@connextar/house 0.18.0 → 0.19.1

package/dist/admin/testing.js

@@ -0,0 +1,223 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, sep } from "node:path";
+export class AdminGuardCoverageError extends Error {
+    problems;
+    constructor(problems) {
+        super(`Admin guard coverage — ${problems.length} problem${problems.length === 1 ? "" : "s"}:\n  - ${problems.join("\n  - ")}`);
+        this.name = "AdminGuardCoverageError";
+        this.problems = problems;
+    }
+}
+const METHODS = "GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS";
+const HANDLER = new RegExp(String.raw `export\s+async\s+function\s+(${METHODS})\s*\(`, "g");
+const UNREADABLE = [
+    new RegExp(String.raw `export\s+(?:const|let|var)\s+(${METHODS})\b`, "g"),
+    new RegExp(String.raw `export\s+function\s+(${METHODS})\b`, "g"),
+    new RegExp(String.raw `export\s*\{[^}]*\b(${METHODS})\b[^}]*\}`, "g"),
+    new RegExp(String.raw `export\s+default\b`, "g"),
+];
+const SOURCE = /\.(?:[cm]?[jt]sx?)$/;
+const TEST = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+const ROUTE = /^route\.[cm]?[jt]sx?$/;
+const DEFAULT_PAGE = /^page\.[jt]sx?$/;
+/** Source with its comments blanked out, strings and template literals left as they are. */
+export function stripComments(source) {
+    let out = "";
+    let i = 0;
+    let quote = null;
+    while (i < source.length) {
+        const char = source[i];
+        const next = source[i + 1];
+        if (quote) {
+            out += char;
+            if (char === "\\") {
+                out += next ?? "";
+                i += 2;
+                continue;
+            }
+            if (char === quote)
+                quote = null;
+            i += 1;
+            continue;
+        }
+        if (char === "\\") {
+            out += char + (next ?? "");
+            i += 2;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === "`") {
+            quote = char;
+            out += char;
+            i += 1;
+            continue;
+        }
+        if (char === "/" && next === "/") {
+            while (i < source.length && source[i] !== "\n")
+                i += 1;
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            const end = source.indexOf("*/", i + 2);
+            const stop = end === -1 ? source.length : end + 2;
+            // Keep the line breaks, so nothing after the comment moves line.
+            out += source.slice(i, stop).replace(/[^\n]/g, " ");
+            i = stop;
+            continue;
+        }
+        out += char;
+        i += 1;
+    }
+    return out;
+}
+function filesUnder(root, dir, match) {
+    const full = join(root, dir);
+    if (!existsSync(full))
+        return [];
+    const out = [];
+    for (const name of readdirSync(full).sort()) {
+        if (name === "node_modules" || name.startsWith("."))
+            continue;
+        const path = join(dir, name);
+        if (statSync(join(root, path)).isDirectory())
+            out.push(...filesUnder(root, path, match));
+        else if (match(name))
+            out.push(path);
+    }
+    return out;
+}
+const posix = (path) => path.split(sep).join("/");
+const names = (guard) => (typeof guard === "string" ? [guard] : [...guard]);
+/** The sweep, answering every problem it found rather than stopping at the first. */
+export function checkAdminGuardCoverage(options) {
+    const root = options.root ?? process.cwd();
+    const apiGuards = names(options.apiGuard);
+    const pageGuards = names(options.pageGuard);
+    const exempt = options.exempt ?? {};
+    const pageFile = options.pageFile ?? DEFAULT_PAGE;
+    const problems = [];
+    const read = (file) => readFileSync(join(root, file), "utf8");
+    const calls = (name, guards) => guards.some((guard) => name === guard || name.endsWith(`.${guard}`));
+    for (const dir of [...options.apiDirs, ...options.pageDirs]) {
+        if (!existsSync(join(root, dir)))
+            problems.push(`${dir}: not found — the sweep would check nothing there`);
+    }
+    const routes = [
+        ...new Set([...options.apiDirs, ...options.pageDirs].flatMap((dir) => filesUnder(root, dir, (n) => ROUTE.test(n)))),
+    ]
+        .map(posix)
+        .sort();
+    const handlers = [];
+    const usedExemptions = new Set();
+    for (const route of routes) {
+        const code = stripComments(read(route));
+        for (const pattern of UNREADABLE) {
+            for (const match of code.matchAll(pattern)) {
+                problems.push(`${route}: \`${match[0].replace(/\s+/g, " ").trim()}\` — export handlers as \`export async function ${match[1] ?? "GET"}(…)\` so the sweep can read them`);
+            }
+        }
+        const found = [...code.matchAll(HANDLER)];
+        if (found.length === 0)
+            problems.push(`${route}: no \`export async function <METHOD>(…)\` handler found`);
+        found.forEach((handler, index) => {
+            const name = `${route} ${handler[1]}`;
+            handlers.push(name);
+            if (Object.hasOwn(exempt, name)) {
+                usedExemptions.add(name);
+                return;
+            }
+            const end = found[index + 1]?.index ?? code.length;
+            const body = code.slice(handler.index, end);
+            const first = /\bawait\s+([\w$.]+)\s*\(/.exec(body)?.[1];
+            if (!first)
+                problems.push(`${name}: never awaits ${apiGuards.join(" or ")}`);
+            else if (!calls(first, apiGuards)) {
+                problems.push(`${name}: the first await is ${first}(), not ${apiGuards.join(" or ")}()`);
+            }
+        });
+    }
+    for (const name of Object.keys(exempt)) {
+        if (!usedExemptions.has(name))
+            problems.push(`exempt "${name}": no such handler — remove the exemption`);
+    }
+    const pages = [...new Set(options.pageDirs.flatMap((dir) => filesUnder(root, dir, (n) => pageFile.test(n))))]
+        .map(posix)
+        .sort();
+    const pageCall = new RegExp(String.raw `\bawait\s+(?:[\w$]+\.)*(?:${pageGuards.map(escape).join("|")})\s*\(`);
+    for (const page of pages) {
+        if (!pageCall.test(stripComments(read(page))))
+            problems.push(`${page}: does not await ${pageGuards.join(" or ")}()`);
+    }
+    for (const file of [...options.apiDirs, ...options.pageDirs].flatMap((dir) => filesUnder(root, dir, (n) => SOURCE.test(n) && !TEST.test(n)))) {
+        if (/^\s*(?:\/\/[^\n]*\n\s*|\/\*[\s\S]*?\*\/\s*)*["']use server["']/.test(read(file))) {
+            problems.push(`${posix(file)}: a "use server" file is an endpoint the route sweep cannot see — make it a route`);
+        }
+    }
+    let flagReaders = [];
+    if (options.flagReaders) {
+        const { pattern, dirs, allowed, ignore } = options.flagReaders;
+        const probe = new RegExp(pattern.source, pattern.flags.replace(/g|y/g, ""));
+        flagReaders = [...new Set(dirs.flatMap((dir) => filesUnder(root, dir, (n) => SOURCE.test(n) && !TEST.test(n))))]
+            .map(posix)
+            .filter((file) => !ignore?.(file))
+            .filter((file) => probe.test(read(file)))
+            .sort();
+        for (const file of flagReaders) {
+            if (!Object.hasOwn(allowed, file)) {
+                problems.push(`${file}: mentions the admin flag (${pattern}) and is not on the allow-list — check it goes through the guard, then list it with why`);
+            }
+        }
+        for (const file of Object.keys(allowed)) {
+            if (!flagReaders.includes(file))
+                problems.push(`${file}: is on the flag allow-list but no longer mentions it — remove it`);
+        }
+    }
+    const minimum = { routes: 1, handlers: 1, pages: 1, ...options.minimum };
+    if (options.apiDirs.length && routes.length < minimum.routes) {
+        problems.push(`found ${routes.length} admin route file(s), expected at least ${minimum.routes}`);
+    }
+    if (options.apiDirs.length && handlers.length < minimum.handlers) {
+        problems.push(`found ${handlers.length} admin handler(s), expected at least ${minimum.handlers}`);
+    }
+    if (options.pageDirs.length && pages.length < minimum.pages) {
+        problems.push(`found ${pages.length} admin page(s), expected at least ${minimum.pages}`);
+    }
+    return { routes, handlers, pages, flagReaders, problems };
+}
+function escape(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** The sweep, throwing every problem at once. Answers what it checked, so a test can say how much. */
+export function assertAdminGuardCoverage(options) {
+    const report = checkAdminGuardCoverage(options);
+    if (report.problems.length)
+        throw new AdminGuardCoverageError(report.problems);
+    return report;
+}
+/** A cookie store in memory, shaped like Next's `cookies()`, for testing an app's "view as". */
+export function memoryCookieJar(initial = {}) {
+    const values = new Map(Object.entries(initial));
+    const attributes = new Map();
+    const jar = {
+        get(name) {
+            const value = values.get(name);
+            return value === undefined ? undefined : { name, value };
+        },
+        set(name, value, options) {
+            values.set(name, value);
+            attributes.set(name, options);
+        },
+        delete(name) {
+            values.delete(name);
+            attributes.delete(name);
+        },
+        /** What `set` was given for a cookie. */
+        options(name) {
+            return attributes.get(name);
+        },
+        has(name) {
+            return values.has(name);
+        },
+    };
+    return jar;
+}
+//# sourceMappingURL=testing.js.map

package/dist/admin/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../src/admin/testing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA+DtC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,QAAQ,CAAW;IAE5B,YAAY,QAAkB;QAC5B,KAAK,CACH,0BAA0B,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,GAAG,wCAAwC,CAAC;AACzD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gCAAgC,OAAO,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC3F,MAAM,UAAU,GAAG;IACjB,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iCAAiC,OAAO,KAAK,EAAE,GAAG,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,wBAAwB,OAAO,KAAK,EAAE,GAAG,CAAC;IAC/D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,sBAAsB,OAAO,YAAY,EAAE,GAAG,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,oBAAoB,EAAE,GAAG,CAAC;CAChD,CAAC;AACF,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAC9C,MAAM,KAAK,GAAG,uBAAuB,CAAC;AACtC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,IAAI,CAAC;YACZ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;gBAClB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YACjC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC3B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,GAAG,IAAI,CAAC;YACb,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAClD,iEAAiE;YACjE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC,GAAG,IAAI,CAAC;YACT,SAAS;QACX,CAAC;QACD,GAAG,IAAI,IAAI,CAAC;QACZ,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,KAAgC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;aACpF,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,MAAM,KAAK,GAAG,CAAC,KAAiC,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AAExG,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,OAAkC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAgB,EAAE,EAAE,CAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IAEvE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mDAAmD,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpH;SACE,GAAG,CAAC,KAAK,CAAC;SACV,IAAI,EAAE,CAAC;IACV,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,mDAAmD,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,kCAAkC,CAC1J,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,0DAA0D,CAAC,CAAC;QAC1G,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;iBACxE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,wBAAwB,KAAK,WAAW,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,2CAA2C,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC1G,GAAG,CAAC,KAAK,CAAC;SACV,IAAI,EAAE,CAAC;IACV,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,6BAA6B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3E,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAC9D,EAAE,CAAC;QACF,IAAI,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5E,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC7G,GAAG,CAAC,KAAK,CAAC;aACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;aACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACxC,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,8BAA8B,OAAO,yFAAyF,CACtI,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,mEAAmE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACzE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,MAAM,2CAA2C,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,MAAM,wCAAwC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,MAAM,qCAAqC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2C,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,IAAY;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,OAA6B;YAC5D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,IAAY;YACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,yCAAyC;QACzC,OAAO,CAAC,IAAY;YAClB,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,GAAG,CAAC,IAAY;YACd,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;KAC4C,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/admin/view-as.d.ts

@@ -0,0 +1,209 @@
+import { type AdminAccess, type AdminRefusal } from "./access.js";
+import { type AdminAuditScope, type AdminAuditSink, type AuditLogger, type RequestMeta } from "./audit.js";
+/**
+ * "View as" — seeing the product through one person's account, AltEd's rules made safe by default.
+ *
+ * Support needs the shape of what somebody sees, not just their rows. An administrator can already read every record,
+ * so a view grants no new access: it changes which screens render, not what may be read. Five rules make it safe:
+ *
+ * 1. **Read-only.** Every write is refused while viewing, except the app's allow-list of writes that happen as a side
+ *    effect of reading (`viewAsWriteGuard`). What reaches outside the database — Stripe, email, a rate-limit bucket —
+ *    is refused in the route with `refuseWhileViewingAs`.
+ * 2. **Short.** The cookie lapses on its own (60 minutes by default), and the expiry is inside the signed value, so the
+ *    server decides rather than the browser.
+ * 3. **The administrator's, and only while they are one.** The cookie names the administrator who started it, and is
+ *    honoured only while the real session passes `adminAccess` — checked on every request, so a demotion, a revoked
+ *    session or a sign-in without the second factor ends the view at once. A cookie is a browser's, not a session's,
+ *    and `signOut` does not clear it: the next person to sign in on a shared machine inherits nothing.
+ * 4. **Never another administrator.** Their view is this one; viewing as them would let one administrator act with
+ *    another's standing. Checked when it starts and on every read, so a promotion mid-view ends it.
+ * 5. **Recorded.** Starting and stopping are both audit events naming the administrator and the account.
+ *
+ * **Signed.** AltEd's cookie was unsigned by design — honoured only for an administrator, who could start any view
+ * anyway. That holds only while every reader checks the binding the same way; signing it costs one HMAC and makes a
+ * forged or edited cookie worthless whoever reads it.
+ */
+/** The cookie store this writes to — Next's `cookies()` from `next/headers` fits it as it is. */
+export interface CookieJar {
+    get(name: string): {
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options?: ViewAsCookieOptions): unknown;
+    delete(name: string): unknown;
+}
+export interface ViewAsCookieOptions {
+    httpOnly: boolean;
+    sameSite: "lax" | "strict";
+    secure: boolean;
+    path: string;
+    maxAge: number;
+}
+export interface ViewAsOptions {
+    cookieName: string;
+    /** At least 32 characters. The app's `BETTER_AUTH_SECRET` serves; the cookie name keeps the signature its own. */
+    secret: string;
+    /** How long a view lasts before it lapses on its own. Default 60. */
+    minutes?: number;
+    /** The request's cookie store: `cookies` from `next/headers`, or anything shaped like it. */
+    cookies: () => CookieJar | Promise<CookieJar>;
+    /** The app's `adminAccess`: the real session must pass it to start a view, and for the view to be honoured. */
+    access: AdminAccess;
+    /** Where start and stop are recorded. */
+    audit?: AdminAuditSink;
+    /** A name for the audit events when the caller does not pass one. */
+    names?: (userId: string) => string | null | undefined | Promise<string | null | undefined>;
+    /** The actor's standing in the audit events. Default `"admin"`. */
+    standing?: string;
+    /** The audit events' scope. Default platform. */
+    scope?: AdminAuditScope;
+    /** Default: `process.env.NODE_ENV === "production"`. */
+    secure?: boolean;
+    /** Default `"/"`. */
+    path?: string;
+    /** For the refusals `start` answers with. */
+    words?: {
+        self?: string;
+        targetIsAdmin?: string;
+    };
+    logger?: AuditLogger;
+    /** For tests. */
+    now?: () => number;
+}
+/** A view in force. */
+export interface ViewingAs {
+    targetId: string;
+    adminId: string;
+    expiresAt: Date;
+}
+/** The administrator behind the request — the real session, never the account on screen. */
+export interface RealAdmin {
+    id: string;
+    sessionId: string;
+    name?: string | null;
+}
+export type ViewAsStartRefusal = {
+    ok: false;
+    reason: "self" | "target-is-admin";
+    message: string;
+    status: 400;
+} | AdminRefusal;
+export type ViewAsStartResult = {
+    ok: true;
+    view: ViewingAs;
+    minutes: number;
+} | ViewAsStartRefusal;
+export interface ViewAs {
+    /** Start viewing as `target`, for this administrator. Refused unless their real session passes `adminAccess`. */
+    start(admin: RealAdmin, target: string | {
+        id: string;
+        name?: string | null;
+    }, meta?: RequestMeta): Promise<ViewAsStartResult>;
+    /**
+     * End the view. Works for anybody signed in — while a view is in force the request presents as the person viewed,
+     * who is not an administrator and could not otherwise end it. Recorded when it was this administrator's view.
+     */
+    stop(realAdmin?: {
+        id: string;
+        name?: string | null;
+    } | null, meta?: RequestMeta): Promise<{
+        stopped: ViewingAs | null;
+    }>;
+    /** The view in force for this administrator, or null. Never writes, so a server component can call it. */
+    read(realAdmin: RealAdmin | null | undefined): Promise<ViewingAs | null>;
+    readonly cookieName: string;
+    readonly minutes: number;
+}
+export declare function viewAs(options: ViewAsOptions): ViewAs;
+/** Whoever the request presents as: AltEd's and Quickie's `impersonatedBy`, or a `viewingAs`. */
+export interface MaybeViewing {
+    name?: string | null;
+    impersonatedBy?: unknown;
+    viewingAs?: {
+        name?: string | null;
+    } | boolean | null;
+}
+export interface RefuseWhileViewingAsOptions {
+    /** Throw the app's own error class: `(message) => new ForbiddenError(message)`. Default `AdminRefusalError`. */
+    makeError?: (message: string) => Error;
+}
+/** The sentence a refusal under "view as" says. */
+export declare function viewingAsMessage(name: string | null | undefined, what: string): string;
+/**
+ * Refuse, under "view as", a request that acts for the viewed account where the write guard cannot see it: a Stripe
+ * call, an email, a rate-limit bucket. Call it first in the route, before anything is spent.
+ */
+export declare function refuseWhileViewingAs(user: MaybeViewing | null | undefined, what: string, options?: RefuseWhileViewingAsOptions): void;
+/** The view this request is in, as the app's request-scoped actor has it: `{ name }`, `true`, or null when not. */
+export type ViewingLookup = () => {
+    name?: string | null;
+} | boolean | null | undefined | Promise<{
+    name?: string | null;
+} | boolean | null | undefined>;
+export interface ViewingAsGateOptions {
+    /** The same lookup the write guard takes — the app's request actor's `viewingAs`. */
+    getViewing: ViewingLookup;
+    makeError?: (message: string) => Error;
+}
+export interface ViewingAsGate {
+    isViewingAs(): Promise<boolean>;
+    /** Throws under "view as". Fail-closed: a lookup that throws refuses too. */
+    assertNotViewingAs(what: string): Promise<void>;
+}
+/**
+ * The fail-closed default for what reaches outside the database: call `assertNotViewingAs` once inside the app's own
+ * `sendEmail`, `sendSms`, Stripe, GoCardless, Xero and AI wrappers, and every route that uses them is covered —
+ * including the next one written. Quickie had to add `refuseWhileViewingAs` to thirty handlers by hand.
+ *
+ * It reads the app's request-scoped actor rather than keeping a store of its own. An `AsyncLocalStorage` set where the
+ * view is resolved — inside `getCurrentUser`, an awaited callee — does not reach the route's later calls: a store
+ * entered in a callee after its first await (the session read) never propagates back to the caller's continuation
+ * (`view-as.test.ts` pins it), and wrapping
+ * every handler in `withViewingAs(…, fn)` is the per-route step this exists to remove. Quickie's and AltEd's actor
+ * is keyed on the request itself (Next's `headers()` object), which every call in the request shares.
+ */
+export declare function viewingAsGate(options: ViewingAsGateOptions): ViewingAsGate;
+/** Every Prisma write operation. A read is never refused — that is the whole point of a view. */
+export declare const PRISMA_WRITE_OPERATIONS: ReadonlySet<string>;
+/** `allow` from a map of model → operations: `allowWhileViewing({ Session: ["update", "updateMany"] })`. */
+export declare function allowWhileViewing(list: Record<string, readonly string[]>): (model: string | undefined, operation: string) => boolean;
+/** The arguments Prisma hands a `$allOperations` query extension. */
+export interface PrismaOperationParams {
+    model?: string;
+    operation: string;
+    args: unknown;
+    query: (args: unknown) => Promise<unknown>;
+}
+export interface ViewAsWriteGuardOptions {
+    /** Which operations are writes. Default: {@link PRISMA_WRITE_OPERATIONS}. */
+    isWrite?: (operation: string) => boolean;
+    /**
+     * The writes that happen as a side effect of reading, and so stay allowed: Better Auth touching the session row,
+     * the rate limiter counting, the audit trail recording the view itself. Everything else is refused.
+     */
+    allow: (model: string | undefined, operation: string) => boolean;
+    /** The view this request is in, from the app's request actor: `{ name }`, `true`, or null when not viewing. */
+    getViewing: ViewingLookup;
+    makeError?: (message: string) => Error;
+    /** The extension's name. Default `"view-as-write-guard"`. */
+    name?: string;
+}
+/**
+ * Make "view as" read-only at the client: `prisma.$extends(viewAsWriteGuard({ … }))`. Every write that arrives while
+ * the request is viewing as somebody is refused, whichever handler made it, unless it is on the allow-list.
+ *
+ * The rule is inverted from "block what is audited", which AltEd learnt by running it: deleting an account ran
+ * `session.deleteMany` and `passkey.deleteMany` before it touched the user row, so the deletion was refused —
+ * correctly — after signing the family out of every device. So everything is refused except what is allowed.
+ *
+ * Typed structurally, so this package imports no Prisma. If an app's Prisma types object to it, wrap it:
+ * `Prisma.defineExtension(viewAsWriteGuard({ … }))`.
+ */
+export declare function viewAsWriteGuard(options: ViewAsWriteGuardOptions): {
+    name: string;
+    query: {
+        $allModels: {
+            $allOperations({ model, operation, args, query }: PrismaOperationParams): Promise<unknown>;
+        };
+    };
+};
+//# sourceMappingURL=view-as.d.ts.map

package/dist/admin/view-as.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-as.d.ts","sourceRoot":"","sources":["../../src/admin/view-as.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmC,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kHAAkH;IAClH,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,OAAO,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,+GAA+G;IAC/G,MAAM,EAAE,WAAW,CAAC;IACpB,yCAAyC;IACzC,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,qEAAqE;IACrE,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3F,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,uBAAuB;AACvB,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,4FAA4F;AAC5F,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,MAAM,kBAAkB,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAAG,YAAY,CAAC;AAEjG,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAAC;AAEpG,MAAM,WAAW,MAAM;IACrB,iHAAiH;IACjH,KAAK,CACH,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EACrD,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B;;;OAGG;IACH,IAAI,CACF,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,EACvD,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC1C,0GAA0G;IAC1G,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAOD,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CA4IrD;AAED,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,2BAA2B;IAC1C,gHAAgH;IAChH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC;CACxC;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,2BAAgC,GACxC,IAAI,CAMN;AAED,mHAAmH;AACnH,MAAM,MAAM,aAAa,GAAG,MACxB;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxB,OAAO,GACP,IAAI,GACJ,SAAS,GACT,OAAO,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,UAAU,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,6EAA6E;IAC7E,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAuB1E;AAED,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAUtD,CAAC;AAEH,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GACtC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAG3D;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC;;;OAGG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjE,+GAA+G;IAC/G,UAAU,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC;IACvC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;;;;8DAMD,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;;;EAgBvG"}