@crowi/api 2.0.0-alpha.0

package/dist/util/ts-rest-helpers.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadGrantedPage = exports.internalServerErrorResponse = exports.invalidPageIdResponse = exports.pageNotFoundResponse = exports.isPopulatedUser = exports.isValidObjectId = exports.toUserPublic = exports.toPageUser = exports.toStringId = exports.toISOStringOrNull = void 0;
+const api_contract_1 = require("@crowi/api-contract");
+const toISOStringOrNull = (date) => {
+    if (!date)
+        return null;
+    return date instanceof Date ? date.toISOString() : String(date);
+};
+exports.toISOStringOrNull = toISOStringOrNull;
+const toStringId = (id) => {
+    return typeof id === 'string' ? id : id.toString();
+};
+exports.toStringId = toStringId;
+const toPageUser = (user) => ({
+    _id: user._id.toString(),
+    id: user._id.toString(),
+    username: user.username,
+    name: user.name,
+    email: user.email,
+    image: user.image || null,
+    createdAt: (0, exports.toISOStringOrNull)(user.createdAt) || new Date().toISOString(),
+});
+exports.toPageUser = toPageUser;
+const KNOWN_USER_STATUSES = new Set(Object.values(api_contract_1.UserPublicStatus));
+/**
+ * Narrow Mongo's `status: number` to the typed enum on the wire. Hand-edited
+ * rows or pre-migration data outside 1..5 collapse to `undefined` so the
+ * response still satisfies the schema instead of 500-ing in the response
+ * validator.
+ */
+const toUserStatus = (status) => {
+    return status !== undefined && KNOWN_USER_STATUSES.has(status) ? status : undefined;
+};
+const toUserPublic = (user) => ({
+    _id: (0, exports.toStringId)(user._id),
+    id: (0, exports.toStringId)(user._id),
+    username: user.username ?? '',
+    name: user.name ?? '',
+    email: user.email ?? '',
+    image: user.image ?? null,
+    introduction: user.introduction ?? '',
+    createdAt: (0, exports.toISOStringOrNull)(user.createdAt) ?? new Date().toISOString(),
+    admin: user.admin ?? false,
+    status: toUserStatus(user.status),
+});
+exports.toUserPublic = toUserPublic;
+/**
+ * Strict 24-character hex string check for Mongo ObjectId.
+ * `Types.ObjectId.isValid()` accepts 12-byte buffers and other formats; we
+ * only accept the canonical hex string used in URLs and request bodies.
+ */
+const isValidObjectId = (id) => typeof id === 'string' && /^[0-9a-f]{24}$/.test(id);
+exports.isValidObjectId = isValidObjectId;
+/**
+ * Heuristic for "this is a populated user document, not just an ObjectId".
+ * The 4 ts-rest routes all need this; the loose form (only _id + username +
+ * email) covers all current call sites.
+ */
+const isPopulatedUser = (value) => {
+    return !!value && typeof value === 'object' && '_id' in value && 'username' in value && 'email' in value;
+};
+exports.isPopulatedUser = isPopulatedUser;
+/**
+ * Standard 404 for "page not found OR not granted". Mapped to 404 (not 403)
+ * so we do not leak page existence to callers without grant.
+ */
+exports.pageNotFoundResponse = {
+    status: 404,
+    body: { error: { code: 'PAGE_NOT_FOUND', message: 'Page not found' } },
+};
+/**
+ * Standard 400 for an invalid page_id (not 24-char hex).
+ */
+exports.invalidPageIdResponse = {
+    status: 400,
+    body: { error: { code: 'INVALID_PAGE_ID', message: 'Invalid page_id' } },
+};
+/**
+ * Standard 500 for an unexpected handler failure. Used by every admin
+ * handler that wraps its body in try/catch and needs to surface a typed
+ * `InternalServerError` shape (see `schemas/common.ts:InternalServerErrorSchema`).
+ */
+exports.internalServerErrorResponse = {
+    status: 500,
+    body: { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } },
+};
+/**
+ * Validate `pageId` and resolve a granted Page document, or return the
+ * standard 400 / 404 response otherwise. Centralises the
+ * isValidObjectId + findPageByIdAndGrantedUser + leak-prevention catch
+ * pattern that ts-rest page-related routes (page / bookmark / comment /
+ * revision / notification) all need.
+ */
+const loadGrantedPage = async (Page, pageId, user) => {
+    if (!(0, exports.isValidObjectId)(pageId)) {
+        return { error: exports.invalidPageIdResponse };
+    }
+    try {
+        const page = await Page.findPageByIdAndGrantedUser(pageId, user);
+        if (!page)
+            return { error: exports.pageNotFoundResponse };
+        return { page };
+    }
+    catch {
+        return { error: exports.pageNotFoundResponse };
+    }
+};
+exports.loadGrantedPage = loadGrantedPage;
+//# sourceMappingURL=ts-rest-helpers.js.map

package/dist/util/ts-rest-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ts-rest-helpers.js","sourceRoot":"","sources":["../../src/util/ts-rest-helpers.ts"],"names":[],"mappings":";;;AAEA,sDAAuD;AAiBhD,MAAM,iBAAiB,GAAG,CAAC,IAA6B,EAAiB,EAAE;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAHW,QAAA,iBAAiB,qBAG5B;AAEK,MAAM,UAAU,GAAG,CAAC,EAA2B,EAAU,EAAE;IAChE,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;AACrD,CAAC,CAAC;AAFW,QAAA,UAAU,cAErB;AAEK,MAAM,UAAU,GAAG,CAAC,IAAmB,EAAY,EAAE,CAAC,CAAC;IAC5D,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;IACxB,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;IACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;IACvB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;IACzB,SAAS,EAAE,IAAA,yBAAiB,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;CACzE,CAAC,CAAC;AARU,QAAA,UAAU,cAQpB;AAoBH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,+BAAgB,CAAC,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,MAA0B,EAAqC,EAAE;IACrF,OAAO,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC,CAAC;AAEK,MAAM,YAAY,GAAG,CAAC,IAAwC,EAAc,EAAE,CAAC,CAAC;IACrF,GAAG,EAAE,IAAA,kBAAU,EAAC,IAAI,CAAC,GAAG,CAAC;IACzB,EAAE,EAAE,IAAA,kBAAU,EAAC,IAAI,CAAC,GAAG,CAAC;IACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;IAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;IACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;IACvB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;IACzB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;IACrC,SAAS,EAAE,IAAA,yBAAiB,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACxE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;IAC1B,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;CAClC,CAAC,CAAC;AAXU,QAAA,YAAY,gBAWtB;AAEH;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAAC,EAA6B,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAAvH,QAAA,eAAe,mBAAwG;AAEpI;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE;IACxE,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK,CAAC;AAC3G,CAAC,CAAC;AAFW,QAAA,eAAe,mBAE1B;AAEF;;;GAGG;AACU,QAAA,oBAAoB,GAAG;IAClC,MAAM,EAAE,GAAY;IACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,gBAAyB,EAAE,EAAE;CAChF,CAAC;AAEX;;GAEG;AACU,QAAA,qBAAqB,GAAG;IACnC,MAAM,EAAE,GAAY;IACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAA0B,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE;CACzE,CAAC;AAEX;;;;GAIG;AACU,QAAA,2BAA2B,GAAG;IACzC,MAAM,EAAE,GAAY;IACpB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAgC,EAAE,EAAE;CACvF,CAAC;AAcX;;;;;;GAMG;AACI,MAAM,eAAe,GAAG,KAAK,EAAE,IAAmB,EAAE,MAAc,EAAE,IAAkB,EAA8B,EAAE;IAC3H,IAAI,CAAC,IAAA,uBAAe,EAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,6BAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,4BAAoB,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,4BAAoB,EAAE,CAAC;IACzC,CAAC;AACH,CAAC,CAAC;AAXW,QAAA,eAAe,mBAW1B"}

package/dist/util/url.d.ts

@@ -0,0 +1 @@
+export declare const getContinueUrl: (req?: any) => any;

package/dist/util/url.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getContinueUrl = void 0;
+const getContinueUrl = (req = {}) => {
+    const { body = {}, query = {} } = req;
+    const url = body.continue || query.continue;
+    const continueUrl = /^(?![/\\]{2,})\/.*$/.test(url) ? url : '/';
+    return continueUrl;
+};
+exports.getContinueUrl = getContinueUrl;
+//# sourceMappingURL=url.js.map

package/dist/util/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/util/url.ts"],"names":[],"mappings":";;;AAAO,MAAM,cAAc,GAAG,CAAC,MAAW,EAAE,EAAE,EAAE;IAC9C,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;IAC5C,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAEhE,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AANW,QAAA,cAAc,kBAMzB"}

package/dist/util/user-code.d.ts

@@ -0,0 +1,10 @@
+/** Generate a fresh `ABCD-1234`-form user code (uniqueness enforced by caller). */
+export declare function generateUserCode(): string;
+/**
+ * Normalise a user-entered code for lookup: upper-case, strip everything that
+ * is not an allowed letter/digit (spaces, dashes, etc.), then re-insert the
+ * canonical dash after the 4th character when the length matches. This lets a
+ * user type `abcd1234`, `abcd-1234`, or `ABCD 1234` and still match the
+ * stored `ABCD-1234`.
+ */
+export declare function normalizeUserCode(input: string): string;

package/dist/util/user-code.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateUserCode = generateUserCode;
+exports.normalizeUserCode = normalizeUserCode;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/**
+ * RFC-0010 Phase 4 (RFC 8628 §6.1) — human-typed `user_code` generation.
+ *
+ * The user types this code into `/oauth/device` on a second device, so the
+ * alphabet deliberately drops ambiguous glyphs:
+ *
+ *  - vowels (A E I O U) — avoids accidentally spelling words.
+ *  - look-alikes 0/O, 1/I/L — removed from the letter set; digits 0-9 are
+ *    kept but the letters that resemble them are not, so a `0` is always a
+ *    digit and an `I` never appears.
+ *
+ * Format is `ABCD-1234` (4 letters + dash + 4 digits). Uniqueness is the
+ * caller's responsibility: the `OAuthDeviceCode` model has a unique index on
+ * `userCode` and retries generation on a duplicate-key error.
+ */
+/** Consonant-only letters, ambiguous glyphs removed (RFC 8628 §6.1). `L` is
+ * dropped too — it reads as `1`/`I` in many fonts. */
+const USER_CODE_LETTERS = 'BCDFGHJKMNPQRSTVWXZ';
+const USER_CODE_DIGITS = '0123456789';
+const LETTER_COUNT = 4;
+const DIGIT_COUNT = 4;
+function pick(alphabet, count) {
+    let out = '';
+    for (let i = 0; i < count; i += 1) {
+        out += alphabet[node_crypto_1.default.randomInt(alphabet.length)];
+    }
+    return out;
+}
+/** Generate a fresh `ABCD-1234`-form user code (uniqueness enforced by caller). */
+function generateUserCode() {
+    return `${pick(USER_CODE_LETTERS, LETTER_COUNT)}-${pick(USER_CODE_DIGITS, DIGIT_COUNT)}`;
+}
+/**
+ * Normalise a user-entered code for lookup: upper-case, strip everything that
+ * is not an allowed letter/digit (spaces, dashes, etc.), then re-insert the
+ * canonical dash after the 4th character when the length matches. This lets a
+ * user type `abcd1234`, `abcd-1234`, or `ABCD 1234` and still match the
+ * stored `ABCD-1234`.
+ */
+function normalizeUserCode(input) {
+    const cleaned = input.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    if (cleaned.length === LETTER_COUNT + DIGIT_COUNT) {
+        return `${cleaned.slice(0, LETTER_COUNT)}-${cleaned.slice(LETTER_COUNT)}`;
+    }
+    return cleaned;
+}
+//# sourceMappingURL=user-code.js.map

package/dist/util/user-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-code.js","sourceRoot":"","sources":["../../src/util/user-code.ts"],"names":[],"mappings":";;;;;AAkCA,4CAEC;AASD,8CAMC;AAnDD,8DAAiC;AAEjC;;;;;;;;;;;;;;GAcG;AAEH;sDACsD;AACtD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,SAAS,IAAI,CAAC,QAAgB,EAAE,KAAa;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,GAAG,IAAI,QAAQ,CAAC,qBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAgB,gBAAgB;IAC9B,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,GAAG,WAAW,EAAE,CAAC;QAClD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/util/view.d.ts

@@ -0,0 +1,10 @@
+import Crowi from '../crowi';
+import { AppContext } from 'src/types/appContext';
+export declare const parentPath: (path: string) => string;
+export declare const isUserPageList: (path: string) => boolean;
+export declare const isUserPage: (path: string) => boolean;
+export declare const isTopPage: (path: string) => path is "/";
+export declare const isTrashPage: (path: string) => boolean;
+export declare const userPageRoot: (user: any) => string;
+export declare const picture: (user: any) => any;
+export declare const getAppContext: (crowi: Crowi, req: any) => AppContext;

package/dist/util/view.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAppContext = exports.picture = exports.userPageRoot = exports.isTrashPage = exports.isTopPage = exports.isUserPage = exports.isUserPageList = exports.parentPath = void 0;
+const config_1 = require("../models/config");
+// Static functions related to view used by swig (functions and filters) and react
+const parentPath = (path) => {
+    if (path === '/' || path.match(/.+\/$/)) {
+        return path;
+    }
+    return path + '/';
+};
+exports.parentPath = parentPath;
+const isUserPageList = (path) => /^\/user\/[^/]+\/$/.test(path) || /^\/user\/$/.test(path);
+exports.isUserPageList = isUserPageList;
+const isUserPage = (path) => /^\/user\/[^/]+$/.test(path);
+exports.isUserPage = isUserPage;
+const isTopPage = (path) => path === '/';
+exports.isTopPage = isTopPage;
+const isTrashPage = (path) => /^\/trash\/.*/.test(path);
+exports.isTrashPage = isTrashPage;
+const userPageRoot = (user) => {
+    if (!user || !user.username) {
+        return '';
+    }
+    return '/user/' + user.username;
+};
+exports.userPageRoot = userPageRoot;
+const picture = (user) => {
+    if (!user) {
+        return '';
+    }
+    if (user.image && user.image != '/images/userpicture.png') {
+        return user.image;
+    }
+    else {
+        return '/images/userpicture.png';
+    }
+};
+exports.picture = picture;
+const getUserContext = (req) => {
+    const { _id = null, name = '', username = '', image = '', email = null, googleId = null, githubId = null, admin = false, lang = '' } = req.user || {};
+    return {
+        _id,
+        name,
+        username,
+        image,
+        email,
+        googleId,
+        githubId,
+        admin,
+        language: lang,
+    };
+};
+const getConfigContext = (config) => {
+    const { crowi } = config || {};
+    return {
+        crowi: {
+            'app:confidential': crowi['app:confidential'] || null,
+        },
+    };
+};
+const getAppContext = (crowi, req) => {
+    const config = req.config;
+    const env = crowi.getEnv();
+    const Config = crowi.model('Config');
+    return {
+        title: (config.crowi['app:title'] || 'Crowi'),
+        path: req.path || '',
+        url: config.crowi['app:url'] || '',
+        auth: {
+            requireThirdPartyAuth: (0, config_1.isRequiredThirdPartyAuth)(config),
+            canDisconnectThirdPartyId: req.user ? req.user.canDisconnectThirdPartyId() : false,
+            disablePasswordAuth: (0, config_1.isDisabledPasswordAuth)(config),
+            providers: {
+                google: (0, config_1.googleLoginEnabled)(config),
+                github: (0, config_1.githubLoginEnabled)(config),
+            },
+        },
+        upload: {
+            image: Config.isUploadable(),
+            file: Config.isUploadable(),
+        },
+        search: {
+            isConfigured: !!crowi.getSearcher(),
+        },
+        security: {
+            registrationWhiteList: config.crowi['security:registrationWhiteList'] || [],
+        },
+        user: getUserContext(req),
+        env: {
+            PLANTUML_URI: env.PLANTUML_URI || null,
+            MATHJAX: env.MATHJAX || null,
+        },
+        config: getConfigContext(config),
+        csrfToken: req.csrfToken,
+    };
+};
+exports.getAppContext = getAppContext;
+//# sourceMappingURL=view.js.map

package/dist/util/view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view.js","sourceRoot":"","sources":["../../src/util/view.ts"],"names":[],"mappings":";;;AAEA,8CAA6H;AAE7H,kFAAkF;AAE3E,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;IACzC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,GAAG,GAAG,CAAC;AACpB,CAAC,CAAC;AANW,QAAA,UAAU,cAMrB;AAEK,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAA7F,QAAA,cAAc,kBAA+E;AAEnG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAA5D,QAAA,UAAU,cAAkD;AAElE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC;AAA3C,QAAA,SAAS,aAAkC;AAEjD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAA1D,QAAA,WAAW,eAA+C;AAEhE,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,EAAE;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;AAClC,CAAC,CAAC;AALW,QAAA,YAAY,gBAKvB;AAEK,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,OAAO,yBAAyB,CAAC;IACnC,CAAC;AACH,CAAC,CAAC;AAVW,QAAA,OAAO,WAUlB;AAEF,MAAM,cAAc,GAAG,CAAC,GAAG,EAAsB,EAAE;IACjD,MAAM,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,KAAK,GAAG,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACtJ,OAAO;QACL,GAAG;QACH,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAAE;IAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC/B,OAAO;QACL,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,IAAI;SACtD;KACF,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,aAAa,GAAG,CAAC,KAAY,EAAE,GAAG,EAAc,EAAE;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO;QACL,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,CAAwB;QACpE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;QACpB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;QAClC,IAAI,EAAE;YACJ,qBAAqB,EAAE,IAAA,iCAAwB,EAAC,MAAM,CAAC;YACvD,yBAAyB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,KAAK;YAClF,mBAAmB,EAAE,IAAA,+BAAsB,EAAC,MAAM,CAAC;YACnD,SAAS,EAAE;gBACT,MAAM,EAAE,IAAA,2BAAkB,EAAC,MAAM,CAAC;gBAClC,MAAM,EAAE,IAAA,2BAAkB,EAAC,MAAM,CAAC;aACnC;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE;SAC5B;QACD,MAAM,EAAE;YACN,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;SACpC;QACD,QAAQ,EAAE;YACR,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,EAAE;SAC5E;QACD,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;QACzB,GAAG,EAAE;YACH,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;SAC7B;QACD,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAChC,SAAS,EAAE,GAAG,CAAC,SAAoC;KACpD,CAAC;AACJ,CAAC,CAAC;AApCW,QAAA,aAAa,iBAoCxB"}

package/dist/util/watcher-backfill.d.ts

@@ -0,0 +1,30 @@
+import type Crowi from '../crowi';
+/**
+ * feature-watch-autosubscribe — one-shot WATCH backfill for pages that
+ * predate auto-watch.
+ *
+ * Auto-watch only materialises `Watcher(STATUS_WATCH)` rows for *future*
+ * participation (create / edit / comment — see `util/auto-watch.ts`). The
+ * notification fan-out is now watcher-only
+ * (`models/activity.ts:getNotificationTargetUsers`), so pages created
+ * before auto-watch landed have no watcher rows and their past
+ * participants silently stop being notified.
+ *
+ * This walks every non-redirect page and materialises a WATCH row for its
+ * implicit pre-watcher notification set — creator + comment authors +
+ * revision authors, exactly what `Page.getNotificationTargetUsers()`
+ * returned and the old fan-out used. It reuses `autoWatchPage`, so an
+ * existing IGNORE opt-out is respected and existing WATCH rows are left
+ * untouched. Idempotent: a second run creates nothing.
+ *
+ * Run via `crowi-admin watcher backfill [--dry-run]`.
+ */
+export interface WatcherBackfillSummary {
+    pagesScanned: number;
+    /** WATCH rows created — or, in dry-run, that WOULD be created. */
+    watchersCreated: number;
+    dryRun: boolean;
+}
+export declare function runWatcherBackfill(crowi: Crowi, opts?: {
+    dryRun?: boolean;
+}): Promise<WatcherBackfillSummary>;

package/dist/util/watcher-backfill.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWatcherBackfill = runWatcherBackfill;
+const auto_watch_1 = require("./auto-watch");
+async function runWatcherBackfill(crowi, opts = {}) {
+    const dryRun = Boolean(opts.dryRun);
+    const Page = crowi.model('Page');
+    const Watcher = crowi.model('Watcher');
+    let pagesScanned = 0;
+    let watchersCreated = 0;
+    // Redirect stubs never notify, so skip them. Cursor so a large
+    // collection doesn't have to fit in memory.
+    const cursor = Page.find({ redirectTo: null }).cursor();
+    for (let page = await cursor.next(); page != null; page = await cursor.next()) {
+        pagesScanned++;
+        // creator + comment authors + revision authors (already de-duped).
+        const targets = (await page.getNotificationTargetUsers());
+        const seen = new Set();
+        const pageId = page._id;
+        for (const userId of targets) {
+            if (!userId)
+                continue;
+            const key = String(userId);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            if (dryRun) {
+                // Mirror autoWatchPage's predicate without writing: a WATCH would
+                // be created only when no Watcher row (WATCH or IGNORE) exists.
+                const existing = await Watcher.findByUserIdAndTargetId(userId, pageId);
+                if (!existing)
+                    watchersCreated++;
+            }
+            else {
+                const { newlyWatching } = await (0, auto_watch_1.autoWatchPage)(Watcher, userId, pageId);
+                if (newlyWatching)
+                    watchersCreated++;
+            }
+        }
+    }
+    return { pagesScanned, watchersCreated, dryRun };
+}
+//# sourceMappingURL=watcher-backfill.js.map

package/dist/util/watcher-backfill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher-backfill.js","sourceRoot":"","sources":["../../src/util/watcher-backfill.ts"],"names":[],"mappings":";;AA+BA,gDAsCC;AAnED,6CAA6C;AA6BtC,KAAK,UAAU,kBAAkB,CAAC,KAAY,EAAE,OAA6B,EAAE;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEvC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,+DAA+D;IAC/D,4CAA4C;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxD,KAAK,IAAI,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,YAAY,EAAE,CAAC;QAEf,mEAAmE;QACnE,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAA6C,CAAC;QACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAqB,CAAC;QAE1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,IAAI,MAAM,EAAE,CAAC;gBACX,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ;oBAAE,eAAe,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAA,0BAAa,EAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACvE,IAAI,aAAa;oBAAE,eAAe,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC"}

package/dist/util/ws-token.d.ts

@@ -0,0 +1,24 @@
+import { type WsTokenPayload } from '@crowi/api-contract';
+/**
+ * Claims signed into the wsToken. The exported runtime schema lives in
+ * `@crowi/api-contract` (`WsTokenPayloadSchema`) — Phase 3 Hocuspocus
+ * code parses the verified payload through the same schema, so the
+ * shape only has one source of truth.
+ */
+export interface WsTokenClaims {
+    userId: string;
+    pageId: string;
+    readonly: boolean;
+}
+export interface SignWsTokenResult {
+    /** Compact JWT string presented by the browser provider on connect. */
+    token: string;
+    /** ISO 8601 expiry timestamp, mirrors `exp * 1000` as a Date. */
+    expiresAt: Date;
+}
+export declare function createWsTokenUtil(): {
+    signWsToken: (claims: WsTokenClaims) => SignWsTokenResult;
+    verifyWsToken: (token: string) => WsTokenPayload | null;
+    ttlSeconds: number;
+    issuer: string;
+};

package/dist/util/ws-token.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWsTokenUtil = createWsTokenUtil;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:util:ws-token');
+/**
+ * Issuer claim used to sign / verify wsTokens. Distinct from the
+ * access/refresh token issuer (`'crowi'`) so a leaked access-token
+ * secret can never be replayed against Hocuspocus, and a leaked
+ * wsToken secret can never be replayed against the HTTP JWT auth.
+ */
+const WS_TOKEN_ISSUER = 'crowi-collab';
+/**
+ * Lifetime of an issued wsToken. Hocuspocus refuses tokens whose `exp`
+ * has passed; the browser provider uses `expiresAt` to proactively
+ * refresh well before the WebSocket would otherwise be torn down.
+ * Five minutes is short enough that a leaked token has limited blast
+ * radius and long enough to cover typical reconnect storms.
+ */
+const WS_TOKEN_TTL_SECONDS = 300;
+/**
+ * Resolve the WS_TOKEN_SECRET once per util instance:
+ *
+ *   - If `WS_TOKEN_SECRET` is set in the env, use it as-is. Operators
+ *     are expected to share the same value across api + Hocuspocus +
+ *     all multi-instance deployments (see RFC-0003 §Phase 9 docs).
+ *   - Otherwise, generate a 32-byte random secret in-memory and log a
+ *     warning. The process can still sign and verify its own tokens
+ *     (closure-stable), but **process restarts invalidate all
+ *     outstanding tokens** and **other instances cannot verify them**.
+ *
+ * The base64 encoding matches the existing `CROWI_ENCRYPTION_KEY`
+ * convention so operators have a single mental model for "key
+ * material" envs.
+ */
+const resolveWsTokenSecret = () => {
+    const fromEnv = process.env.WS_TOKEN_SECRET;
+    if (fromEnv && fromEnv.length > 0) {
+        debug('WS_TOKEN_SECRET resolved from env');
+        return fromEnv;
+    }
+    const generated = node_crypto_1.default.randomBytes(32).toString('base64');
+    console.warn('[crowi] WS_TOKEN_SECRET is not set — generated a random secret in-memory. ' +
+        'Process restarts will invalidate all outstanding wsTokens, and multi-instance ' +
+        'deployments will not be able to cross-verify tokens. Set WS_TOKEN_SECRET to ' +
+        'a stable base64-encoded 32-byte value (`openssl rand -base64 32`) in production.');
+    return generated;
+};
+/**
+ * Build a sign / verify pair bound to a single resolved secret. Crowi
+ * boots once per process, so the closure-captured secret is stable for
+ * the lifetime of the process; both the HTTP handler and the Hocuspocus
+ * `onAuthenticate` hook use the same factory so sign / verify can never
+ * drift apart in a single process.
+ *
+ * When `WS_TOKEN_SECRET` is unset, `resolveWsTokenSecret` generates a
+ * fresh random secret per invocation. Two `createWsTokenUtil()` calls in
+ * the same process would otherwise close over *different* random
+ * secrets, which silently breaks HTTP-sign / Hocuspocus-verify in dev.
+ * Memoise the factory result so every caller in the process shares one
+ * closure (= one secret) regardless of when they call.
+ *
+ * The secret is read directly from `process.env.WS_TOKEN_SECRET` (not
+ * via `crowi.getConfig()`) on purpose — out-of-band Hocuspocus
+ * deployments read the same env, so env is the single source of truth
+ * for cross-process secret distribution. This intentionally diverges
+ * from `createJwtUtil(crowi)`, which reads from config to allow
+ * admin-UI rotation.
+ */
+let cachedUtil = null;
+function buildWsTokenUtil() {
+    const secret = resolveWsTokenSecret();
+    /**
+     * Sign a wsToken for the given claims. Returns the compact JWT plus
+     * the absolute ISO expiry; callers serialise the timestamp into the
+     * wire payload (`WsTokenResponseSchema.expiresAt`).
+     */
+    function signWsToken(claims) {
+        // Pin `iat` ourselves so the response's `expiresAt` is **exactly**
+        // the same instant as the JWT's `exp` claim — recomputing from
+        // `Date.now()` after `jwt.sign(...)` would drift by ~1ms and made
+        // proactive-refresh logic harder to reason about.
+        const iat = Math.floor(Date.now() / 1000);
+        const exp = iat + WS_TOKEN_TTL_SECONDS;
+        const token = jsonwebtoken_1.default.sign({ ...claims, iat, exp }, secret, {
+            issuer: WS_TOKEN_ISSUER,
+            algorithm: 'HS256',
+        });
+        return { token, expiresAt: new Date(exp * 1000) };
+    }
+    /**
+     * Verify a wsToken. Returns the validated payload, or `null` for any
+     * failure (expired, bad signature, wrong issuer, malformed claims).
+     * Callers must treat `null` as "reject the connection" — never log
+     * the raw token (it is a bearer credential until `exp`).
+     */
+    function verifyWsToken(token) {
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, secret, {
+                issuer: WS_TOKEN_ISSUER,
+                algorithms: ['HS256'],
+            });
+            const parsed = api_contract_1.WsTokenPayloadSchema.safeParse(decoded);
+            if (!parsed.success) {
+                debug('wsToken payload failed schema validation:', parsed.error.issues);
+                return null;
+            }
+            return parsed.data;
+        }
+        catch (err) {
+            debug('wsToken verification failed:', err.message);
+            return null;
+        }
+    }
+    return {
+        signWsToken,
+        verifyWsToken,
+        ttlSeconds: WS_TOKEN_TTL_SECONDS,
+        issuer: WS_TOKEN_ISSUER,
+    };
+}
+function createWsTokenUtil() {
+    if (cachedUtil === null) {
+        cachedUtil = buildWsTokenUtil();
+    }
+    return cachedUtil;
+}
+//# sourceMappingURL=ws-token.js.map

package/dist/util/ws-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-token.js","sourceRoot":"","sources":["../../src/util/ws-token.ts"],"names":[],"mappings":";;;;;AAuJA,8CAKC;AA5JD,8DAAiC;AACjC,gEAA+B;AAC/B,sDAAgF;AAChF,kDAA0B;AAE1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,qBAAqB,CAAC,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAqBjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,oBAAoB,GAAG,GAAW,EAAE;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CACV,4EAA4E;QAC1E,gFAAgF;QAChF,8EAA8E;QAC9E,kFAAkF,CACrF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,IAAI,UAAU,GAA+C,IAAI,CAAC;AAElE,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IAEtC;;;;OAIG;IACH,SAAS,WAAW,CAAC,MAAqB;QACxC,mEAAmE;QACnE,+DAA+D;QAC/D,kEAAkE;QAClE,kDAAkD;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,oBAAoB,CAAC;QACvC,MAAM,KAAK,GAAG,sBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE;YACtD,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,SAAS,aAAa,CAAC,KAAa;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;gBACxC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mCAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,2CAA2C,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,8BAA8B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,aAAa;QACb,UAAU,EAAE,oBAAoB;QAChC,MAAM,EAAE,eAAe;KACxB,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB;IAC/B,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,UAAU,GAAG,gBAAgB,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}