, and exact conversation ID matching.
+ */
+export declare function verifySession(token: string, keys: CryptoKey[], options: VerifySessionOptions): Promise<VerifySessionResult>;
+//# sourceMappingURL=session-token.d.ts.map

package/dist/security/session-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token.d.ts","sourceRoot":"","sources":["../../src/security/session-token.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACnC;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EACA,WAAW,GACX,eAAe,GACf,SAAS,GACT,iBAAiB,GACjB,uBAAuB,CAAC;CAC7B,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAgCzD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAuEvD;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAYtF;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG;IAAE,CAAC,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC,EAC9D,IAAI,EAAE,SAAS,EAAE,GAChB,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,EAAE,GAChB,OAAO,CAAC,OAAO,CAAC,CA2DlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,EAAE,EACjB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA+H9B"}

package/dist/security/session-token.js

@@ -0,0 +1,338 @@
+/**
+ * Session token signing and verification using compact JWS with HS256 and Web Crypto (crypto.subtle).
+ */
+const B64URL_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const B64URL_LOOKUP = new Int8Array(256).fill(-1);
+for (let i = 0; i < B64URL_CHARS.length; i++) {
+    B64URL_LOOKUP[B64URL_CHARS.charCodeAt(i)] = i;
+}
+/**
+ * Strict, unpadded base64url encoding.
+ */
+export function base64UrlEncode(bytes) {
+    let result = '';
+    const len = bytes.length;
+    let i = 0;
+    for (; i + 2 < len; i += 3) {
+        const b0 = bytes[i];
+        const b1 = bytes[i + 1];
+        const b2 = bytes[i + 2];
+        result +=
+            B64URL_CHARS[b0 >> 2] +
+                B64URL_CHARS[((b0 & 3) << 4) | (b1 >> 4)] +
+                B64URL_CHARS[((b1 & 15) << 2) | (b2 >> 6)] +
+                B64URL_CHARS[b2 & 63];
+    }
+    if (i < len) {
+        const b0 = bytes[i];
+        if (i + 1 < len) {
+            const b1 = bytes[i + 1];
+            result +=
+                B64URL_CHARS[b0 >> 2] +
+                    B64URL_CHARS[((b0 & 3) << 4) | (b1 >> 4)] +
+                    B64URL_CHARS[(b1 & 15) << 2];
+        }
+        else {
+            result +=
+                B64URL_CHARS[b0 >> 2] +
+                    B64URL_CHARS[(b0 & 3) << 4];
+        }
+    }
+    return result;
+}
+/**
+ * Strict, unpadded base64url decoding. Rejects padding ('='), non-base64url characters,
+ * invalid lengths (len % 4 === 1), and non-canonical trailing bits.
+ */
+export function base64UrlDecode(str) {
+    if (typeof str !== 'string' || str.length === 0) {
+        throw new Error('Invalid base64url string: empty');
+    }
+    const len = str.length;
+    const rem = len % 4;
+    if (rem === 1) {
+        throw new Error('Invalid base64url string: length % 4 cannot be 1');
+    }
+    const byteLen = Math.floor(len / 4) * 3 + (rem === 2 ? 1 : rem === 3 ? 2 : 0);
+    const out = new Uint8Array(byteLen);
+    let inIdx = 0;
+    let outIdx = 0;
+    const fullChunks = Math.floor(len / 4);
+    for (let i = 0; i < fullChunks; i++) {
+        const code0 = str.charCodeAt(inIdx++);
+        const code1 = str.charCodeAt(inIdx++);
+        const code2 = str.charCodeAt(inIdx++);
+        const code3 = str.charCodeAt(inIdx++);
+        if (code0 >= 256 || code1 >= 256 || code2 >= 256 || code3 >= 256) {
+            throw new Error('Invalid base64url character');
+        }
+        const c0 = B64URL_LOOKUP[code0];
+        const c1 = B64URL_LOOKUP[code1];
+        const c2 = B64URL_LOOKUP[code2];
+        const c3 = B64URL_LOOKUP[code3];
+        if (c0 === -1 || c1 === -1 || c2 === -1 || c3 === -1) {
+            throw new Error('Invalid base64url character');
+        }
+        out[outIdx++] = (c0 << 2) | (c1 >> 4);
+        out[outIdx++] = ((c1 & 15) << 4) | (c2 >> 2);
+        out[outIdx++] = ((c2 & 3) << 6) | c3;
+    }
+    if (rem === 2) {
+        const code0 = str.charCodeAt(inIdx++);
+        const code1 = str.charCodeAt(inIdx++);
+        if (code0 >= 256 || code1 >= 256) {
+            throw new Error('Invalid base64url character');
+        }
+        const c0 = B64URL_LOOKUP[code0];
+        const c1 = B64URL_LOOKUP[code1];
+        if (c0 === -1 || c1 === -1 || (c1 & 15) !== 0) {
+            throw new Error('Invalid base64url character or non-canonical trailing bits');
+        }
+        out[outIdx++] = (c0 << 2) | (c1 >> 4);
+    }
+    else if (rem === 3) {
+        const code0 = str.charCodeAt(inIdx++);
+        const code1 = str.charCodeAt(inIdx++);
+        const code2 = str.charCodeAt(inIdx++);
+        if (code0 >= 256 || code1 >= 256 || code2 >= 256) {
+            throw new Error('Invalid base64url character');
+        }
+        const c0 = B64URL_LOOKUP[code0];
+        const c1 = B64URL_LOOKUP[code1];
+        const c2 = B64URL_LOOKUP[code2];
+        if (c0 === -1 || c1 === -1 || c2 === -1 || (c2 & 3) !== 0) {
+            throw new Error('Invalid base64url character or non-canonical trailing bits');
+        }
+        out[outIdx++] = (c0 << 2) | (c1 >> 4);
+        out[outIdx++] = ((c1 & 15) << 4) | (c2 >> 2);
+    }
+    return out;
+}
+/**
+ * Imports an HMAC-SHA256 key for signing and verifying session tokens.
+ * Rejects secrets shorter than 32 UTF-8 bytes with a clear error.
+ * Does not access crypto.subtle at module load time.
+ */
+export async function importSessionKey(secret) {
+    const bytes = typeof secret === 'string' ? new TextEncoder().encode(secret) : new Uint8Array(secret);
+    if (bytes.byteLength < 32) {
+        throw new Error(`Session secret must be at least 32 bytes (got ${bytes.byteLength})`);
+    }
+    return await crypto.subtle.importKey('raw', bytes, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
+}
+/**
+ * Signs session claims using the first key in keys and sets kid to '0'.
+ */
+export async function signSession(claims, keys) {
+    if (keys.length === 0) {
+        throw new Error('At least one key is required to sign');
+    }
+    const signingKey = keys[0];
+    const fullClaims = {
+        ...claims,
+        v: (claims.v ?? 1),
+    };
+    const header = {
+        alg: 'HS256',
+        typ: 'JWT',
+        kid: '0',
+    };
+    const headerB64 = base64UrlEncode(new TextEncoder().encode(JSON.stringify(header)));
+    const payloadB64 = base64UrlEncode(new TextEncoder().encode(JSON.stringify(fullClaims)));
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const signingInputBytes = new TextEncoder().encode(signingInput);
+    const signatureBuffer = await crypto.subtle.sign('HMAC', signingKey, signingInputBytes);
+    const signatureB64 = base64UrlEncode(new Uint8Array(signatureBuffer));
+    return `${signingInput}.${signatureB64}`;
+}
+/**
+ * Verifies a compact JWS signature over `header.payload` using HS256 and the provided key(s).
+ * Does not validate SessionClaims.
+ */
+export async function verifySessionSignature(token, keys) {
+    if (typeof token !== 'string')
+        return false;
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return false;
+    const [headerPart, payloadPart, signaturePart] = parts;
+    if (!headerPart || !payloadPart || !signaturePart)
+        return false;
+    let headerBytes;
+    let signatureBytes;
+    try {
+        headerBytes = base64UrlDecode(headerPart);
+        signatureBytes = base64UrlDecode(signaturePart);
+    }
+    catch {
+        return false;
+    }
+    let header;
+    try {
+        header = JSON.parse(new TextDecoder().decode(headerBytes));
+    }
+    catch {
+        return false;
+    }
+    if (typeof header !== 'object' || header === null || Array.isArray(header))
+        return false;
+    const headerObj = header;
+    if (headerObj.alg !== 'HS256')
+        return false;
+    if (keys.length === 0)
+        return false;
+    const signingInputBytes = new TextEncoder().encode(`${headerPart}.${payloadPart}`);
+    const kidRaw = headerObj.kid;
+    const indexedIdx = typeof kidRaw === 'number'
+        ? kidRaw
+        : typeof kidRaw === 'string' && /^\d+$/.test(kidRaw)
+            ? parseInt(kidRaw, 10)
+            : undefined;
+    if (indexedIdx !== undefined && indexedIdx >= 0 && indexedIdx < keys.length) {
+        try {
+            if (await crypto.subtle.verify('HMAC', keys[indexedIdx], signatureBytes, signingInputBytes)) {
+                return true;
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    for (let i = 0; i < keys.length; i++) {
+        if (i === indexedIdx)
+            continue;
+        try {
+            if (await crypto.subtle.verify('HMAC', keys[i], signatureBytes, signingInputBytes)) {
+                return true;
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    return false;
+}
+/**
+ * Verifies a session token.
+ * 1. Checks compact JWS format (header.payload.signature) and base64url decoding.
+ * 2. Verifies header alg is HS256 (rejects none and any other algorithm).
+ * 3. Verifies signature over the exact original header.payload bytes via verifySessionSignature.
+ * 4. Only after signature verification succeeds, validates session claims:
+ *    v must be 1; sid, cid, org must be strings; uid and tier (if present) must be strings;
+ *    iat and exp must be valid numeric seconds.
+ * 5. Constructs returned claims exclusively from validated fields (never spreads untrusted payload).
+ * 6. Enforces expiration with clock skew (default 60s), exact origin matching, and exact conversation ID matching.
+ */
+export async function verifySession(token, keys, options) {
+    if (typeof token !== 'string') {
+        return { ok: false, code: 'malformed' };
+    }
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return { ok: false, code: 'malformed' };
+    }
+    const [headerPart, payloadPart, signaturePart] = parts;
+    if (!headerPart || !payloadPart) {
+        return { ok: false, code: 'malformed' };
+    }
+    let headerBytes;
+    try {
+        headerBytes = base64UrlDecode(headerPart);
+    }
+    catch {
+        return { ok: false, code: 'malformed' };
+    }
+    let header;
+    try {
+        header = JSON.parse(new TextDecoder().decode(headerBytes));
+    }
+    catch {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof header !== 'object' || header === null || Array.isArray(header)) {
+        return { ok: false, code: 'malformed' };
+    }
+    const headerObj = header;
+    // Reject algorithms other than HS256, including 'none'
+    if (headerObj.alg !== 'HS256') {
+        return { ok: false, code: 'bad_signature' };
+    }
+    if (!signaturePart) {
+        return { ok: false, code: 'bad_signature' };
+    }
+    let payloadBytes;
+    try {
+        payloadBytes = base64UrlDecode(payloadPart);
+        base64UrlDecode(signaturePart);
+    }
+    catch {
+        return { ok: false, code: 'malformed' };
+    }
+    const verified = await verifySessionSignature(token, keys);
+    if (!verified) {
+        return { ok: false, code: 'bad_signature' };
+    }
+    // Validate all claims only after signature verification
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+    }
+    catch {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+        return { ok: false, code: 'malformed' };
+    }
+    const p = payload;
+    if (p.v !== 1) {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof p.sid !== 'string') {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof p.cid !== 'string') {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof p.org !== 'string') {
+        return { ok: false, code: 'malformed' };
+    }
+    if (p.uid !== undefined && typeof p.uid !== 'string') {
+        return { ok: false, code: 'malformed' };
+    }
+    if (p.tier !== undefined && typeof p.tier !== 'string') {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof p.iat !== 'number' || !Number.isFinite(p.iat)) {
+        return { ok: false, code: 'malformed' };
+    }
+    if (typeof p.exp !== 'number' || !Number.isFinite(p.exp)) {
+        return { ok: false, code: 'malformed' };
+    }
+    // Construct returned claims exclusively from validated fields
+    const claims = {
+        v: 1,
+        sid: p.sid,
+        cid: p.cid,
+        org: p.org,
+        iat: p.iat,
+        exp: p.exp,
+        ...(typeof p.uid === 'string' ? { uid: p.uid } : {}),
+        ...(typeof p.tier === 'string' ? { tier: p.tier } : {}),
+    };
+    // Expiration check with clock skew (default 60 seconds), strictly in seconds
+    const clockSkewSec = options.clockSkewSec ?? 60;
+    const nowSec = options.now ?? Math.floor(Date.now() / 1000);
+    if (nowSec - clockSkewSec > claims.exp) {
+        return { ok: false, code: 'expired' };
+    }
+    // Exact origin matching (origin: null directly compares claims.org !== null)
+    if (claims.org !== options.origin) {
+        return { ok: false, code: 'origin_mismatch' };
+    }
+    // Exact conversation ID matching
+    if (claims.cid !== options.conversationId) {
+        return { ok: false, code: 'conversation_mismatch' };
+    }
+    return { ok: true, claims };
+}
+//# sourceMappingURL=session-token.js.map

package/dist/security/session-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token.js","sourceRoot":"","sources":["../../src/security/session-token.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgCH,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF,MAAM,aAAa,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7C,aAAa,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,MAAM;YACJ,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;gBACrB,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACzC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1C,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,MAAM;gBACJ,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;oBACrB,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBACzC,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM;gBACJ,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;oBACrB,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAEtC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAA2B;IAChE,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,KAAK,EACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAA8D,EAC9D,IAAiB;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG;QACjB,GAAI,MAA6C;QACjD,CAAC,EAAE,CAAE,MAAkC,CAAC,CAAC,IAAI,CAAC,CAAM;KACrD,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzF,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAEjE,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IAEtE,OAAO,GAAG,YAAY,IAAI,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,IAAiB;IAEjB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;IACvD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEhE,IAAI,WAAuB,CAAC;IAC5B,IAAI,cAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC1C,cAAc,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC;IAC7B,MAAM,UAAU,GACd,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAClD,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,CAAC,CAAC,SAAS,CAAC;IAElB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,cAA8B,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC5G,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,UAAU;YAAE,SAAS;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAA8B,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACnG,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,IAAiB,EACjB,OAA6B;IAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;IACvD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,WAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,MAAiC,CAAC;IAEpD,uDAAuD;IACvD,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,YAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5C,eAAe,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC9C,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,CAAC,GAAG,OAAkC,CAAC;IAE7C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,MAAM,MAAM,GAAkB;QAC5B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IAEF,6EAA6E;IAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE5D,IAAI,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAChD,CAAC;IAED,iCAAiC;IACjC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/security/sessions.d.ts

@@ -0,0 +1,49 @@
+import { type WireErrorBody, type WireErrorCode } from '@chatcops/core';
+import { type SessionClaims } from './session-token.js';
+import { type TurnstileConfig } from './turnstile.js';
+/**
+ * Session tokens for the chat endpoint. `POST /session` gives the widget a
+ * short-lived token bound to its origin and one conversation id, and chat
+ * requests send it as `Authorization: Bearer <token>`. A visitor who guesses
+ * another conversation's id can't get a token for it, so the id alone no
+ * longer reads or writes someone else's conversation.
+ */
+export declare const DEFAULT_SESSION_TTL_SEC = 900;
+/** An expired token still resumes its conversation for this long after it expires. */
+export declare const SESSION_RESUME_GRACE_SEC: number;
+export interface SessionConfig {
+    sessionSecrets?: string[];
+    sessionTtlSec?: number;
+    requireSession?: boolean;
+    turnstile?: TurnstileConfig;
+}
+export type SessionCheck = {
+    ok: true;
+    claims?: SessionClaims;
+} | {
+    ok: false;
+    code: WireErrorCode;
+    message: string;
+};
+export interface SessionReply {
+    status: number;
+    body: {
+        token: string;
+        expiresAt: number;
+        conversationId: string;
+    } | WireErrorBody;
+}
+export interface Sessions {
+    /** Whether chat requests without a token are refused. */
+    required: boolean;
+    /** Answers `POST /session`. */
+    mint(body: unknown, origin: string | null, clientIp?: string): Promise<SessionReply>;
+    /** Checks the `Authorization` header of a chat request for this conversation. */
+    check(authorization: string | null | undefined, origin: string | null, conversationId: string): Promise<SessionCheck>;
+}
+/**
+ * `undefined` when `sessionSecrets` isn't set. Throws at startup on a bad
+ * config. `isUnused` says whether a conversation has nothing stored yet.
+ */
+export declare function createSessions(config: SessionConfig, isUnused?: (conversationId: string) => Promise<boolean>, now?: () => number): Sessions | undefined;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/security/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/security/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAgD,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEvE;;;;;;GAMG;AAEH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAI1D,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC;CACpF;AAED,MAAM,WAAW,QAAQ;IACvB,yDAAyD;IACzD,QAAQ,EAAE,OAAO,CAAC;IAClB,+BAA+B;IAC/B,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrF,iFAAiF;IACjF,KAAK,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACvH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,QAAQ,GAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAqB,EAC1E,GAAG,GAAE,MAAM,MAAiB,GAC3B,QAAQ,GAAG,SAAS,CAoGtB"}

package/dist/security/sessions.js

@@ -0,0 +1,159 @@
+import { errorBody } from '@chatcops/core';
+import { importSessionKey, signSession, verifySession } from './session-token.js';
+import { verifyTurnstile } from './turnstile.js';
+/**
+ * Session tokens for the chat endpoint. `POST /session` gives the widget a
+ * short-lived token bound to its origin and one conversation id, and chat
+ * requests send it as `Authorization: Bearer <token>`. A visitor who guesses
+ * another conversation's id can't get a token for it, so the id alone no
+ * longer reads or writes someone else's conversation.
+ */
+export const DEFAULT_SESSION_TTL_SEC = 900;
+/** An expired token still resumes its conversation for this long after it expires. */
+export const SESSION_RESUME_GRACE_SEC = 30 * 24 * 60 * 60;
+const MIN_SECRET_BYTES = 32;
+const MAX_ID_LENGTH = 128;
+/**
+ * `undefined` when `sessionSecrets` isn't set. Throws at startup on a bad
+ * config. `isUnused` says whether a conversation has nothing stored yet.
+ */
+export function createSessions(config, isUnused = async () => false, now = Date.now) {
+    const secrets = config.sessionSecrets;
+    if (secrets === undefined) {
+        if (config.requireSession)
+            throw new Error('`requireSession` needs `sessionSecrets` to sign tokens with.');
+        if (config.turnstile)
+            throw new Error('`turnstile` is checked when a session token is issued, so it needs `sessionSecrets`.');
+        return undefined;
+    }
+    const turnstile = config.turnstile;
+    if (turnstile && !turnstile.secretKey)
+        throw new Error('`turnstile` needs its `secretKey`.');
+    if (!Array.isArray(secrets) || secrets.length === 0)
+        throw new Error('`sessionSecrets` needs at least one secret.');
+    secrets.forEach((secret, i) => {
+        const bytes = typeof secret === 'string' ? new TextEncoder().encode(secret).byteLength : 0;
+        if (bytes < MIN_SECRET_BYTES) {
+            throw new Error(`sessionSecrets[${i}] is ${bytes} bytes; it needs at least ${MIN_SECRET_BYTES}. Generate one with \`openssl rand -base64 32\`.`);
+        }
+    });
+    const ttlSec = config.sessionTtlSec ?? DEFAULT_SESSION_TTL_SEC;
+    if (!(Number.isInteger(ttlSec) && ttlSec > 0))
+        throw new Error('`sessionTtlSec` must be a whole number of seconds above 0.');
+    // Imported on first use: Workers don't allow crypto.subtle at global scope.
+    let keys;
+    const getKeys = () => (keys ??= Promise.all(secrets.map((secret) => importSessionKey(secret))));
+    const nowSec = () => Math.floor(now() / 1000);
+    const required = config.requireSession ?? true;
+    return {
+        required,
+        async mint(body, origin, clientIp) {
+            const request = readMintRequest(body);
+            if (!request)
+                return { status: 400, body: errorBody('invalid_request', { message: 'Invalid session request' }) };
+            const org = origin ?? '';
+            const time = nowSec();
+            // Resuming a conversation needs a token that was issued for it, from
+            // this origin. Expired is fine within the grace window. An id with
+            // nothing stored yet (the widget makes its own) is given out as is,
+            // since there's nothing in it to read. Anything else gets a new
+            // conversation, so a guessed or leaked id is useless.
+            let resumed;
+            let cid;
+            if (request.conversationId && request.previousToken) {
+                const result = await verifySession(request.previousToken, await getKeys(), {
+                    origin: org,
+                    conversationId: request.conversationId,
+                    now: time,
+                    clockSkewSec: SESSION_RESUME_GRACE_SEC,
+                });
+                if (result.ok)
+                    resumed = result.claims;
+            }
+            // A refresh was checked when its first token was issued; a new session
+            // has to pass Turnstile first.
+            if (turnstile && !resumed) {
+                const result = await verifyTurnstile(request.turnstileToken, turnstile, {
+                    remoteIp: clientIp,
+                    idempotencyKey: request.idempotencyKey,
+                });
+                if (!result.ok) {
+                    if (result.code === 'unavailable') {
+                        console.warn('[chatcops] Turnstile could not be reached, so no session token was issued.');
+                        return { status: 503, body: errorBody('turnstile_failed', { message: 'Turnstile could not be reached. Try again.' }) };
+                    }
+                    return { status: 401, body: errorBody('turnstile_failed', { message: 'The Turnstile check failed.' }) };
+                }
+            }
+            if (resumed)
+                cid = resumed.cid;
+            else if (request.conversationId && (await isUnused(request.conversationId)))
+                cid = request.conversationId;
+            const claims = {
+                v: 1,
+                sid: resumed?.sid ?? crypto.randomUUID(),
+                cid: cid ?? crypto.randomUUID(),
+                org,
+                iat: time,
+                exp: time + ttlSec,
+            };
+            const token = await signSession(claims, await getKeys());
+            return { status: 200, body: { token, expiresAt: claims.exp * 1000, conversationId: claims.cid } };
+        },
+        async check(authorization, origin, conversationId) {
+            const token = bearer(authorization);
+            if (!token) {
+                return required
+                    ? { ok: false, code: 'session_required', message: 'This chat needs a session token. Get one from POST /session.' }
+                    : { ok: true };
+            }
+            const result = await verifySession(token, await getKeys(), { origin: origin ?? '', conversationId, now: nowSec() });
+            if (result.ok)
+                return { ok: true, claims: result.claims };
+            switch (result.code) {
+                case 'expired':
+                    return { ok: false, code: 'token_expired', message: 'The session token has expired. Get a new one from POST /session.' };
+                case 'conversation_mismatch':
+                    return { ok: false, code: 'conversation_mismatch', message: 'The session token is for a different conversation.' };
+                default:
+                    return { ok: false, code: 'session_required', message: 'The session token is invalid. Get a new one from POST /session.' };
+            }
+        },
+    };
+}
+function bearer(header) {
+    if (typeof header !== 'string')
+        return undefined;
+    const match = /^Bearer\s+(\S+)\s*$/i.exec(header);
+    return match?.[1];
+}
+function readMintRequest(body) {
+    if (body === undefined || body === null)
+        return {};
+    if (typeof body !== 'object' || Array.isArray(body))
+        return undefined;
+    const { conversationId, previousToken, turnstileToken, idempotencyKey } = body;
+    const request = {};
+    if (turnstileToken !== undefined) {
+        if (typeof turnstileToken !== 'string' || turnstileToken.length > 4096)
+            return undefined;
+        request.turnstileToken = turnstileToken;
+    }
+    if (idempotencyKey !== undefined) {
+        if (typeof idempotencyKey !== 'string' || idempotencyKey.length > 128)
+            return undefined;
+        request.idempotencyKey = idempotencyKey;
+    }
+    if (conversationId !== undefined) {
+        if (typeof conversationId !== 'string' || conversationId.length === 0 || conversationId.length > MAX_ID_LENGTH)
+            return undefined;
+        request.conversationId = conversationId;
+    }
+    if (previousToken !== undefined) {
+        if (typeof previousToken !== 'string' || previousToken.length > 4096)
+            return undefined;
+        request.previousToken = previousToken;
+    }
+    return request;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/security/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/security/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA0C,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAsB,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,eAAe,EAAwB,MAAM,gBAAgB,CAAC;AAEvE;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,aAAa,GAAG,GAAG,CAAC;AA2B1B;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,WAAyD,KAAK,IAAI,EAAE,CAAC,KAAK,EAC1E,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC3G,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC9H,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACpH,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,QAAQ,KAAK,6BAA6B,gBAAgB,kDAAkD,CAAC,CAAC;QACnJ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAC/D,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAE7H,4EAA4E;IAC5E,IAAI,IAAsC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAE/C,OAAO;QACL,QAAQ;QAER,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ;YAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,EAAE,CAAC;YACjH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;YAEtB,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,gEAAgE;YAChE,sDAAsD;YACtD,IAAI,OAAkC,CAAC;YACvC,IAAI,GAAuB,CAAC;YAC5B,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,OAAO,EAAE,EAAE;oBACzE,MAAM,EAAE,GAAG;oBACX,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,GAAG,EAAE,IAAI;oBACT,YAAY,EAAE,wBAAwB;iBACvC,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACzC,CAAC;YACD,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,OAAO,CAAC,cAAc;iBACvC,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAClC,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;wBAC3F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,EAAE,CAAC;oBACzH,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,EAAE,CAAC;gBAC1G,CAAC;YACH,CAAC;YAED,IAAI,OAAO;gBAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;iBAC1B,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBAAE,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;YAE1G,MAAM,MAAM,GAAkB;gBAC5B,CAAC,EAAE,CAAC;gBACJ,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE;gBACxC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE;gBAC/B,GAAG;gBACH,GAAG,EAAE,IAAI;gBACT,GAAG,EAAE,IAAI,GAAG,MAAM;aACnB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;QACpG,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,QAAQ;oBACb,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8DAA8D,EAAE;oBAClH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACpH,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,SAAS;oBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;gBAC3H,KAAK,uBAAuB;oBAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;gBACrH;oBACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC;YAC/H,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAiC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAUD,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,IAA+B,CAAC;IAC1G,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;IAC1C,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC;QACxF,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;IAC1C,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,aAAa;YAAE,OAAO,SAAS,CAAC;QACjI,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;IAC1C,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,SAAS,CAAC;QACvF,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}