@de-otio/trellis 0.4.0

package/dist/lib/link-security-handler.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Link Security Handler
+ *
+ * Handles URL extraction, normalization, validation, and security checks for links in posts and comments.
+ * Provides synchronous validation for immediate blocking of dangerous URLs and async queue integration
+ * for threat intelligence checks.
+ *
+ * PREPARATORY: Designed for integration with threat intelligence services and domain reputation system.
+ */
+import type { Env } from "../env";
+import { type LoggerEnv } from "./logger";
+/**
+ * Normalized URL structure
+ */
+export interface NormalizedUrl {
+    original: string;
+    normalized: string;
+    scheme: string;
+    host: string;
+    domain: string;
+    path: string;
+    query: string;
+}
+/**
+ * Link status enumeration
+ */
+export declare enum LinkStatus {
+    SAFE = "safe",
+    WARNING = "warning",
+    BLOCKED = "blocked",
+    PENDING = "pending"
+}
+/**
+ * Link validation result
+ */
+export interface LinkValidationResult {
+    status: LinkStatus;
+    reason?: string;
+    normalizedUrl?: NormalizedUrl;
+}
+/**
+ * Domain reputation information
+ */
+export interface DomainReputationInfo {
+    domain: string;
+    reputation: number;
+    status: string;
+    lastChecked: Date | null;
+}
+/**
+ * Environment interface for LinkSecurityHandler
+ */
+export interface LinkSecurityEnv extends Env {
+    DATABASE_URL: string;
+}
+export declare class LinkSecurityHandler {
+    private logger;
+    constructor(env?: LoggerEnv);
+    /**
+     * Extract all URLs from text
+     *
+     * @param text - Text to extract URLs from
+     * @returns Array of unique URLs found in the text
+     */
+    extractUrls(text: string): string[];
+    /**
+     * Normalize a URL
+     *
+     * Normalizes URLs by:
+     * - Converting scheme to lowercase
+     * - Converting host to lowercase
+     * - Resolving punycode for IDN domains
+     * - Stripping fragments
+     * - Preserving path and query
+     *
+     * @param url - URL to normalize
+     * @returns Normalized URL object or null if invalid
+     */
+    normalizeUrl(url: string): NormalizedUrl | null;
+    /**
+     * Validate URL synchronously
+     *
+     * Performs immediate validation checks:
+     * - Scheme validation (block dangerous schemes)
+     * - Internal IP/hostname detection (SSRF protection)
+     * - Basic security checks
+     *
+     * @param url - URL to validate
+     * @returns Validation result with status and reason
+     */
+    validateUrlSync(url: string): LinkValidationResult;
+    /**
+     * Validate URL scheme
+     *
+     * @param scheme - URL scheme to validate
+     * @returns Validation result
+     */
+    private validateScheme;
+    /**
+     * Check if host/domain is internal (SSRF protection)
+     *
+     * @param host - Hostname or IP address (may include port)
+     * @param domain - Domain name (without port)
+     * @returns Check result
+     */
+    private checkInternalAccess;
+    /**
+     * Check if domain is a raw IP address
+     *
+     * @param domain - Domain to check
+     * @returns True if domain is a raw IP
+     */
+    private isRawIpUrl;
+    /**
+     * Check domain reputation from database
+     *
+     * @param domain - Domain to check
+     * @param env - Environment with database connection
+     * @returns Domain reputation information or null if not found
+     */
+    checkDomainReputation(domain: string, env: LinkSecurityEnv): Promise<DomainReputationInfo | null>;
+    /**
+     * Queue threat intelligence check for a URL
+     *
+     * Creates a LinkCheck record and queues an async threat intel check.
+     *
+     * @param params - Parameters for queueing the check
+     * @param env - Environment with queue and database connections
+     * @returns LinkCheck ID or null if failed
+     */
+    queueThreatIntelCheck(params: {
+        postId?: string;
+        commentId?: string;
+        originalUrl: string;
+        normalizedUrl: string;
+        domain: string;
+        status: LinkStatus;
+    }, env: LinkSecurityEnv): Promise<string | null>;
+}
+//# sourceMappingURL=link-security-handler.d.ts.map

package/dist/lib/link-security-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-security-handler.d.ts","sourceRoot":"","sources":["../../src/lib/link-security-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,GAAG;IAC1C,YAAY,EAAE,MAAM,CAAC;CACtB;AAoDD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAI3B;;;;;OAKG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE;IAcnC;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAqD/C;;;;;;;;;;OAUG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB;IA0DlD;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAyBtB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAkF3B;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAqClB;;;;;;OAMG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA4BvC;;;;;;;;OAQG;IACG,qBAAqB,CACzB,MAAM,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,UAAU,CAAC;KACpB,EACD,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAiD1B"}

package/dist/lib/link-security-handler.js

@@ -0,0 +1,460 @@
+"use strict";
+/**
+ * Link Security Handler
+ *
+ * Handles URL extraction, normalization, validation, and security checks for links in posts and comments.
+ * Provides synchronous validation for immediate blocking of dangerous URLs and async queue integration
+ * for threat intelligence checks.
+ *
+ * PREPARATORY: Designed for integration with threat intelligence services and domain reputation system.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinkSecurityHandler = exports.LinkStatus = void 0;
+const logger_1 = require("./logger");
+/**
+ * Link status enumeration
+ */
+var LinkStatus;
+(function (LinkStatus) {
+    LinkStatus["SAFE"] = "safe";
+    LinkStatus["WARNING"] = "warning";
+    LinkStatus["BLOCKED"] = "blocked";
+    LinkStatus["PENDING"] = "pending";
+})(LinkStatus || (exports.LinkStatus = LinkStatus = {}));
+/**
+ * URL extraction regex pattern
+ * Matches http:// and https:// URLs, including those with ports, paths, and query strings
+ * Excludes trailing punctuation like closing parentheses and periods
+ */
+const URL_REGEX = /\bhttps?:\/\/[^\s<>"')\]]+/gi;
+/**
+ * Dangerous URL schemes that should be blocked
+ */
+const DANGEROUS_SCHEMES = [
+    "javascript:",
+    "data:",
+    "file:",
+    "vbscript:",
+    "chrome:",
+    "chrome-extension:",
+    "moz-extension:",
+    "about:",
+    "jar:",
+];
+/**
+ * Allowed URL schemes
+ */
+const ALLOWED_SCHEMES = ["http:", "https:", "mailto:", "tel:"];
+/**
+ * Private IPv4 ranges
+ */
+const PRIVATE_IPV4_RANGES = [
+    { start: 0x0a000000, end: 0x0affffff }, // 10.0.0.0/8
+    { start: 0xac100000, end: 0xac1fffff }, // 172.16.0.0/12
+    { start: 0xc0a80000, end: 0xc0a8ffff }, // 192.168.0.0/16
+    { start: 0x7f000000, end: 0x7fffffff }, // 127.0.0.0/8
+    { start: 0xa9fe0000, end: 0xa9feffff }, // 169.254.0.0/16 (link-local)
+];
+/**
+ * Internal hostname patterns
+ */
+const INTERNAL_HOSTNAME_PATTERNS = [
+    /^localhost$/i,
+    /^localhost\./i, // localhost.localdomain, localhost.local, etc.
+    /\.local$/i,
+    /\.corp$/i,
+    /\.internal$/i,
+    /\.lan$/i,
+];
+class LinkSecurityHandler {
+    logger;
+    constructor(env) {
+        this.logger = logger_1.Logger.getInstance(env);
+    }
+    /**
+     * Extract all URLs from text
+     *
+     * @param text - Text to extract URLs from
+     * @returns Array of unique URLs found in the text
+     */
+    extractUrls(text) {
+        if (!text || typeof text !== "string") {
+            return [];
+        }
+        const matches = text.match(URL_REGEX);
+        if (!matches) {
+            return [];
+        }
+        // Deduplicate URLs
+        return [...new Set(matches)];
+    }
+    /**
+     * Normalize a URL
+     *
+     * Normalizes URLs by:
+     * - Converting scheme to lowercase
+     * - Converting host to lowercase
+     * - Resolving punycode for IDN domains
+     * - Stripping fragments
+     * - Preserving path and query
+     *
+     * @param url - URL to normalize
+     * @returns Normalized URL object or null if invalid
+     */
+    normalizeUrl(url) {
+        if (!url || typeof url !== "string") {
+            return null;
+        }
+        try {
+            // Parse URL
+            const parsed = new URL(url);
+            // Normalize scheme (lowercase)
+            const scheme = parsed.protocol.toLowerCase().replace(":", "");
+            // Normalize host (lowercase, include port if present)
+            let host = parsed.host.toLowerCase();
+            // Get hostname (without port, and without brackets for IPv6)
+            let hostname = parsed.hostname.toLowerCase();
+            // Remove brackets from IPv6 addresses for domain matching
+            const domain = hostname.replace(/^\[|\]$/g, "");
+            // Resolve punycode for IDN domains
+            // Note: The URL constructor already handles punycode, but we ensure it's normalized
+            try {
+                // If host contains non-ASCII, it's already in punycode form from URL constructor
+                // We can use it as-is
+                host = host;
+            }
+            catch (error) {
+                this.logger.warn("Failed to normalize hostname:", error);
+                return null;
+            }
+            // Strip fragment
+            const path = parsed.pathname;
+            const query = parsed.search;
+            // Build normalized URL
+            const normalized = `${scheme}://${host}${path}${query}`;
+            return {
+                original: url,
+                normalized,
+                scheme,
+                host,
+                domain,
+                path,
+                query,
+            };
+        }
+        catch (error) {
+            this.logger.warn("Failed to normalize URL:", error);
+            return null;
+        }
+    }
+    /**
+     * Validate URL synchronously
+     *
+     * Performs immediate validation checks:
+     * - Scheme validation (block dangerous schemes)
+     * - Internal IP/hostname detection (SSRF protection)
+     * - Basic security checks
+     *
+     * @param url - URL to validate
+     * @returns Validation result with status and reason
+     */
+    validateUrlSync(url) {
+        // Check scheme first (before parsing URL, as some schemes like javascript: can't be parsed)
+        const schemeMatch = url.match(/^([^:]+):/i);
+        if (schemeMatch) {
+            // Remove null bytes and normalize scheme
+            const scheme = schemeMatch[1].replace(/\0/g, "").toLowerCase();
+            const schemeCheck = this.validateScheme(scheme);
+            if (!schemeCheck.allowed) {
+                return {
+                    status: LinkStatus.BLOCKED,
+                    reason: schemeCheck.reason || "Dangerous URL scheme",
+                };
+            }
+        }
+        // Normalize URL
+        const normalized = this.normalizeUrl(url);
+        if (!normalized) {
+            return {
+                status: LinkStatus.BLOCKED,
+                reason: "Invalid URL format",
+            };
+        }
+        // Check for internal IPs and hostnames first (SSRF protection)
+        // This catches private IPs and internal hostnames
+        // Pass host (may include port) and domain (hostname without port)
+        const internalCheck = this.checkInternalAccess(normalized.host, normalized.domain);
+        if (!internalCheck.allowed) {
+            return {
+                status: LinkStatus.BLOCKED,
+                reason: internalCheck.reason || "Internal network access blocked",
+                normalizedUrl: normalized,
+            };
+        }
+        // Check for raw IP URLs (potential SSRF) - only public IPs
+        // Private IPs are already caught by checkInternalAccess above
+        // This check must happen after checkInternalAccess to ensure private IPs
+        // are caught with the correct error message
+        if (this.isRawIpUrl(normalized.domain)) {
+            return {
+                status: LinkStatus.BLOCKED,
+                reason: "Raw IP URLs are not allowed",
+                normalizedUrl: normalized,
+            };
+        }
+        // URL passed all synchronous checks
+        return {
+            status: LinkStatus.SAFE, // Safe for synchronous checks, may be updated after async threat intel check
+            normalizedUrl: normalized,
+        };
+    }
+    /**
+     * Validate URL scheme
+     *
+     * @param scheme - URL scheme to validate
+     * @returns Validation result
+     */
+    validateScheme(scheme) {
+        const normalizedScheme = scheme.toLowerCase();
+        // Check for dangerous schemes
+        if (DANGEROUS_SCHEMES.includes(normalizedScheme + ":")) {
+            return {
+                allowed: false,
+                reason: "Dangerous scheme",
+            };
+        }
+        // Check if scheme is allowed
+        if (!ALLOWED_SCHEMES.includes(normalizedScheme + ":")) {
+            return {
+                allowed: false,
+                reason: `Scheme not allowed: ${normalizedScheme}`,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Check if host/domain is internal (SSRF protection)
+     *
+     * @param host - Hostname or IP address (may include port)
+     * @param domain - Domain name (without port)
+     * @returns Check result
+     */
+    checkInternalAccess(host, domain) {
+        // Extract hostname without port for IP checking
+        // Handle IPv6 addresses in brackets: [::1]:8080 -> [::1 -> ::1
+        let hostnameWithoutPort = host.split(":")[0];
+        if (hostnameWithoutPort.startsWith("[")) {
+            hostnameWithoutPort = hostnameWithoutPort.substring(1);
+        }
+        // Check for localhost explicitly (before other patterns)
+        // Values are already lowercased from normalizeUrl, but check all variations
+        const checkLocalhost = (value) => {
+            if (!value)
+                return false;
+            const lower = value.toLowerCase();
+            return lower === "localhost" || lower.startsWith("localhost.");
+        };
+        if (checkLocalhost(domain) ||
+            checkLocalhost(hostnameWithoutPort) ||
+            checkLocalhost(host)) {
+            return {
+                allowed: false,
+                reason: "Internal hostname detected",
+            };
+        }
+        // Check for internal hostname patterns
+        for (const pattern of INTERNAL_HOSTNAME_PATTERNS) {
+            if (pattern.test(host) ||
+                pattern.test(hostnameWithoutPort) ||
+                pattern.test(domain)) {
+                return {
+                    allowed: false,
+                    reason: "Internal hostname detected",
+                };
+            }
+        }
+        // Check for IPv4 private ranges (use hostname without port)
+        const ipv4Match = hostnameWithoutPort.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+        if (ipv4Match) {
+            // Use unsigned 32-bit arithmetic to avoid overflow
+            const ip = ((parseInt(ipv4Match[1]) << 24) |
+                (parseInt(ipv4Match[2]) << 16) |
+                (parseInt(ipv4Match[3]) << 8) |
+                parseInt(ipv4Match[4])) >>>
+                0;
+            for (const range of PRIVATE_IPV4_RANGES) {
+                if (ip >= range.start && ip <= range.end) {
+                    return {
+                        allowed: false,
+                        reason: "Private IP range detected",
+                    };
+                }
+            }
+        }
+        // Check for IPv6 internal ranges
+        // Domain is already without brackets (from normalizeUrl using hostname)
+        if (domain === "::1" ||
+            domain.startsWith("fe80:") ||
+            domain.startsWith("fc00:") ||
+            domain.startsWith("fd00:")) {
+            return {
+                allowed: false,
+                reason: "IPv6 internal range detected",
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Check if domain is a raw IP address
+     *
+     * @param domain - Domain to check
+     * @returns True if domain is a raw IP
+     */
+    isRawIpUrl(domain) {
+        // Check for IPv4 (only if it's not already blocked as private IP)
+        // This check should only catch public IPs
+        if (/^\d+\.\d+\.\d+\.\d+$/.test(domain)) {
+            // Check if it's a private IP - if so, it's already handled by checkInternalAccess
+            const parts = domain.split(".").map(Number);
+            // Use unsigned 32-bit arithmetic to avoid overflow
+            const ip = ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>>
+                0;
+            for (const range of PRIVATE_IPV4_RANGES) {
+                if (ip >= range.start && ip <= range.end) {
+                    return false; // Private IPs are handled separately
+                }
+            }
+            return true; // Public IP
+        }
+        // Check for IPv6 (simplified check)
+        const ipv6Domain = domain.replace(/^\[|\]$/g, "");
+        if (/^[0-9a-f:]+$/i.test(ipv6Domain) && ipv6Domain.includes(":")) {
+            // Check if it's an internal IPv6 - if so, it's already handled
+            if (ipv6Domain === "::1" ||
+                ipv6Domain.startsWith("fe80:") ||
+                ipv6Domain.startsWith("fc00:") ||
+                ipv6Domain.startsWith("fd00:")) {
+                return false; // Internal IPv6s are handled separately
+            }
+            return true; // Public IPv6
+        }
+        return false;
+    }
+    /**
+     * Check domain reputation from database
+     *
+     * @param domain - Domain to check
+     * @param env - Environment with database connection
+     * @returns Domain reputation information or null if not found
+     */
+    async checkDomainReputation(domain, env) {
+        try {
+            const { DomainReputationService } = await Promise.resolve().then(() => __importStar(require("./domain-reputation-service")));
+            // Get region for reputation service (default to EU if not specified)
+            const region = env.DEFAULT_REGION || "EU";
+            const reputationService = new DomainReputationService(env);
+            const reputation = await reputationService.getReputation(domain, region, env);
+            return {
+                domain: reputation.domain,
+                reputation: reputation.reputation,
+                status: reputation.status,
+                lastChecked: reputation.lastChecked,
+            };
+        }
+        catch (error) {
+            this.logger.error("Failed to check domain reputation:", error);
+            return null;
+        }
+    }
+    /**
+     * Queue threat intelligence check for a URL
+     *
+     * Creates a LinkCheck record and queues an async threat intel check.
+     *
+     * @param params - Parameters for queueing the check
+     * @param env - Environment with queue and database connections
+     * @returns LinkCheck ID or null if failed
+     */
+    async queueThreatIntelCheck(params, env) {
+        try {
+            const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../db")));
+            const db = createPrisma(env);
+            // Ensure domain reputation record exists
+            await db.domainReputation.upsert({
+                where: { domain: params.domain },
+                create: {
+                    domain: params.domain,
+                    reputation: 0,
+                    status: "unknown",
+                },
+                update: {},
+            });
+            // Create LinkCheck record
+            const linkCheck = await db.linkCheck.create({
+                data: {
+                    postId: params.postId || null,
+                    commentId: params.commentId || null,
+                    originalUrl: params.originalUrl,
+                    normalizedUrl: params.normalizedUrl,
+                    domain: params.domain,
+                    status: params.status,
+                    checkType: "async",
+                },
+            });
+            // Queue threat intel check if queue is available
+            if (env.LINK_CHECK_QUEUE) {
+                try {
+                    await env.LINK_CHECK_QUEUE.send({
+                        linkCheckId: linkCheck.id,
+                        url: params.normalizedUrl,
+                        domain: params.domain,
+                    });
+                }
+                catch (queueError) {
+                    this.logger.warn("Failed to queue threat intel check:", queueError);
+                    // Continue - the LinkCheck record is created, can be processed later
+                }
+            }
+            return linkCheck.id;
+        }
+        catch (error) {
+            this.logger.error("Failed to queue threat intel check:", error);
+            return null;
+        }
+    }
+}
+exports.LinkSecurityHandler = LinkSecurityHandler;
+//# sourceMappingURL=link-security-handler.js.map

package/dist/lib/link-security-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-security-handler.js","sourceRoot":"","sources":["../../src/lib/link-security-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGH,qCAAkD;AAelD;;GAEG;AACH,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,iCAAmB,CAAA;IACnB,iCAAmB,CAAA;AACrB,CAAC,EALW,UAAU,0BAAV,UAAU,QAKrB;AA4BD;;;;GAIG;AACH,MAAM,SAAS,GAAG,8BAA8B,CAAC;AAEjD;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,aAAa;IACb,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,mBAAmB;IACnB,gBAAgB;IAChB,QAAQ;IACR,MAAM;CACP,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAE/D;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,aAAa;IACrD,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,gBAAgB;IACxD,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,iBAAiB;IACzD,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,cAAc;IACtD,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,8BAA8B;CACvE,CAAC;AAEF;;GAEG;AACH,MAAM,0BAA0B,GAAG;IACjC,cAAc;IACd,eAAe,EAAE,+CAA+C;IAChE,WAAW;IACX,UAAU;IACV,cAAc;IACd,SAAS;CACV,CAAC;AAEF,MAAa,mBAAmB;IACtB,MAAM,CAAS;IAEvB,YAAY,GAAe;QACzB,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mBAAmB;QACnB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,GAAW;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,YAAY;YACZ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAE9D,sDAAsD;YACtD,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAErC,6DAA6D;YAC7D,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC7C,0DAA0D;YAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAEhD,mCAAmC;YACnC,oFAAoF;YACpF,IAAI,CAAC;gBACH,iFAAiF;gBACjF,sBAAsB;gBACtB,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iBAAiB;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;YAE5B,uBAAuB;YACvB,MAAM,UAAU,GAAG,GAAG,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;YAExD,OAAO;gBACL,QAAQ,EAAE,GAAG;gBACb,UAAU;gBACV,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,eAAe,CAAC,GAAW;QACzB,4FAA4F;QAC5F,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,yCAAyC;YACzC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,sBAAsB;iBACrD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,UAAU,CAAC,OAAO;gBAC1B,MAAM,EAAE,oBAAoB;aAC7B,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,kDAAkD;QAClD,kEAAkE;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAC5C,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,MAAM,CAClB,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,UAAU,CAAC,OAAO;gBAC1B,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,iCAAiC;gBACjE,aAAa,EAAE,UAAU;aAC1B,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,8DAA8D;QAC9D,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE,UAAU,CAAC,OAAO;gBAC1B,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU;aAC1B,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE,6EAA6E;YACtG,aAAa,EAAE,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,MAAc;QAInC,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,8BAA8B;QAC9B,IAAI,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB;aAC3B,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,GAAG,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uBAAuB,gBAAgB,EAAE;aAClD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,IAAY,EACZ,MAAc;QAEd,gDAAgD;QAChD,+DAA+D;QAC/D,IAAI,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,mBAAmB,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,yDAAyD;QACzD,4EAA4E;QAC5E,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE;YAChD,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC,CAAC;QAEF,IACE,cAAc,CAAC,MAAM,CAAC;YACtB,cAAc,CAAC,mBAAmB,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,EACpB,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,4BAA4B;aACrC,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,IACE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EACpB,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4BAA4B;iBACrC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC5E,IAAI,SAAS,EAAE,CAAC;YACd,mDAAmD;YACnD,MAAM,EAAE,GACN,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC7B,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC,CAAC;YAEJ,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;gBACxC,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBACzC,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,2BAA2B;qBACpC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,wEAAwE;QACxE,IACE,MAAM,KAAK,KAAK;YAChB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAC1B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAC1B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAC1B,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,8BAA8B;aACvC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,MAAc;QAC/B,kEAAkE;QAClE,0CAA0C;QAC1C,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,kFAAkF;YAClF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,mDAAmD;YACnD,MAAM,EAAE,GACN,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClE,CAAC,CAAC;YAEJ,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;gBACxC,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBACzC,OAAO,KAAK,CAAC,CAAC,qCAAqC;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,YAAY;QAC3B,CAAC;QAED,oCAAoC;QACpC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,+DAA+D;YAC/D,IACE,UAAU,KAAK,KAAK;gBACpB,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC9B,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC9B,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAC9B,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,wCAAwC;YACxD,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,cAAc;QAC7B,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,GAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAAG,wDAClC,6BAA6B,GAC9B,CAAC;YAEF,qEAAqE;YACrE,MAAM,MAAM,GAAI,GAAG,CAAC,cAAqC,IAAI,IAAI,CAAC;YAElE,MAAM,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC3D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,aAAa,CACtD,MAAM,EACN,MAAM,EACN,GAAU,CACX,CAAC;YAEF,OAAO;gBACL,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CACzB,MAOC,EACD,GAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,OAAO,GAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAE7B,yCAAyC;YACzC,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBAChC,MAAM,EAAE;oBACN,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,CAAC;oBACb,MAAM,EAAE,SAAS;iBAClB;gBACD,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEH,0BAA0B;YAC1B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE;oBACJ,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;oBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;oBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS,EAAE,OAAO;iBACnB;aACF,CAAC,CAAC;YAEH,iDAAiD;YACjD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;wBAC9B,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,GAAG,EAAE,MAAM,CAAC,aAAa;wBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;qBACtB,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,UAAU,CAAC,CAAC;oBACpE,qEAAqE;gBACvE,CAAC;YACH,CAAC;YAED,OAAO,SAAS,CAAC,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AA/aD,kDA+aC"}