@ltm-alpha/alpha-cs 1.6.0

package/dist/ui-server/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/ui-server/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAQ5B,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAAoB,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAuB,CAAC;AAEnE,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAwC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,mBAAmB,CAAC;AAK7C,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACvE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgB9C;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAM7E;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBjF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAalF;AAuBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAwBpF"}

package/dist/ui-server/security.js

@@ -0,0 +1,332 @@
+"use strict";
+/**
+ * The `codegraph ui` server's security boundary.
+ *
+ * Threat model, stated plainly: this process serves a browser-readable view of
+ * the user's SOURCE CODE from a port on their machine. It binds loopback, so
+ * nothing on the network can reach it. That leaves one realistic attack —
+ * **DNS rebinding**: any page the user visits can point `evil.example` at
+ * `127.0.0.1` and then have the browser issue same-origin requests to us. The
+ * browser will happily connect; the only thing that distinguishes the attacker's
+ * request from the viewer's own is the `Host` header, which the browser fills in
+ * from the URL and script cannot forge.
+ *
+ * So the rules are:
+ *
+ * - **`Host` must be a loopback name** (`localhost`, `127.0.0.1`, `[::1]`) and,
+ *   if it carries a port, that port must be ours. Anything else is 403.
+ * - **`Origin`, when present, must be loopback too.** Belt and braces: absent on
+ *   the viewer's own same-origin GETs, and present-and-foreign only on a
+ *   cross-site request we want nothing to do with.
+ * - **No CORS headers, ever.** Not adding `Access-Control-Allow-Origin` is what
+ *   keeps a cross-origin reader from seeing a response body even if it does
+ *   reach us. There is deliberately no way to turn this on.
+ * - **GET/HEAD everywhere; POST/DELETE only under `/api/`, and only for a
+ *   request that could not have been forged by a form.** See
+ *   {@link isWriteRequest} below — the viewer went from a pure reader to one
+ *   that saves trails into `.alpha-cs/ui/`, and that is the entire change to
+ *   this boundary.
+ * - **Every path resolves through {@link validatePathWithinRoot}** — the same
+ *   chokepoint the MCP read sinks use, which catches `../` traversal AND
+ *   in-tree symlinks pointing out of the root (#527).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WRITE_HEADER = exports.ALLOWED_METHODS = exports.WRITE_METHODS = exports.READ_METHODS = exports.PathRefusalError = void 0;
+exports.isWriteMethod = isWriteMethod;
+exports.isWriteRequest = isWriteRequest;
+exports.isAllowedHost = isAllowedHost;
+exports.isAllowedOrigin = isAllowedOrigin;
+exports.isSafeRequestPath = isSafeRequestPath;
+exports.resolveStaticAsset = resolveStaticAsset;
+exports.resolveProjectFile = resolveProjectFile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const errors_1 = require("../errors");
+Object.defineProperty(exports, "PathRefusalError", { enumerable: true, get: function () { return errors_1.PathRefusalError; } });
+const utils_1 = require("../utils");
+/**
+ * Host names that mean "this machine". A browser only ever sends the bracketed
+ * form for IPv6, but the raw form is accepted after brackets are stripped.
+ */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
+/** Methods that answer anywhere: the viewer's assets and every read endpoint. */
+exports.READ_METHODS = ['GET', 'HEAD'];
+/**
+ * Methods that answer under `/api/` only, and only for a request carrying
+ * {@link WRITE_HEADER}. The viewer's one write is a saved trail.
+ */
+exports.WRITE_METHODS = ['POST', 'DELETE'];
+/** HTTP methods the viewer server answers at all. Everything else is 405. */
+exports.ALLOWED_METHODS = [...exports.READ_METHODS, ...exports.WRITE_METHODS];
+/**
+ * The header a write has to carry.
+ *
+ * Belt and braces behind the `Host` and `Origin` checks, and worth the two
+ * lines because it fails *differently*: a custom request header cannot be sent
+ * cross-origin without a CORS preflight, and this server answers no preflight
+ * and sends no `Access-Control-*` header, so the browser never issues the real
+ * request. That closes the one shape those checks lean on a header for — a
+ * `<form method="post">` submitted from another page, which sends no `Origin`
+ * in some older browsers and cannot set a custom header in any of them.
+ */
+exports.WRITE_HEADER = 'x-codegraph-ui';
+/** The content type a write body must declare. A form can send none of these. */
+const WRITE_CONTENT_TYPE = 'application/json';
+function isWriteMethod(method) {
+    return exports.WRITE_METHODS.includes(method);
+}
+/**
+ * Whether a mutating request is one the viewer could have made.
+ *
+ * @param method     the request method, already known to be a write method
+ * @param pathname   the raw request path
+ * @param headers    `x-codegraph-ui` and, for a body-carrying method, `content-type`
+ */
+function isWriteRequest(pathname, headers) {
+    // Writes live under /api/ and nowhere else. The static side of this server
+    // serves a built bundle; there is nothing there to POST to.
+    if (pathname !== '/api' && !pathname.startsWith('/api/')) {
+        return { ok: false, reason: 'Only the /api/ endpoints accept writes.' };
+    }
+    if (headers.marker === undefined || headers.marker.trim() === '') {
+        return { ok: false, reason: `A write must carry the ${exports.WRITE_HEADER} header.` };
+    }
+    if (headers.contentType !== undefined) {
+        const type = headers.contentType.split(';')[0]?.trim().toLowerCase();
+        if (type !== '' && type !== WRITE_CONTENT_TYPE) {
+            return { ok: false, reason: `A write body must be ${WRITE_CONTENT_TYPE}.` };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Split a `Host` header into hostname and port, or `null` if it is malformed.
+ *
+ * An unbracketed IPv6 literal (`::1`) is malformed per RFC 7230 and is rejected
+ * rather than guessed at — no browser produces one, so accepting it would only
+ * widen the parser for an attacker's benefit.
+ */
+function splitHostPort(host) {
+    const trimmed = host.trim();
+    if (!trimmed)
+        return null;
+    if (trimmed.startsWith('[')) {
+        const end = trimmed.indexOf(']');
+        if (end < 0)
+            return null;
+        const port = parsePortSuffix(trimmed.slice(end + 1));
+        if (port === null)
+            return null;
+        return { hostname: trimmed.slice(1, end), port };
+    }
+    const colon = trimmed.indexOf(':');
+    if (colon === -1)
+        return { hostname: trimmed, port: undefined };
+    // A second colon without brackets is a bare IPv6 literal or junk.
+    if (trimmed.indexOf(':', colon + 1) !== -1)
+        return null;
+    const port = parsePortSuffix(trimmed.slice(colon));
+    if (port === null)
+        return null;
+    return { hostname: trimmed.slice(0, colon), port };
+}
+/**
+ * Parse the `:1234` tail of a `Host` header.
+ *
+ * @returns the port, `undefined` for an empty suffix, or `null` when the suffix
+ *   is present but not a plain port number.
+ */
+function parsePortSuffix(suffix) {
+    if (suffix === '')
+        return undefined;
+    if (!suffix.startsWith(':'))
+        return null;
+    const digits = suffix.slice(1);
+    if (!/^\d{1,5}$/.test(digits))
+        return null;
+    const port = Number(digits);
+    return port >= 0 && port <= 65535 ? port : null;
+}
+/**
+ * Whether a request's `Host` header names this loopback server.
+ *
+ * A missing `Host` is rejected: HTTP/1.1 requires it, and the one client that
+ * may legally omit it (HTTP/1.0) is not a browser we need to serve.
+ */
+function isAllowedHost(host, port) {
+    if (typeof host !== 'string')
+        return false;
+    const parts = splitHostPort(host);
+    if (!parts)
+        return false;
+    if (!LOOPBACK_HOSTNAMES.has(parts.hostname.toLowerCase()))
+        return false;
+    return parts.port === undefined || parts.port === port;
+}
+/**
+ * Whether a request's `Origin` header is acceptable.
+ *
+ * An ABSENT `Origin` is allowed — browsers omit it on same-origin GETs, which
+ * is every request the viewer makes. A present one must be loopback-on-our-port;
+ * the literal `null` origin (sandboxed iframe, `file://` page) is refused.
+ */
+function isAllowedOrigin(origin, port) {
+    if (origin === undefined)
+        return true;
+    const trimmed = origin.trim();
+    if (trimmed === '')
+        return true;
+    if (trimmed === 'null')
+        return false;
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return false;
+    // WHATWG keeps IPv6 hostnames bracketed; the allowlist stores them bare.
+    const hostname = url.hostname.replace(/^\[/, '').replace(/\]$/, '').toLowerCase();
+    if (!LOOPBACK_HOSTNAMES.has(hostname))
+        return false;
+    return url.port === '' || Number(url.port) === port;
+}
+/**
+ * Whether a raw request path is worth resolving at all.
+ *
+ * Rejects any `..` segment outright rather than letting containment sort it
+ * out later. Containment WOULD catch it — but the SPA fallback sits behind
+ * containment, so `GET /../../etc/passwd` would otherwise be answered with the
+ * app shell (a 200) instead of the 404 a traversal attempt deserves. Nothing
+ * outside the root leaks either way; this just stops the server from
+ * pretending a hostile path was an ordinary route.
+ *
+ * Takes the RAW path from `req.url`, before WHATWG URL parsing folds `..`
+ * segments away — that folding is what would hide the attempt.
+ */
+function isSafeRequestPath(rawPath) {
+    const decoded = decodePath(rawPath);
+    if (decoded === null)
+        return false;
+    return !decoded.split('/').includes('..');
+}
+/**
+ * Resolve a request path to a file inside the static asset root.
+ *
+ * Returns the absolute path, or `null` for anything that is not a readable file
+ * inside `rootDir` — a traversal attempt, a symlink escape, a directory, a
+ * missing file. Callers turn `null` into a 404 (never a 403): telling a prober
+ * which of those it hit is free information.
+ *
+ * Percent-decoding happens HERE, before containment is checked, so an encoded
+ * `..%2f` is caught by the same guard as a literal `../`.
+ */
+function resolveStaticAsset(rootDir, urlPath) {
+    const decoded = decodePath(urlPath);
+    if (decoded === null)
+        return null;
+    const relative = decoded.replace(/^\/+/, '');
+    const absolute = (0, utils_1.validatePathWithinRoot)(rootDir, relative);
+    if (!absolute)
+        return null;
+    try {
+        return fs.statSync(absolute).isFile() ? absolute : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Percent-decode a URL path and reject the encodings that only ever show up in
+ * an attack: NUL (truncates a path in some syscalls), other C0 control bytes,
+ * and backslashes (a separator on Windows, a legal filename character on POSIX
+ * — treating it as a separator everywhere is the safe direction, and no built
+ * asset name contains one).
+ *
+ * @returns the decoded path, or `null` if it is unusable.
+ */
+function decodePath(urlPath) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(urlPath);
+    }
+    catch {
+        return null; // malformed percent-encoding
+    }
+    // eslint-disable-next-line no-control-regex -- rejecting raw control bytes IS the point
+    if (/[\x00-\x1f\x7f\\]/.test(decoded))
+        return null;
+    return decoded;
+}
+/**
+ * Resolve a project-relative source path to an absolute path that is safe to
+ * read and hand to the browser.
+ *
+ * This is the single read chokepoint for anything served OUT OF THE USER'S
+ * REPOSITORY (as opposed to the viewer's own bundled assets). The JSON API
+ * built on top of this server must route every file read through it — that is
+ * what keeps `/api/source?path=../../.ssh/id_rsa` from being a credential leak
+ * over a port the user opened to read their own code.
+ *
+ * @throws {PathRefusalError} when the root is a sensitive system directory, or
+ *   the path escapes the root by traversal or symlink.
+ */
+function resolveProjectFile(projectRoot, relativePath) {
+    if (typeof relativePath !== 'string' || relativePath.trim() === '') {
+        throw new errors_1.PathRefusalError('No file path was given.');
+    }
+    const decoded = decodePath(relativePath);
+    if (decoded === null) {
+        throw new errors_1.PathRefusalError(`Refusing to read an unusable path: ${relativePath}`);
+    }
+    // Sensitive-directory refusal, same list the MCP entry points use. Checked on
+    // the ROOT rather than the leaf: a root of `/etc` makes every path under it
+    // sensitive, and a leaf check would have to enumerate the world.
+    const rootError = (0, utils_1.validateProjectPath)(projectRoot);
+    if (rootError)
+        throw new errors_1.PathRefusalError(rootError);
+    if (path.isAbsolute(decoded)) {
+        throw new errors_1.PathRefusalError(`Refusing to read an absolute path: ${decoded}`);
+    }
+    const absolute = (0, utils_1.validatePathWithinRoot)(projectRoot, decoded);
+    if (!absolute) {
+        throw new errors_1.PathRefusalError(`Refusing to read a path outside the project: ${decoded}`);
+    }
+    return absolute;
+}
+//# sourceMappingURL=security.js.map

package/dist/ui-server/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/ui-server/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CH,sCAEC;AASD,wCAmBC;AAyDD,sCAMC;AASD,0CAiBC;AAeD,8CAIC;AAaD,gDAaC;AAoCD,gDAwBC;AAzQD,uCAAyB;AACzB,2CAA6B;AAC7B,sCAA6C;AAGpC,iGAHA,yBAAgB,OAGA;AAFzB,oCAAuE;AAIvE;;;GAGG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3F,iFAAiF;AACpE,QAAA,YAAY,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAE/D;;;GAGG;AACU,QAAA,aAAa,GAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEnE,6EAA6E;AAChE,QAAA,eAAe,GAAsB,CAAC,GAAG,oBAAY,EAAE,GAAG,qBAAa,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACU,QAAA,YAAY,GAAG,gBAAgB,CAAC;AAE7C,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C,SAAgB,aAAa,CAAC,MAAc;IAC1C,OAAO,qBAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,OAAwE;IAExE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,oBAAY,UAAU,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrE,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,kBAAkB,GAAG,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAQD;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAChE,kEAAkE;IAClE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,IAAwB,EAAE,IAAY;IAClE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,MAA0B,EAAE,IAAY;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAAC,OAAe,EAAE,OAAe;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC5C,CAAC;IACD,wFAAwF;IACxF,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAAC,WAAmB,EAAE,YAAoB;IAC1E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,yBAAgB,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAgB,CAAC,sCAAsC,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAA,2BAAmB,EAAC,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS;QAAE,MAAM,IAAI,yBAAgB,CAAC,SAAS,CAAC,CAAC;IAErD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAgB,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,yBAAgB,CAAC,gDAAgD,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/ui-server/static.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Static file serving for the viewer's own bundle (`dist/viewer/`).
+ *
+ * Deliberately small: a MIME table, a stream, and the SPA fallback. Everything
+ * that decides WHETHER a path may be read lives in `security.ts`.
+ */
+import type { ServerResponse } from 'http';
+/** The content type to send for a file, by extension. */
+export declare function contentTypeFor(filePath: string): string;
+/**
+ * Cache policy.
+ *
+ * Vite content-hashes everything under `assets/`, so those are immutable for a
+ * year — a reload of the viewer refetches nothing, and an upgraded Alpha Code Sense
+ * changes the hash and therefore the URL. `index.html` names those hashes, so
+ * it must never be cached.
+ */
+export declare function cacheControlFor(relativePath: string): string;
+/**
+ * Stream a file as the response body.
+ *
+ * `HEAD` gets identical headers and no body — it is a GET whose body the client
+ * asked us to skip, which keeps it read-only by construction.
+ */
+export declare function sendFile(res: ServerResponse, absolutePath: string, options: {
+    rootDir: string;
+    method: string;
+    extraHeaders?: Record<string, string>;
+}): void;
+/** Send a plain-text status response (the error path for a browser or curl). */
+export declare function sendText(res: ServerResponse, status: number, message: string, method: string): void;
+/** Send a JSON response. Used for `/api/*`, which must never get HTML back. */
+export declare function sendJson(res: ServerResponse, status: number, payload: unknown, method: string): void;
+/**
+ * Whether a request path should fall back to `index.html` when no file matches.
+ *
+ * The viewer is hash-routed (`/#/s/<id>`), so in practice only `/` is ever
+ * requested — but a bookmarked or hand-typed `/anything` should still open the
+ * app rather than a 404 page. A path that names a FILE (has an extension) never
+ * falls back: answering `/assets/index-abc123.js` with HTML would hand the
+ * browser a script that is not a script, and hide a genuinely missing asset
+ * behind a page that looks like it loaded.
+ */
+export declare function shouldFallBackToIndex(pathname: string): boolean;
+//# sourceMappingURL=static.d.ts.map

package/dist/ui-server/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/ui-server/static.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAgC3C,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAClF,IAAI,CA+BN;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQnG;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQpG;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D"}

package/dist/ui-server/static.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Static file serving for the viewer's own bundle (`dist/viewer/`).
+ *
+ * Deliberately small: a MIME table, a stream, and the SPA fallback. Everything
+ * that decides WHETHER a path may be read lives in `security.ts`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contentTypeFor = contentTypeFor;
+exports.cacheControlFor = cacheControlFor;
+exports.sendFile = sendFile;
+exports.sendText = sendText;
+exports.sendJson = sendJson;
+exports.shouldFallBackToIndex = shouldFallBackToIndex;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Content types for everything the Vite build emits, plus the handful of things
+ * a future viewer asset might be. Unknown extensions fall back to
+ * `application/octet-stream`, which — with `X-Content-Type-Options: nosniff` —
+ * a browser will download rather than execute.
+ */
+const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.txt': 'text/plain; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.avif': 'image/avif',
+    '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.otf': 'font/otf',
+    '.wasm': 'application/wasm',
+};
+/** The content type to send for a file, by extension. */
+function contentTypeFor(filePath) {
+    return CONTENT_TYPES[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';
+}
+/**
+ * Cache policy.
+ *
+ * Vite content-hashes everything under `assets/`, so those are immutable for a
+ * year — a reload of the viewer refetches nothing, and an upgraded Alpha Code Sense
+ * changes the hash and therefore the URL. `index.html` names those hashes, so
+ * it must never be cached.
+ */
+function cacheControlFor(relativePath) {
+    const normalized = relativePath.split(path.sep).join('/');
+    return normalized.startsWith('assets/')
+        ? 'public, max-age=31536000, immutable'
+        : 'no-store';
+}
+/**
+ * Stream a file as the response body.
+ *
+ * `HEAD` gets identical headers and no body — it is a GET whose body the client
+ * asked us to skip, which keeps it read-only by construction.
+ */
+function sendFile(res, absolutePath, options) {
+    let stats;
+    try {
+        stats = fs.statSync(absolutePath);
+    }
+    catch {
+        sendText(res, 404, 'Not found', options.method);
+        return;
+    }
+    const relative = path.relative(options.rootDir, absolutePath);
+    res.writeHead(200, {
+        'Content-Type': contentTypeFor(absolutePath),
+        'Content-Length': String(stats.size),
+        'Cache-Control': cacheControlFor(relative),
+        'Last-Modified': stats.mtime.toUTCString(),
+        ...options.extraHeaders,
+    });
+    if (options.method === 'HEAD') {
+        res.end();
+        return;
+    }
+    const stream = fs.createReadStream(absolutePath);
+    stream.on('error', () => {
+        // Headers are already out, so there is no status left to change: drop the
+        // connection so the client sees a truncated body rather than a silent lie.
+        res.destroy();
+    });
+    res.on('close', () => stream.destroy());
+    stream.pipe(res);
+}
+/** Send a plain-text status response (the error path for a browser or curl). */
+function sendText(res, status, message, method) {
+    const body = Buffer.from(message.endsWith('\n') ? message : `${message}\n`, 'utf-8');
+    res.writeHead(status, {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Content-Length': String(body.byteLength),
+        'Cache-Control': 'no-store',
+    });
+    res.end(method === 'HEAD' ? undefined : body);
+}
+/** Send a JSON response. Used for `/api/*`, which must never get HTML back. */
+function sendJson(res, status, payload, method) {
+    const body = Buffer.from(JSON.stringify(payload), 'utf-8');
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': String(body.byteLength),
+        'Cache-Control': 'no-store',
+    });
+    res.end(method === 'HEAD' ? undefined : body);
+}
+/**
+ * Whether a request path should fall back to `index.html` when no file matches.
+ *
+ * The viewer is hash-routed (`/#/s/<id>`), so in practice only `/` is ever
+ * requested — but a bookmarked or hand-typed `/anything` should still open the
+ * app rather than a 404 page. A path that names a FILE (has an extension) never
+ * falls back: answering `/assets/index-abc123.js` with HTML would hand the
+ * browser a script that is not a script, and hide a genuinely missing asset
+ * behind a page that looks like it loaded.
+ */
+function shouldFallBackToIndex(pathname) {
+    return path.extname(pathname) === '';
+}
+//# sourceMappingURL=static.js.map

package/dist/ui-server/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/ui-server/static.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCH,wCAEC;AAUD,0CAKC;AAQD,4BAmCC;AAGD,4BAQC;AAGD,4BAQC;AAYD,sDAEC;AAlID,uCAAyB;AAEzB,2CAA6B;AAE7B;;;;;GAKG;AACH,MAAM,aAAa,GAAqC;IACtD,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,gCAAgC;IACxC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,iCAAiC;IACzC,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,kBAAkB;CAC5B,CAAC;AAEF,yDAAyD;AACzD,SAAgB,cAAc,CAAC,QAAgB;IAC7C,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,YAAoB;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACrC,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CACtB,GAAmB,EACnB,YAAoB,EACpB,OAAmF;IAEnF,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,cAAc,CAAC,YAAY,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,eAAe,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC1C,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;QAC1C,GAAG,OAAO,CAAC,YAAY;KACxB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,0EAA0E;QAC1E,2EAA2E;QAC3E,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,SAAgB,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe,EAAE,MAAc;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,EAAE,OAAO,CAAC,CAAC;IACrF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,2BAA2B;QAC3C,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACzC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAgB,EAAE,MAAc;IAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACzC,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;AACvC,CAAC"}