@indecisivedev/openplan 0.2.0-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (120) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +120 -0
  3. package/dist/access-policy.d.ts +35 -0
  4. package/dist/access-policy.js +107 -0
  5. package/dist/access-policy.js.map +1 -0
  6. package/dist/access-store.d.ts +33 -0
  7. package/dist/access-store.js +212 -0
  8. package/dist/access-store.js.map +1 -0
  9. package/dist/admin.d.ts +1 -0
  10. package/dist/admin.js +13 -0
  11. package/dist/admin.js.map +1 -0
  12. package/dist/api.d.ts +2 -0
  13. package/dist/api.js +867 -0
  14. package/dist/api.js.map +1 -0
  15. package/dist/bootstrap-admin.d.ts +1 -0
  16. package/dist/bootstrap-admin.js +35 -0
  17. package/dist/bootstrap-admin.js.map +1 -0
  18. package/dist/browser-security.d.ts +5 -0
  19. package/dist/browser-security.js +53 -0
  20. package/dist/browser-security.js.map +1 -0
  21. package/dist/celld-quickstart.d.ts +51 -0
  22. package/dist/celld-quickstart.js +1175 -0
  23. package/dist/celld-quickstart.js.map +1 -0
  24. package/dist/cli-api-client.d.ts +78 -0
  25. package/dist/cli-api-client.js +272 -0
  26. package/dist/cli-api-client.js.map +1 -0
  27. package/dist/cli-credentials.d.ts +47 -0
  28. package/dist/cli-credentials.js +447 -0
  29. package/dist/cli-credentials.js.map +1 -0
  30. package/dist/cli-endpoint.d.ts +19 -0
  31. package/dist/cli-endpoint.js +56 -0
  32. package/dist/cli-endpoint.js.map +1 -0
  33. package/dist/cli-program.d.ts +11 -0
  34. package/dist/cli-program.js +934 -0
  35. package/dist/cli-program.js.map +1 -0
  36. package/dist/cli.d.ts +2 -0
  37. package/dist/cli.js +7 -0
  38. package/dist/cli.js.map +1 -0
  39. package/dist/client-ip.d.ts +4 -0
  40. package/dist/client-ip.js +49 -0
  41. package/dist/client-ip.js.map +1 -0
  42. package/dist/config.d.ts +35 -0
  43. package/dist/config.js +113 -0
  44. package/dist/config.js.map +1 -0
  45. package/dist/crypto.d.ts +3 -0
  46. package/dist/crypto.js +11 -0
  47. package/dist/crypto.js.map +1 -0
  48. package/dist/database.d.ts +15 -0
  49. package/dist/database.js +155 -0
  50. package/dist/database.js.map +1 -0
  51. package/dist/db.d.ts +31 -0
  52. package/dist/db.js +388 -0
  53. package/dist/db.js.map +1 -0
  54. package/dist/drafts.d.ts +43 -0
  55. package/dist/drafts.js +90 -0
  56. package/dist/drafts.js.map +1 -0
  57. package/dist/feature-settings.d.ts +7 -0
  58. package/dist/feature-settings.js +32 -0
  59. package/dist/feature-settings.js.map +1 -0
  60. package/dist/generated/annotation-client.d.ts +1 -0
  61. package/dist/generated/annotation-client.js +2 -0
  62. package/dist/generated/annotation-client.js.map +1 -0
  63. package/dist/html-policy.d.ts +15 -0
  64. package/dist/html-policy.js +172 -0
  65. package/dist/html-policy.js.map +1 -0
  66. package/dist/ids.d.ts +2 -0
  67. package/dist/ids.js +10 -0
  68. package/dist/ids.js.map +1 -0
  69. package/dist/local-auth.d.ts +36 -0
  70. package/dist/local-auth.js +215 -0
  71. package/dist/local-auth.js.map +1 -0
  72. package/dist/maintenance.d.ts +1 -0
  73. package/dist/maintenance.js +18 -0
  74. package/dist/maintenance.js.map +1 -0
  75. package/dist/oidc.d.ts +39 -0
  76. package/dist/oidc.js +194 -0
  77. package/dist/oidc.js.map +1 -0
  78. package/dist/public-url.d.ts +17 -0
  79. package/dist/public-url.js +96 -0
  80. package/dist/public-url.js.map +1 -0
  81. package/dist/rate-limit.d.ts +25 -0
  82. package/dist/rate-limit.js +55 -0
  83. package/dist/rate-limit.js.map +1 -0
  84. package/dist/reconcile.d.ts +5 -0
  85. package/dist/reconcile.js +18 -0
  86. package/dist/reconcile.js.map +1 -0
  87. package/dist/render-annotations.d.ts +10 -0
  88. package/dist/render-annotations.js +73 -0
  89. package/dist/render-annotations.js.map +1 -0
  90. package/dist/render-web.d.ts +74 -0
  91. package/dist/render-web.js +439 -0
  92. package/dist/render-web.js.map +1 -0
  93. package/dist/render.d.ts +4 -0
  94. package/dist/render.js +85 -0
  95. package/dist/render.js.map +1 -0
  96. package/dist/server.d.ts +1 -0
  97. package/dist/server.js +26 -0
  98. package/dist/server.js.map +1 -0
  99. package/dist/shoo.d.ts +26 -0
  100. package/dist/shoo.js +92 -0
  101. package/dist/shoo.js.map +1 -0
  102. package/dist/sqlite-migrations.d.ts +6 -0
  103. package/dist/sqlite-migrations.js +214 -0
  104. package/dist/sqlite-migrations.js.map +1 -0
  105. package/dist/storage.d.ts +14 -0
  106. package/dist/storage.js +86 -0
  107. package/dist/storage.js.map +1 -0
  108. package/dist/types.d.ts +24 -0
  109. package/dist/types.js +2 -0
  110. package/dist/types.js.map +1 -0
  111. package/dist/upload-state.d.ts +19 -0
  112. package/dist/upload-state.js +118 -0
  113. package/dist/upload-state.js.map +1 -0
  114. package/dist/web-auth.d.ts +33 -0
  115. package/dist/web-auth.js +122 -0
  116. package/dist/web-auth.js.map +1 -0
  117. package/dist/web.d.ts +2 -0
  118. package/dist/web.js +550 -0
  119. package/dist/web.js.map +1 -0
  120. package/package.json +70 -0
package/dist/web.js ADDED
@@ -0,0 +1,550 @@
1
+ import { APPLICATION_REFERRER_POLICY, isSameOriginMutation, safeNextPath } from "./browser-security.js";
2
+ import { assertBrowserAuthConfigured, browserAuthProvider, config, requireOidcSettings } from "./config.js";
3
+ import { beginOidcLogin, completeOidcLogin, oidcProviderKey, oidcSessionBinding } from "./oidc.js";
4
+ import { isAdminAccount } from "./admin.js";
5
+ import express from "express";
6
+ import { findOrCreateAccountForIdentity, pool, revokeApiKey } from "./db.js";
7
+ import { newInternalId } from "./ids.js";
8
+ import { clientIp } from "./client-ip.js";
9
+ import { createRateLimiter } from "./rate-limit.js";
10
+ import { randomToken, sha256 } from "./crypto.js";
11
+ import { getAccountDraftWithVersions, listAccountDrafts } from "./drafts.js";
12
+ import { getDraftIdFromHost, getHomeUrl, getRequestBaseUrl } from "./public-url.js";
13
+ import { buildAuthorizeUrl, buildPkce, exchangeCode, verifyIdToken } from "./shoo.js";
14
+ import { clearAuthStateCookie, clearSessionCookie, createAuthStateCookie, createSessionCookie, readAuthState, readSession } from "./web-auth.js";
15
+ import { authenticateLocalUser, changeLocalPassword, createLocalUser, listLocalUsers, readWebSession } from "./local-auth.js";
16
+ import { renderAccountSecurity, renderAdminUsers, renderAuthError, renderAdminFeatures, renderCliAuth, renderCliAuthKey, renderDashboard, renderDraftDetail, renderSignIn } from "./render-web.js";
17
+ import { getDraftAccessOverview, setAccessPolicy } from "./access-store.js";
18
+ import { getBrowserLocalAnnotationsSetting, setBrowserLocalAnnotationsEnabled } from "./feature-settings.js";
19
+ // Server-rendered web UI: browser sign-in, the drafts dashboard, and the /cli/auth
20
+ // key page. Apex-domain only — on draft subdomains these paths fall through to
21
+ // the 404 handler so a draft origin can never serve dashboard UI.
22
+ export function registerWebRoutes(app) {
23
+ const web = [onlyApex, requireSameOrigin, requireConfigured];
24
+ const accessBody = express.urlencoded({ extended: false, limit: "8kb" });
25
+ const loginBody = express.urlencoded({ extended: false, limit: "8kb" });
26
+ const keyMintRateLimit = createRateLimiter({
27
+ windowMs: Number(process.env.KEY_MINT_RATE_LIMIT_WINDOW_MS || 3_600_000),
28
+ max: Number(process.env.KEY_MINT_RATE_LIMIT_MAX || 10),
29
+ keyPrefix: "key-mint",
30
+ key: (req) => readSession(req)?.accountId || clientIp(req) || "anonymous"
31
+ });
32
+ const localLoginRateLimit = createRateLimiter({
33
+ windowMs: 15 * 60_000,
34
+ max: 30,
35
+ keyPrefix: "local-login",
36
+ key: (req) => clientIp(req) || "anonymous"
37
+ });
38
+ app.get("/auth/sign-in", ...web, async (req, res) => {
39
+ if (browserAuthProvider() === "local") {
40
+ return res.type("html").send(renderSignIn({
41
+ next: safeNextPath(req.query.next),
42
+ provider: "local"
43
+ }));
44
+ }
45
+ if (browserAuthProvider() === "oidc") {
46
+ try {
47
+ const settings = requireOidcSettings();
48
+ const login = await beginOidcLogin(settings, callbackUrl());
49
+ res.append("Set-Cookie", createAuthStateCookie({
50
+ state: login.state, verifier: login.verifier, nonce: login.nonce,
51
+ next: safeNextPath(req.query.next), authProvider: "oidc",
52
+ oidcBinding: oidcSessionBinding(settings)
53
+ }));
54
+ return res.redirect(login.url);
55
+ }
56
+ catch {
57
+ return res.status(502).type("html").send(renderAuthError({ message: "Sign-in could not be started. Please retry." }));
58
+ }
59
+ }
60
+ const { verifier, challenge, state } = buildPkce();
61
+ const next = safeNextPath(req.query.next);
62
+ res.append("Set-Cookie", createAuthStateCookie({ state, verifier, next, authProvider: "shoo" }));
63
+ res.redirect(buildAuthorizeUrl({ redirectUri: callbackUrl(), state, challenge }));
64
+ });
65
+ app.post("/auth/sign-in", ...web, loginBody, localLoginRateLimit, async (req, res, next) => {
66
+ if (browserAuthProvider() !== "local")
67
+ return next();
68
+ const nextPath = safeNextPath(req.body?.next);
69
+ try {
70
+ const account = await authenticateLocalUser(req, typeof req.body?.username === "string" ? req.body.username : "", typeof req.body?.password === "string" ? req.body.password : "");
71
+ if (!account) {
72
+ return res.status(403).type("html").send(renderSignIn({
73
+ next: nextPath,
74
+ provider: "local",
75
+ error: "Invalid username or password, or the account is temporarily locked."
76
+ }));
77
+ }
78
+ res.append("Set-Cookie", createSessionCookie({
79
+ accountId: account.accountId,
80
+ accountName: account.accountName,
81
+ authProvider: "local",
82
+ sessionVersion: account.sessionVersion
83
+ }));
84
+ res.redirect(303, nextPath);
85
+ }
86
+ catch (error) {
87
+ res.status(400).type("html").send(renderSignIn({
88
+ next: nextPath,
89
+ provider: "local",
90
+ error: errorMessage(error)
91
+ }));
92
+ }
93
+ });
94
+ app.get("/auth/callback", ...web, async (req, res, next) => {
95
+ if (browserAuthProvider() === "local")
96
+ return next();
97
+ try {
98
+ res.append("Set-Cookie", clearAuthStateCookie());
99
+ const authState = readAuthState(req);
100
+ const { code, state } = req.query;
101
+ if (!authState || typeof state !== "string" || state !== authState.state) {
102
+ return res
103
+ .status(400)
104
+ .type("html")
105
+ .send(renderAuthError({ message: "Sign-in expired or state mismatch. Please retry." }));
106
+ }
107
+ const provider = browserAuthProvider();
108
+ if (provider === "oidc") {
109
+ const settings = requireOidcSettings();
110
+ if (authState.authProvider !== "oidc" || authState.oidcBinding !== oidcSessionBinding(settings)
111
+ || typeof authState.nonce !== "string" || !authState.nonce) {
112
+ return res.status(400).type("html").send(renderAuthError({ message: "Sign-in configuration changed. Please retry." }));
113
+ }
114
+ if (req.query.error !== undefined) {
115
+ return res.status(403).type("html").send(renderAuthError({ message: "Sign-in was cancelled or could not be completed. Please retry." }));
116
+ }
117
+ let identity;
118
+ try {
119
+ const responseUrl = new URL(callbackUrl());
120
+ responseUrl.search = new URL(req.originalUrl, "http://request.invalid").search;
121
+ identity = await completeOidcLogin(settings, responseUrl, {
122
+ state: authState.state, verifier: authState.verifier, nonce: authState.nonce
123
+ }, callbackUrl());
124
+ }
125
+ catch {
126
+ return res.status(502).type("html").send(renderAuthError({ message: "Sign-in could not be completed. Please retry." }));
127
+ }
128
+ const account = await findOrCreateAccountForIdentity({
129
+ provider: oidcProviderKey(settings), subject: identity.subject, profile: identity.profile
130
+ });
131
+ res.append("Set-Cookie", createSessionCookie({ ...account,
132
+ authProvider: "oidc", oidcBinding: oidcSessionBinding(settings)
133
+ }));
134
+ return res.redirect(safeNextPath(authState.next));
135
+ }
136
+ if (authState.authProvider !== undefined && authState.authProvider !== "shoo") {
137
+ return res.status(400).type("html").send(renderAuthError({ message: "Sign-in configuration changed. Please retry." }));
138
+ }
139
+ if (req.query.error !== undefined) {
140
+ return res.status(403).type("html").send(renderAuthError({ message: "Sign-in was cancelled or could not be completed. Please retry." }));
141
+ }
142
+ if (typeof code !== "string" || !code) {
143
+ return res
144
+ .status(400)
145
+ .type("html")
146
+ .send(renderAuthError({ message: "Missing authorization code." }));
147
+ }
148
+ // Exchange/verification failures are expected OAuth outcomes (expired
149
+ // or replayed 120s codes, shoo hiccups) — render a retryable page, not
150
+ // the JSON 500 handler.
151
+ let claims;
152
+ try {
153
+ const tokens = await exchangeCode({
154
+ code,
155
+ verifier: authState.verifier,
156
+ redirectUri: callbackUrl()
157
+ });
158
+ claims = await verifyIdToken(tokens.id_token, { audOrigin: webOrigin() });
159
+ }
160
+ catch (error) {
161
+ console.error("shoo sign-in failed:", errorMessage(error));
162
+ return res
163
+ .status(502)
164
+ .type("html")
165
+ .send(renderAuthError({ message: "Sign-in could not be completed. Please retry." }));
166
+ }
167
+ const account = await findOrCreateAccountForIdentity({
168
+ provider: "shoo",
169
+ subject: claims.pairwise_sub,
170
+ // Profile claims are present only with pii consent, and each is
171
+ // individually optional (depends on the Google profile). Blank or
172
+ // whitespace-only strings mean "absent", never a stored value.
173
+ profile: {
174
+ email: claimText(claims.email),
175
+ emailVerified: typeof claims.email_verified === "boolean" ? claims.email_verified : null,
176
+ displayName: claimText(claims.name),
177
+ pictureUrl: claimText(claims.picture),
178
+ piiSubject: claimText(claims.pii_sub)
179
+ }
180
+ });
181
+ res.append("Set-Cookie", createSessionCookie(account));
182
+ res.redirect(safeNextPath(authState.next));
183
+ }
184
+ catch (error) {
185
+ next(error);
186
+ }
187
+ });
188
+ app.post("/auth/sign-out", onlyApex, requireSameOrigin, (req, res) => {
189
+ res.append("Set-Cookie", clearSessionCookie());
190
+ res.redirect("/");
191
+ });
192
+ app.get("/dashboard", ...web, async (req, res, next) => {
193
+ try {
194
+ const session = await readWebSession(req);
195
+ if (!session) {
196
+ return res.type("html").send(renderSignIn({ next: "/dashboard", provider: signInProvider() }));
197
+ }
198
+ const drafts = await listAccountDrafts(session.accountId, {
199
+ requestBaseUrl: getRequestBaseUrl(req)
200
+ });
201
+ res.type("html").send(renderDashboard({ session, drafts, isAdmin: await isAdminAccount(session.accountId) }));
202
+ }
203
+ catch (error) {
204
+ next(error);
205
+ }
206
+ });
207
+ app.get("/admin/features", ...web, async (req, res, next) => {
208
+ try {
209
+ const session = await readWebSession(req);
210
+ if (!session)
211
+ return res.type("html").send(renderSignIn({ next: "/admin/features", provider: signInProvider() }));
212
+ if (!await isAdminAccount(session.accountId))
213
+ return next();
214
+ const setting = await getBrowserLocalAnnotationsSetting();
215
+ res.type("html").send(renderAdminFeatures({
216
+ session,
217
+ enabled: setting.enabled,
218
+ updatedAt: setting.updatedAt,
219
+ localUsers: browserAuthProvider() === "local"
220
+ }));
221
+ }
222
+ catch (error) {
223
+ next(error);
224
+ }
225
+ });
226
+ app.post("/admin/features/browser-local-annotations", ...web, accessBody, async (req, res, next) => {
227
+ try {
228
+ const session = await readWebSession(req);
229
+ if (!session)
230
+ return res.type("html").send(renderSignIn({ next: "/admin/features", provider: signInProvider() }));
231
+ if (!await isAdminAccount(session.accountId))
232
+ return next();
233
+ const enabled = req.body?.enabled === "true";
234
+ await setBrowserLocalAnnotationsEnabled(session.accountId, enabled);
235
+ res.redirect(303, "/admin/features");
236
+ }
237
+ catch (error) {
238
+ next(error);
239
+ }
240
+ });
241
+ app.get("/admin/users", ...web, async (req, res, next) => {
242
+ if (browserAuthProvider() !== "local")
243
+ return next();
244
+ try {
245
+ const session = await readWebSession(req);
246
+ if (!session)
247
+ return res.type("html").send(renderSignIn({ next: "/admin/users", provider: "local" }));
248
+ if (!await isAdminAccount(session.accountId))
249
+ return next();
250
+ res.type("html").send(renderAdminUsers({ session, users: await listLocalUsers() }));
251
+ }
252
+ catch (error) {
253
+ next(error);
254
+ }
255
+ });
256
+ app.post("/admin/users", ...web, accessBody, async (req, res, next) => {
257
+ if (browserAuthProvider() !== "local")
258
+ return next();
259
+ try {
260
+ const session = await readWebSession(req);
261
+ if (!session)
262
+ return res.type("html").send(renderSignIn({ next: "/admin/users", provider: "local" }));
263
+ if (!await isAdminAccount(session.accountId))
264
+ return next();
265
+ await createLocalUser({
266
+ username: typeof req.body?.username === "string" ? req.body.username : "",
267
+ password: typeof req.body?.password === "string" ? req.body.password : "",
268
+ ...(typeof req.body?.displayName === "string" && req.body.displayName.trim()
269
+ ? { displayName: req.body.displayName }
270
+ : {}),
271
+ isAdmin: req.body?.isAdmin === "true"
272
+ });
273
+ res.redirect(303, "/admin/users");
274
+ }
275
+ catch (error) {
276
+ const session = await readWebSession(req);
277
+ if (!session)
278
+ return res.type("html").send(renderSignIn({ next: "/admin/users", provider: "local" }));
279
+ res.status(400).type("html").send(renderAdminUsers({
280
+ session,
281
+ users: await listLocalUsers(),
282
+ error: errorMessage(error)
283
+ }));
284
+ }
285
+ });
286
+ app.get("/account/security", ...web, async (req, res, next) => {
287
+ try {
288
+ const session = await readWebSession(req);
289
+ if (!session)
290
+ return res.type("html").send(renderSignIn({ next: "/account/security", provider: signInProvider() }));
291
+ res.type("html").send(renderAccountSecurity({
292
+ session,
293
+ local: browserAuthProvider() === "local",
294
+ isAdmin: await isAdminAccount(session.accountId)
295
+ }));
296
+ }
297
+ catch (error) {
298
+ next(error);
299
+ }
300
+ });
301
+ app.post("/account/password", ...web, accessBody, async (req, res, next) => {
302
+ if (browserAuthProvider() !== "local")
303
+ return next();
304
+ try {
305
+ const session = await readWebSession(req);
306
+ if (!session)
307
+ return res.type("html").send(renderSignIn({ next: "/account/security", provider: "local" }));
308
+ await changeLocalPassword({
309
+ accountId: session.accountId,
310
+ currentPassword: typeof req.body?.currentPassword === "string" ? req.body.currentPassword : "",
311
+ newPassword: typeof req.body?.newPassword === "string" ? req.body.newPassword : ""
312
+ });
313
+ res.append("Set-Cookie", clearSessionCookie());
314
+ res.type("html").send(renderSignIn({
315
+ provider: "local",
316
+ message: "Password changed. Sign in again with the new password."
317
+ }));
318
+ }
319
+ catch (error) {
320
+ const session = await readWebSession(req);
321
+ if (!session)
322
+ return res.type("html").send(renderSignIn({ next: "/account/security", provider: "local" }));
323
+ res.status(400).type("html").send(renderAccountSecurity({
324
+ session,
325
+ local: true,
326
+ error: errorMessage(error),
327
+ isAdmin: await isAdminAccount(session.accountId)
328
+ }));
329
+ }
330
+ });
331
+ app.get("/dashboard/drafts/:draftId", ...web, async (req, res, next) => {
332
+ try {
333
+ const session = await readWebSession(req);
334
+ if (!session) {
335
+ return res.type("html").send(renderSignIn({ next: "/dashboard", provider: signInProvider() }));
336
+ }
337
+ const result = await getAccountDraftWithVersions(session.accountId, routeParam(req, "draftId"), {
338
+ requestBaseUrl: getRequestBaseUrl(req)
339
+ });
340
+ if (!result)
341
+ return next();
342
+ const access = await getDraftAccessOverview(session.accountId, routeParam(req, "draftId"));
343
+ const annotations = await getBrowserLocalAnnotationsSetting();
344
+ res.type("html").send(renderDraftDetail({
345
+ session,
346
+ draft: result.draft,
347
+ versions: result.versions,
348
+ annotationsEnabled: annotations.enabled,
349
+ isAdmin: await isAdminAccount(session.accountId),
350
+ ...(access ? { access } : {})
351
+ }));
352
+ }
353
+ catch (error) {
354
+ next(error);
355
+ }
356
+ });
357
+ app.post("/dashboard/drafts/:draftId/access", ...web, accessBody, async (req, res, next) => {
358
+ try {
359
+ const session = await readWebSession(req);
360
+ if (!session)
361
+ return res.type("html").send(renderSignIn({ next: "/dashboard", provider: signInProvider() }));
362
+ const mutation = webAccessMutation(req.body, false);
363
+ if (mutation.mode === "private" && (!config.sessionSecret || !config.publicBaseUrl)) {
364
+ return res.status(503).type("html").send(renderAuthError({ message: "Private sharing requires web sign-in configuration." }));
365
+ }
366
+ if (mutation.mode === "password" && !config.shareSecret) {
367
+ return res.status(503).type("html").send(renderAuthError({ message: "Password sharing is not configured." }));
368
+ }
369
+ const access = await setAccessPolicy({
370
+ accountId: session.accountId,
371
+ draftId: routeParam(req, "draftId"),
372
+ ...mutation
373
+ });
374
+ if (!access)
375
+ return next();
376
+ res.redirect(303, `/dashboard/drafts/${encodeURIComponent(routeParam(req, "draftId"))}`);
377
+ }
378
+ catch (error) {
379
+ res.status(400).type("html").send(renderAuthError({ message: errorMessage(error) }));
380
+ }
381
+ });
382
+ app.post("/dashboard/drafts/:draftId/versions/:versionNumber/access", ...web, accessBody, async (req, res, next) => {
383
+ try {
384
+ const session = await readWebSession(req);
385
+ if (!session)
386
+ return res.type("html").send(renderSignIn({ next: "/dashboard", provider: signInProvider() }));
387
+ const mutation = webAccessMutation(req.body, true);
388
+ if (mutation.mode === "private" && (!config.sessionSecret || !config.publicBaseUrl)) {
389
+ return res.status(503).type("html").send(renderAuthError({ message: "Private sharing requires web sign-in configuration." }));
390
+ }
391
+ if (mutation.mode === "password" && !config.shareSecret) {
392
+ return res.status(503).type("html").send(renderAuthError({ message: "Password sharing is not configured." }));
393
+ }
394
+ const access = await setAccessPolicy({
395
+ accountId: session.accountId,
396
+ draftId: routeParam(req, "draftId"),
397
+ versionNumber: positiveVersion(req.params.versionNumber),
398
+ ...mutation
399
+ });
400
+ if (!access)
401
+ return next();
402
+ res.redirect(303, `/dashboard/drafts/${encodeURIComponent(routeParam(req, "draftId"))}`);
403
+ }
404
+ catch (error) {
405
+ res.status(400).type("html").send(renderAuthError({ message: errorMessage(error) }));
406
+ }
407
+ });
408
+ app.get("/cli/auth", ...web, async (req, res, next) => {
409
+ try {
410
+ const session = await readWebSession(req);
411
+ if (!session) {
412
+ return res.type("html").send(renderSignIn({ next: "/cli/auth", provider: signInProvider() }));
413
+ }
414
+ res.type("html").send(renderCliAuth({
415
+ session,
416
+ keys: await listAccountApiKeys(session.accountId),
417
+ isAdmin: await isAdminAccount(session.accountId)
418
+ }));
419
+ }
420
+ catch (error) {
421
+ next(error);
422
+ }
423
+ });
424
+ // Mints a fresh named key for the signed-in account and shows it once.
425
+ // POST + SameSite=Lax session cookie keeps cross-site requests out.
426
+ app.post("/cli/auth/keys", ...web, keyMintRateLimit, async (req, res, next) => {
427
+ try {
428
+ const session = await readWebSession(req);
429
+ if (!session) {
430
+ return res.type("html").send(renderSignIn({ next: "/cli/auth", provider: signInProvider() }));
431
+ }
432
+ const token = `op_${randomToken(32)}`;
433
+ const keyName = `CLI · ${new Date().toISOString().slice(0, 10)}`;
434
+ await pool.query("INSERT INTO api_keys (id, account_id, name, key_hash) VALUES ($1, $2, $3, $4)", [newInternalId(), session.accountId, keyName, sha256(token)]);
435
+ res.type("html").send(renderCliAuthKey({
436
+ session,
437
+ token,
438
+ keyName,
439
+ isAdmin: await isAdminAccount(session.accountId)
440
+ }));
441
+ }
442
+ catch (error) {
443
+ next(error);
444
+ }
445
+ });
446
+ app.post("/cli/auth/keys/:apiKeyId/revoke", ...web, async (req, res, next) => {
447
+ try {
448
+ const session = await readWebSession(req);
449
+ if (!session) {
450
+ return res.type("html").send(renderSignIn({ next: "/cli/auth", provider: signInProvider() }));
451
+ }
452
+ await revokeApiKey(session.accountId, routeParam(req, "apiKeyId"));
453
+ res.redirect("/cli/auth");
454
+ }
455
+ catch (error) {
456
+ next(error);
457
+ }
458
+ });
459
+ }
460
+ async function listAccountApiKeys(accountId) {
461
+ const result = await pool.query(`
462
+ SELECT id, name, created_at, last_used_at
463
+ FROM api_keys
464
+ WHERE account_id = $1 AND revoked_at IS NULL
465
+ ORDER BY created_at DESC
466
+ `, [accountId]);
467
+ return result.rows;
468
+ }
469
+ function webAccessMutation(body, allowInherit) {
470
+ if (!body || typeof body !== "object")
471
+ throw new Error("Invalid access policy form.");
472
+ const input = body;
473
+ if (allowInherit && input.mode === "inherit")
474
+ return { inherit: true };
475
+ if (input.mode !== "private" && input.mode !== "password" && input.mode !== "public") {
476
+ throw new Error("Select a valid access mode.");
477
+ }
478
+ const password = typeof input.password === "string" && input.password ? input.password : undefined;
479
+ if (input.mode === "password" && (!password || password.length < 8 || password.length > 512)) {
480
+ throw new Error("Password must be between 8 and 512 characters.");
481
+ }
482
+ return password === undefined ? { mode: input.mode } : { mode: input.mode, password };
483
+ }
484
+ function positiveVersion(value) {
485
+ const parsed = Number(value);
486
+ if (!Number.isInteger(parsed) || parsed < 1)
487
+ throw new Error("Invalid version number.");
488
+ return parsed;
489
+ }
490
+ function signInProvider() {
491
+ return browserAuthProvider();
492
+ }
493
+ // Web sign-in needs a session secret and a configured public base URL (the
494
+ // redirect_uri must be a stable, exact string — never request-derived).
495
+ const requireConfigured = (_req, res, next) => {
496
+ if (!config.sessionSecret || !config.publicBaseUrl) {
497
+ return res
498
+ .status(503)
499
+ .type("html")
500
+ .send(renderAuthError({
501
+ message: "Web sign-in is not configured on this deployment (OPENPLAN_SESSION_SECRET / OPENPLAN_PUBLIC_BASE_URL)."
502
+ }));
503
+ }
504
+ try {
505
+ assertBrowserAuthConfigured();
506
+ }
507
+ catch {
508
+ return res.status(503).type("html").send(renderAuthError({ message: "Browser identity provider is not configured on this deployment." }));
509
+ }
510
+ next();
511
+ };
512
+ const onlyApex = (req, res, next) => {
513
+ const draftId = getDraftIdFromHost({
514
+ publicBaseUrl: config.publicBaseUrl,
515
+ host: req.hostname || req.get("host")
516
+ });
517
+ if (draftId)
518
+ return next("route");
519
+ res.setHeader("Referrer-Policy", APPLICATION_REFERRER_POLICY);
520
+ next();
521
+ };
522
+ function webOrigin() {
523
+ return getHomeUrl({ publicBaseUrl: config.publicBaseUrl, requestBaseUrl: "" });
524
+ }
525
+ function callbackUrl() {
526
+ return `${webOrigin()}/auth/callback`;
527
+ }
528
+ function claimText(value) {
529
+ if (typeof value !== "string")
530
+ return null;
531
+ const trimmed = value.trim();
532
+ return trimmed || null;
533
+ }
534
+ function routeParam(req, name) {
535
+ const value = req.params[name];
536
+ return Array.isArray(value) ? value[0] ?? "" : value ?? "";
537
+ }
538
+ function errorMessage(error) {
539
+ return error instanceof Error ? error.message : String(error);
540
+ }
541
+ const requireSameOrigin = (req, res, next) => {
542
+ if (["GET", "HEAD", "OPTIONS"].includes(req.method))
543
+ return next();
544
+ if (!isSameOriginMutation(req.get("origin"), req.get("referer"), req.get("sec-fetch-site"), webOrigin())) {
545
+ res.status(403).json({ ok: false, error: "A same-origin browser request is required." });
546
+ return;
547
+ }
548
+ next();
549
+ };
550
+ //# sourceMappingURL=web.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5G,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,WAAW,EACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,cAAc,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EAClC,MAAM,uBAAuB,CAAC;AAE/B,mFAAmF;AACnF,+EAA+E;AAC/E,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,GAAgB;IAChD,MAAM,GAAG,GAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;QACzC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,SAAS,CAAC;QACxE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;QACtD,SAAS,EAAE,UAAU;QACrB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW;KAC1E,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;QAC5C,QAAQ,EAAE,EAAE,GAAG,MAAM;QACrB,GAAG,EAAE,EAAE;QACP,SAAS,EAAE,aAAa;QACxB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW;KAC3C,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,mBAAmB,EAAE,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClC,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,mBAAmB,EAAE,KAAK,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC5D,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC;oBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;oBAChE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM;oBACxD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;iBAC1C,CAAC,CAAC,CAAC;gBACJ,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,MAAM,CACR,YAAY,EACZ,qBAAqB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CACvE,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,mBAAmB,EAAE,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,GAAG,EACH,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAC/D,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAChE,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;oBACpD,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,qEAAqE;iBAC7E,CAAC,CAAC,CAAC;YACN,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,OAAO;gBACrB,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC,CAAC;YACJ,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;gBAC7C,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzD,IAAI,mBAAmB,EAAE,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAEjD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;YAClC,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACzE,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,MAAM,CAAC;qBACZ,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;YACvC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;gBACvC,IAAI,SAAS,CAAC,YAAY,KAAK,MAAM,IAAI,SAAS,CAAC,WAAW,KAAK,kBAAkB,CAAC,QAAQ,CAAC;uBAC1F,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;oBAC7D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC,CAAC;gBACzH,CAAC;gBACD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC,CAAC;gBAC3I,CAAC;gBACD,IAAI,QAAQ,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;oBAC3C,WAAW,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,MAAM,CAAC;oBAC/E,QAAQ,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE;wBACxD,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK;qBAC7E,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAC;gBAC1H,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;oBACnD,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1F,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC,EAAE,GAAG,OAAO;oBACvD,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;iBAChE,CAAC,CAAC,CAAC;gBACJ,OAAO,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,SAAS,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC9E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC,CAAC;YACzH,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC,CAAC;YAC3I,CAAC;YACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtC,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,MAAM,CAAC;qBACZ,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,wBAAwB;YACxB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;oBAChC,IAAI;oBACJ,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,WAAW,EAAE,WAAW,EAAE;iBAC3B,CAAC,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3D,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,MAAM,CAAC;qBACZ,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,MAAM,CAAC,YAAY;gBAC5B,gEAAgE;gBAChE,kEAAkE;gBAClE,+DAA+D;gBAC/D,OAAO,EAAE;oBACP,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC9B,aAAa,EAAE,OAAO,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;oBACxF,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;oBACnC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;oBACrC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;iBACtC;aACF,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE;gBACxD,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAClH,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,iCAAiC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBACxC,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,mBAAmB,EAAE,KAAK,OAAO;aAC9C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,2CAA2C,EAC3C,GAAG,GAAG,EACN,UAAU,EACV,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAClH,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;YAC7C,MAAM,iCAAiC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvD,IAAI,mBAAmB,EAAE,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACtG,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,mBAAmB,EAAE,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACtG,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC5D,MAAM,eAAe,CAAC;gBACpB,QAAQ,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;gBACzE,QAAQ,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;gBACzE,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC1E,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;oBACvC,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;aACtC,CAAC,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACtG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACjD,OAAO;gBACP,KAAK,EAAE,MAAM,cAAc,EAAE;gBAC7B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YACpH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBAC1C,OAAO;gBACP,KAAK,EAAE,mBAAmB,EAAE,KAAK,OAAO;gBACxC,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;aACjD,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzE,IAAI,mBAAmB,EAAE,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3G,MAAM,mBAAmB,CAAC;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;gBAC9F,WAAW,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;aACnF,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;gBACjC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3G,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBACtD,OAAO;gBACP,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;gBAC1B,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;aACjD,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE;gBAC9F,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;aACvC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3F,MAAM,WAAW,GAAG,MAAM,iCAAiC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACnB,iBAAiB,CAAC;gBAChB,OAAO;gBACP,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,kBAAkB,EAAE,WAAW,CAAC,OAAO;gBACvC,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC,CAAC;YAChI,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;gBACnC,GAAG,QAAQ;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjH,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBACpF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC,CAAC;YAChI,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;gBACnC,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;gBACxD,GAAG,QAAQ;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACnB,aAAa,CAAC;gBACZ,OAAO;gBACP,IAAI,EAAE,MAAM,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC;gBACjD,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;aACjD,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,oEAAoE;IACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,KAAK,CACd,+EAA+E,EAC/E,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAC7D,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACnB,gBAAgB,CAAC;gBACf,OAAO;gBACP,KAAK;gBACL,OAAO;gBACP,OAAO,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;aACjD,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;KAKC,EACD,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAa,EACb,YAAqB;IAErB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,IAA+B,CAAC;IAC9C,IAAI,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,mBAAmB,EAAE,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,MAAM,iBAAiB,GAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,OAAO,GAAG;aACP,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CACH,eAAe,CAAC;YACd,OAAO,EACL,wGAAwG;SAC3G,CAAC,CACH,CAAC;IACN,CAAC;IACD,IAAI,CAAC;QACH,2BAA2B,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAClD,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF,SAAS,SAAS;IAChB,OAAO,UAAU,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,GAAG,SAAS,EAAE,gBAAgB,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAGD,SAAS,UAAU,CAAC,GAAY,EAAE,IAAY;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,iBAAiB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAC3D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}