@empline/preflight 1.0.20

package/dist/checks/auth/session-security.js

@@ -0,0 +1,399 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Session Security Preflight
+ *
+ * Validates authentication session security patterns to prevent:
+ * - Deleted users remaining logged in (zombie sessions)
+ * - Missing user existence validation in JWT callbacks
+ * - Stale session data after user deletion
+ * - Missing periodic revalidation of user status
+ *
+ * Critical Security Checks:
+ * 1. JWT callback must validate user existence periodically
+ * 2. Session callbacks should not blindly trust token data
+ * 3. User deletion should invalidate active sessions
+ *
+ * Usage:
+ *   pnpm preflight:session-security
+ *   pnpm preflight:session-security --verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.checkAuthConfiguration = checkAuthConfiguration;
+exports.checkJwtUserValidation = checkJwtUserValidation;
+exports.checkSessionCallbackSecurity = checkSessionCallbackSecurity;
+exports.checkUserDeletionHandling = checkUserDeletionHandling;
+const fs = __importStar(require("fs"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+// Check metadata
+exports.id = "auth/session-security";
+exports.name = "Session Security";
+exports.category = "auth";
+exports.blocking = true;
+exports.description = "Session Security Preflight";
+exports.tags = ["auth", "security"];
+// CACHED FILE LISTS - Scan once, use everywhere
+let _cachedAuthFiles = null;
+async function getAuthFiles() {
+    if (!_cachedAuthFiles) {
+        _cachedAuthFiles = await file_cache_1.fileCache.getFiles("lib/auth*.ts", { ignore: glob_patterns_1.STANDARD_EXCLUDES });
+    }
+    return _cachedAuthFiles;
+}
+let _cachedUserApiFiles = null;
+async function getUserApiFiles() {
+    if (!_cachedUserApiFiles) {
+        _cachedUserApiFiles = await file_cache_1.fileCache.getFiles("app/api/**/user*/**/*.ts", {
+            ignore: glob_patterns_1.STANDARD_EXCLUDES,
+        });
+    }
+    return _cachedUserApiFiles;
+}
+let _cachedUserLibFiles = null;
+async function getUserLibFiles() {
+    if (!_cachedUserLibFiles) {
+        _cachedUserLibFiles = await file_cache_1.fileCache.getFiles("lib/**/*user*.ts", {
+            ignore: glob_patterns_1.STANDARD_EXCLUDES,
+        });
+    }
+    return _cachedUserLibFiles;
+}
+const EXCLUDED = [...glob_patterns_1.STANDARD_EXCLUDES];
+/**
+ * Check 1: JWT Callback User Validation
+ *
+ * Ensures the JWT callback validates that users still exist in the database
+ * on subsequent requests (not just initial login).
+ */
+async function checkJwtUserValidation() {
+    const issues = [];
+    const authFiles = await getAuthFiles();
+    for (const file of authFiles) {
+        const content = fs.readFileSync(file, "utf8");
+        const lines = content.split("\n");
+        // Check if file has JWT callback
+        if (!content.includes("async jwt(") && !content.includes("jwt:")) {
+            continue;
+        }
+        // Look for JWT callback implementation
+        const jwtCallbackMatch = content.match(/async\s+jwt\s*\([^)]*\)\s*\{[\s\S]*?\n\s{4}\}/);
+        if (!jwtCallbackMatch)
+            continue;
+        const jwtCallback = jwtCallbackMatch[0];
+        // Check for user existence validation patterns
+        const hasUserValidation = jwtCallback.includes("findFirst") ||
+            jwtCallback.includes("findUnique") ||
+            jwtCallback.includes("deletedAt") ||
+            jwtCallback.includes("lastValidated") ||
+            jwtCallback.includes("revalidate");
+        const hasPeriodicCheck = jwtCallback.includes("VALIDATION_INTERVAL") ||
+            jwtCallback.includes("shouldRevalidate") ||
+            jwtCallback.includes("lastValidated");
+        if (!hasUserValidation) {
+            const lineNum = content.substring(0, content.indexOf("async jwt")).split("\n").length;
+            issues.push({
+                file,
+                line: lineNum,
+                type: "no-user-validation",
+                severity: "error",
+                message: "JWT callback does not validate user existence on subsequent requests",
+                suggestion: "Add periodic database check: prisma.authUsers.findFirst({ where: { id: token.id, deletedAt: null } })",
+            });
+        }
+        else if (!hasPeriodicCheck) {
+            const lineNum = content.substring(0, content.indexOf("async jwt")).split("\n").length;
+            issues.push({
+                file,
+                line: lineNum,
+                type: "no-periodic-validation",
+                severity: "warning",
+                message: "JWT callback validates user but may check on every request (performance impact)",
+                suggestion: "Add periodic validation with timestamp: check every 5 minutes instead of every request",
+            });
+        }
+        // Check for empty token return on deleted user
+        if (hasUserValidation &&
+            !jwtCallback.includes("return {} as JWT") &&
+            !jwtCallback.includes("return {}")) {
+            if (!jwtCallback.includes("throw") && !jwtCallback.includes("null")) {
+                issues.push({
+                    file,
+                    type: "no-session-invalidation",
+                    severity: "warning",
+                    message: "JWT callback validates user but may not properly invalidate session for deleted users",
+                    suggestion: "Return empty token to force re-authentication: return {} as JWT",
+                });
+            }
+        }
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "JWT User Validation",
+        passed: !hasErrors,
+        blocking: true,
+        issues,
+    };
+}
+/**
+ * Check 2: Session Callback Security
+ *
+ * Ensures session callbacks don't blindly trust token data without validation.
+ */
+async function checkSessionCallbackSecurity() {
+    const issues = [];
+    const authFiles = await getAuthFiles();
+    for (const file of authFiles) {
+        const content = fs.readFileSync(file, "utf8");
+        // Check if file has session callback
+        if (!content.includes("async session(") && !content.includes("session:")) {
+            continue;
+        }
+        // Check for role escalation protection
+        // Session callback should not allow arbitrary role assignment from token
+        const sessionCallbackMatch = content.match(/async\s+session\s*\([^)]*\)\s*\{[\s\S]*?\n\s{4}\}/);
+        if (!sessionCallbackMatch)
+            continue;
+        const sessionCallback = sessionCallbackMatch[0];
+        // Check if session blindly copies role without validation
+        if (sessionCallback.includes("session.user.role = token.role") &&
+            !sessionCallback.includes("validate") &&
+            !sessionCallback.includes("check")) {
+            // This is acceptable if JWT callback already validates - just info
+            issues.push({
+                file,
+                type: "role-from-token",
+                severity: "info",
+                message: "Session callback copies role from token - ensure JWT callback validates user",
+                suggestion: "JWT callback should periodically verify user role from database",
+            });
+        }
+    }
+    return {
+        name: "Session Callback Security",
+        passed: true, // Info-only, not blocking
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 3: User Deletion Session Handling
+ *
+ * Checks if user deletion logic properly handles active sessions.
+ */
+async function checkUserDeletionHandling() {
+    const issues = [];
+    // Look for user deletion endpoints/functions
+    const apiFiles = await getUserApiFiles();
+    const libFiles = await getUserLibFiles();
+    const allFiles = [...apiFiles, ...libFiles];
+    for (const file of allFiles) {
+        const content = fs.readFileSync(file, "utf8");
+        const lines = content.split("\n");
+        // Look for user deletion patterns
+        const hasDeletion = content.includes("deletedAt:") ||
+            content.includes(".delete(") ||
+            content.includes("deleteUser") ||
+            content.includes("removeUser");
+        if (!hasDeletion)
+            continue;
+        // Check if deletion includes session invalidation comment or logic
+        const hasSessionHandling = content.includes("session") ||
+            content.includes("signOut") ||
+            content.includes("invalidate") ||
+            content.includes("JWT callback will detect");
+        if (!hasSessionHandling) {
+            // Find the line with deletion
+            let deletionLine = 1;
+            for (let i = 0; i < lines.length; i++) {
+                if (lines[i].includes("deletedAt:") || lines[i].includes(".delete(")) {
+                    deletionLine = i + 1;
+                    break;
+                }
+            }
+            issues.push({
+                file,
+                line: deletionLine,
+                type: "deletion-no-session-handling",
+                severity: "info",
+                message: "User deletion found - ensure JWT callback validates user existence periodically",
+                suggestion: "JWT callback should check deletedAt: null to auto-invalidate deleted user sessions",
+            });
+        }
+    }
+    return {
+        name: "User Deletion Session Handling",
+        passed: true, // Info-only
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 4: Auth Configuration Security
+ *
+ * Validates auth configuration for security best practices.
+ */
+async function checkAuthConfiguration() {
+    const issues = [];
+    const authFiles = await getAuthFiles();
+    for (const file of authFiles) {
+        const content = fs.readFileSync(file, "utf8");
+        const lines = content.split("\n");
+        // Check session maxAge - warn if very long without revalidation
+        const maxAgeMatch = content.match(/maxAge:\s*(\d+)/);
+        if (maxAgeMatch) {
+            const maxAgeSeconds = parseInt(maxAgeMatch[1], 10);
+            const maxAgeDays = maxAgeSeconds / (24 * 60 * 60);
+            if (maxAgeDays > 7) {
+                // Check if there's periodic validation
+                const hasPeriodicValidation = content.includes("lastValidated") || content.includes("VALIDATION_INTERVAL");
+                if (!hasPeriodicValidation) {
+                    const lineNum = content.substring(0, content.indexOf("maxAge")).split("\n").length;
+                    issues.push({
+                        file,
+                        line: lineNum,
+                        type: "long-session-no-validation",
+                        severity: "warning",
+                        message: `Session maxAge is ${maxAgeDays} days - long sessions need periodic user validation`,
+                        suggestion: "Add periodic user existence check in JWT callback (every 5-15 minutes)",
+                    });
+                }
+            }
+        }
+        // Check for E2E bypass without proper guards
+        if (content.includes("E2E_SKIP_AUTH")) {
+            const hasEnvCheck = content.includes("NODE_ENV") || content.includes("development") || content.includes("test");
+            if (!hasEnvCheck) {
+                issues.push({
+                    file,
+                    type: "e2e-bypass-no-env-check",
+                    severity: "warning",
+                    message: "E2E auth bypass found - ensure it's properly guarded by environment",
+                    suggestion: "Add NODE_ENV check to prevent bypass in production",
+                });
+            }
+        }
+    }
+    return {
+        name: "Auth Configuration Security",
+        passed: !issues.some((i) => i.severity === "error"),
+        blocking: false,
+        issues,
+    };
+}
+function printResults(checks, verbose) {
+    console.log("\n🔐 SESSION SECURITY PREFLIGHT");
+    console.log(`${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    let totalErrors = 0;
+    let totalWarnings = 0;
+    let totalInfo = 0;
+    for (const check of checks) {
+        const icon = check.passed
+            ? `${console_chars_1.emoji.success}`
+            : check.blocking
+                ? `${console_chars_1.emoji.error}`
+                : `${console_chars_1.emoji.warning}`;
+        const issueCount = check.issues.length > 0 ? ` (${check.issues.length} issues)` : "";
+        console.log(`\n${icon} ${check.name}${issueCount}`);
+        if (check.issues.length > 0) {
+            const errors = check.issues.filter((i) => i.severity === "error");
+            const warnings = check.issues.filter((i) => i.severity === "warning");
+            const infos = check.issues.filter((i) => i.severity === "info");
+            totalErrors += errors.length;
+            totalWarnings += warnings.length;
+            totalInfo += infos.length;
+            if (errors.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.error} ERRORS (${errors.length}):`);
+                for (const issue of errors) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (warnings.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.warning}  WARNINGS (${warnings.length}):`);
+                for (const issue of warnings) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (verbose && issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (verbose && infos.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.info}  INFO (${infos.length}):`);
+                for (const issue of infos) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                }
+            }
+        }
+    }
+    console.log("\n" + `${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    console.log(`${console_chars_1.emoji.chart} Summary: ${totalErrors} errors | ${totalWarnings} warnings | ${totalInfo} info`);
+    console.log(`${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    const hasBlockingFailure = checks.some((c) => !c.passed && c.blocking);
+    if (hasBlockingFailure) {
+        console.log(`\n${console_chars_1.emoji.error} SESSION SECURITY FAILED - fix errors before deploying\n`);
+    }
+    else if (totalWarnings > 0) {
+        console.log(`\n${console_chars_1.emoji.warning}  SESSION SECURITY PASSED with warnings\n`);
+    }
+    else {
+        console.log(`\n${console_chars_1.emoji.success} SESSION SECURITY PASSED\n`);
+    }
+    console.log(`${console_chars_1.emoji.clipboard} Security Best Practices:`);
+    console.log("   ${chars.bullet} JWT callback should validate user exists periodically (every 5 min)");
+    console.log(`   ${console_chars_1.chars.bullet} Check deletedAt: null to auto-invalidate deleted user sessions`);
+    console.log(`   ${console_chars_1.chars.bullet} Return empty token {} to force re-authentication`);
+    console.log(`   ${console_chars_1.chars.bullet} Long session maxAge (>7 days) requires periodic validation\n`);
+    return hasBlockingFailure;
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    const checks = [];
+    checks.push(await checkJwtUserValidation());
+    checks.push(await checkSessionCallbackSecurity());
+    checks.push(await checkUserDeletionHandling());
+    checks.push(await checkAuthConfiguration());
+    const failed = printResults(checks, verbose);
+    process.exit(failed ? 1 : 0);
+}
+main().catch(console.error);
+//# sourceMappingURL=session-security.js.map

package/dist/checks/auth/session-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-security.js","sourceRoot":"","sources":["../../../src/checks/auth/session-security.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6aD,wDAAsB;AACtB,wDAAsB;AACtB,oEAA4B;AAC5B,8DAAyB;AA9a3B,uCAAyB;AACzB,6DAA8D;AAC9D,wDAAoD;AACpD,8DAA+D;AAG/D,iBAAiB;AACJ,QAAA,EAAE,GAAG,uBAAuB,CAAC;AAC7B,QAAA,IAAI,GAAG,kBAAkB,CAAC;AAC1B,QAAA,QAAQ,GAAG,MAAM,CAAC;AAClB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,4BAA4B,CAAC;AAC3C,QAAA,IAAI,GAAG,CAAC,MAAM,EAAC,UAAU,CAAC,CAAC;AAExC,gDAAgD;AAEhD,IAAI,gBAAgB,GAAoB,IAAI,CAAC;AAC7C,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,gBAAgB,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,iCAAiB,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,IAAI,mBAAmB,GAAoB,IAAI,CAAC;AAChD,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,0BAA0B,EAAE;YACzE,MAAM,EAAE,iCAAiB;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,IAAI,mBAAmB,GAAoB,IAAI,CAAC;AAChD,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE;YACjE,MAAM,EAAE,iCAAiB;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAmBD,MAAM,QAAQ,GAAG,CAAC,GAAG,iCAAiB,CAAC,CAAC;AAExC;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,iCAAiC;QACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACxF,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAEhC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAExC,+CAA+C;QAC/C,MAAM,iBAAiB,GACrB,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;YACjC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;YACjC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAErC,MAAM,gBAAgB,GACpB,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC3C,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACxC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAExC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,sEAAsE;gBAC/E,UAAU,EACR,uGAAuG;aAC1G,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,iFAAiF;gBAC1F,UAAU,EACR,wFAAwF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,IACE,iBAAiB;YACjB,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzC,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAClC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI;oBACJ,IAAI,EAAE,yBAAyB;oBAC/B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EACL,uFAAuF;oBACzF,UAAU,EAAE,iEAAiE;iBAC9E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,CAAC,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,4BAA4B;IACzC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,qCAAqC;QACrC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,yEAAyE;QACzE,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAChG,IAAI,CAAC,oBAAoB;YAAE,SAAS;QAEpC,MAAM,eAAe,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAEhD,0DAA0D;QAC1D,IACE,eAAe,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAC1D,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;YACrC,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAClC,CAAC;YACD,mEAAmE;YACnE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,8EAA8E;gBACvF,UAAU,EAAE,iEAAiE;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,IAAI,EAAE,0BAA0B;QACxC,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB;IACtC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,kCAAkC;QAClC,MAAM,WAAW,GACf,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,mEAAmE;QACnE,MAAM,kBAAkB,GACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAE/C,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,8BAA8B;YAC9B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrE,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,iFAAiF;gBAC1F,UAAU,EACR,oFAAoF;aACvF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,IAAI,EAAE,YAAY;QAC1B,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,gEAAgE;QAChE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,aAAa,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAElD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnB,uCAAuC;gBACvC,MAAM,qBAAqB,GACzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;gBAE/E,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBACnF,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,4BAA4B;wBAClC,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,qBAAqB,UAAU,qDAAqD;wBAC7F,UAAU,EAAE,wEAAwE;qBACrF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,WAAW,GACf,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE9F,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI;oBACJ,IAAI,EAAE,yBAAyB;oBAC/B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,qEAAqE;oBAC9E,UAAU,EAAE,oDAAoD;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACnD,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB,EAAE,OAAgB;IAC3D,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM;YACvB,CAAC,CAAC,GAAG,qBAAK,CAAC,OAAO,EAAE;YACpB,CAAC,CAAC,KAAK,CAAC,QAAQ;gBACd,CAAC,CAAC,GAAG,qBAAK,CAAC,KAAK,EAAE;gBAClB,CAAC,CAAC,GAAG,qBAAK,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;YAEhE,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC;YACjC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,UAAU;wBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,OAAO,eAAe,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;gBACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,OAAO,IAAI,KAAK,CAAC,UAAU;wBAC7B,OAAO,CAAC,GAAG,CAAC,YAAY,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,IAAI,WAAW,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC3D,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,mBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,KAAK,aAAa,WAAW,aAAa,aAAa,eAAe,SAAS,OAAO,CAChG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAElD,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,0DAA0D,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,SAAS,2BAA2B,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CACT,wFAAwF,CACzF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,iEAAiE,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,mDAAmD,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,MAAM,qBAAK,CAAC,MAAM,+DAA+D,CAAC,CAAC;IAE/F,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElE,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,CAAC,IAAI,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,4BAA4B,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/auth/session-update-safety.d.ts

@@ -0,0 +1,96 @@
+#!/usr/bin/env tsx
+/**
+ * Session Update Safety Preflight
+ *
+ * Comprehensive session handling validation to prevent auth-related bugs
+ * like unexpected login redirects, stale sessions, and UI flashes.
+ *
+ * BLOCKING ERRORS:
+ * - update() called in render path (causes infinite loops)
+ *
+ * WARNINGS:
+ * - Unhandled update() return values (can cause silent failures)
+ * - Idle refresh without activity timestamp reset (repeated refreshes)
+ * - Login redirect without session validation (unnecessary redirects)
+ *
+ * INFO (Best Practices):
+ * - update() without session status check
+ * - Session-dependent UI without loading state
+ * - signOut() without storage cleanup
+ *
+ * Usage:
+ *   pnpm preflight:session-update-safety
+ *   pnpm preflight:session-update-safety --verbose
+ */
+export declare const id = "auth/session-update-safety";
+export declare const name = "Session Update Safety";
+export declare const category = "auth";
+export declare const blocking = true;
+export declare const description = "Session Update Safety Preflight";
+export declare const tags: string[];
+interface Issue {
+    file: string;
+    line: number;
+    type: string;
+    severity: "error" | "warning" | "info";
+    message: string;
+    suggestion?: string;
+    code?: string;
+}
+interface CheckResult {
+    name: string;
+    passed: boolean;
+    blocking: boolean;
+    issues: Issue[];
+}
+/**
+ * Check 1: Unhandled update() Return Value
+ *
+ * Detects when update() is called but its return value is ignored.
+ * The return value indicates if the session was successfully refreshed.
+ */
+declare function checkUnhandledUpdateReturn(): Promise<CheckResult>;
+/**
+ * Check 2: Idle Refresh Without Activity Reset
+ *
+ * Detects idle-based session refresh that doesn't reset the activity timestamp,
+ * which can cause repeated refresh attempts.
+ */
+declare function checkIdleRefreshPattern(): Promise<CheckResult>;
+/**
+ * Check 3: Session Update in Render Path
+ *
+ * Detects update() calls that could be triggered during render,
+ * causing infinite loops or unexpected behavior.
+ */
+declare function checkUpdateInRenderPath(): Promise<CheckResult>;
+/**
+ * Check 5: Programmatic Login Redirect Without Session Check
+ *
+ * Detects router.push('/login') calls that don't first verify the session
+ * is actually invalid, which can cause unnecessary redirects.
+ */
+declare function checkProgrammaticLoginRedirect(): Promise<CheckResult>;
+/**
+ * Check 6: Session-Dependent UI Without Loading State
+ *
+ * Detects components that render session-dependent content without
+ * handling the loading state, which can cause flash of wrong content.
+ */
+declare function checkSessionLoadingState(): Promise<CheckResult>;
+/**
+ * Check 7: SignOut Without Cleanup
+ *
+ * Detects signOut() calls that don't clear local state/storage,
+ * which can leave stale data after logout.
+ */
+declare function checkSignOutCleanup(): Promise<CheckResult>;
+/**
+ * Check 4: Missing Session Status Check Before Update
+ *
+ * Detects update() calls that don't check session status first,
+ * which can cause unnecessary API calls or errors.
+ */
+declare function checkSessionStatusBeforeUpdate(): Promise<CheckResult>;
+export { checkIdleRefreshPattern, checkProgrammaticLoginRedirect, checkSessionLoadingState, checkSessionStatusBeforeUpdate, checkSignOutCleanup, checkUnhandledUpdateReturn, checkUpdateInRenderPath, };
+//# sourceMappingURL=session-update-safety.d.ts.map

package/dist/checks/auth/session-update-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-update-safety.d.ts","sourceRoot":"","sources":["../../../src/checks/auth/session-update-safety.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,eAAO,MAAM,EAAE,+BAA+B,CAAC;AAC/C,eAAO,MAAM,IAAI,0BAA0B,CAAC;AAC5C,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,oCAAoC,CAAC;AAC7D,eAAO,MAAM,IAAI,UAAW,CAAC;AAE7B,UAAU,KAAK;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAaD;;;;;GAKG;AACH,iBAAe,0BAA0B,IAAI,OAAO,CAAC,WAAW,CAAC,CAkGhE;AAED;;;;;GAKG;AACH,iBAAe,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC,CA+F7D;AAED;;;;;GAKG;AACH,iBAAe,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC,CAkF7D;AAED;;;;;GAKG;AACH,iBAAe,8BAA8B,IAAI,OAAO,CAAC,WAAW,CAAC,CAyFpE;AAED;;;;;GAKG;AACH,iBAAe,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC,CAwE9D;AAED;;;;;GAKG;AACH,iBAAe,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC,CAgFzD;AAED;;;;;GAKG;AACH,iBAAe,8BAA8B,IAAI,OAAO,CAAC,WAAW,CAAC,CAmEpE;AAyGD,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GACxB,CAAC"}