@daloyjs/core 0.34.2 → 0.35.0

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:84b20929-3d10-58e2-9e87-0279dac97e10",
+  "serialNumber": "urn:uuid:c41e526d-a8c9-5e8a-bef4-4d616a1ee814",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-23T09:06:35.455Z",
+    "timestamp": "2026-05-24T23:40:26.023Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.34.2"
+        "version": "0.35.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.34.2",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.35.0",
       "name": "@daloyjs/core",
-      "version": "0.34.2",
+      "version": "0.35.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.34.2",
+      "purl": "pkg:npm/@daloyjs/core@0.35.0",
       "licenses": [
         {
           "license": {
@@ -39,12 +39,16 @@
         {
           "type": "website",
           "url": "https://daloyjs.dev"
+        },
+        {
+          "type": "distribution",
+          "url": "https://www.npmjs.com/package/@daloyjs/core"
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.34.2",
+        "tagId": "swidtag--daloyjs-core-0.35.0",
         "name": "@daloyjs/core",
-        "version": "0.34.2",
+        "version": "0.35.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -53,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.34.2",
+      "ref": "pkg:npm/@daloyjs/core@0.35.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.34.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.34.2-84b20929-3d10-58e2-9e87-0279dac97e10",
+  "name": "@daloyjs/core-0.35.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.0-c41e526d-a8c9-5e8a-bef4-4d616a1ee814",
   "creationInfo": {
-    "created": "2026-05-23T09:06:35.455Z",
+    "created": "2026-05-24T23:40:26.023Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.34.2",
+      "versionInfo": "0.35.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.34.2"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.0"
         }
       ]
     }

package/dist/security.d.ts

@@ -104,8 +104,8 @@ export declare function randomId(): string;
 /**
  * Header names that MUST appear at most once on a request per RFC 7230.
  * Duplicate values for these headers are a classic HTTP-request-smuggling
- * vector — front-end and back-end proxies can disagree on which value
- * "wins", letting an attacker desync the connection.
+ * vector — front-end and back-end proxies can disagree on framing or
+ * routing, letting an attacker desync the connection.
  *
  * Exported for adapter authors that need the same set.
  *
@@ -202,6 +202,14 @@ export declare function assertStrongSecret(secret: unknown, scope: string): void
  * @since 0.15.0
  */
 export type WebhookHmacAlgorithm = "sha256" | "sha384" | "sha512";
+/**
+ * Default tolerance window (in seconds) for webhook timestamp verification.
+ * Matches Stripe / Standard Webhooks defaults — five minutes either side of
+ * the receiver's clock. Override per call via `toleranceSeconds`.
+ *
+ * @since 0.21.0
+ */
+export declare const WEBHOOK_DEFAULT_TOLERANCE_SECONDS = 300;
 /**
  * Verify an HMAC signature for a webhook payload in constant time.
  *
@@ -243,6 +251,35 @@ export declare function verifyWebhookSignature(opts: {
     signature: string | Uint8Array;
     secret: string | Uint8Array;
     algorithm?: WebhookHmacAlgorithm;
+    /**
+     * Optional event timestamp (Unix seconds; string or number). When
+     * supplied, the HMAC is computed over `"<timestamp>.<payload>"` instead
+     * of just `payload`, which binds the signature to a specific point in
+     * time and lets the verifier reject replays whose timestamp drifts
+     * outside `toleranceSeconds`. Matches the Stripe / Standard Webhooks
+     * convention. Pass the value extracted from the producer's signature
+     * header (e.g. the `t=` field of `Stripe-Signature`).
+     *
+     * @since 0.21.0
+     */
+    timestamp?: string | number;
+    /**
+     * Maximum drift (in seconds) between `timestamp` and `now()` before the
+     * signature is rejected as a likely replay. Only consulted when
+     * `timestamp` is supplied. Defaults to
+     * {@link WEBHOOK_DEFAULT_TOLERANCE_SECONDS} (5 minutes).
+     *
+     * @since 0.21.0
+     */
+    toleranceSeconds?: number;
+    /**
+     * Clock used for replay-window checks. Returns milliseconds since the
+     * Unix epoch. Defaults to {@link Date.now}; override in tests to make
+     * the clock deterministic.
+     *
+     * @since 0.21.0
+     */
+    now?: () => number;
 }): Promise<boolean>;
 /**
  * Compute an HMAC signature over `payload` and return it hex-encoded. The
@@ -255,5 +292,100 @@ export declare function signWebhookPayload(opts: {
     payload: Uint8Array | string;
     secret: string | Uint8Array;
     algorithm?: WebhookHmacAlgorithm;
+    /**
+     * Optional event timestamp (Unix seconds; string or number). When
+     * supplied, the HMAC is computed over `"<timestamp>.<payload>"` so the
+     * receiver can use {@link verifyWebhookSignature} with the same
+     * `timestamp` and a `toleranceSeconds` window to defeat replay attacks.
+     *
+     * @since 0.21.0
+     */
+    timestamp?: string | number;
 }): Promise<string>;
+/**
+ * Return a single-segment, storage-safe basename derived from a
+ * (potentially attacker-controlled) filename — for example, the `name`
+ * field on a multipart `UploadedFile` before passing it to `fs.writeFile`
+ * or any other filesystem sink.
+ *
+ * The transformation:
+ *
+ *   1. Takes the basename only — anything before the last `/` or `\` is
+ *      discarded (`../../etc/passwd` → `passwd`, `C:\\foo\\bar.txt` →
+ *      `bar.txt`).
+ *   2. Strips NUL bytes and other control characters (NUL truncation is
+ *      the classic `evil.png\0.exe` bypass).
+ *   3. Strips Windows-reserved characters (`<>:"|?*`) and replaces them
+ *      with `_`.
+ *   4. Strips leading dots so the result cannot be `.`, `..`, or a hidden
+ *      dotfile (`.htaccess` → `htaccess`).
+ *   5. Trims trailing dots and spaces (Windows silently strips these on
+ *      `CreateFile`, so `file.txt ` and `file.txt` collide).
+ *   6. Refuses Windows-reserved names (`CON`, `PRN`, `AUX`, `NUL`,
+ *      `COM1`–`COM9`, `LPT1`–`LPT9`) — case-insensitive, with or without
+ *      extension.
+ *   7. Throws {@link BadRequestError} if the result is empty.
+ *
+ * Returns a basename only — never includes a directory. Callers are
+ * expected to combine it with a trusted base directory via
+ * `path.join(baseDir, sanitized)`. Combined with a final
+ * `path.resolve(baseDir, sanitized).startsWith(path.resolve(baseDir))`
+ * check this fully closes the Zip-Slip and arbitrary-write class of bug.
+ *
+ * @param name - The candidate filename (typically from
+ *   `UploadedFile.name`, a `Content-Disposition` header, or any other
+ *   untrusted source).
+ * @returns A sanitized basename safe to combine with a trusted directory.
+ * @throws {BadRequestError} When the input reduces to an empty string or
+ *   matches a Windows-reserved device name.
+ * @since 0.35.0
+ */
+export declare function sanitizeFilename(name: string): string;
+/**
+ * Validate that a candidate relative path is safe to combine with a
+ * trusted base directory — i.e. it cannot escape via `..` segments,
+ * absolute roots, drive letters, NUL truncation, or mixed
+ * POSIX/Windows separators.
+ *
+ * Throws {@link BadRequestError} on any of:
+ *
+ *   - Empty input
+ *   - NUL bytes (`evil\0../../etc/passwd` truncation)
+ *   - Backslash characters (treated as Windows separators; rejecting
+ *     them prevents POSIX callers being bypassed by `..\\..\\etc`)
+ *   - POSIX absolute paths (`/etc/passwd`)
+ *   - Windows drive letters or UNC roots (`C:\\foo`, `\\\\server\\share`)
+ *   - Any segment equal to `..` after `/`-splitting
+ *
+ * Returns the normalized POSIX-style relative path on success. Designed
+ * for the Aikido / OWASP "Directory Traversal & File Exposure" class
+ * (`CVE-2023-26111` `node-static`, Zip Slip, `req.query.file` →
+ * `sendFile`).
+ *
+ * @param input - The candidate relative path.
+ * @returns The input unchanged when safe.
+ * @throws {BadRequestError} When the path could escape its base directory.
+ * @since 0.35.0
+ */
+export declare function assertSafeRelativePath(input: string): string;
+/**
+ * Recursively scan a parsed JSON value (object / array / scalar) for any
+ * property key that starts with `$` — the MongoDB / NoSQL operator
+ * namespace (`$ne`, `$gt`, `$regex`, `$where`, …).
+ *
+ * Returns `true` on the first hit. Use before passing untrusted data
+ * into a query object that may be interpreted as an operator expression.
+ *
+ * @since 0.35.0
+ */
+export declare function hasMongoOperatorKeys(value: unknown): boolean;
+/**
+ * Throw {@link BadRequestError} when {@link hasMongoOperatorKeys}
+ * returns `true`. Safe to call on the parsed request body before
+ * threading it into a NoSQL driver — closes the
+ * `{"password": {"$ne": null}}` authentication-bypass class of bug.
+ *
+ * @since 0.35.0
+ */
+export declare function assertNoMongoOperators(value: unknown): void;
 //# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAUjC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGvD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAOxE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAG5D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAStE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA4B/C,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA0BvE;AAqFD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAUjC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAIvD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAOxE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAG5D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAStE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA4B/C,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA0BvE;AAqFD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,MAAM,CAAC;AA4CrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CAgDnB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgClB;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAuB5D;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAI3D"}

package/dist/security.js

@@ -187,13 +187,13 @@ export function randomId() {
         return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
     }
     // Last-resort fallback (should never trigger on Node 20+/Bun/Deno/Workers).
-    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`; // daloy-allow-weak-random: Web Crypto unavailable; documented in randomId() TSDoc above.
 }
 /**
  * Header names that MUST appear at most once on a request per RFC 7230.
  * Duplicate values for these headers are a classic HTTP-request-smuggling
- * vector — front-end and back-end proxies can disagree on which value
- * "wins", letting an attacker desync the connection.
+ * vector — front-end and back-end proxies can disagree on framing or
+ * routing, letting an attacker desync the connection.
  *
  * Exported for adapter authors that need the same set.
  *
@@ -202,6 +202,7 @@ export function randomId() {
 export const SMUGGLING_SINGLETON_HEADERS = Object.freeze([
     "host",
     "content-length",
+    "transfer-encoding",
 ]);
 /**
  * Reject requests that carry more than one value for any header in
@@ -422,6 +423,56 @@ function decodeWebhookSignature(signature, expected, expectedBytes) {
     const b64 = base64ToBytes(value);
     return b64 && b64.length === expectedBytes ? b64 : null;
 }
+/**
+ * Default tolerance window (in seconds) for webhook timestamp verification.
+ * Matches Stripe / Standard Webhooks defaults — five minutes either side of
+ * the receiver's clock. Override per call via `toleranceSeconds`.
+ *
+ * @since 0.21.0
+ */
+export const WEBHOOK_DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Maximum plausible Unix-timestamp value we'll accept on the verifier
+ * side. Equal to seconds in `Number.MAX_SAFE_INTEGER` milliseconds — beyond
+ * this we treat the value as adversarial/malformed rather than as a real
+ * future date. Practically: caps timestamps somewhere around year 287000.
+ */
+const WEBHOOK_MAX_TIMESTAMP_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 1000);
+function normalizeWebhookTimestamp(ts) {
+    if (ts === undefined || ts === null)
+        return null;
+    let seconds;
+    if (typeof ts === "number") {
+        if (!Number.isFinite(ts) || !Number.isInteger(ts))
+            return null;
+        seconds = ts;
+    }
+    else if (typeof ts === "string") {
+        // Only accept the canonical integer-seconds form, no whitespace, no sign
+        // tricks, no decimals, no leading zeros (other than literal "0"). This
+        // keeps the signed payload string deterministic across producers.
+        if (!/^(0|[1-9][0-9]{0,18})$/.test(ts))
+            return null;
+        seconds = Number(ts);
+        if (!Number.isFinite(ts) && !Number.isFinite(seconds))
+            return null;
+    }
+    else {
+        return null;
+    }
+    if (seconds < 0 || seconds > WEBHOOK_MAX_TIMESTAMP_SECONDS)
+        return null;
+    return { seconds, canonical: String(seconds) };
+}
+function buildSignedPayloadBytes(payload, timestamp) {
+    if (!timestamp)
+        return payload;
+    const prefix = new TextEncoder().encode(`${timestamp.canonical}.`);
+    const out = new Uint8Array(prefix.length + payload.length);
+    out.set(prefix, 0);
+    out.set(payload, prefix.length);
+    return out;
+}
 /**
  * Verify an HMAC signature for a webhook payload in constant time.
  *
@@ -462,6 +513,23 @@ export async function verifyWebhookSignature(opts) {
     const algo = resolveWebhookAlgorithm(opts.algorithm ?? "sha256");
     if (!algo)
         return false;
+    let timestamp = null;
+    if (opts.timestamp !== undefined) {
+        timestamp = normalizeWebhookTimestamp(opts.timestamp);
+        if (!timestamp)
+            return false;
+        const tolerance = opts.toleranceSeconds === undefined
+            ? WEBHOOK_DEFAULT_TOLERANCE_SECONDS
+            : opts.toleranceSeconds;
+        if (!Number.isFinite(tolerance) || tolerance < 0)
+            return false;
+        const nowMs = (opts.now ?? Date.now)();
+        if (!Number.isFinite(nowMs))
+            return false;
+        const nowSeconds = Math.floor(nowMs / 1000);
+        if (Math.abs(nowSeconds - timestamp.seconds) > tolerance)
+            return false;
+    }
     const payloadBytes = typeof opts.payload === "string"
         ? new TextEncoder().encode(opts.payload)
         : opts.payload;
@@ -471,11 +539,12 @@ export async function verifyWebhookSignature(opts) {
     const providedBytes = decodeWebhookSignature(opts.signature, algo.name, algo.signatureBytes);
     if (!providedBytes)
         return false;
+    const signedBytes = buildSignedPayloadBytes(payloadBytes, timestamp);
     const c = globalThis.crypto;
     if (!c?.subtle)
         return false;
     const key = await c.subtle.importKey("raw", secretBytes, { name: "HMAC", hash: algo.hashName }, false, ["sign"]);
-    const computed = new Uint8Array(await c.subtle.sign("HMAC", key, payloadBytes));
+    const computed = new Uint8Array(await c.subtle.sign("HMAC", key, signedBytes));
     return timingSafeEqualBytes(computed, providedBytes);
 }
 /**
@@ -489,6 +558,13 @@ export async function signWebhookPayload(opts) {
     const algo = resolveWebhookAlgorithm(opts.algorithm ?? "sha256");
     if (!algo)
         throw new TypeError("unsupported webhook HMAC algorithm");
+    let timestamp = null;
+    if (opts.timestamp !== undefined) {
+        timestamp = normalizeWebhookTimestamp(opts.timestamp);
+        if (!timestamp) {
+            throw new TypeError("signWebhookPayload(): timestamp must be a non-negative integer number of seconds");
+        }
+    }
     const payloadBytes = typeof opts.payload === "string"
         ? new TextEncoder().encode(opts.payload)
         : opts.payload;
@@ -499,7 +575,191 @@ export async function signWebhookPayload(opts) {
     if (!c?.subtle)
         throw new Error("WebCrypto unavailable: cannot sign webhook payload");
     const key = await c.subtle.importKey("raw", secretBytes, { name: "HMAC", hash: algo.hashName }, false, ["sign"]);
-    const computed = new Uint8Array(await c.subtle.sign("HMAC", key, payloadBytes));
+    const signedBytes = buildSignedPayloadBytes(payloadBytes, timestamp);
+    const computed = new Uint8Array(await c.subtle.sign("HMAC", key, signedBytes));
     return bytesToHex(computed);
 }
+// ---------------------------------------------------------------------------
+// File-path traversal helpers (Zip Slip / OWASP A01 / Aikido "Directory
+// Traversal & File Exposure" class). Daloy's router already rejects `..`
+// and `//` in request URLs, but applications that persist user-uploaded
+// filenames or accept untrusted relative paths still need a sanitizer to
+// stop attackers from breaking out of an upload directory or overwriting
+// arbitrary files (`../../etc/passwd`, `..\\..\\windows\\system32`, NUL
+// truncation `evil.png\0../../etc/passwd`).
+// ---------------------------------------------------------------------------
+const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/g;
+const WINDOWS_RESERVED_CHARS_RE = /[<>:"|?*]/g;
+const WINDOWS_RESERVED_NAMES = new Set([
+    "con", "prn", "aux", "nul",
+    "com1", "com2", "com3", "com4", "com5", "com6", "com7", "com8", "com9",
+    "lpt1", "lpt2", "lpt3", "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9",
+]);
+/**
+ * Return a single-segment, storage-safe basename derived from a
+ * (potentially attacker-controlled) filename — for example, the `name`
+ * field on a multipart `UploadedFile` before passing it to `fs.writeFile`
+ * or any other filesystem sink.
+ *
+ * The transformation:
+ *
+ *   1. Takes the basename only — anything before the last `/` or `\` is
+ *      discarded (`../../etc/passwd` → `passwd`, `C:\\foo\\bar.txt` →
+ *      `bar.txt`).
+ *   2. Strips NUL bytes and other control characters (NUL truncation is
+ *      the classic `evil.png\0.exe` bypass).
+ *   3. Strips Windows-reserved characters (`<>:"|?*`) and replaces them
+ *      with `_`.
+ *   4. Strips leading dots so the result cannot be `.`, `..`, or a hidden
+ *      dotfile (`.htaccess` → `htaccess`).
+ *   5. Trims trailing dots and spaces (Windows silently strips these on
+ *      `CreateFile`, so `file.txt ` and `file.txt` collide).
+ *   6. Refuses Windows-reserved names (`CON`, `PRN`, `AUX`, `NUL`,
+ *      `COM1`–`COM9`, `LPT1`–`LPT9`) — case-insensitive, with or without
+ *      extension.
+ *   7. Throws {@link BadRequestError} if the result is empty.
+ *
+ * Returns a basename only — never includes a directory. Callers are
+ * expected to combine it with a trusted base directory via
+ * `path.join(baseDir, sanitized)`. Combined with a final
+ * `path.resolve(baseDir, sanitized).startsWith(path.resolve(baseDir))`
+ * check this fully closes the Zip-Slip and arbitrary-write class of bug.
+ *
+ * @param name - The candidate filename (typically from
+ *   `UploadedFile.name`, a `Content-Disposition` header, or any other
+ *   untrusted source).
+ * @returns A sanitized basename safe to combine with a trusted directory.
+ * @throws {BadRequestError} When the input reduces to an empty string or
+ *   matches a Windows-reserved device name.
+ * @since 0.35.0
+ */
+export function sanitizeFilename(name) {
+    if (typeof name !== "string") {
+        throw new BadRequestError("Invalid filename");
+    }
+    // Step 1: basename — strip everything up to (and including) the last
+    // POSIX or Windows separator.
+    let base = name;
+    const lastSep = Math.max(base.lastIndexOf("/"), base.lastIndexOf("\\"));
+    if (lastSep !== -1)
+        base = base.slice(lastSep + 1);
+    // Step 2/3: strip control + Windows-reserved characters.
+    base = base.replace(CONTROL_CHAR_RE, "").replace(WINDOWS_RESERVED_CHARS_RE, "_");
+    // Step 4: strip leading dots so `.htaccess` / `..` / `.` cannot escape.
+    base = base.replace(/^\.+/, "");
+    // Step 5: trim trailing dots and spaces (Windows silently drops them).
+    base = base.replace(/[\s.]+$/, "");
+    if (base.length === 0) {
+        throw new BadRequestError("Invalid filename");
+    }
+    // Step 6: refuse Windows-reserved device names, with or without ext.
+    const stem = base.split(".")[0].toLowerCase();
+    if (WINDOWS_RESERVED_NAMES.has(stem)) {
+        throw new BadRequestError(`Reserved filename: ${name}`);
+    }
+    return base;
+}
+/**
+ * Validate that a candidate relative path is safe to combine with a
+ * trusted base directory — i.e. it cannot escape via `..` segments,
+ * absolute roots, drive letters, NUL truncation, or mixed
+ * POSIX/Windows separators.
+ *
+ * Throws {@link BadRequestError} on any of:
+ *
+ *   - Empty input
+ *   - NUL bytes (`evil\0../../etc/passwd` truncation)
+ *   - Backslash characters (treated as Windows separators; rejecting
+ *     them prevents POSIX callers being bypassed by `..\\..\\etc`)
+ *   - POSIX absolute paths (`/etc/passwd`)
+ *   - Windows drive letters or UNC roots (`C:\\foo`, `\\\\server\\share`)
+ *   - Any segment equal to `..` after `/`-splitting
+ *
+ * Returns the normalized POSIX-style relative path on success. Designed
+ * for the Aikido / OWASP "Directory Traversal & File Exposure" class
+ * (`CVE-2023-26111` `node-static`, Zip Slip, `req.query.file` →
+ * `sendFile`).
+ *
+ * @param input - The candidate relative path.
+ * @returns The input unchanged when safe.
+ * @throws {BadRequestError} When the path could escape its base directory.
+ * @since 0.35.0
+ */
+export function assertSafeRelativePath(input) {
+    if (typeof input !== "string" || input.length === 0) {
+        throw new BadRequestError("Invalid path");
+    }
+    if (input.indexOf("\0") !== -1) {
+        throw new BadRequestError("Invalid path");
+    }
+    if (input.indexOf("\\") !== -1) {
+        throw new BadRequestError("Invalid path");
+    }
+    if (input.startsWith("/")) {
+        throw new BadRequestError("Invalid path");
+    }
+    // Windows drive letter `C:` or `c:` at the head.
+    if (input.length >= 2 && input.charAt(1) === ":") {
+        throw new BadRequestError("Invalid path");
+    }
+    for (const seg of input.split("/")) {
+        if (seg === "..") {
+            throw new BadRequestError("Invalid path");
+        }
+    }
+    return input;
+}
+// ---------------------------------------------------------------------------
+// NoSQL operator-injection helpers (Aikido "NoSQL Injection" / OWASP A03).
+// MongoDB-class drivers accept query objects whose keys ($ne, $gt, $regex,
+// $where, …) change the query semantics. Apps that take a JSON request body
+// and pass it straight to `Users.findOne({ username, password })` are the
+// classic auth-bypass case (`password: { $ne: null }`). Daloy's
+// `safeJsonParse` already strips prototype-pollution keys; these helpers
+// add the operator-key check.
+// ---------------------------------------------------------------------------
+function walkForMongoOperators(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            if (walkForMongoOperators(item))
+                return true;
+        }
+        return false;
+    }
+    for (const key of Object.keys(value)) {
+        if (key.length > 0 && key.charCodeAt(0) === 36 /* $ */)
+            return true;
+        if (walkForMongoOperators(value[key]))
+            return true;
+    }
+    return false;
+}
+/**
+ * Recursively scan a parsed JSON value (object / array / scalar) for any
+ * property key that starts with `$` — the MongoDB / NoSQL operator
+ * namespace (`$ne`, `$gt`, `$regex`, `$where`, …).
+ *
+ * Returns `true` on the first hit. Use before passing untrusted data
+ * into a query object that may be interpreted as an operator expression.
+ *
+ * @since 0.35.0
+ */
+export function hasMongoOperatorKeys(value) {
+    return walkForMongoOperators(value);
+}
+/**
+ * Throw {@link BadRequestError} when {@link hasMongoOperatorKeys}
+ * returns `true`. Safe to call on the parsed request body before
+ * threading it into a NoSQL driver — closes the
+ * `{"password": {"$ne": null}}` authentication-bypass class of bug.
+ *
+ * @since 0.35.0
+ */
+export function assertNoMongoOperators(value) {
+    if (walkForMongoOperators(value)) {
+        throw new BadRequestError("Operator-prefixed key rejected");
+    }
+}
 //# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/E,mBAAmB;IACnB,qBAAqB;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,gCAAgC,EAAE,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,eAAe,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,aAAa;IACb,mCAAmC;IACnC,aAAa;IACb,WAAW;IACX,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,qBAAqB;IACrB,oCAAoC;IACpC,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,KAAa;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,mDAAmD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2DAA2D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACzF,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;IAC1D,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uCAAuC,KAAK,sBAAsB,qBAAqB,KAAK;YAClG,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yDAAyD,MAAM,CAAC,CAAC,CAAC,sBAAsB,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,uBAAuB,GAGzB;IACF,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;CACpD,CAAC;AAEF,SAAS,uBAAuB,CAC9B,SAAkB;IAElB,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAa;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8B,EAC9B,QAA8B,EAC9B,aAAqB;IAErB,IAAI,SAAS,YAAY,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAElB,MAAM,aAAa,GAAG,sBAAsB,CAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yFAAyF;AACvK,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,gBAAgB;IAChB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/E,mBAAmB;IACnB,qBAAqB;CACtB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,gCAAgC,EAAE,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,eAAe,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,aAAa;IACb,mCAAmC;IACnC,aAAa;IACb,WAAW;IACX,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,qBAAqB;IACrB,oCAAoC;IACpC,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,KAAa;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,mDAAmD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2DAA2D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACzF,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;IAC1D,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uCAAuC,KAAK,sBAAsB,qBAAqB,KAAK;YAClG,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yDAAyD,MAAM,CAAC,CAAC,CAAC,sBAAsB,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,uBAAuB,GAGzB;IACF,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;CACpD,CAAC;AAEF,SAAS,uBAAuB,CAC9B,SAAkB;IAElB,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAa;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8B,EAC9B,QAA8B,EAC9B,aAAqB;IAErB,IAAI,SAAS,YAAY,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;GAKG;AACH,MAAM,6BAA6B,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;AAEjF,SAAS,yBAAyB,CAChC,EAA+B;IAE/B,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAe,CAAC;IACpB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;SAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,6BAA6B;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAmB,EACnB,SAAuC;IAEvC,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAkC5C;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,IAAI,SAAS,GAAkD,IAAI,CAAC;IACpE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,SAAS,GACb,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACjC,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IAED,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAElB,MAAM,aAAa,GAAG,sBAAsB,CAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,WAAW,GAAG,uBAAuB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAErE,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAA2B,CAAC,CAAC,CAAC;IAC/F,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAaxC;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,IAAI,SAAS,GAAkD,IAAI,CAAC;IACpE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACjB,kFAAkF,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,WAAW,GAAG,uBAAuB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAA2B,CAAC,CAAC,CAAC;IAC/F,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,4CAA4C;AAC5C,8EAA8E;AAE9E,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAC/C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACvE,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,qEAAqE;IACrE,8BAA8B;IAC9B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACnD,yDAAyD;IACzD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACjF,wEAAwE;IACxE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChC,uEAAuE;IACvE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,iDAAiD;IACjD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,gEAAgE;AAChE,yEAAyE;AACzE,8BAA8B;AAC9B,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,qBAAqB,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,EAAE,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,qBAAqB,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}