@de-otio/chaoskb-server 0.2.0

package/dist/lib/constructs/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../lib/constructs/api.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAAuC;AACvC,uDAA0G;AAC1G,qEAA+D;AAE/D,iDAA4C;AAE5C,2CAAuC;AACvC,2CAA6B;AAS7B,MAAa,GAAI,SAAQ,sBAAS;IAChB,WAAW,CAAc;IACzB,OAAO,CAAiB;IAExC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAe;QACvD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,MAAM,eAAe,GAAG,IAAI,eAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE;YACzD,eAAe,EAAE,sBAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,GAAG,IAAI,kCAAc,CAAC,IAAI,EAAE,SAAS,EAAE;YACjD,OAAO,EAAE,oBAAO,CAAC,WAAW;YAC5B,YAAY,EAAE,yBAAY,CAAC,MAAM;YACjC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC;YACxD,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,sBAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,WAAW,EAAE;gBACX,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBACjC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,CAAC,aAAa;aAC/D;YACD,4BAA4B,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC7D,eAAe;YACf,OAAO,EAAE,oBAAO,CAAC,MAAM;YACvB,QAAQ,EAAE;gBACR,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,SAAS,EAAE,yBAAyB;aAC7C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,QAAQ,EAAE,gCAAmB,CAAC,IAAI;SACnC,CAAC,CAAC;QAEH,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;CACF;AAzCD,kBAyCC"}

package/dist/lib/constructs/auth.d.ts

@@ -0,0 +1,11 @@
+import { Construct } from 'constructs';
+import { aws_ssm as ssm } from 'aws-cdk-lib';
+export interface AuthProps {
+    readonly environment: string;
+    readonly signupsEnabled?: boolean;
+}
+export declare class Auth extends Construct {
+    readonly signupsEnabledParam: ssm.StringParameter;
+    constructor(scope: Construct, id: string, props: AuthProps);
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/constructs/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../lib/constructs/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,OAAO,IAAI,GAAG,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,qBAAa,IAAK,SAAQ,SAAS;IACjC,SAAgB,mBAAmB,EAAE,GAAG,CAAC,eAAe,CAAC;gBAE7C,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;CAS3D"}

package/dist/lib/constructs/auth.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth = void 0;
+const constructs_1 = require("constructs");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+class Auth extends constructs_1.Construct {
+    signupsEnabledParam;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.signupsEnabledParam = new aws_cdk_lib_1.aws_ssm.StringParameter(this, 'SignupsEnabled', {
+            parameterName: `/chaoskb/${props.environment}/signups-enabled`,
+            stringValue: props.signupsEnabled === false ? 'false' : 'true',
+            description: 'Whether new user signups are enabled',
+        });
+    }
+}
+exports.Auth = Auth;
+//# sourceMappingURL=auth.js.map

package/dist/lib/constructs/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../lib/constructs/auth.ts"],"names":[],"mappings":";;;AAAA,2CAAuC;AACvC,6CAA6C;AAO7C,MAAa,IAAK,SAAQ,sBAAS;IACjB,mBAAmB,CAAsB;IAEzD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAgB;QACxD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,IAAI,CAAC,mBAAmB,GAAG,IAAI,qBAAG,CAAC,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE;YACzE,aAAa,EAAE,YAAY,KAAK,CAAC,WAAW,kBAAkB;YAC9D,WAAW,EAAE,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC9D,WAAW,EAAE,sCAAsC;SACpD,CAAC,CAAC;IACL,CAAC;CACF;AAZD,oBAYC"}

package/dist/lib/constructs/blob-store.d.ts

@@ -0,0 +1,10 @@
+import { TableV2 } from 'aws-cdk-lib/aws-dynamodb';
+import { Construct } from 'constructs';
+export interface BlobStoreProps {
+    readonly environment: string;
+}
+export declare class BlobStore extends Construct {
+    readonly table: TableV2;
+    constructor(scope: Construct, id: string, props: BlobStoreProps);
+}
+//# sourceMappingURL=blob-store.d.ts.map

package/dist/lib/constructs/blob-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-store.d.ts","sourceRoot":"","sources":["../../../lib/constructs/blob-store.ts"],"names":[],"mappings":"AACA,OAAO,EAA0C,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,qBAAa,SAAU,SAAQ,SAAS;IACtC,SAAgB,KAAK,EAAE,OAAO,CAAC;gBAEnB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc;CAqBhE"}

package/dist/lib/constructs/blob-store.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlobStore = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_dynamodb_1 = require("aws-cdk-lib/aws-dynamodb");
+const constructs_1 = require("constructs");
+class BlobStore extends constructs_1.Construct {
+    table;
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.table = new aws_dynamodb_1.TableV2(this, 'Table', {
+            tableName: `chaoskb-${props.environment}`,
+            partitionKey: { name: 'PK', type: aws_dynamodb_1.AttributeType.STRING },
+            sortKey: { name: 'SK', type: aws_dynamodb_1.AttributeType.STRING },
+            billing: aws_dynamodb_1.Billing.onDemand(),
+            pointInTimeRecovery: true,
+            removalPolicy: aws_cdk_lib_1.RemovalPolicy.RETAIN,
+            timeToLiveAttribute: 'ttl',
+            globalSecondaryIndexes: [
+                {
+                    indexName: 'updatedAt-index',
+                    partitionKey: { name: 'PK', type: aws_dynamodb_1.AttributeType.STRING },
+                    sortKey: { name: 'updatedAt', type: aws_dynamodb_1.AttributeType.STRING },
+                    projectionType: aws_dynamodb_1.ProjectionType.ALL,
+                },
+            ],
+        });
+    }
+}
+exports.BlobStore = BlobStore;
+//# sourceMappingURL=blob-store.js.map

package/dist/lib/constructs/blob-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-store.js","sourceRoot":"","sources":["../../../lib/constructs/blob-store.ts"],"names":[],"mappings":";;;AAAA,6CAA4C;AAC5C,2DAA2F;AAC3F,2CAAuC;AAMvC,MAAa,SAAU,SAAQ,sBAAS;IACtB,KAAK,CAAU;IAE/B,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAqB;QAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjB,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAO,CAAC,IAAI,EAAE,OAAO,EAAE;YACtC,SAAS,EAAE,WAAW,KAAK,CAAC,WAAW,EAAE;YACzC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4BAAa,CAAC,MAAM,EAAE;YACxD,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4BAAa,CAAC,MAAM,EAAE;YACnD,OAAO,EAAE,sBAAO,CAAC,QAAQ,EAAE;YAC3B,mBAAmB,EAAE,IAAI;YACzB,aAAa,EAAE,2BAAa,CAAC,MAAM;YACnC,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE;gBACtB;oBACE,SAAS,EAAE,iBAAiB;oBAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,4BAAa,CAAC,MAAM,EAAE;oBACxD,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,4BAAa,CAAC,MAAM,EAAE;oBAC1D,cAAc,EAAE,6BAAc,CAAC,GAAG;iBACnC;aACF;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAxBD,8BAwBC"}

package/dist/lib/deploy-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=deploy-cli.d.ts.map

package/dist/lib/deploy-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-cli.d.ts","sourceRoot":"","sources":["../../lib/deploy-cli.ts"],"names":[],"mappings":""}

package/dist/lib/deploy-cli.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const chaoskb_stack_js_1 = require("./chaoskb-stack.js");
+function parseArgs(argv) {
+    const args = argv.slice(2);
+    let region = 'us-east-1';
+    let environment = 'self-hosted';
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === '--region' && args[i + 1]) {
+            region = args[i + 1];
+            i++;
+        }
+        else if (args[i] === '--environment' && args[i + 1]) {
+            environment = args[i + 1];
+            i++;
+        }
+    }
+    return { region, environment };
+}
+function main() {
+    const { region, environment } = parseArgs(process.argv);
+    const app = new aws_cdk_lib_1.App();
+    new chaoskb_stack_js_1.ChaosKBStack(app, `ChaosKB-${environment}`, {
+        environment,
+        env: {
+            region,
+            account: process.env['CDK_DEFAULT_ACCOUNT'],
+        },
+    });
+    console.log(`
+ChaosKB CDK App created.
+
+  Environment: ${environment}
+  Region:      ${region}
+
+To deploy, run:
+
+  npx cdk deploy --app "npx ts-node lib/deploy-cli.ts"
+
+Or with specific AWS profile:
+
+  npx cdk deploy --app "npx ts-node lib/deploy-cli.ts" --profile <your-profile>
+`);
+    app.synth();
+}
+main();
+//# sourceMappingURL=deploy-cli.js.map

package/dist/lib/deploy-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-cli.js","sourceRoot":"","sources":["../../lib/deploy-cli.ts"],"names":[],"mappings":";;;AAEA,6CAAkC;AAClC,yDAAkD;AAElD,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,IAAI,WAAW,GAAG,aAAa,CAAC;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,WAAW,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,IAAI;IACX,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,GAAG,GAAG,IAAI,iBAAG,EAAE,CAAC;IAEtB,IAAI,+BAAY,CAAC,GAAG,EAAE,WAAW,WAAW,EAAE,EAAE;QAC9C,WAAW;QACX,GAAG,EAAE;YACH,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;SAC5C;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC;;;iBAGG,WAAW;iBACX,MAAM;;;;;;;;;CAStB,CAAC,CAAC;IAED,GAAG,CAAC,KAAK,EAAE,CAAC;AACd,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/lib/handler/index.d.ts

@@ -0,0 +1,23 @@
+interface LambdaFunctionURLEvent {
+    requestContext: {
+        http: {
+            method: string;
+            path: string;
+            sourceIp?: string;
+        };
+        requestId: string;
+    };
+    headers: Record<string, string>;
+    queryStringParameters?: Record<string, string>;
+    body?: string;
+    isBase64Encoded: boolean;
+}
+interface LambdaFunctionURLResult {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+    isBase64Encoded?: boolean;
+}
+export declare const handler: (event: LambdaFunctionURLEvent) => Promise<LambdaFunctionURLResult>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/handler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/handler/index.ts"],"names":[],"mappings":"AAqCA,UAAU,sBAAsB;IAC9B,cAAc,EAAE;QACd,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1D,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA8BD,eAAO,MAAM,OAAO,GAAU,OAAO,sBAAsB,KAAG,OAAO,CAAC,uBAAuB,CAgS5F,CAAC"}

package/dist/lib/handler/index.js

@@ -0,0 +1,276 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
+const logger_js_1 = require("./logger.js");
+const ssh_auth_js_1 = require("./middleware/ssh-auth.js");
+const rate_limit_js_1 = require("./middleware/rate-limit.js");
+const health_js_1 = require("./routes/health.js");
+const register_js_1 = require("./routes/register.js");
+const blobs_js_1 = require("./routes/blobs.js");
+const restore_js_1 = require("./routes/restore.js");
+const tenants_js_1 = require("./routes/tenants.js");
+const export_js_1 = require("./routes/export.js");
+const wrapped_key_js_1 = require("./routes/wrapped-key.js");
+const rotation_js_1 = require("./routes/rotation.js");
+const audit_js_1 = require("./routes/audit.js");
+const revocation_js_1 = require("./routes/revocation.js");
+const devices_js_1 = require("./routes/devices.js");
+const invites_js_1 = require("./routes/invites.js");
+const projects_js_1 = require("./routes/projects.js");
+const notifications_js_1 = require("./routes/notifications.js");
+const TABLE_NAME = process.env['TABLE_NAME'] ?? '';
+const SIGNUPS_ENABLED_PARAM = process.env['SIGNUPS_ENABLED_PARAM'] ?? '';
+const client = new client_dynamodb_1.DynamoDBClient({});
+const ddb = lib_dynamodb_1.DynamoDBDocumentClient.from(client, {
+    marshallOptions: { removeUndefinedValues: true },
+});
+const CORS_HEADERS = {
+    'Access-Control-Allow-Origin': 'none',
+    'Access-Control-Allow-Methods': 'GET, PUT, POST, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+};
+function response(statusCode, body, headers = {}, isBase64Encoded = false) {
+    return {
+        statusCode,
+        headers: { ...CORS_HEADERS, ...headers },
+        body,
+        isBase64Encoded,
+    };
+}
+const handler = async (event) => {
+    const startTime = Date.now();
+    const method = event.requestContext.http.method;
+    const path = event.requestContext.http.path;
+    const requestId = event.requestContext.requestId;
+    logger_js_1.logger.info('Request received', { requestId, operation: `${method} ${path}` });
+    try {
+        // OPTIONS (CORS preflight)
+        if (method === 'OPTIONS') {
+            return response(204, '', {});
+        }
+        // Health check — no auth
+        if (method === 'GET' && path === '/health') {
+            const result = (0, health_js_1.handleHealth)();
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Registration challenge — no auth, IP rate limited
+        if (method === 'GET' && path === '/v1/register/challenge') {
+            const sourceIp = event.headers['x-forwarded-for']?.split(',')[0]?.trim()
+                ?? event.requestContext.http.sourceIp
+                ?? 'unknown';
+            const rateCheck = await (0, rate_limit_js_1.checkIpRateLimit)(sourceIp, 'CHALLENGE', ddb, TABLE_NAME);
+            if (!rateCheck.allowed) {
+                return response(429, JSON.stringify({ error: 'rate_limited', message: 'Too many requests' }), {
+                    'Content-Type': 'application/json',
+                    ...(0, rate_limit_js_1.rateLimitHeaders)(rateCheck),
+                });
+            }
+            const result = await (0, register_js_1.handleChallenge)(ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Link confirm — no auth, IP rate limited (new device submits its public key)
+        if (method === 'POST' && path === '/v1/link-confirm') {
+            const sourceIp = event.headers['x-forwarded-for']?.split(',')[0]?.trim()
+                ?? event.requestContext.http.sourceIp
+                ?? 'unknown';
+            const rateCheck = await (0, rate_limit_js_1.checkIpRateLimit)(sourceIp, 'LINK_CONFIRM', ddb, TABLE_NAME);
+            if (!rateCheck.allowed) {
+                return response(429, JSON.stringify({ error: 'rate_limited', message: 'Too many requests' }), {
+                    'Content-Type': 'application/json',
+                    ...(0, rate_limit_js_1.rateLimitHeaders)(rateCheck),
+                });
+            }
+            const result = await (0, devices_js_1.handleLinkConfirm)(event.body, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Register — no auth, IP rate limited (1 req/sec)
+        if (method === 'POST' && path === '/v1/auth/register') {
+            const sourceIp = event.headers['x-forwarded-for']?.split(',')[0]?.trim()
+                ?? event.requestContext.http.sourceIp
+                ?? 'unknown';
+            const rateCheck = await (0, rate_limit_js_1.checkIpRateLimit)(sourceIp, 'REGISTER', ddb, TABLE_NAME);
+            if (!rateCheck.allowed) {
+                return response(429, JSON.stringify({ error: 'rate_limited', message: 'Too many requests' }), {
+                    'Content-Type': 'application/json',
+                    ...(0, rate_limit_js_1.rateLimitHeaders)(rateCheck),
+                });
+            }
+            const result = await (0, register_js_1.handleRegister)(event.body, ddb, TABLE_NAME, SIGNUPS_ENABLED_PARAM);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // All other routes require authentication
+        const auth = await (0, ssh_auth_js_1.authenticateRequest)(event, ddb, TABLE_NAME);
+        const tenantId = auth.tenantId;
+        // Revoke all devices (emergency)
+        if (path === '/v1/revoke-all' && method === 'POST') {
+            const result = await (0, revocation_js_1.handleRevokeAll)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Audit log
+        if (path === '/v1/audit' && method === 'GET') {
+            const result = await (0, audit_js_1.handleGetAuditLog)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Key rotation routes
+        if (path === '/v1/rotate-start' && method === 'POST') {
+            const result = await (0, rotation_js_1.handleRotateStart)(tenantId, auth.fingerprint, event.body, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (path === '/v1/rotate-confirm' && method === 'POST') {
+            const result = await (0, rotation_js_1.handleRotateConfirm)(tenantId, auth.fingerprint, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Device linking routes (authenticated)
+        if (path === '/v1/link-code' && method === 'POST') {
+            const result = await (0, devices_js_1.handleCreateLinkCodeFull)(tenantId, event.body, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        const linkStatusMatch = path.match(/^\/v1\/link-code\/([^/]+)\/status$/);
+        if (linkStatusMatch && method === 'GET') {
+            const codeHash = linkStatusMatch[1];
+            const result = await (0, devices_js_1.handleGetLinkCodeStatus)(tenantId, codeHash, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Device management routes (authenticated)
+        if (path === '/v1/devices' && method === 'GET') {
+            const result = await (0, devices_js_1.handleListDevices)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        const deviceDeleteMatch = path.match(/^\/v1\/devices\/([^/]+)$/);
+        if (deviceDeleteMatch && method === 'DELETE') {
+            const fingerprint = deviceDeleteMatch[1];
+            const result = await (0, devices_js_1.handleDeleteDevice)(tenantId, fingerprint, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Wrapped key routes
+        if (path === '/v1/wrapped-key' && method === 'PUT') {
+            const result = await (0, wrapped_key_js_1.handlePutWrappedKey)(tenantId, auth.fingerprint, event.body, event.isBase64Encoded, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (path === '/v1/wrapped-key' && method === 'GET') {
+            const result = await (0, wrapped_key_js_1.handleGetWrappedKey)(tenantId, auth.fingerprint, ddb, TABLE_NAME);
+            if (result.statusCode === 200 && result.headers['Content-Type'] === 'application/octet-stream') {
+                return response(result.statusCode, result.body, result.headers, true);
+            }
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Blob routes
+        const blobMatch = path.match(/^\/v1\/blobs\/([^/]+)$/);
+        const restoreMatch = path.match(/^\/v1\/blobs\/([^/]+)\/restore$/);
+        if (restoreMatch && method === 'POST') {
+            const blobId = restoreMatch[1];
+            const result = await (0, restore_js_1.handleRestore)(blobId, tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (path === '/v1/blobs/count' && method === 'GET') {
+            const result = await (0, blobs_js_1.handleCountBlobs)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (blobMatch) {
+            const blobId = blobMatch[1];
+            if (method === 'PUT') {
+                const contentType = event.headers['content-type'] || event.headers['Content-Type'] || '';
+                const result = await (0, blobs_js_1.handlePutBlob)(blobId, tenantId, event.body, event.isBase64Encoded, contentType, ddb, TABLE_NAME);
+                if (result.statusCode === 200 && result.headers['Content-Type'] === 'application/octet-stream') {
+                    return response(result.statusCode, result.body, result.headers, true);
+                }
+                return response(result.statusCode, result.body, result.headers);
+            }
+            if (method === 'GET') {
+                const result = await (0, blobs_js_1.handleGetBlob)(blobId, tenantId, ddb, TABLE_NAME);
+                if (result.statusCode === 200 && result.headers['Content-Type'] === 'application/octet-stream') {
+                    return response(result.statusCode, result.body, result.headers, true);
+                }
+                return response(result.statusCode, result.body, result.headers);
+            }
+            if (method === 'DELETE') {
+                const result = await (0, blobs_js_1.handleDeleteBlob)(blobId, tenantId, ddb, TABLE_NAME);
+                return response(result.statusCode, result.body, result.headers);
+            }
+        }
+        if (path === '/v1/blobs' && method === 'GET') {
+            const since = event.queryStringParameters?.['since'];
+            const result = await (0, blobs_js_1.handleListBlobs)(tenantId, since, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Tenant routes
+        const tenantDeleteMatch = path.match(/^\/v1\/tenants\/([^/]+)$/);
+        if (path === '/v1/tenants' && method === 'POST') {
+            const result = await (0, tenants_js_1.handleCreateTenant)(event.body, tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (path === '/v1/tenants' && method === 'GET') {
+            const result = await (0, tenants_js_1.handleListTenants)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (tenantDeleteMatch && method === 'DELETE') {
+            const projectTenantId = tenantDeleteMatch[1];
+            const result = await (0, tenants_js_1.handleDeleteTenant)(projectTenantId, tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Invite routes
+        const inviteActionMatch = path.match(/^\/v1\/invites\/([^/]+)\/(accept|decline)$/);
+        if (path === '/v1/invites' && method === 'POST') {
+            const result = await (0, invites_js_1.handleCreateInvite)(tenantId, auth.fingerprint, event.body, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (path === '/v1/invites' && method === 'GET') {
+            const result = await (0, invites_js_1.handleListInvites)(tenantId, auth.fingerprint, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        if (inviteActionMatch && method === 'POST') {
+            const inviteId = inviteActionMatch[1];
+            const action = inviteActionMatch[2];
+            if (action === 'accept') {
+                const result = await (0, invites_js_1.handleAcceptInvite)(tenantId, auth.fingerprint, inviteId, ddb, TABLE_NAME);
+                return response(result.statusCode, result.body, result.headers);
+            }
+            if (action === 'decline') {
+                const result = await (0, invites_js_1.handleDeclineInvite)(tenantId, auth.fingerprint, inviteId, event.body, ddb, TABLE_NAME);
+                return response(result.statusCode, result.body, result.headers);
+            }
+        }
+        // Notifications
+        if (path === '/v1/notifications' && method === 'GET') {
+            const result = await (0, notifications_js_1.handleGetNotifications)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        const notificationDismissMatch = path.match(/^\/v1\/notifications\/(.+)\/dismiss$/);
+        if (notificationDismissMatch && method === 'POST') {
+            const notificationId = decodeURIComponent(notificationDismissMatch[1]);
+            const result = await (0, notifications_js_1.handleDismissNotification)(tenantId, notificationId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Shared projects
+        if (path === '/v1/projects/available' && method === 'GET') {
+            const result = await (0, projects_js_1.handleListAvailableProjects)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Export
+        if (path === '/v1/export' && method === 'GET') {
+            const result = await (0, export_js_1.handleExport)(tenantId, ddb, TABLE_NAME);
+            return response(result.statusCode, result.body, result.headers);
+        }
+        // Not found
+        return response(404, JSON.stringify({ error: 'not_found', message: `No route for ${method} ${path}` }), {
+            'Content-Type': 'application/json',
+        });
+    }
+    catch (err) {
+        const durationMs = Date.now() - startTime;
+        if (err instanceof ssh_auth_js_1.AuthError) {
+            logger_js_1.logger.warn('Auth failed', { requestId, durationMs, error: err.message });
+            return response(err.statusCode, JSON.stringify({ error: 'auth_error', message: err.message }), {
+                'Content-Type': 'application/json',
+            });
+        }
+        logger_js_1.logger.error('Unhandled error', { requestId, durationMs, error: String(err) });
+        return response(500, JSON.stringify({ error: 'internal_error', message: 'Internal server error' }), {
+            'Content-Type': 'application/json',
+        });
+    }
+};
+exports.handler = handler;
+//# sourceMappingURL=index.js.map

package/dist/lib/handler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../lib/handler/index.ts"],"names":[],"mappings":";;;AAAA,8DAA0D;AAC1D,wDAA+D;AAC/D,2CAAqC;AACrC,0DAA0E;AAC1E,8DAAgF;AAChF,kDAAkD;AAClD,sDAAuE;AACvE,gDAM2B;AAC3B,oDAAoD;AACpD,oDAAgG;AAChG,kDAAkD;AAClD,4DAAmF;AACnF,sDAA8E;AAC9E,gDAAsD;AACtD,0DAAyD;AACzD,oDAM6B;AAC7B,oDAK6B;AAC7B,sDAAmE;AACnE,gEAA8F;AAoB9F,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;AACnD,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;AAEzE,MAAM,MAAM,GAAG,IAAI,gCAAc,CAAC,EAAE,CAAC,CAAC;AACtC,MAAM,GAAG,GAAG,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE;IAC9C,eAAe,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,YAAY,GAA2B;IAC3C,6BAA6B,EAAE,MAAM;IACrC,8BAA8B,EAAE,iCAAiC;IACjE,8BAA8B,EAAE,6BAA6B;CAC9D,CAAC;AAEF,SAAS,QAAQ,CACf,UAAkB,EAClB,IAAY,EACZ,UAAkC,EAAE,EACpC,eAAe,GAAG,KAAK;IAEvB,OAAO;QACL,UAAU;QACV,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,EAAE;QACxC,IAAI;QACJ,eAAe;KAChB,CAAC;AACJ,CAAC;AAEM,MAAM,OAAO,GAAG,KAAK,EAAE,KAA6B,EAAoC,EAAE;IAC/F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC;IAEjD,kBAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAE/E,IAAI,CAAC;QACH,2BAA2B;QAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAA,wBAAY,GAAE,CAAC;YAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,oDAAoD;QACpD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;mBACnE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ;mBAClC,SAAS,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAgB,EAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE;oBAC5F,cAAc,EAAE,kBAAkB;oBAClC,GAAG,IAAA,gCAAgB,EAAC,SAAS,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAe,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,8EAA8E;QAC9E,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;mBACnE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ;mBAClC,SAAS,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAgB,EAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE;oBAC5F,cAAc,EAAE,kBAAkB;oBAClC,GAAG,IAAA,gCAAgB,EAAC,SAAS,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAiB,EAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,kDAAkD;QAClD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;mBACnE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ;mBAClC,SAAS,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAgB,EAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAChF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACvB,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE;oBAC5F,cAAc,EAAE,kBAAkB;oBAClC,GAAG,IAAA,gCAAgB,EAAC,SAAS,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAc,EAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;YACxF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,0CAA0C;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAmB,EAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,iCAAiC;QACjC,IAAI,IAAI,KAAK,gBAAgB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAe,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAChE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,YAAY;QACZ,IAAI,IAAI,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAClE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,KAAK,kBAAkB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAChG,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,KAAK,oBAAoB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAmB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACtF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,IAAA,qCAAwB,EAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACrF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACzE,IAAI,eAAe,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAuB,EAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAClE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjE,IAAI,iBAAiB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAChF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,qBAAqB;QACrB,IAAI,IAAI,KAAK,iBAAiB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAmB,EACtC,QAAQ,EACR,IAAI,CAAC,WAAW,EAChB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,eAAe,EACrB,GAAG,EACH,UAAU,CACX,CAAC;YACF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,KAAK,iBAAiB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAmB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,0BAA0B,EAAE,CAAC;gBAC/F,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,cAAc;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAEnE,IAAI,YAAY,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACtE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,KAAK,iBAAiB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAgB,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAE5B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAa,EAChC,MAAM,EACN,QAAQ,EACR,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,eAAe,EACrB,WAAW,EACX,GAAG,EACH,UAAU,CACX,CAAC;gBACF,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,0BAA0B,EAAE,CAAC;oBAC/F,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,0BAA0B,EAAE,CAAC;oBAC/F,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAgB,EAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBACzE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAe,EAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,gBAAgB;QAChB,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAEjE,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC/E,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAClE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,iBAAiB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,eAAe,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACpF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,gBAAgB;QAChB,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAEnF,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACjG,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACpF,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,iBAAiB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAEpC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAkB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC/F,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAmB,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC5G,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,KAAK,mBAAmB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAA,yCAAsB,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACpF,IAAI,wBAAwB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAA,4CAAyB,EAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC1F,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,KAAK,wBAAwB,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,yCAA2B,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC5E,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,SAAS;QACT,IAAI,IAAI,KAAK,YAAY,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAED,YAAY;QACZ,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE;YACtG,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,IAAI,GAAG,YAAY,uBAAS,EAAE,CAAC;YAC7B,kBAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE;gBAC7F,cAAc,EAAE,kBAAkB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,kBAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE;YAClG,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAhSW,QAAA,OAAO,WAgSlB"}