@de-otio/trellis 0.4.0

package/dist/lib/internal-docs-handler.js

@@ -0,0 +1,570 @@
+"use strict";
+/**
+ * Internal Documentation Handler
+ *
+ * Handles serving internal documentation to INTERNAL and SUPER_ADMIN role users.
+ * CRITICAL SECURITY: Only users with INTERNAL or SUPER_ADMIN role can access this documentation.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalDocsHandler = void 0;
+const db_1 = require("../db");
+const internal_docs_dashboard_json_1 = __importDefault(require("./internal-docs-dashboard.json"));
+const internal_docs_navigation_1 = require("./internal-docs-navigation");
+const internal_docs_navigation_json_1 = __importDefault(require("./internal-docs-navigation.json"));
+const logger_1 = require("./logger");
+const secret_resolver_1 = require("./secret-resolver");
+const security_headers_1 = require("./security-headers");
+const session_manager_1 = require("./session-manager");
+/**
+ * Internal Documentation Handler class
+ */
+class InternalDocsHandler {
+    sessionManager;
+    securityHeaders;
+    allowedFiles;
+    logger;
+    constructor(env) {
+        this.sessionManager = new session_manager_1.SessionManager();
+        this.securityHeaders = new security_headers_1.SecurityHeaders();
+        this.logger = logger_1.Logger.getInstance(env);
+        // Validate navigation data at construction time
+        const validation = (0, internal_docs_navigation_1.validateNavigation)(internal_docs_navigation_json_1.default);
+        if (!validation.valid) {
+            this.logger.error("[InternalDocsHandler] Navigation validation failed:", validation.errors);
+            throw new Error(`Invalid navigation data: ${validation.errors.join("; ")}`);
+        }
+        // Generate allowedFiles whitelist from navigation (single source of truth)
+        this.allowedFiles = (0, internal_docs_navigation_1.buildAllowedFilesFromNavigation)(internal_docs_navigation_json_1.default);
+        this.logger.info(`[InternalDocsHandler] Generated ${Object.keys(this.allowedFiles).length} allowed files from navigation`);
+    }
+    /**
+     * Verify user has INTERNAL or SUPER_ADMIN role
+     * CRITICAL: This is a security check - only INTERNAL or SUPER_ADMIN users can access documentation
+     */
+    async verifyInternalAccess(session, env) {
+        if (!session) {
+            return { authorized: false };
+        }
+        try {
+            const db = (0, db_1.createPrisma)(env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user) {
+                return { authorized: false };
+            }
+            // CRITICAL: Only INTERNAL or SUPER_ADMIN role users can access
+            if (user.role !== "INTERNAL" && user.role !== "SUPER_ADMIN") {
+                return { authorized: false, userRole: user.role };
+            }
+            return { authorized: true, userRole: user.role };
+        }
+        catch (error) {
+            this.logger.error("[InternalDocsHandler] Error verifying access:", error);
+            return { authorized: false };
+        }
+    }
+    /**
+     * Get list of available documentation files
+     * GET /api/internal/docs
+     *
+     * Returns list of documentation files available in doc/requirements/internal-documentation/
+     */
+    async handleGetDocsList(request, env) {
+        try {
+            const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+            const session = await this.sessionManager.getSession(request, sessionSecret, env);
+            const access = await this.verifyInternalAccess(session, env);
+            if (!access.authorized) {
+                // CRITICAL SECURITY: Log unauthorized access attempt
+                this.logger.warn("[InternalDocsHandler] Unauthorized access attempt to internal documentation", {
+                    userId: session?.userId,
+                    userRole: access.userRole,
+                    ipAddress: request.headers.get("CF-Connecting-IP") ||
+                        request.headers.get("X-Forwarded-For"),
+                    userAgent: request.headers.get("User-Agent"),
+                });
+                return this.securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Unauthorized: INTERNAL or SUPER_ADMIN role required",
+                }), {
+                    status: 403,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // Documentation files available in doc/requirements/internal-documentation/
+            const docsList = [
+                {
+                    id: "overview",
+                    title: "Overview",
+                    description: "Internal documentation system overview",
+                    path: "OVERVIEW.md",
+                    category: "general",
+                },
+                {
+                    id: "developer-guide",
+                    title: "Developer Guide",
+                    description: "Comprehensive technical guide for developers",
+                    path: "DEVELOPER_GUIDE.md",
+                    category: "developers",
+                },
+                {
+                    id: "developer",
+                    title: "Developer Documentation Strategy",
+                    description: "Strategy for creating and maintaining developer documentation",
+                    path: "DEVELOPER_DOCS.md",
+                    category: "developers",
+                },
+                {
+                    id: "business-analyst-guide",
+                    title: "Business Analyst Guide",
+                    description: "Comprehensive guide for business analysts and data scientists",
+                    path: "BUSINESS_ANALYST_GUIDE.md",
+                    category: "business-analysts",
+                },
+                {
+                    id: "business-analyst",
+                    title: "Business Analyst Documentation Strategy",
+                    description: "Strategy for business analyst documentation",
+                    path: "BUSINESS_ANALYST_DOCS.md",
+                    category: "business-analysts",
+                },
+                {
+                    id: "support-guide",
+                    title: "Support Guide",
+                    description: "Comprehensive guide for support workers and customer service",
+                    path: "SUPPORT_GUIDE.md",
+                    category: "support",
+                },
+                {
+                    id: "support",
+                    title: "Support Documentation Strategy",
+                    description: "Strategy for support documentation",
+                    path: "SUPPORT_DOCS.md",
+                    category: "support",
+                },
+                {
+                    id: "sales-guide",
+                    title: "Sales Guide",
+                    description: "Comprehensive guide for sales teams",
+                    path: "SALES_GUIDE.md",
+                    category: "sales",
+                },
+                {
+                    id: "sales",
+                    title: "Sales Documentation Strategy",
+                    description: "Strategy for sales documentation",
+                    path: "SALES_DOCS.md",
+                    category: "sales",
+                },
+                {
+                    id: "operations-guide",
+                    title: "Operations Guide",
+                    description: "Comprehensive guide for SRE, DevOps, and infrastructure teams",
+                    path: "OPERATIONS_GUIDE.md",
+                    category: "operations",
+                },
+                {
+                    id: "operations",
+                    title: "Operations Documentation Strategy",
+                    description: "Strategy for operations documentation",
+                    path: "OPERATIONS_DOCS.md",
+                    category: "operations",
+                },
+                {
+                    id: "compliance-guide",
+                    title: "Compliance Guide",
+                    description: "Comprehensive GDPR, BDSG, and security audit documentation",
+                    path: "COMPLIANCE_GUIDE.md",
+                    category: "compliance",
+                },
+                {
+                    id: "compliance",
+                    title: "Compliance Documentation Strategy",
+                    description: "Strategy for compliance documentation",
+                    path: "COMPLIANCE_DOCS.md",
+                    category: "compliance",
+                },
+                {
+                    id: "architecture",
+                    title: "Architecture",
+                    description: "Overall design and approach",
+                    path: "ARCHITECTURE.md",
+                    category: "developers",
+                },
+                {
+                    id: "implementation",
+                    title: "Implementation Guide",
+                    description: "Step-by-step implementation guide",
+                    path: "IMPLEMENTATION.md",
+                    category: "developers",
+                },
+                {
+                    id: "sync-strategy",
+                    title: "Sync Strategy",
+                    description: "Strategies for keeping documentation in sync",
+                    path: "SYNC_STRATEGY.md",
+                    category: "developers",
+                },
+            ];
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ docs: docsList }), {
+                status: 200,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        catch (error) {
+            this.logger.error("[InternalDocsHandler] Error in handleGetDocsList:", error);
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "content-type": "application/json" },
+            });
+        }
+    }
+    /**
+     * Get navigation structure for internal documentation
+     * GET /api/internal/docs/navigation
+     *
+     * Returns the navigation structure used by the frontend component.
+     * This is the same structure as navigation.json but served from API.
+     */
+    async handleGetNavigation(request, env) {
+        try {
+            const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+            const session = await this.sessionManager.getSession(request, sessionSecret, env);
+            const access = await this.verifyInternalAccess(session, env);
+            if (!access.authorized) {
+                // CRITICAL SECURITY: Log unauthorized access attempt
+                this.logger.warn("[InternalDocsHandler] Unauthorized access attempt to navigation", {
+                    userId: session?.userId,
+                    userRole: access.userRole,
+                    ipAddress: request.headers.get("CF-Connecting-IP") ||
+                        request.headers.get("X-Forwarded-For"),
+                    userAgent: request.headers.get("User-Agent"),
+                });
+                return this.securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Unauthorized: INTERNAL or SUPER_ADMIN role required",
+                }), {
+                    status: 403,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // Return navigation structure from JSON file
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ sections: internal_docs_navigation_json_1.default.sections }), {
+                status: 200,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        catch (error) {
+            this.logger.error("[InternalDocsHandler] Error in handleGetNavigation:", error);
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "content-type": "application/json" },
+            });
+        }
+    }
+    /**
+     * Get dashboard-specific documentation structure
+     * GET /api/internal/docs/dashboard
+     *
+     * Returns dashboard-specific organization of documentation files,
+     * independent of the navigation menu structure.
+     */
+    async handleGetDashboardDocs(request, env) {
+        try {
+            const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+            const session = await this.sessionManager.getSession(request, sessionSecret, env);
+            const access = await this.verifyInternalAccess(session, env);
+            if (!access.authorized) {
+                // CRITICAL SECURITY: Log unauthorized access attempt
+                this.logger.warn("[InternalDocsHandler] Unauthorized access attempt to dashboard docs", {
+                    userId: session?.userId,
+                    userRole: access.userRole,
+                    ipAddress: request.headers.get("CF-Connecting-IP") ||
+                        request.headers.get("X-Forwarded-For"),
+                    userAgent: request.headers.get("User-Agent"),
+                });
+                return this.securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Unauthorized: INTERNAL or SUPER_ADMIN role required",
+                }), {
+                    status: 403,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // Return dashboard-specific structure from JSON file
+            // Sort sections by order field
+            const sortedSections = [...internal_docs_dashboard_json_1.default.sections].sort((a, b) => (a.order || 999) - (b.order || 999));
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ sections: sortedSections }), {
+                status: 200,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        catch (error) {
+            this.logger.error("[InternalDocsHandler] Error in handleGetDashboardDocs:", error);
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "content-type": "application/json" },
+            });
+        }
+    }
+    /**
+     * Get specific documentation file content
+     * GET /api/internal/docs/:filename
+     *
+     * SECURITY: This endpoint requires INTERNAL or SUPER_ADMIN role authentication
+     * The filename is validated and checked against the whitelist
+     *
+     * Security layers (defense in depth):
+     * 1. Authentication check (session + INTERNAL or SUPER_ADMIN role)
+     * 2. Filename validation (path traversal prevention)
+     * 3. Whitelist check (explicit file access control)
+     */
+    async handleGetDoc(request, env, filename) {
+        try {
+            // ============================================================
+            // SECURITY LAYER 0: Authentication and Authorization Check
+            // ============================================================
+            // Verify user has valid session and INTERNAL or SUPER_ADMIN role
+            // This is the primary security gate - only employees and super admins can pass
+            const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+            const session = await this.sessionManager.getSession(request, sessionSecret, env);
+            const access = await this.verifyInternalAccess(session, env);
+            if (!access.authorized) {
+                // CRITICAL SECURITY: Log unauthorized access attempt
+                // This helps with security monitoring and incident response
+                this.logger.warn("[InternalDocsHandler] Unauthorized access attempt to internal documentation file", {
+                    filename,
+                    userId: session?.userId || "no-session",
+                    userRole: access.userRole || "unknown",
+                    ipAddress: request.headers.get("CF-Connecting-IP") ||
+                        request.headers.get("X-Forwarded-For") ||
+                        "unknown",
+                    userAgent: request.headers.get("User-Agent") || "unknown",
+                });
+                return this.securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Unauthorized: INTERNAL or SUPER_ADMIN role required",
+                }), {
+                    status: 403,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // ============================================================
+            // SECURITY LAYER 1: Filename Validation (Path Traversal Prevention)
+            // ============================================================
+            // Validate filename format to prevent path traversal attacks
+            // Allow: alphanumeric, hyphens, underscores, dots, forward slashes (for subdirectories)
+            // Block: path traversal (..), absolute paths (/), and other dangerous patterns
+            if (!/^[a-zA-Z0-9._\-\/]+\.md$/.test(filename) ||
+                filename.includes("..") ||
+                filename.startsWith("/")) {
+                // SECURITY: Log potential attack attempt
+                this.logger.warn("[InternalDocsHandler] Invalid filename format (potential path traversal):", {
+                    filename,
+                    ipAddress: request.headers.get("CF-Connecting-IP"),
+                    userAgent: request.headers.get("User-Agent"),
+                });
+                return this.securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid filename" }), {
+                    status: 400,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // ============================================================
+            // SECURITY LAYER 2: Whitelist Check (Explicit File Access Control)
+            // ============================================================
+            // The whitelist is generated from navigation.json at runtime
+            // Only files explicitly listed in navigation can be accessed
+            // This prevents:
+            // - Access to files not intended for documentation
+            // - Accidental exposure of unlisted files
+            // - Path traversal even if validation is bypassed
+            let filePath;
+            // Try exact match first (most common case)
+            filePath = this.allowedFiles[filename];
+            // If not found, try case-insensitive lookup (for flexibility)
+            if (!filePath) {
+                const normalizedFilename = filename.toLowerCase();
+                for (const [key, value] of Object.entries(this.allowedFiles)) {
+                    if (key.toLowerCase() === normalizedFilename) {
+                        filePath = value;
+                        break;
+                    }
+                }
+            }
+            // SECURITY: If file is not in whitelist, deny access
+            // This is intentional - we return 404 (not 403) to avoid information leakage
+            // An attacker cannot distinguish between "file doesn't exist" and "file not allowed"
+            if (!filePath) {
+                // SECURITY: Log access attempt to non-whitelisted file
+                this.logger.warn("[InternalDocsHandler] Access attempt to non-whitelisted file:", {
+                    filename,
+                    userId: session?.userId,
+                    ipAddress: request.headers.get("CF-Connecting-IP"),
+                });
+                return this.securityHeaders.createSecureResponse(JSON.stringify({ error: "File not found" }), {
+                    status: 404,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            // Fetch the markdown file from the public docs folder
+            // SECURITY: This is safe because we've already verified INTERNAL or SUPER_ADMIN role above
+            // The files are in public/docs/internal/ but access is controlled via this API endpoint
+            //
+            // NOTE: In the future, consider:
+            // - Using Cloudflare R2/KV for direct file storage
+            // - Bundling files in Worker (if size allows)
+            // - Using Cloudflare Assets API
+            try {
+                // Construct the URL to fetch from the frontend's public folder
+                // Try multiple sources in order of preference
+                const origin = request.headers.get("Origin");
+                const appDomain = env.APP_DOMAIN;
+                const frontendUrl = origin || appDomain || "https://rkm1.de";
+                const docsUrl = `${frontendUrl}/docs/${filePath}`;
+                this.logger.info("[InternalDocsHandler] Fetching docs from:", docsUrl);
+                // Fetch with timeout and retry logic
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 second timeout
+                let fileResponse;
+                try {
+                    // Add cache-busting query parameter to prevent Cloudflare CDN from serving stale content
+                    // In dev environment, we want fresh content on every request
+                    const cacheBust = Date.now();
+                    const separator = docsUrl.includes("?") ? "&" : "?";
+                    fileResponse = await fetch(`${docsUrl}${separator}cb=${cacheBust}`, {
+                        headers: {
+                            "User-Agent": "Trellis-Internal-Docs-API/1.0",
+                            "Cache-Control": "no-cache, no-store, must-revalidate",
+                            Pragma: "no-cache",
+                        },
+                        signal: controller.signal,
+                    });
+                }
+                finally {
+                    clearTimeout(timeoutId);
+                }
+                if (!fileResponse.ok) {
+                    // Distinguish between different error types
+                    if (fileResponse.status === 404) {
+                        this.logger.error(`[InternalDocsHandler] File not found: ${filePath} (404)`);
+                        return this.securityHeaders.createSecureResponse(JSON.stringify({
+                            error: "File not found",
+                            filename,
+                            path: filePath,
+                            status: 404,
+                        }), {
+                            status: 404,
+                            headers: { "content-type": "application/json" },
+                        });
+                    }
+                    if (fileResponse.status >= 500) {
+                        this.logger.error(`[InternalDocsHandler] Server error fetching file: ${filePath}, status: ${fileResponse.status}`);
+                        return this.securityHeaders.createSecureResponse(JSON.stringify({
+                            error: "Frontend server error",
+                            message: `Failed to fetch file from frontend (${fileResponse.status} ${fileResponse.statusText})`,
+                            filename,
+                            path: filePath,
+                            status: 502,
+                        }), {
+                            status: 502,
+                            headers: { "content-type": "application/json" },
+                        });
+                    }
+                    // Other client errors (403, etc.)
+                    this.logger.error(`[InternalDocsHandler] Failed to fetch file: ${filePath}, status: ${fileResponse.status}, statusText: ${fileResponse.statusText}`);
+                    return this.securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "Failed to fetch file",
+                        message: `${fileResponse.status} ${fileResponse.statusText}`,
+                        filename,
+                        path: filePath,
+                        status: fileResponse.status,
+                    }), {
+                        status: fileResponse.status,
+                        headers: { "content-type": "application/json" },
+                    });
+                }
+                const markdownContent = await fileResponse.text();
+                if (!markdownContent || markdownContent.trim().length === 0) {
+                    this.logger.warn(`[InternalDocsHandler] File ${filePath} is empty`);
+                    return this.securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "File is empty",
+                        filename,
+                        path: filePath,
+                        status: 404,
+                    }), {
+                        status: 404,
+                        headers: { "content-type": "application/json" },
+                    });
+                }
+                // Validate that the response is actually markdown, not HTML (e.g., index.html fallback)
+                // Check for common HTML indicators
+                const trimmedContent = markdownContent.trim();
+                if (trimmedContent.startsWith("<!DOCTYPE") ||
+                    trimmedContent.startsWith("<!doctype") ||
+                    trimmedContent.startsWith("<html") ||
+                    trimmedContent.startsWith("<HTML") ||
+                    (trimmedContent.includes("<head>") &&
+                        trimmedContent.includes("<body>"))) {
+                    this.logger.error(`[InternalDocsHandler] Received HTML instead of markdown for ${filePath}. This usually means the file is missing and the SPA served index.html as a fallback.`);
+                    return this.securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "File not found",
+                        message: "The requested documentation file was not found on the frontend server. The file may need to be copied to the web app's public folder.",
+                        filename,
+                        path: filePath,
+                        status: 404,
+                    }), {
+                        status: 404,
+                        headers: { "content-type": "application/json" },
+                    });
+                }
+                this.logger.info(`[InternalDocsHandler] Successfully loaded ${filePath}, content length: ${markdownContent.length}`);
+                return this.securityHeaders.createSecureResponse(JSON.stringify({
+                    content: markdownContent,
+                    filename,
+                    path: filePath,
+                }), {
+                    status: 200,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+            catch (error) {
+                // Handle network errors, timeouts, etc.
+                if (error instanceof Error && error.name === "AbortError") {
+                    this.logger.error("[InternalDocsHandler] Timeout fetching markdown file:", filePath);
+                    return this.securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "Request timeout",
+                        message: "Frontend did not respond in time",
+                        filename,
+                        path: filePath,
+                        status: 504,
+                    }), {
+                        status: 504,
+                        headers: { "content-type": "application/json" },
+                    });
+                }
+                this.logger.error("[InternalDocsHandler] Error fetching markdown file:", error);
+                const errorMessage = error instanceof Error ? error.message : "Unknown error";
+                return this.securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Network error",
+                    message: errorMessage,
+                    filename,
+                    path: filePath,
+                    status: 500,
+                }), {
+                    status: 500,
+                    headers: { "content-type": "application/json" },
+                });
+            }
+        }
+        catch (error) {
+            this.logger.error("[InternalDocsHandler] Error getting doc:", error);
+            return this.securityHeaders.createSecureResponse(JSON.stringify({ error: "Internal server error" }), {
+                status: 500,
+                headers: { "content-type": "application/json" },
+            });
+        }
+    }
+}
+exports.InternalDocsHandler = InternalDocsHandler;
+//# sourceMappingURL=internal-docs-handler.js.map

package/dist/lib/internal-docs-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-docs-handler.js","sourceRoot":"","sources":["../../src/lib/internal-docs-handler.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,8BAAqC;AACrC,kGAA2D;AAC3D,yEAGoC;AACpC,oGAA6D;AAC7D,qCAAkD;AAClD,uDAA4C;AAC5C,yDAAqD;AAErD,uDAAsE;AAEtE;;GAEG;AACH,MAAa,mBAAmB;IACtB,cAAc,CAAiB;IAC/B,eAAe,CAAkB;IACjC,YAAY,CAAyB;IACrC,MAAM,CAAS;IAEvB,YAAY,GAAe;QACzB,IAAI,CAAC,cAAc,GAAG,IAAI,gCAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,kCAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtC,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAA,6CAAkB,EAAC,uCAAc,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD,EACrD,UAAU,CAAC,MAAM,CAClB,CAAC;YACF,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,IAAI,CAAC,YAAY,GAAG,IAAA,0DAA+B,EAAC,uCAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,gCAAgC,CACzG,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAuB,EACvB,GAAQ;QAER,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAA,iBAAY,EAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;gBAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAC/B,CAAC;YAED,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAgB,EAAE,CAAC;YAChE,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAgB,EAAE,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YAC1E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAgB,EAAE,GAAQ;QAChD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAClD,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE7D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvB,qDAAqD;gBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6EAA6E,EAC7E;oBACE,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;wBACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACxC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;iBAC7C,CACF,CAAC;gBAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,qDAAqD;iBAC7D,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,MAAM,QAAQ,GAAG;gBACf;oBACE,EAAE,EAAE,UAAU;oBACd,KAAK,EAAE,UAAU;oBACjB,WAAW,EAAE,wCAAwC;oBACrD,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,SAAS;iBACpB;gBACD;oBACE,EAAE,EAAE,iBAAiB;oBACrB,KAAK,EAAE,iBAAiB;oBACxB,WAAW,EAAE,8CAA8C;oBAC3D,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,WAAW;oBACf,KAAK,EAAE,kCAAkC;oBACzC,WAAW,EACT,+DAA+D;oBACjE,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,wBAAwB;oBAC5B,KAAK,EAAE,wBAAwB;oBAC/B,WAAW,EACT,+DAA+D;oBACjE,IAAI,EAAE,2BAA2B;oBACjC,QAAQ,EAAE,mBAAmB;iBAC9B;gBACD;oBACE,EAAE,EAAE,kBAAkB;oBACtB,KAAK,EAAE,yCAAyC;oBAChD,WAAW,EAAE,6CAA6C;oBAC1D,IAAI,EAAE,0BAA0B;oBAChC,QAAQ,EAAE,mBAAmB;iBAC9B;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,KAAK,EAAE,eAAe;oBACtB,WAAW,EACT,8DAA8D;oBAChE,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,SAAS;iBACpB;gBACD;oBACE,EAAE,EAAE,SAAS;oBACb,KAAK,EAAE,gCAAgC;oBACvC,WAAW,EAAE,oCAAoC;oBACjD,IAAI,EAAE,iBAAiB;oBACvB,QAAQ,EAAE,SAAS;iBACpB;gBACD;oBACE,EAAE,EAAE,aAAa;oBACjB,KAAK,EAAE,aAAa;oBACpB,WAAW,EAAE,qCAAqC;oBAClD,IAAI,EAAE,gBAAgB;oBACtB,QAAQ,EAAE,OAAO;iBAClB;gBACD;oBACE,EAAE,EAAE,OAAO;oBACX,KAAK,EAAE,8BAA8B;oBACrC,WAAW,EAAE,kCAAkC;oBAC/C,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,OAAO;iBAClB;gBACD;oBACE,EAAE,EAAE,kBAAkB;oBACtB,KAAK,EAAE,kBAAkB;oBACzB,WAAW,EACT,+DAA+D;oBACjE,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,YAAY;oBAChB,KAAK,EAAE,mCAAmC;oBAC1C,WAAW,EAAE,uCAAuC;oBACpD,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,kBAAkB;oBACtB,KAAK,EAAE,kBAAkB;oBACzB,WAAW,EACT,4DAA4D;oBAC9D,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,YAAY;oBAChB,KAAK,EAAE,mCAAmC;oBAC1C,WAAW,EAAE,uCAAuC;oBACpD,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,cAAc;oBAClB,KAAK,EAAE,cAAc;oBACrB,WAAW,EAAE,6BAA6B;oBAC1C,IAAI,EAAE,iBAAiB;oBACvB,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,gBAAgB;oBACpB,KAAK,EAAE,sBAAsB;oBAC7B,WAAW,EAAE,mCAAmC;oBAChD,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,YAAY;iBACvB;gBACD;oBACE,EAAE,EAAE,eAAe;oBACnB,KAAK,EAAE,eAAe;oBACtB,WAAW,EAAE,8CAA8C;oBAC3D,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,YAAY;iBACvB;aACF,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAClC;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mDAAmD,EACnD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAgB,EAAE,GAAQ;QAClD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAClD,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE7D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvB,qDAAqD;gBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,EACjE;oBACE,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;wBACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACxC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;iBAC7C,CACF,CAAC;gBAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,qDAAqD;iBAC7D,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,uCAAc,CAAC,QAAQ,EAAE,CAAC,EACrD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD,EACrD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAgB,EAAE,GAAQ;QACrD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAClD,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE7D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvB,qDAAqD;gBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qEAAqE,EACrE;oBACE,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;wBACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACxC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;iBAC7C,CACF,CAAC;gBAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,qDAAqD;iBAC7D,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,qDAAqD;YACrD,+BAA+B;YAC/B,MAAM,cAAc,GAAG,CAAC,GAAG,sCAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAC9C,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAC5C;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wDAAwD,EACxD,KAAK,CACN,CAAC;YACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,YAAY,CAChB,OAAgB,EAChB,GAAQ,EACR,QAAgB;QAEhB,IAAI,CAAC;YACH,+DAA+D;YAC/D,2DAA2D;YAC3D,+DAA+D;YAC/D,iEAAiE;YACjE,+EAA+E;YAC/E,MAAM,aAAa,GAAG,yBAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAClD,OAAO,EACP,aAAa,EACb,GAAG,CACJ,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE7D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACvB,qDAAqD;gBACrD,4DAA4D;gBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kFAAkF,EAClF;oBACE,QAAQ;oBACR,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,YAAY;oBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;oBACtC,SAAS,EACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;wBACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;wBACtC,SAAS;oBACX,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;iBAC1D,CACF,CAAC;gBAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,qDAAqD;iBAC7D,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,oEAAoE;YACpE,+DAA+D;YAC/D,6DAA6D;YAC7D,wFAAwF;YACxF,+EAA+E;YAC/E,IACE,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC1C,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EACxB,CAAC;gBACD,yCAAyC;gBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2EAA2E,EAC3E;oBACE,QAAQ;oBACR,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBAClD,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;iBAC7C,CACF,CAAC;gBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAC7C;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,+DAA+D;YAC/D,mEAAmE;YACnE,+DAA+D;YAC/D,6DAA6D;YAC7D,6DAA6D;YAC7D,iBAAiB;YACjB,mDAAmD;YACnD,0CAA0C;YAC1C,kDAAkD;YAClD,IAAI,QAA4B,CAAC;YAEjC,2CAA2C;YAC3C,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEvC,8DAA8D;YAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7D,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,kBAAkB,EAAE,CAAC;wBAC7C,QAAQ,GAAG,KAAK,CAAC;wBACjB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,6EAA6E;YAC7E,qFAAqF;YACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,uDAAuD;gBACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+DAA+D,EAC/D;oBACE,QAAQ;oBACR,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;iBACnD,CACF,CAAC;gBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAC3C;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAED,sDAAsD;YACtD,2FAA2F;YAC3F,wFAAwF;YACxF,EAAE;YACF,iCAAiC;YACjC,mDAAmD;YACnD,8CAA8C;YAC9C,gCAAgC;YAChC,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,8CAA8C;gBAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;gBACjC,MAAM,WAAW,GAAG,MAAM,IAAI,SAAS,IAAI,iBAAiB,CAAC;gBAC7D,MAAM,OAAO,GAAG,GAAG,WAAW,SAAS,QAAQ,EAAE,CAAC;gBAElD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,CAAC,CAAC;gBAEvE,qCAAqC;gBACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,oBAAoB;gBAEnF,IAAI,YAAsB,CAAC;gBAC3B,IAAI,CAAC;oBACH,yFAAyF;oBACzF,6DAA6D;oBAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBACpD,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,SAAS,MAAM,SAAS,EAAE,EAAE;wBAClE,OAAO,EAAE;4BACP,YAAY,EAAE,+BAA+B;4BAC7C,eAAe,EAAE,qCAAqC;4BACtD,MAAM,EAAE,UAAU;yBACnB;wBACD,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,SAAS,CAAC,CAAC;gBAC1B,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;oBACrB,4CAA4C;oBAC5C,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yCAAyC,QAAQ,QAAQ,CAC1D,CAAC;wBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,gBAAgB;4BACvB,QAAQ;4BACR,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE,GAAG;yBACZ,CAAC,EACF;4BACE,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CACF,CAAC;oBACJ,CAAC;oBAED,IAAI,YAAY,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;wBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD,QAAQ,aAAa,YAAY,CAAC,MAAM,EAAE,CAChG,CAAC;wBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;4BACb,KAAK,EAAE,uBAAuB;4BAC9B,OAAO,EAAE,uCAAuC,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,UAAU,GAAG;4BACjG,QAAQ;4BACR,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE,GAAG;yBACZ,CAAC,EACF;4BACE,MAAM,EAAE,GAAG;4BACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;yBAChD,CACF,CAAC;oBACJ,CAAC;oBAED,kCAAkC;oBAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+CAA+C,QAAQ,aAAa,YAAY,CAAC,MAAM,iBAAiB,YAAY,CAAC,UAAU,EAAE,CAClI,CAAC;oBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,sBAAsB;wBAC7B,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE;wBAC5D,QAAQ;wBACR,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,YAAY,CAAC,MAAM;qBAC5B,CAAC,EACF;wBACE,MAAM,EAAE,YAAY,CAAC,MAAM;wBAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;gBAElD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,QAAQ,WAAW,CAAC,CAAC;oBACpE,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,eAAe;wBACtB,QAAQ;wBACR,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,GAAG;qBACZ,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAED,wFAAwF;gBACxF,mCAAmC;gBACnC,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;gBAC9C,IACE,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC;oBACtC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC;oBACtC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;oBAClC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;oBAClC,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAChC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACpC,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+DAA+D,QAAQ,uFAAuF,CAC/J,CAAC;oBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,gBAAgB;wBACvB,OAAO,EACL,uIAAuI;wBACzI,QAAQ;wBACR,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,GAAG;qBACZ,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CAA6C,QAAQ,qBAAqB,eAAe,CAAC,MAAM,EAAE,CACnG,CAAC;gBAEF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,OAAO,EAAE,eAAe;oBACxB,QAAQ;oBACR,IAAI,EAAE,QAAQ;iBACf,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wCAAwC;gBACxC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uDAAuD,EACvD,QAAQ,CACT,CAAC;oBACF,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,iBAAiB;wBACxB,OAAO,EAAE,kCAAkC;wBAC3C,QAAQ;wBACR,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,GAAG;qBACZ,CAAC,EACF;wBACE,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CACF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD,EACrD,KAAK,CACN,CAAC;gBACF,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,YAAY;oBACrB,QAAQ;oBACR,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,GAAG;iBACZ,CAAC,EACF;oBACE,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAClD;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA7tBD,kDA6tBC"}

package/dist/lib/internal-docs-navigation.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Internal Documentation Navigation Utilities
+ *
+ * Generates allowedFiles whitelist from navigation.json
+ * This eliminates the need for manual whitelist maintenance.
+ */
+export interface NavItem {
+    title: string;
+    path: string;
+}
+export interface NavSection {
+    title: string;
+    items: NavItem[];
+}
+export interface NavigationData {
+    sections: NavSection[];
+}
+/**
+ * Build allowedFiles whitelist from navigation data
+ *
+ * Converts navigation paths to the format expected by the API handler:
+ * - Input: "internal/OVERVIEW.md"
+ * - Output: { "OVERVIEW.md": "internal/OVERVIEW.md" }
+ *
+ * For subdirectories:
+ * - Input: "internal/bavaria-compliance/README.md"
+ * - Output: { "bavaria-compliance/README.md": "internal/bavaria-compliance/README.md" }
+ */
+export declare function buildAllowedFilesFromNavigation(navigation: NavigationData): Record<string, string>;
+/**
+ * Validate that all navigation items have valid paths
+ *
+ * Checks:
+ * - Paths start with "internal/"
+ * - Paths end with ".md"
+ * - No path traversal attempts (no "..")
+ */
+export declare function validateNavigation(navigation: NavigationData): {
+    valid: boolean;
+    errors: string[];
+};
+//# sourceMappingURL=internal-docs-navigation.d.ts.map

package/dist/lib/internal-docs-navigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-docs-navigation.d.ts","sourceRoot":"","sources":["../../src/lib/internal-docs-navigation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,cAAc,GACzB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,cAAc,GAAG;IAC9D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAyCA"}