@knpkv/codecommit-web 0.17.0 → 0.19.0

package/dist/server/internal/OwnerSessionSecurity.js

@@ -1,220 +0,0 @@
-import { credentialValuesEqual, decideOneTimeCredential, expiresAt, issueCsrfToken, issuePairingCode, issueSessionToken, serializeCredentialCookie } from "@knpkv/browser-pairing";
-import { Clock, Context, Effect, Layer, Redacted, Ref, Schema } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
-import { ForbiddenApiError, OwnerSessionAuth, UnauthorizedApiError } from "../Api.js";
-export class OwnerSessionSecrets extends Context.Service()("@knpkv/codecommit-web/OwnerSessionSecrets") {
-}
-export class UnsafeServerHostnameError extends Schema.TaggedError()("UnsafeServerHostnameError", { hostname: Schema.String, message: Schema.String }) {
-}
-const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
-const MAX_BOOTSTRAP_FAILURES = 5;
-const authenticatedDevPublicOrigin = "http://localhost:5173";
-export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
-export const requireLoopbackHostname = Effect.fn("OwnerSessionSecurity.requireLoopbackHostname")(function* (hostname) {
-    if (!isLoopbackHostname(hostname)) {
-        return yield* new UnsafeServerHostnameError({
-            hostname,
-            message: "CodeCommit web may only listen on a loopback hostname"
-        });
-    }
-    return hostname;
-});
-export const makeOwnerSessionSecrets = Effect.fn("OwnerSessionSecurity.makeSecrets")(function* (authorityOrigin) {
-    const validatedAuthorityOrigin = yield* requireLoopbackOrigin(authorityOrigin);
-    const [ownerToken, csrfToken, bootstrapToken] = yield* Effect.all([
-        issueSessionToken(),
-        issueCsrfToken(),
-        issuePairingCode()
-    ]);
-    const bootstrapAvailable = yield* Ref.make(true);
-    const bootstrapAttemptState = yield* Ref.make({ failedAttempts: 0, inFlight: 0 });
-    return OwnerSessionSecrets.of({
-        authorityOrigin: validatedAuthorityOrigin,
-        ownerToken,
-        csrfToken,
-        bootstrapToken,
-        bootstrapAvailable,
-        bootstrapAttemptState,
-        bootstrapExpiresAtMillis: yield* Ref.make(undefined)
-    });
-});
-export const activateOwnerSessionBootstrap = Effect.fn("OwnerSessionSecurity.activateBootstrap")(function* (secrets) {
-    const now = yield* Clock.currentTimeMillis;
-    const expiry = yield* expiresAt(now, 60_000);
-    yield* Ref.set(secrets.bootstrapExpiresAtMillis, expiry);
-});
-export const ownerSessionOrigin = (hostname, port) => {
-    const urlHostname = hostname === "::1" ? "[::1]" : hostname;
-    return `http://${urlHostname}:${port}/`;
-};
-export const ownerSessionUrl = (hostname, port, secrets) => ownerSessionUrlForOrigin(ownerSessionOrigin(hostname, port), secrets);
-export const ownerSessionUrlForOrigin = (origin, secrets) => {
-    const bootstrapToken = encodeURIComponent(Redacted.value(secrets.bootstrapToken));
-    return `${origin.replace(/\/+$/u, "")}/#bootstrap_token=${bootstrapToken}`;
-};
-export const requireLoopbackOrigin = Effect.fn("OwnerSessionSecurity.requireLoopbackOrigin")(function* (origin) {
-    const url = yield* Effect.try({
-        try: () => new URL(origin),
-        catch: () => new UnsafeServerHostnameError({
-            hostname: origin,
-            message: "CodeCommit public origin must be a valid loopback HTTP origin"
-        })
-    });
-    if (url.protocol !== "http:" ||
-        !isLoopbackHostname(url.hostname) ||
-        url.pathname !== "/" ||
-        url.search !== "" ||
-        url.hash !== "") {
-        return yield* new UnsafeServerHostnameError({
-            hostname: origin,
-            message: "CodeCommit public origin must be an HTTP loopback origin without a path, query, or fragment"
-        });
-    }
-    return url.origin;
-});
-/** Validate the advertised origin against either the bound server or the supported Vite proxy. */
-export const requireSupportedPublicOrigin = Effect.fn("OwnerSessionSecurity.requireSupportedPublicOrigin")(function* (origin, authorityOrigin) {
-    const validatedOrigin = yield* requireLoopbackOrigin(origin);
-    const validatedAuthority = yield* requireLoopbackOrigin(authorityOrigin);
-    const authorityUrl = new URL(validatedAuthority);
-    const isSupportedProxy = validatedOrigin === authenticatedDevPublicOrigin &&
-        authorityUrl.protocol === "http:" && authorityUrl.hostname === "127.0.0.1";
-    if (validatedOrigin !== validatedAuthority && !isSupportedProxy) {
-        return yield* new UnsafeServerHostnameError({
-            hostname: origin,
-            message: "CodeCommit public origin must be the bound server or its supported Vite proxy"
-        });
-    }
-    return validatedOrigin;
-});
-export const resolvePublicOrigin = Effect.fn("OwnerSessionSecurity.resolvePublicOrigin")(function* (configuredOrigin, authorityOrigin) {
-    return configuredOrigin === undefined
-        ? yield* requireLoopbackOrigin(authorityOrigin)
-        : yield* requireSupportedPublicOrigin(configuredOrigin, authorityOrigin);
-});
-export const ownerSessionCookie = (secrets) => serializeCredentialCookie(secrets.ownerToken, {
-    name: "cc_owner",
-    httpOnly: true,
-    path: "/api",
-    sameSite: "strict",
-    secure: false
-});
-export const authorizeOwnerRequest = Effect.fn("OwnerSessionSecurity.authorizeRequest")(function* (request, secrets) {
-    const ownerCredentialMatches = credentialValuesEqual(request.credential, Redacted.value(secrets.ownerToken)) === true;
-    if (!ownerCredentialMatches) {
-        return yield* new UnauthorizedApiError({ message: "Missing or invalid owner session" });
-    }
-    const sameOrigin = request.origin !== undefined && request.origin === secrets.authorityOrigin;
-    if (request.origin !== undefined && !sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Request origin does not match the CodeCommit server" });
-    }
-    // Safe reads intentionally allow non-browser callers without Origin or CSRF
-    // headers; every read still requires the process-scoped owner credential.
-    if (safeMethods.has(request.method.toUpperCase()))
-        return;
-    if (!sameOrigin) {
-        return yield* new ForbiddenApiError({ message: "Mutation origin does not match the CodeCommit server" });
-    }
-    const csrfTokenMatches = request.csrfToken !== undefined &&
-        credentialValuesEqual(request.csrfToken, Redacted.value(secrets.csrfToken)) === true;
-    if (!csrfTokenMatches) {
-        return yield* new ForbiddenApiError({ message: "Missing or invalid CSRF token" });
-    }
-});
-export const authorizeBootstrapRequest = Effect.fn("OwnerSessionSecurity.authorizeBootstrap")(function* (request, secrets) {
-    if (request.origin !== secrets.authorityOrigin) {
-        return yield* new ForbiddenApiError({ message: "Bootstrap origin does not match the CodeCommit server" });
-    }
-    const suppliedToken = request.authorization !== undefined && request.authorization.startsWith("Bearer ")
-        ? request.authorization.slice("Bearer ".length)
-        : undefined;
-    const acquireAdmission = Ref.modify(secrets.bootstrapAttemptState, (state) => {
-        if (state.failedAttempts + state.inFlight >= MAX_BOOTSTRAP_FAILURES) {
-            return ["unavailable", state];
-        }
-        const bootstrapTokenMatches = suppliedToken !== undefined &&
-            credentialValuesEqual(suppliedToken, Redacted.value(secrets.bootstrapToken)) === true;
-        if (!bootstrapTokenMatches) {
-            return ["invalid", {
-                    failedAttempts: Math.min(MAX_BOOTSTRAP_FAILURES, state.failedAttempts + 1),
-                    inFlight: state.inFlight
-                }];
-        }
-        return ["accepted", { ...state, inFlight: state.inFlight + 1 }];
-    }).pipe(Effect.flatMap((admission) => {
-        if (admission === "unavailable") {
-            return Effect.fail(new UnauthorizedApiError({ message: "Bootstrap confirmation temporarily unavailable" }));
-        }
-        if (admission === "invalid") {
-            return Effect.fail(new UnauthorizedApiError({ message: "Missing or invalid bootstrap token" }));
-        }
-        return Effect.void;
-    }));
-    return yield* Effect.acquireUseRelease(acquireAdmission, () => Effect.gen(function* () {
-        const expiresAt = yield* Ref.get(secrets.bootstrapExpiresAtMillis);
-        if (expiresAt === undefined) {
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token is not active" });
-        }
-        const now = yield* Clock.currentTimeMillis;
-        const decision = yield* Ref.modify(secrets.bootstrapAvailable, (available) => {
-            const state = {
-                expiresAt,
-                consumedAt: available ? null : 0,
-                revokedAt: null
-            };
-            const next = decideOneTimeCredential(state, now);
-            return [next, next === "accepted" ? false : available];
-        });
-        if (decision === "expired")
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token has expired" });
-        if (decision === "consumed") {
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token has already been used" });
-        }
-        if (decision === "invalid") {
-            return yield* new UnauthorizedApiError({ message: "Bootstrap token state is invalid" });
-        }
-    }), () => Ref.update(secrets.bootstrapAttemptState, (state) => ({
-        ...state,
-        inFlight: Math.max(0, state.inFlight - 1)
-    })));
-});
-export const ownerSessionAuthLayer = Layer.effect(OwnerSessionAuth, Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
-    return OwnerSessionAuth.of({
-        ownerCookie: Effect.fn("OwnerSessionSecurity.ownerCookie")(function* (httpEffect, { credential }) {
-            const request = yield* HttpServerRequest.HttpServerRequest;
-            yield* authorizeOwnerRequest({
-                credential: Redacted.value(credential),
-                csrfToken: request.headers["x-csrf-token"],
-                host: request.headers.host,
-                method: request.method,
-                origin: request.headers.origin
-            }, secrets);
-            return yield* httpEffect;
-        })
-    });
-}));
-export const OwnerSessionBootstrapRouter = HttpRouter.use((router) => router.add("POST", "/auth/bootstrap", Effect.gen(function* () {
-    const secrets = yield* OwnerSessionSecrets;
-    const request = yield* HttpServerRequest.HttpServerRequest;
-    const authorization = authorizeBootstrapRequest({
-        authorization: request.headers.authorization,
-        host: request.headers.host,
-        origin: request.headers.origin
-    }, secrets);
-    const result = yield* Effect.result(authorization);
-    if (result._tag === "Failure") {
-        const error = result.failure;
-        return HttpServerResponse.text(error.message, {
-            status: error._tag === "UnauthorizedApiError" ? 401 : 403
-        });
-    }
-    return yield* HttpServerResponse.json({ csrfToken: Redacted.value(secrets.csrfToken) }, {
-        status: 200,
-        headers: {
-            "cache-control": "no-store",
-            "set-cookie": ownerSessionCookie(secrets)
-        }
-    });
-})));
-//# sourceMappingURL=OwnerSessionSecurity.js.map

package/dist/server/internal/OwnerSessionSecurity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"OwnerSessionSecurity.js","sourceRoot":"","sources":["../../../src/server/internal/OwnerSessionSecurity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAkBrF,MAAM,OAAO,mBAAoB,SAAQ,OAAO,CAAC,OAAO,EAGrD,CAAC,2CAA2C,CAAC;CAAG;AAEnD,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACpD;CAAG;AAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AACvD,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAChC,MAAM,4BAA4B,GAAG,uBAAuB,CAAA;AAG5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,8CAA8C,CAAC,CAC9F,QAAQ,CAAC,EAAC,QAAgB;IACxB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ;YACR,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAClF,QAAQ,CAAC,EAAC,eAAuB;IAC/B,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC9E,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChE,iBAAiB,EAAE;QACnB,cAAc,EAAE;QAChB,gBAAgB,EAAE;KACnB,CAAC,CAAA;IACF,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwB,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IACxG,OAAO,mBAAmB,CAAC,EAAE,CAAC;QAC5B,eAAe,EAAE,wBAAwB;QACzC,UAAU;QACV,SAAS;QACT,cAAc;QACd,kBAAkB;QAClB,qBAAqB;QACrB,wBAAwB,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAqB,SAAS,CAAC;KACzE,CAAC,CAAA;AACJ,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CAC9F,QAAQ,CAAC,EAAC,OAAoC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;AAC1D,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE;IAC3E,MAAM,WAAW,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC3D,OAAO,UAAU,WAAW,IAAI,IAAI,GAAG,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,IAAY,EACZ,OAAoC,EAC5B,EAAE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAc,EACd,OAA4D,EACpD,EAAE;IACV,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAA;IACjF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,cAAc,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,4CAA4C,CAAC,CAC1F,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,yBAAyB,CAAC;YAC5B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+DAA+D;SACzE,CAAC;KACL,CAAC,CAAA;IACF,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,EAAE,CAAC,mDAAmD,CAAC,CACxG,QAAQ,CAAC,EAAC,MAAc,EAAE,eAAuB;IAC/C,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAC5D,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAChD,MAAM,gBAAgB,GAAG,eAAe,KAAK,4BAA4B;QACvE,YAAY,CAAC,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,QAAQ,KAAK,WAAW,CAAA;IAC5E,IAAI,eAAe,KAAK,kBAAkB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,CAAC;YAC1C,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,+EAA+E;SACzF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,eAAe,CAAA;AACxB,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,0CAA0C,CAAC,CACtF,QAAQ,CAAC,EAAC,gBAAoC,EAAE,eAAuB;IACrE,OAAO,gBAAgB,KAAK,SAAS;QACnC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC;QAC/C,CAAC,CAAC,KAAK,CAAC,CAAC,4BAA4B,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAA;AAC5E,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAwD,EAChD,EAAE,CACV,yBAAyB,CAAC,OAAO,CAAC,UAAU,EAAE;IAC5C,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,KAAK;CACd,CAAC,CAAA;AAUJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CACrF,QAAQ,CAAC,EAAC,OAAkC,EAAE,OAAoC;IAChF,MAAM,sBAAsB,GAC1B,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAA;IACxF,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,eAAe,CAAA;IAC7F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAM;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS;QACtD,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAA;IACtF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC,CACF,CAAA;AAQD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAAC,yCAAyC,CAAC,CAC3F,QAAQ,CAAC,EAAC,OAA+B,EAAE,OAAoC;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QACtG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,MAAM,CACjC,OAAO,CAAC,qBAAqB,EAC7B,CAAC,KAAK,EAAwD,EAAE;QAC9D,IAAI,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB,EAAE,CAAC;YACpE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,qBAAqB,GAAG,aAAa,KAAK,SAAS;YACvD,qBAAqB,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,CAAA;QACvF,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,CAAC,SAAS,EAAE;oBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;oBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3B,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAA;QACjG,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC,CAAC,CACH,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,gBAAgB,EAChB,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE;YAC3E,MAAM,KAAK,GAAG;gBACZ,SAAS;gBACT,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChC,SAAS,EAAE,IAAI;aAChB,CAAA;YACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAChD,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAC9G,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;QACzF,CAAC;IACH,CAAC,CAAC,EACJ,GAAG,EAAE,CACH,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,KAAK;QACR,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;KAC1C,CAAC,CAAC,CACN,CAAA;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAC/C,gBAAgB,EAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACxD,QAAQ,CAAC,EAAC,UAAU,EAAE,EAAE,UAAU,EAAE;YAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;YAC1D,KAAK,CAAC,CAAC,qBAAqB,CAC1B;gBACE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAC/B,EACD,OAAO,CACR,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAA;QAC1B,CAAC,CACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,GAAG,CACR,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAC7C;QACE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;KAC/B,EACD,OAAO,CACR,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAA;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5C,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAC1D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE;QACtF,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAC1C;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CACF,CAAA"}