@de-otio/trellis 0.4.0

package/dist/lib/session-manager.js

@@ -0,0 +1,492 @@
+"use strict";
+/**
+ * Session Management
+ *
+ * Handles encrypted cookie-based session storage for authentication.
+ * Uses Supabase Auth.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionManager = void 0;
+const logger_1 = require("./logger");
+/**
+ * Session Manager class for handling encrypted sessions
+ */
+class SessionManager {
+    static COOKIE_NAME = "trellis_session";
+    hadLegacySessionCookie = false;
+    hadInvalidSessionCookie = false;
+    /**
+     * Get session configuration from environment
+     */
+    async getSessionConfig(env) {
+        // Import dynamically to avoid circular dependencies
+        const { getSessionConfig } = await Promise.resolve().then(() => __importStar(require("./session-config")));
+        return getSessionConfig(env);
+    }
+    /**
+     * Derive encryption key from secret using PBKDF2
+     * This provides proper key stretching and consistent key size
+     *
+     * Environment Variables:
+     * - SESSION_SALT: Custom salt for PBKDF2 (REQUIRED — must be set in environment)
+     */
+    async deriveKey(secret, envSalt) {
+        // Import secret as key material
+        const keyMaterial = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "PBKDF2", false, ["deriveBits", "deriveKey"]);
+        // SESSION_SALT is required — fail-closed if not provided
+        if (!envSalt) {
+            throw new Error("SESSION_SALT environment variable is required. " +
+                "Set a unique, random salt value in your environment configuration.");
+        }
+        // PBKDF2 with 100k iterations provides good security
+        const saltString = envSalt;
+        const salt = new TextEncoder().encode(saltString);
+        // Derive 256-bit key for AES-256
+        return crypto.subtle.deriveKey({
+            name: "PBKDF2",
+            salt: salt,
+            iterations: 100000,
+            hash: "SHA-256",
+        }, keyMaterial, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+    }
+    /**
+     * Encrypt session data using Web Crypto API (AES-GCM)
+     */
+    async encryptSession(data, secret, salt) {
+        const key = await this.deriveKey(secret, salt);
+        const iv = crypto.getRandomValues(new Uint8Array(12)); // 12 bytes for GCM
+        const encoded = new TextEncoder().encode(data);
+        const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, encoded);
+        // Combine IV and encrypted data: [IV (12 bytes)][Encrypted Data]
+        const combined = new Uint8Array(iv.length + encrypted.byteLength);
+        combined.set(iv, 0);
+        combined.set(new Uint8Array(encrypted), iv.length);
+        // Base64 encode for cookie storage
+        return Buffer.from(combined).toString("base64");
+    }
+    /**
+     * Decrypt session data
+     */
+    async decryptSession(encryptedData, secret, salt) {
+        try {
+            const key = await this.deriveKey(secret, salt);
+            // Decode base64
+            const combined = new Uint8Array(Buffer.from(encryptedData, "base64"));
+            // Extract IV (first 12 bytes) and encrypted data
+            const iv = combined.slice(0, 12);
+            const encrypted = combined.slice(12);
+            const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, encrypted);
+            return new TextDecoder().decode(decrypted);
+        }
+        catch (error) {
+            // Note: Logger not available in this private method, but error is handled by caller
+            return null;
+        }
+    }
+    /**
+     * Parse cookies from Cookie header with proper URL decoding
+     * Handles edge cases and malformed cookies securely
+     */
+    parseCookies(cookieHeader) {
+        const cookies = {};
+        if (!cookieHeader)
+            return cookies;
+        for (const cookie of cookieHeader.split(";")) {
+            const trimmed = cookie.trim();
+            const eqIndex = trimmed.indexOf("=");
+            if (eqIndex > 0) {
+                try {
+                    const key = decodeURIComponent(trimmed.slice(0, eqIndex).trim());
+                    const value = decodeURIComponent(trimmed.slice(eqIndex + 1).trim());
+                    if (key && value)
+                        cookies[key] = value;
+                }
+                catch (e) {
+                    // Skip malformed cookies
+                    continue;
+                }
+            }
+        }
+        return cookies;
+    }
+    /**
+     * Get session from request
+     * Checks Authorization header first (for localStorage token), then falls back to cookie
+     * Checks expiration and inactivity timeout
+     *
+     * Supports dual-secret rotation: tries primary secret first, then fallback secret
+     * This enables zero-downtime secret rotation without invalidating existing sessions
+     */
+    async getSession(request, secret, env) {
+        const logger = logger_1.Logger.getInstance(env);
+        const salt = env?.SESSION_SALT;
+        // Validate secret is provided and is a string
+        logger.debug("[SessionManager] getSession entry");
+        if (!secret || typeof secret !== "string" || secret.length === 0) {
+            logger.error("[SessionManager] Invalid secret provided");
+            return null;
+        }
+        // S1.3 — Enforce session secret minimum 32 characters
+        if (secret.length < 32) {
+            logger.error("[SessionManager] Session secret too short (must be >= 32 characters)");
+            return null;
+        }
+        this.hadLegacySessionCookie = false;
+        this.hadInvalidSessionCookie = false;
+        const requestOrigin = request.headers.get("Origin");
+        const requestUrl = new URL(request.url);
+        // Strategy 1: Check Authorization header first
+        const authHeader = request.headers.get("Authorization");
+        if (authHeader && authHeader.startsWith("Bearer ")) {
+            const token = authHeader.substring(7); // Remove "Bearer " prefix
+            // Strategy 1a: If the token looks like a JWT (3 dot-separated parts), try Cognito verification
+            if (token.split(".").length === 3) {
+                try {
+                    const { verifyCognitoJwt } = await Promise.resolve().then(() => __importStar(require("./auth/cognito-jwt")));
+                    const claims = await verifyCognitoJwt(token);
+                    logger.debug("[SessionManager] Cognito JWT verified", {
+                        sub: claims.sub,
+                        username: claims.username,
+                    });
+                    // S1.7 — Use JWT exp claim for session expiration, capped at 1 hour
+                    let expiresAt = Date.now() + 3600_000;
+                    try {
+                        const jwtPayload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString());
+                        if (jwtPayload.exp) {
+                            expiresAt = Math.min(jwtPayload.exp * 1000, Date.now() + 3600_000);
+                        }
+                    }
+                    catch {
+                        // If JWT payload parsing fails, use default 1 hour expiration
+                    }
+                    return {
+                        userId: claims.sub,
+                        email: claims.email || claims.username,
+                        role: claims["custom:role"] || "END_USER",
+                        expiresAt,
+                        dataRegion: claims["custom:dataRegion"] || "EU",
+                        profileContext: "primary",
+                        ageTier: claims["custom:ageTier"] || "ADULT",
+                    };
+                }
+                catch (jwtErr) {
+                    logger.debug("[SessionManager] Cognito JWT verification failed, trying encrypted session", jwtErr);
+                    // Fall through to encrypted session approach
+                }
+            }
+            // Strategy 1b: Try to decrypt as encrypted session token (localStorage approach)
+            logger.debug("[SessionManager] Found Authorization header, attempting to decrypt token", {
+                tokenLength: token.length,
+                origin: requestOrigin,
+                hostname: requestUrl.hostname,
+            });
+            let decrypted = await this.decryptSession(token, secret, salt);
+            // If primary secret fails and fallback secret exists, try fallback
+            if (!decrypted && env) {
+                const { Secrets } = await Promise.resolve().then(() => __importStar(require("./secret-resolver")));
+                const fallbackSecret = Secrets.getSessionSecretFallback(env);
+                if (fallbackSecret) {
+                    logger.debug("[SessionManager] Primary secret failed for Authorization token, trying fallback");
+                    decrypted = await this.decryptSession(token, fallbackSecret, salt);
+                }
+            }
+            if (decrypted) {
+                try {
+                    const session = JSON.parse(decrypted);
+                    // Validate session structure (same validation as cookie path)
+                    if (session.userId && session.email) {
+                        const now = Date.now();
+                        if (session.expiresAt && session.expiresAt < now) {
+                            logger.debug("[SessionManager] Session from Authorization header expired");
+                            return null;
+                        }
+                        logger.debug("[SessionManager] Successfully decrypted session from Authorization header", {
+                            userId: session.userId,
+                            email: session.email,
+                        });
+                        return session;
+                    }
+                }
+                catch (parseError) {
+                    logger.debug("[SessionManager] Failed to parse decrypted token from Authorization header", parseError);
+                }
+            }
+            else {
+                logger.debug("[SessionManager] Failed to decrypt token from Authorization header");
+            }
+        }
+        // Strategy 2: Fall back to cookie (for backward compatibility)
+        const cookieHeader = request.headers.get("Cookie");
+        logger.debug("[SessionManager] getSession called", {
+            hasAuthHeader: !!authHeader,
+            hasCookieHeader: !!cookieHeader,
+            cookieHeaderLength: cookieHeader?.length || 0,
+            origin: requestOrigin,
+            hostname: requestUrl.hostname,
+        });
+        if (!cookieHeader) {
+            logger.debug("[SessionManager] No Cookie header found");
+            return null;
+        }
+        // Parse cookie with improved parsing
+        const cookies = this.parseCookies(cookieHeader);
+        const sessionToken = cookies[SessionManager.COOKIE_NAME] ?? null;
+        if (!sessionToken) {
+            if (cookies.session) {
+                this.hadLegacySessionCookie = true;
+                logger.debug("[SessionManager] Legacy session cookie detected; ignoring legacy cookie name.");
+            }
+            logger.debug("[SessionManager] No session cookie found. Available cookies: " +
+                Object.keys(cookies).join(", ") +
+                ", Cookie header preview: " +
+                cookieHeader.substring(0, 200), {
+                availableCookies: Object.keys(cookies),
+                cookieHeaderPreview: cookieHeader.substring(0, 200),
+            });
+            return null;
+        }
+        logger.debug("[SessionManager] Found session token, length: " + sessionToken.length, { tokenLength: sessionToken.length });
+        // Try primary secret first
+        logger.debug("[SessionManager] Attempting to decrypt session with primary secret");
+        let decrypted = await this.decryptSession(sessionToken, secret, salt);
+        // If primary secret fails and fallback secret exists, try fallback (for zero-downtime rotation)
+        if (!decrypted && env) {
+            logger.debug("[SessionManager] Primary secret failed, checking for fallback secret");
+            // Use secret resolver to get fallback secret (supports both old and new naming)
+            const { Secrets } = await Promise.resolve().then(() => __importStar(require("./secret-resolver")));
+            const fallbackSecret = Secrets.getSessionSecretFallback(env);
+            if (fallbackSecret) {
+                logger.debug("[SessionManager] Primary secret failed, trying fallback secret (rotation in progress)");
+                decrypted = await this.decryptSession(sessionToken, fallbackSecret, salt);
+                if (decrypted) {
+                    logger.debug("[SessionManager] Successfully decrypted with fallback secret");
+                }
+                else {
+                    logger.debug("[SessionManager] Fallback secret also failed");
+                }
+            }
+            else {
+                logger.debug("[SessionManager] No fallback secret available");
+            }
+        }
+        if (!decrypted) {
+            logger.debug("[SessionManager] Session decryption failed with both primary and fallback secrets");
+            logger.debug("[SessionManager] Session token length:", sessionToken?.length ?? "undefined");
+            logger.debug("[SessionManager] Secret length:", secret?.length ?? "undefined");
+            return null;
+        }
+        try {
+            const session = JSON.parse(decrypted);
+            const sessionKeys = Object.keys(session);
+            logger.debug("[SessionManager] Parsed session keys:", sessionKeys);
+            // Detect BlueSky/AT Protocol session (legacy, from before Supabase migration)
+            if (session.did ||
+                session.handle ||
+                session.accessJwt ||
+                session.refreshJwt) {
+                logger.debug("[SessionManager] Legacy BlueSky/AT Protocol session detected, ignoring. User should re-authenticate with Supabase.");
+                this.hadInvalidSessionCookie = true;
+                return null;
+            }
+            // Validate Supabase session structure
+            if (session.userId && session.email) {
+                const now = Date.now();
+                // Check expiration
+                if (session.expiresAt && session.expiresAt < now) {
+                    logger.debug("[SessionManager] Session expired");
+                    return null;
+                }
+                // Check inactivity timeout if configured
+                if (env && session.lastActivityAt) {
+                    const config = await this.getSessionConfig(env);
+                    if (config.inactivityTimeoutMinutes > 0) {
+                        const inactivityTimeout = config.inactivityTimeoutMinutes * 60 * 1000;
+                        const timeSinceLastActivity = now - session.lastActivityAt;
+                        if (timeSinceLastActivity > inactivityTimeout) {
+                            logger.debug("[SessionManager] Session expired due to inactivity");
+                            return null;
+                        }
+                    }
+                }
+                // Update last activity timestamp
+                session.lastActivityAt = now;
+                return session;
+            }
+            else {
+                this.hadInvalidSessionCookie = true;
+                logger.error("[SessionManager] Invalid session structure (expected userId and email):", sessionKeys);
+                return null;
+            }
+        }
+        catch (error) {
+            logger.error("[SessionManager] Failed to parse session:", error);
+            return null;
+        }
+    }
+    /**
+     * Set session cookie in response (alias for setSession)
+     */
+    async setSessionCookie(response, session, secret, cookieDomain, env) {
+        return this.setSession(response, session, secret, cookieDomain, env);
+    }
+    /**
+     * Set session cookie in response
+     * Uses configurable session timeout based on session type
+     */
+    async setSession(response, session, secret, cookieDomain, env) {
+        const logger = logger_1.Logger.getInstance(env);
+        const salt = env?.SESSION_SALT;
+        const encrypted = await this.encryptSession(JSON.stringify(session), secret, salt);
+        logger.debug("[SessionManager] Preparing session cookie. UserId: " +
+            session.userId +
+            ", Email: " +
+            session.email +
+            ", SessionType: " +
+            (session.sessionType || "user"), {
+            userId: session.userId,
+            email: session.email,
+            sessionType: session.sessionType || "user",
+        });
+        // Determine session type (default to 'user' for backward compatibility)
+        const sessionType = session.sessionType || "user";
+        // Calculate cookie max-age based on session type and configuration
+        let cookieMaxAge;
+        if (env) {
+            const config = await this.getSessionConfig(env);
+            const { calculateCookieMaxAge } = await Promise.resolve().then(() => __importStar(require("./session-config")));
+            cookieMaxAge = calculateCookieMaxAge(config, sessionType);
+        }
+        else {
+            // Fallback to default (90 days) if no config available
+            cookieMaxAge = 90 * 24 * 60 * 60; // 90 days
+        }
+        // Note: Secure requires HTTPS. For local dev, you may need to remove Secure flag
+        // SameSite=None; Secure is required for:
+        // 1. Cross-subdomain requests (example.com <-> api.example.com) when domain is set with leading dot
+        // 2. Cross-domain requests (e.g., dev.example.com <-> api.example.com) when no domain is set
+        // Domain attribute allows cookie to be shared across subdomains (e.g., example.com and api.example.com)
+        // For same-domain requests (localhost), we use SameSite=Lax
+        // For all production scenarios (with or without domain), we use SameSite=None; Secure
+        const isLocalhost = !cookieDomain || cookieDomain === "";
+        const sameSite = isLocalhost ? "SameSite=Lax" : "SameSite=None; Secure";
+        let cookieValue = `${SessionManager.COOKIE_NAME}=${encrypted}; HttpOnly; Secure; ${sameSite}; Path=/; Max-Age=${cookieMaxAge}`;
+        if (cookieDomain) {
+            cookieValue += `; Domain=${cookieDomain}`;
+        }
+        logger.debug("[SessionManager] Setting session cookie (length: " +
+            encrypted.length +
+            (cookieDomain ? ", domain: " + cookieDomain : "") +
+            ")", {
+            cookieLength: encrypted.length,
+            cookieDomain: cookieDomain || undefined,
+        });
+        // Clone response to add cookie header
+        const newResponse = new Response(response.body, response);
+        newResponse.headers.append("Set-Cookie", cookieValue);
+        return newResponse;
+    }
+    /**
+     * Clear session cookie (alias for clearSession)
+     */
+    clearSessionCookie(response) {
+        return this.clearSession(response);
+    }
+    /**
+     * Clear session cookie
+     * @param response - Response to add clear cookie headers to
+     * @param cookieDomain - Optional domain to clear cookie from (e.g., ".example.com" for cross-subdomain)
+     */
+    clearSession(response, cookieDomain) {
+        const newResponse = new Response(response.body, response);
+        // Consolidated cookie clearing: Max-Age=0 clears regardless of SameSite value,
+        // so we only need 3 Set-Cookie headers instead of 6:
+        // 1. Current cookie name without domain (clears API-domain-only cookies)
+        // 2. Current cookie name with domain (clears cross-subdomain cookies, if domain is set)
+        // 3. Legacy cookie name without domain (backward compatibility)
+        const cookieName = SessionManager.COOKIE_NAME;
+        const clearAttrs = "HttpOnly; Secure; SameSite=None; Path=/; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT";
+        // 1. Clear current cookie without domain
+        newResponse.headers.append("Set-Cookie", `${cookieName}=; ${clearAttrs}`);
+        // 2. Clear current cookie with domain (if set)
+        if (cookieDomain) {
+            newResponse.headers.append("Set-Cookie", `${cookieName}=; ${clearAttrs}; Domain=${cookieDomain}`);
+        }
+        // 3. Clear legacy "session" cookie without domain (backward compatibility)
+        newResponse.headers.append("Set-Cookie", `session=; ${clearAttrs}`);
+        return newResponse;
+    }
+    /**
+     * AUTH-5: Hash a session token for blocklist storage.
+     */
+    async hashToken(token) {
+        const encoded = new TextEncoder().encode(token);
+        const hash = await crypto.subtle.digest("SHA-256", encoded);
+        return Array.from(new Uint8Array(hash))
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("");
+    }
+    /**
+     * AUTH-5: Revoke a session token by adding it to the blocklist.
+     * Call this on logout to prevent token reuse.
+     */
+    async revokeSession(request, env) {
+        const kvStore = env.SESSION_BLOCKLIST_KV;
+        if (!kvStore)
+            return; // No blocklist KV configured
+        // Extract the raw token from the request
+        const authHeader = request.headers.get("Authorization");
+        let token = null;
+        if (authHeader?.startsWith("Bearer ")) {
+            token = authHeader.substring(7);
+        }
+        else {
+            const cookieHeader = request.headers.get("Cookie");
+            if (cookieHeader) {
+                const cookies = this.parseCookies(cookieHeader);
+                token = cookies[SessionManager.COOKIE_NAME] ?? null;
+            }
+        }
+        if (!token)
+            return;
+        const tokenHash = await this.hashToken(token);
+        // Store with TTL matching max session lifetime (90 days)
+        await kvStore.put(`blocked:${tokenHash}`, "1", {
+            expirationTtl: 90 * 24 * 60 * 60,
+        });
+    }
+}
+exports.SessionManager = SessionManager;
+//# sourceMappingURL=session-manager.js.map

package/dist/lib/session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../src/lib/session-manager.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,qCAAkC;AA0ClC;;GAEG;AACH,MAAa,cAAc;IACjB,MAAM,CAAU,WAAW,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,GAAG,KAAK,CAAC;IAC/B,uBAAuB,GAAG,KAAK,CAAC;IAEvC;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,GAA2B;QACxD,oDAAoD;QACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,kBAAkB,GAAC,CAAC;QAC9D,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS,CACrB,MAAc,EACd,OAAgB;QAEhB,gCAAgC;QAChC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,CAAC,CAC5B,CAAC;QAEF,yDAAyD;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,iDAAiD;gBACjD,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,qDAAqD;QACrD,MAAM,UAAU,GAAG,OAAO,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAElD,iCAAiC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,MAAM;YAClB,IAAI,EAAE,SAAS;SAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,IAAY,EACZ,MAAc,EACd,IAAa;QAEb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE/C,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB;QAC1E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,OAAO,CACR,CAAC;QAEF,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAEnD,mCAAmC;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,aAAqB,EACrB,MAAc,EACd,IAAa;QAEb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAE/C,gBAAgB;YAChB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEtE,iDAAiD;YACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,SAAS,CACV,CAAC;YAEF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,YAAoB;QACvC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC;QAElC,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACjE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACpE,IAAI,GAAG,IAAI,KAAK;wBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACzC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,yBAAyB;oBACzB,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,OAAgB,EAChB,MAAc,EACd,GAA4B;QAE5B,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,EAAE,YAAY,CAAC;QAE/B,8CAA8C;QAC9C,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sDAAsD;QACtD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC;QAErC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAExC,+CAA+C;QAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;YAEjE,+FAA+F;YAC/F,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;oBAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBAC7C,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;wBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;wBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;qBAC1B,CAAC,CAAC;oBACH,oEAAoE;oBACpE,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CACzD,CAAC;wBACF,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;4BACnB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;wBACrE,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,8DAA8D;oBAChE,CAAC;oBAED,OAAO;wBACL,MAAM,EAAE,MAAM,CAAC,GAAG;wBAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ;wBACtC,IAAI,EAAG,MAAM,CAAC,aAAa,CAAc,IAAI,UAAU;wBACvD,SAAS;wBACT,UAAU,EAAG,MAAM,CAAC,mBAAmB,CAAY,IAAI,IAAI;wBAC3D,cAAc,EAAE,SAAS;wBACzB,OAAO,EAAI,MAAc,CAAC,gBAAgB,CAAa,IAAI,OAAO;qBACxD,CAAC;gBACf,CAAC;gBAAC,OAAO,MAAM,EAAE,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,4EAA4E,EAAE,MAAM,CAAC,CAAC;oBACnG,6CAA6C;gBAC/C,CAAC;YACH,CAAC;YAED,iFAAiF;YACjF,MAAM,CAAC,KAAK,CACV,0EAA0E,EAC1E;gBACE,WAAW,EAAE,KAAK,CAAC,MAAM;gBACzB,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B,CACF,CAAC;YAEF,IAAI,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE/D,mEAAmE;YACnE,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;gBACtD,MAAM,cAAc,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAU,CAAC,CAAC;gBACpE,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,CAAC,KAAK,CACV,iFAAiF,CAClF,CAAC;oBACF,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,MAAM,OAAO,GAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAE3C,8DAA8D;oBAC9D,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;wBACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBACvB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;4BACjD,MAAM,CAAC,KAAK,CACV,4DAA4D,CAC7D,CAAC;4BACF,OAAO,IAAI,CAAC;wBACd,CAAC;wBAED,MAAM,CAAC,KAAK,CACV,2EAA2E,EAC3E;4BACE,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,KAAK,EAAE,OAAO,CAAC,KAAK;yBACrB,CACF,CAAC;wBACF,OAAO,OAAkB,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CACV,4EAA4E,EAC5E,UAAU,CACX,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CACV,oEAAoE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;YACjD,aAAa,EAAE,CAAC,CAAC,UAAU;YAC3B,eAAe,EAAE,CAAC,CAAC,YAAY;YAC/B,kBAAkB,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;YAC7C,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qCAAqC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QACjE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;gBACnC,MAAM,CAAC,KAAK,CACV,+EAA+E,CAChF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,KAAK,CACV,+DAA+D;gBAC7D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/B,2BAA2B;gBAC3B,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAChC;gBACE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBACtC,mBAAmB,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aACpD,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,KAAK,CACV,gDAAgD,GAAG,YAAY,CAAC,MAAM,EACtE,EAAE,WAAW,EAAE,YAAY,CAAC,MAAM,EAAE,CACrC,CAAC;QAEF,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CACV,oEAAoE,CACrE,CAAC;QACF,IAAI,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAEtE,gGAAgG;QAChG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CACV,sEAAsE,CACvE,CAAC;YACF,gFAAgF;YAChF,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;YACtD,MAAM,cAAc,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAU,CAAC,CAAC;YACpE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,CAAC,KAAK,CACV,uFAAuF,CACxF,CAAC;gBACF,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;gBAC1E,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,CAAC,KAAK,CACV,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,mFAAmF,CACpF,CAAC;YACF,MAAM,CAAC,KAAK,CACV,wCAAwC,EACxC,YAAY,EAAE,MAAM,IAAI,WAAW,CACpC,CAAC;YACF,MAAM,CAAC,KAAK,CACV,iCAAiC,EACjC,MAAM,EAAE,MAAM,IAAI,WAAW,CAC9B,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,WAAW,CAAC,CAAC;YAEnE,8EAA8E;YAC9E,IACE,OAAO,CAAC,GAAG;gBACX,OAAO,CAAC,MAAM;gBACd,OAAO,CAAC,SAAS;gBACjB,OAAO,CAAC,UAAU,EAClB,CAAC;gBACD,MAAM,CAAC,KAAK,CACV,oHAAoH,CACrH,CAAC;gBACF,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,sCAAsC;YACtC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAEvB,mBAAmB;gBACnB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBACjD,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACjD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,yCAAyC;gBACzC,IAAI,GAAG,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,MAAM,CAAC,wBAAwB,GAAG,CAAC,EAAE,CAAC;wBACxC,MAAM,iBAAiB,GACrB,MAAM,CAAC,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;wBAC9C,MAAM,qBAAqB,GAAG,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;wBAC3D,IAAI,qBAAqB,GAAG,iBAAiB,EAAE,CAAC;4BAC9C,MAAM,CAAC,KAAK,CACV,oDAAoD,CACrD,CAAC;4BACF,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,iCAAiC;gBACjC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;gBAE7B,OAAO,OAAkB,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,MAAM,CAAC,KAAK,CACV,yEAAyE,EACzE,WAAW,CACZ,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,QAAkB,EAClB,OAAgB,EAChB,MAAc,EACd,YAAqB,EACrB,GAA4B;QAE5B,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,QAAkB,EAClB,OAAgB,EAChB,MAAc,EACd,YAAqB,EACrB,GAA4B;QAE5B,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,EAAE,YAAY,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CACzC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,MAAM,EACN,IAAI,CACL,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,qDAAqD;YACnD,OAAO,CAAC,MAAM;YACd,WAAW;YACX,OAAO,CAAC,KAAK;YACb,iBAAiB;YACjB,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,EACjC;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;SAC3C,CACF,CAAC;QAEF,wEAAwE;QACxE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAElD,mEAAmE;QACnE,IAAI,YAAoB,CAAC;QACzB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,EAAE,qBAAqB,EAAE,GAAG,wDAAa,kBAAkB,GAAC,CAAC;YACnE,YAAY,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;QAC9C,CAAC;QACD,iFAAiF;QACjF,yCAAyC;QACzC,oGAAoG;QACpG,6FAA6F;QAC7F,wGAAwG;QACxG,4DAA4D;QAC5D,sFAAsF;QACtF,MAAM,WAAW,GAAG,CAAC,YAAY,IAAI,YAAY,KAAK,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACxE,IAAI,WAAW,GAAG,GAAG,cAAc,CAAC,WAAW,IAAI,SAAS,uBAAuB,QAAQ,qBAAqB,YAAY,EAAE,CAAC;QAE/H,IAAI,YAAY,EAAE,CAAC;YACjB,WAAW,IAAI,YAAY,YAAY,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,CAAC,KAAK,CACV,mDAAmD;YACjD,SAAS,CAAC,MAAM;YAChB,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,EACL;YACE,YAAY,EAAE,SAAS,CAAC,MAAM;YAC9B,YAAY,EAAE,YAAY,IAAI,SAAS;SACxC,CACF,CAAC;QAEF,sCAAsC;QACtC,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEtD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAkB;QACnC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,QAAkB,EAAE,YAAqB;QACpD,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE1D,+EAA+E;QAC/E,qDAAqD;QACrD,yEAAyE;QACzE,wFAAwF;QACxF,gEAAgE;QAChE,MAAM,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC;QAC9C,MAAM,UAAU,GAAG,2FAA2F,CAAC;QAE/G,yCAAyC;QACzC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,UAAU,MAAM,UAAU,EAAE,CAAC,CAAC;QAE1E,+CAA+C;QAC/C,IAAI,YAAY,EAAE,CAAC;YACjB,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,UAAU,MAAM,UAAU,YAAY,YAAY,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,2EAA2E;QAC3E,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;QAEpE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CACjB,OAAgB,EAChB,GAA2B;QAE3B,MAAM,OAAO,GAAI,GAAW,CAAC,oBAAoB,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,6BAA6B;QAEnD,yCAAyC;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAEhC,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAChD,KAAK,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;YACtD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,yDAAyD;QACzD,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,SAAS,EAAE,EAAE,GAAG,EAAE;YAC7C,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;;AA9lBH,wCA+lBC"}

package/dist/lib/sso-auth-handler.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SSO Auth Handler stub — legacy Supabase/SAML SSO is no longer supported.
+ * Authentication is handled by AWS Cognito + Amplify SDK.
+ * This stub exists to satisfy test mocks that reference this module.
+ */
+export declare class SSOAuthHandler {
+    initiateSSO(..._args: unknown[]): Promise<Response>;
+    handleSSOCallback(..._args: unknown[]): Promise<Response>;
+    handleSSOExchange(..._args: unknown[]): Promise<Response>;
+    handleTokenExchange(..._args: unknown[]): Promise<Response>;
+}
+//# sourceMappingURL=sso-auth-handler.d.ts.map

package/dist/lib/sso-auth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-auth-handler.d.ts","sourceRoot":"","sources":["../../src/lib/sso-auth-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,cAAc;IACnB,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAGnD,iBAAiB,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAGzD,iBAAiB,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAGzD,mBAAmB,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGlE"}

package/dist/lib/sso-auth-handler.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSOAuthHandler = void 0;
+/**
+ * SSO Auth Handler stub — legacy Supabase/SAML SSO is no longer supported.
+ * Authentication is handled by AWS Cognito + Amplify SDK.
+ * This stub exists to satisfy test mocks that reference this module.
+ */
+class SSOAuthHandler {
+    async initiateSSO(..._args) {
+        return new Response(JSON.stringify({ error: "Deprecated" }), { status: 410 });
+    }
+    async handleSSOCallback(..._args) {
+        return new Response(JSON.stringify({ error: "Deprecated" }), { status: 410 });
+    }
+    async handleSSOExchange(..._args) {
+        return new Response(JSON.stringify({ error: "Deprecated" }), { status: 410 });
+    }
+    async handleTokenExchange(..._args) {
+        return new Response(JSON.stringify({ error: "Deprecated" }), { status: 410 });
+    }
+}
+exports.SSOAuthHandler = SSOAuthHandler;
+//# sourceMappingURL=sso-auth-handler.js.map

package/dist/lib/sso-auth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-auth-handler.js","sourceRoot":"","sources":["../../src/lib/sso-auth-handler.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,MAAa,cAAc;IACzB,KAAK,CAAC,WAAW,CAAC,GAAG,KAAgB;QACnC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAgB;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,GAAG,KAAgB;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,GAAG,KAAgB;QAC3C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;CACF;AAbD,wCAaC"}

package/dist/lib/storage/s3-storage.d.ts

@@ -0,0 +1,29 @@
+/**
+ * S3 Storage — implements Cloudflare R2Bucket interface.
+ */
+import type { R2Bucket, R2Object, R2ObjectBody } from "../../types/cloudflare-compat";
+export declare class S3Storage implements R2Bucket {
+    private readonly bucketName;
+    constructor(bucketName: string);
+    put(key: string, value: ReadableStream | ArrayBuffer | ArrayBufferView | string | null, options?: {
+        httpMetadata?: {
+            contentType?: string;
+        };
+        customMetadata?: Record<string, string>;
+    }): Promise<R2Object>;
+    get(key: string): Promise<R2ObjectBody | null>;
+    delete(key: string | string[]): Promise<void>;
+    list(options?: {
+        prefix?: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<{
+        objects: R2Object[];
+        truncated: boolean;
+        cursor?: string;
+    }>;
+    head(key: string): Promise<R2Object | null>;
+    /** Generate a presigned upload URL for direct client uploads */
+    getPresignedUploadUrl(key: string, contentType: string, expiresIn?: number): Promise<string>;
+}
+//# sourceMappingURL=s3-storage.d.ts.map

package/dist/lib/storage/s3-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-storage.d.ts","sourceRoot":"","sources":["../../../src/lib/storage/s3-storage.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAQtF,qBAAa,SAAU,YAAW,QAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEzC,GAAG,CACP,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,cAAc,GAAG,WAAW,GAAG,eAAe,GAAG,MAAM,GAAG,IAAI,EACrE,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7F,OAAO,CAAC,QAAQ,CAAC;IAgCd,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAsC9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAwBI,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAqBjD,gEAAgE;IAC1D,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC;CAW/F"}