@maudecode/talaria-web 0.0.0

package/dist/app.js

@@ -0,0 +1,453 @@
+import { gzipSync } from 'node:zlib';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { ORPCError } from '@orpc/server';
+import { OpenAPIHandler } from '@orpc/openapi/node';
+import { sessionsRouter } from './api/sessions-router.js';
+import { gitRouter } from './api/git-router.js';
+import { RAW_GET_ROUTES, RAW_POST_ROUTES, runRaw } from './api/raw-routes.js';
+import { chatRouter } from './api/chat-router.js';
+import { settingsRouter } from './api/settings-router.js';
+import { toolsRouter } from './api/tools-router.js';
+import { automationRouter } from './api/automation-router.js';
+import { handleExtensionSidecarProxy, handleExtensionStatic, handleKanbanEventsStream, handleTerminalOutput, matchSidecarProxy } from './api/automation-raw.js';
+import { handleApprovalStream, handleChatStream, handleClarifyStream, handleSessionEvents, handleSessionJournalStream, handleSessionStream, sessionEventsPathSessionId } from './api/sse-routes.js';
+import { BodyError, RequestContext, acceptsEncoding } from './http/context.js';
+import { activeProfileName, checkAuth, checkCsrf, csrfError, getProfileCookie, isCsrfExemptPath, isPublicPath } from './auth/gate.js';
+import { guardQuerySessionId } from './api/session-visibility.js';
+import { checkSameOriginBrowserRequest } from './http/origin.js';
+import { coreRouter, HttpError, errorResponseBody, errorResponseHeaders, shellLanguage, startupUnavailable } from './api/router.js';
+import { isSpaPath } from './spa.js';
+import { buildCspReportOnlyPolicy, CSP_REPORT_TO } from './http/csp.js';
+import { STARTUP_IMMEDIATE_PATHS } from './startup.js';
+const SHELL_ERROR_HTML = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Hermes is restarting</title>
+</head>
+<body style="margin:0;padding:2rem;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#111827;color:#e5e7eb;">
+  <main style="max-width:40rem;margin:10vh auto;line-height:1.5;">
+    <h1 style="font-size:1.5rem;margin:0 0 0.75rem;">Hermes is restarting…</h1>
+    <p style="margin:0;color:#cbd5e1;">The WebUI shell could not load cleanly. Refresh in a moment if this page does not update automatically.</p>
+  </main>
+</body>
+</html>`;
+function sendBytes(ctx, body, contentType, opts) {
+    if (opts.etag && ctx.header('if-none-match') === opts.etag) {
+        ctx.send({ status: 304, headers: { ETag: opts.etag, 'Cache-Control': opts.cacheControl } });
+        return;
+    }
+    const headers = { 'Content-Type': contentType, 'Cache-Control': opts.cacheControl, Vary: 'Accept-Encoding', ...opts.headers };
+    if (opts.etag)
+        headers.ETag = opts.etag;
+    let payload = body;
+    if (opts.gz && ctx.acceptsGzip()) {
+        headers['Content-Encoding'] = 'gzip';
+        payload = opts.gz;
+    }
+    ctx.send({ status: 200, headers, body: payload });
+}
+function notFound(ctx) {
+    // Python `handle_kanban_*`: an unknown Kanban path names itself and points at a stale cached bundle.
+    if (ctx.path.startsWith('/api/kanban/') || ctx.path === '/api/kanban') {
+        ctx.json({ error: `unknown Kanban endpoint: ${ctx.method} ${ctx.path}. If this appeared after a WebUI update, your browser may be running a stale cached bundle; use Hard refresh now, then reopen Kanban.` }, { status: 404 });
+        return;
+    }
+    ctx.json({ error: 'not found' }, { status: 404 });
+}
+/** Serve the shell, hashed assets, service worker, and manifest; false when the path is not a frontend route. */
+function handleSpa(ctx) {
+    const { spa, version } = ctx.deps;
+    const path = ctx.path;
+    if (path === '/sw.js') {
+        const sw = spa.serviceWorker(version);
+        if (sw)
+            sendBytes(ctx, sw, 'application/javascript; charset=utf-8', { cacheControl: 'no-store', headers: { 'Service-Worker-Allowed': '/' } });
+        else
+            notFound(ctx);
+        return true;
+    }
+    const distFile = (rel, cacheControl) => {
+        const asset = spa.asset(rel);
+        if (!asset) {
+            notFound(ctx);
+            return true;
+        }
+        const cc = cacheControl ?? (rel.startsWith('assets/') ? 'public, max-age=31536000, immutable' : 'no-cache');
+        sendBytes(ctx, asset.body, asset.contentType, { cacheControl: cc, gz: asset.gz, etag: asset.etag });
+        return true;
+    };
+    if (['/manifest.json', '/manifest.webmanifest', '/session/manifest.json', '/session/manifest.webmanifest'].includes(path))
+        return distFile('manifest.webmanifest', 'no-cache');
+    if (path.startsWith('/assets/'))
+        return distFile(path.slice(1));
+    if (path.startsWith('/static/dist/'))
+        return distFile(path.slice('/static/dist/'.length));
+    // Legacy alias: `/session/static/<rel>` is `/static/<rel>` (deep-linked shells before the relative base href).
+    const staticRel = path.startsWith('/static/') ? path.slice('/static/'.length) : path.startsWith('/session/static/') ? path.slice('/session/static/'.length) : null;
+    if (staticRel !== null) {
+        const asset = ctx.deps.staticFiles.get(staticRel);
+        if (!asset) {
+            notFound(ctx);
+            return true;
+        }
+        // A `?v=<version>` fingerprint makes the URL immutable; `unknown` and a digest-less `-dirty` are not fingerprints.
+        const token = ctx.query.get('v') ?? '';
+        const fingerprinted = token !== '' && token !== 'unknown' && !token.endsWith('-dirty');
+        sendBytes(ctx, asset.body, asset.contentType, { cacheControl: fingerprinted ? 'public, max-age=31536000, immutable' : 'public, max-age=300', gz: asset.gz, etag: asset.etag });
+        return true;
+    }
+    if (isSpaPath(path)) {
+        if (!spa.available()) {
+            ctx.deps.log('[webui] WARNING: Failed to serve WebUI shell route: static/dist/index.html is missing');
+            ctx.text(SHELL_ERROR_HTML, { status: 503, contentType: 'text/html; charset=utf-8' });
+            return true;
+        }
+        const extra = { 'X-Frame-Options': 'DENY' };
+        if (path === '/share' || path.startsWith('/share/'))
+            extra['X-Robots-Tag'] = 'noindex, nofollow';
+        try {
+            const html = Buffer.from(spa.renderShell(path, { lang: shellLanguage(ctx) || 'en', version }), 'utf8');
+            sendBytes(ctx, html, 'text/html; charset=utf-8', { cacheControl: 'no-store', headers: extra });
+        }
+        catch (error) {
+            ctx.deps.log(`[webui] WARNING: Failed to serve WebUI shell route: ${String(error)}`);
+            ctx.text(SHELL_ERROR_HTML, { status: 503, contentType: 'text/html; charset=utf-8' });
+        }
+        return true;
+    }
+    return false;
+}
+function serveFavicon(ctx) {
+    try {
+        const data = readFileSync(resolve(ctx.deps.config.staticRoot, 'brand', 'favicon.ico'));
+        ctx.send({ status: 200, headers: { 'Content-Type': 'image/x-icon', 'Cache-Control': 'public, max-age=86400' }, body: data });
+    }
+    catch {
+        notFound(ctx);
+    }
+}
+function preflight(ctx) {
+    const origin = (ctx.header('origin') ?? '').trim();
+    const headers = {};
+    const allowed = origin && checkSameOriginBrowserRequest({ origin, referer: ctx.header('referer'), host: ctx.header('host'), secFetchSite: ctx.header('sec-fetch-site'), forwardedHost: ctx.header('x-forwarded-host'), realHost: ctx.header('x-real-host') }, ctx.deps.config.env) === null;
+    if (allowed) {
+        headers['Access-Control-Allow-Origin'] = origin;
+        headers.Vary = 'Origin';
+        headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
+        headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization';
+    }
+    ctx.send({ status: 200, headers, security: false });
+}
+/** Every implemented procedure, keyed like the contract. */
+export const appRouter = { ...coreRouter, ...sessionsRouter, ...gitRouter, ...chatRouter, ...settingsRouter, ...toolsRouter, ...automationRouter };
+const SSE_GET_ROUTES = {
+    '/api/chat/stream': handleChatStream,
+    '/api/session/stream': handleSessionStream,
+    '/api/sessions/events': handleSessionEvents,
+    '/api/kanban/events/stream': handleKanbanEventsStream,
+    '/api/terminal/output': handleTerminalOutput,
+    '/api/approval/stream': handleApprovalStream,
+    '/api/clarify/stream': handleClarifyStream,
+};
+const ORPC_MAX_BODY_BYTES = 20 * 1024 * 1024;
+const GZIP_MIN_BYTES = 1024;
+/**
+ * Cap the bytes oRPC may buffer from a request body: a chunked body carries no `Content-Length`, so the declared-size
+ * check cannot bound it. Counting in `emit` keeps the stream in whatever mode oRPC's reader puts it; once over the
+ * limit the reader sees a `BodyError` (mapped to 413 by the root interceptor) and the rest of the body is dropped.
+ */
+function boundRequestBody(req, maxBytes) {
+    if (req.method === 'GET' || req.method === 'HEAD')
+        return () => undefined;
+    const originalEmit = req.emit.bind(req);
+    let total = 0;
+    let tripped = false;
+    req.emit = ((event, ...args) => {
+        if (event === 'data' && !tripped) {
+            total += args[0].length;
+            if (total > maxBytes) {
+                tripped = true;
+                return originalEmit('error', new BodyError(`Request body too large (${String(total)} bytes, max ${String(maxBytes)})`));
+            }
+        }
+        if (tripped && (event === 'data' || event === 'end'))
+            return false;
+        return originalEmit(event, ...args);
+    });
+    return () => { req.emit = originalEmit; };
+}
+/** Buffer a JSON response written by oRPC and gzip it when the client accepts gzip and the body exceeds 1 KiB. */
+function gzipJsonResponse(req, res) {
+    const accept = req.headers['accept-encoding'];
+    if (!acceptsEncoding(Array.isArray(accept) ? accept.join(',') : accept, 'gzip'))
+        return;
+    const writeHead = res.writeHead.bind(res);
+    const end = res.end.bind(res);
+    let pending = null;
+    let armed = true;
+    const flush = () => { if (pending) {
+        writeHead(pending[0], pending[1]);
+        pending = null;
+    } };
+    res.writeHead = ((status, headers) => {
+        if (!armed)
+            return writeHead(status, headers);
+        pending = [status, headers];
+        return res;
+    });
+    const originalWrite = res.write.bind(res);
+    res.write = ((chunk, ...rest) => { armed = false; flush(); return originalWrite(chunk, ...rest); });
+    res.end = ((chunk, ...rest) => {
+        if (armed && pending && typeof chunk === 'string') {
+            const headers = pending[1] ?? {};
+            const ct = headers['content-type'];
+            const type = typeof ct === 'string' ? ct : '';
+            const body = Buffer.from(chunk, 'utf8');
+            if (type.startsWith('application/json') && body.length > GZIP_MIN_BYTES && !headers['content-encoding']) {
+                const gz = gzipSync(body, { level: 4 });
+                pending = [pending[0], { ...headers, 'content-encoding': 'gzip', 'content-length': String(gz.length), vary: 'Accept-Encoding' }];
+                armed = false;
+                flush();
+                return end(gz);
+            }
+        }
+        armed = false;
+        flush();
+        return end(chunk, ...rest);
+    });
+}
+export function createApp(deps, opts = {}) {
+    const orpc = new OpenAPIHandler(opts.router ?? appRouter, {
+        customErrorResponseBodyEncoder: (error) => errorResponseBody(error),
+        // Python `j()` gzipped any JSON body over 1 KiB for clients that accept it; oRPC serialises below the standard
+        // handler, so the node response is wrapped here.
+        adapterInterceptors: [
+            async (options) => {
+                const unbind = boundRequestBody(options.request, ORPC_MAX_BODY_BYTES);
+                gzipJsonResponse(options.request, options.response);
+                try {
+                    return await options.next();
+                }
+                finally {
+                    unbind();
+                }
+            },
+        ],
+        // Root level: oRPC converts thrown errors into responses below `interceptors`, so only here do error responses get the shared headers.
+        rootInterceptors: [
+            async (options) => {
+                // Python handlers read `?board=` / `?dry_run=` on POST/PATCH/DELETE as well as the JSON body (the iOS app sends
+                // kanban arguments only as query items); oRPC's compact decode reads the body alone for non-GET, so the query
+                // is merged in as the fallback for keys the body does not carry.
+                const request = options.request;
+                const readBody = request.body;
+                // A body the byte cap tripped surfaces as the Python 413, not oRPC's generic 500.
+                request.body = async () => {
+                    try {
+                        return await readBody();
+                    }
+                    catch (error) {
+                        if (error instanceof BodyError)
+                            throw new HttpError(413, error.message);
+                        throw error;
+                    }
+                };
+                if (request.method !== 'GET' && request.url.searchParams.size > 0) {
+                    const query = Object.fromEntries(request.url.searchParams);
+                    const original = request.body;
+                    request.body = async () => {
+                        const data = await original();
+                        if (data === undefined)
+                            return query;
+                        if (data && typeof data === 'object' && !Array.isArray(data))
+                            return { ...query, ...data };
+                        return data;
+                    };
+                }
+                const result = await options.next();
+                if (!result.matched)
+                    return result;
+                const { ctx } = options.context;
+                const headers = result.response.headers;
+                Object.assign(headers, lowerKeys(ctx.securityHeaders()));
+                headers['cache-control'] = 'no-store';
+                headers['content-security-policy-report-only'] = buildCspReportOnlyPolicy(ctx.cspExtras);
+                headers['report-to'] = CSP_REPORT_TO;
+                const status = result.response.status;
+                ctx.beforeOrpcResponse(status);
+                Object.assign(headers, lowerKeys(ctx.extraResponseHeaders));
+                if (ctx.pendingCookies.length) {
+                    headers['set-cookie'] = [...ctx.pendingCookies];
+                    ctx.pendingCookies = [];
+                }
+                if (ctx.notModified)
+                    return { ...result, response: { ...result.response, status: 304, body: undefined } };
+                return result;
+            },
+        ],
+        clientInterceptors: [
+            async (options) => {
+                try {
+                    return await options.next();
+                }
+                catch (error) {
+                    if (error instanceof ORPCError) {
+                        const extra = errorResponseHeaders(error);
+                        if (Object.keys(extra).length)
+                            options.context.ctx.extraResponseHeaders = extra;
+                        throw error;
+                    }
+                    options.context.ctx.deps.log(`[webui] ERROR ${options.context.ctx.method} ${options.context.ctx.req.url ?? ''}\n${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+                    throw new ORPCError('INTERNAL_SERVER_ERROR', { message: 'Internal server error' });
+                }
+            },
+        ],
+    });
+    const handler = (req, res) => {
+        const ctx = new RequestContext(req, res, deps);
+        return deps.requestScope.run(ctx, () => dispatch(ctx));
+    };
+    const dispatch = async (ctx) => {
+        const { req, res } = ctx;
+        deps.stats.requestsTotal += 1;
+        deps.stats.lastRequestAt = Date.now() / 1000;
+        let releaseWrite = null;
+        try {
+            if (ctx.method === 'OPTIONS') {
+                preflight(ctx);
+                return;
+            }
+            const profile = await getProfileCookie(ctx);
+            if (profile)
+                ctx.requestProfile = profile;
+            const path = ctx.path;
+            if (path.startsWith('/api/') && (ctx.header('origin') ?? '').trim().toLowerCase() === 'null') {
+                ctx.rawJson(403, { error: 'Sandboxed documents cannot call the API directly' });
+                return;
+            }
+            const isCspReport = path === '/api/csp-report' && ctx.method === 'POST';
+            if (!isCspReport && !(await checkAuth(ctx)))
+                return;
+            // Python `_startup_exempt`: the public surface (login, auth status, OIDC, passkeys, share reads) answers during recovery.
+            if (!deps.startup.ready && path.startsWith('/api/') && !STARTUP_IMMEDIATE_PATHS.has(path) && !isPublicPath(path) && !(await deps.startup.wait())) {
+                startupUnavailable(ctx);
+                return;
+            }
+            // Python ran `_check_csrf` before `_guard_request_session_visibility`: a cross-origin unsafe request answers 403
+            // even when it names a foreign session id.
+            const unsafe = ctx.method !== 'GET' && ctx.method !== 'HEAD';
+            if (unsafe && path.startsWith('/api/') && !isCspReport && !isCsrfExemptPath(path) && !(await checkCsrf(ctx))) {
+                ctx.json({ error: csrfError(ctx.csrfFailure) }, { status: 403 });
+                return;
+            }
+            if (path.startsWith('/api/') && !guardQuerySessionId(ctx))
+                return;
+            // A profile-scoped write racing that profile's deletion RPC could resurrect a partially populated home
+            // (`config.set` recreates the parent): every unsafe request under a profile holds a write lease for its
+            // lifetime — deletion waits for leases to drain, and a request arriving during deletion is refused (409).
+            // The delete route is the lifecycle owner (mark + drain), so it must not lease the profile it is deleting.
+            if (unsafe && path.startsWith('/api/') && path !== '/api/profile/delete' && path !== '/api/profile/switch') {
+                const lease = deps.profiles.beginWrite(activeProfileName(ctx));
+                if (lease === 'deleting') {
+                    ctx.json({ error: `Profile '${activeProfileName(ctx)}' is being deleted.` }, { status: 409 });
+                    return;
+                }
+                if (lease === 'missing') {
+                    ctx.json({ error: `Profile '${activeProfileName(ctx)}' does not exist.` }, { status: 404 });
+                    return;
+                }
+                if (lease === 'unreadable') {
+                    ctx.json({ error: 'Profile deletion records are unreadable; retry in a moment.' }, { status: 503 });
+                    return;
+                }
+                releaseWrite = lease;
+            }
+            // The synchronous local-I/O and workspace gates read the profile's last-known config and fail closed while it
+            // is unresolved; settle it here (a cache hit is one stat) so an edited config.yaml costs one RPC, not a request.
+            if (path.startsWith('/api/'))
+                await deps.agentConfig.read(deps.profileHome(deps.activeProfile())).catch(() => undefined);
+            if (ctx.method === 'GET' || ctx.method === 'HEAD') {
+                if (handleSpa(ctx))
+                    return;
+                if (path.startsWith('/extensions/')) {
+                    handleExtensionStatic(ctx);
+                    return;
+                }
+                if (path === '/favicon.ico') {
+                    serveFavicon(ctx);
+                    return;
+                }
+                const raw = RAW_GET_ROUTES[path];
+                if (raw) {
+                    await runRaw(ctx, raw);
+                    return;
+                }
+                const sse = SSE_GET_ROUTES[path];
+                if (sse) {
+                    await sse(ctx);
+                    return;
+                }
+                const journalSessionId = sessionEventsPathSessionId(path);
+                if (journalSessionId !== null) {
+                    await handleSessionJournalStream(ctx, journalSessionId);
+                    return;
+                }
+                if (RAW_POST_ROUTES[path]) {
+                    ctx.json({ error: `POST required for ${path}` }, { status: 405 });
+                    return;
+                }
+            }
+            else if (ctx.method === 'POST') {
+                const raw = RAW_POST_ROUTES[path];
+                if (raw) {
+                    await runRaw(ctx, raw);
+                    return;
+                }
+            }
+            // The extension sidecar proxy dispatches only after the CSRF check above has run for unsafe methods (Python
+            // ran `_check_csrf` before `_handle_extension_sidecar_proxy`).
+            const sidecarProxy = matchSidecarProxy(path);
+            if (sidecarProxy) {
+                await handleExtensionSidecarProxy(ctx, sidecarProxy[0], sidecarProxy[1]);
+                return;
+            }
+            // Python `read_body` refused any declared body over 20 MiB before reading it (`handle_post` → 413).
+            const declared = Number(ctx.header('content-length') ?? '0');
+            if (ctx.method !== 'GET' && ctx.method !== 'HEAD' && Number.isFinite(declared) && declared > ORPC_MAX_BODY_BYTES) {
+                ctx.json({ error: `Request body too large (${String(declared)} bytes, max ${String(ORPC_MAX_BODY_BYTES)})` }, { status: 413 });
+                return;
+            }
+            const { matched } = await orpc.handle(req, res, { context: { ctx } });
+            if (matched) {
+                ctx.markFinished(res.statusCode);
+                return;
+            }
+            notFound(ctx);
+        }
+        catch (error) {
+            if (ctx.isFinished)
+                return;
+            deps.log(`[webui] ERROR ${ctx.method} ${req.url ?? ''}\n${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+            try {
+                ctx.json({ error: 'Internal server error' }, { status: 500 });
+            }
+            catch {
+                /* client gone */
+            }
+        }
+        finally {
+            releaseWrite?.();
+        }
+    };
+    return { deps, handler };
+}
+function lowerKeys(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers))
+        out[k.toLowerCase()] = v;
+    return out;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAe,MAAM,cAAc,CAAA;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC/J,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACnM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAgC,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACrI,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,aAAa,EAAE,kBAAkB,EAAmB,MAAM,iBAAiB,CAAA;AACpJ,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;QAajB,CAAA;AASR,SAAS,SAAS,CAAC,GAAmB,EAAE,IAAY,EAAE,WAAmB,EAAE,IAAsF;IAC/J,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QAC3F,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAc,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;IACxI,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvC,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QACjC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAA;QACpC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAA;IACnB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB;IACnC,qGAAqG;IACrG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,uIAAuI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC/N,OAAM;IACR,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AACnD,CAAC;AAED,iHAAiH;AACjH,SAAS,SAAS,CAAC,GAAmB;IACpC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAA;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,EAAE;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,uCAAuC,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;;YACxI,QAAQ,CAAC,GAAG,CAAC,CAAA;QAClB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,YAAqB,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,EAAE,GAAG,YAAY,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QAC3G,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACnG,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,+BAA+B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAA;IAC9K,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;IACzF,+GAA+G;IAC/G,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClK,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,IAAI,CAAA;QACb,CAAC;QACD,mHAAmH;QACnH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,aAAa,GAAG,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACtF,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,qBAAqB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9K,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAA;YACrG,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAA;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAA;QACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,cAAc,CAAC,GAAG,mBAAmB,CAAA;QAChG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;YACtG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpF,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAA;QACtF,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAA;QACtF,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9H,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB;IACpC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAClD,MAAM,OAAO,GAAc,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,6BAA6B,CACrD,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EACpM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,KAAK,IAAI,CAAA;IACV,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAA;QAC/C,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAA;QACvB,OAAO,CAAC,8BAA8B,CAAC,GAAG,wCAAwC,CAAA;QAClF,OAAO,CAAC,8BAA8B,CAAC,GAAG,6BAA6B,CAAA;IACzE,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,GAAG,cAAc,EAAE,GAAG,WAAW,EAAE,GAAG,gBAAgB,EAAE,CAAA;AAElJ,MAAM,cAAc,GAA2D;IAC7E,kBAAkB,EAAE,gBAAgB;IACpC,qBAAqB,EAAE,mBAAmB;IAC1C,sBAAsB,EAAE,mBAAmB;IAC3C,2BAA2B,EAAE,wBAAwB;IACrD,sBAAsB,EAAE,oBAAoB;IAC5C,sBAAsB,EAAE,oBAAoB;IAC5C,qBAAqB,EAAE,mBAAmB;CAC3C,CAAA;AAOD,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC5C,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAoB,EAAE,QAAgB;IAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAA;IACzE,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAa,EAAE,GAAG,IAAe,EAAW,EAAE;QACzD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,KAAK,IAAK,IAAI,CAAC,CAAC,CAAY,CAAC,MAAM,CAAA;YACnC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,OAAO,GAAG,IAAI,CAAA;gBACd,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YACzH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAClE,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;IACrC,CAAC,CAAoB,CAAA;IACrB,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,GAAG,YAAY,CAAA,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,kHAAkH;AAClH,SAAS,gBAAgB,CAAC,GAAqC,EAAE,GAAmB;IAClF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAM;IACvF,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,OAAO,GAAqD,IAAI,CAAA;IACpE,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAA;IAAC,CAAC,CAAC,CAAC,CAAA;IAChG,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,MAAc,EAAE,OAA6B,EAAE,EAAE;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7C,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC3B,OAAO,GAAG,CAAA;IACZ,CAAC,CAAyB,CAAA;IAC1B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAQ,aAA8C,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA,CAAC,CAAC,CAAqB,CAAA;IAC5K,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QACjD,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAChC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;YAClC,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACxG,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBACvC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;gBAChI,KAAK,GAAG,KAAK,CAAA;gBACb,KAAK,EAAE,CAAA;gBACP,OAAO,GAAG,CAAC,EAAE,CAAC,CAAA;YAChB,CAAC;QACH,CAAC;QACD,KAAK,GAAG,KAAK,CAAA;QACb,KAAK,EAAE,CAAA;QACP,OAAQ,GAA2C,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;IACrE,CAAC,CAAmB,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,OAAyB,EAAE;IAClE,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE;QACxD,8BAA8B,EAAE,CAAC,KAAiC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC/F,+GAA+G;QAC/G,iDAAiD;QACjD,mBAAmB,EAAE;YACnB,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAA0B,EAAE,mBAAmB,CAAC,CAAA;gBACxF,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAA0B,CAAC,CAAA;gBACrE,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;gBAC7B,CAAC;wBAAS,CAAC;oBACT,MAAM,EAAE,CAAA;gBACV,CAAC;YACH,CAAC;SACF;QACD,uIAAuI;QACvI,gBAAgB,EAAE;YAChB,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChB,gHAAgH;gBAChH,8GAA8G;gBAC9G,iEAAiE;gBACjE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;gBAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAA;gBAC7B,kFAAkF;gBAClF,OAAO,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE;oBACxB,IAAI,CAAC;wBACH,OAAO,MAAM,QAAQ,EAAE,CAAA;oBACzB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,SAAS;4BAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;wBACvE,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC,CAAA;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAClE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;oBAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAA;oBAC7B,OAAO,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE;wBACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAA;wBAC7B,IAAI,IAAI,KAAK,SAAS;4BAAE,OAAO,KAAK,CAAA;wBACpC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;4BAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAI,IAAgC,EAAE,CAAA;wBACvH,OAAO,IAAI,CAAA;oBACb,CAAC,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;gBACnC,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAA;gBAClC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAA;gBAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAA;gBACvC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;gBACxD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,CAAA;gBACrC,OAAO,CAAC,qCAAqC,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACxF,OAAO,CAAC,WAAW,CAAC,GAAG,aAAa,CAAA;gBACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;gBACrC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAA;gBAC3D,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;oBAC9B,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,CAAA;oBAC/C,GAAG,CAAC,cAAc,GAAG,EAAE,CAAA;gBACzB,CAAC;gBACD,IAAI,GAAG,CAAC,WAAW;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAA;gBACzG,OAAO,MAAM,CAAA;YACf,CAAC;SACF;QACD,kBAAkB,EAAE;YAClB,KAAK,EAAE,OAAO,EAAE,EAAE;gBAChB,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;gBAC7B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;wBAC/B,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAmC,CAAC,CAAA;wBACvE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;4BAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAA;wBAC/E,MAAM,KAAK,CAAA;oBACb,CAAC;oBACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;oBAC5L,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;gBACpF,CAAC;YACH,CAAC;SACF;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAmB,EAAiB,EAAE;QAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;QACxB,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;QAC5C,IAAI,YAAY,GAAwB,IAAI,CAAA;QAC5C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,SAAS,CAAC,GAAG,CAAC,CAAA;gBACd,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,OAAO;gBAAE,GAAG,CAAC,cAAc,GAAG,OAAO,CAAA;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;YACrB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC7F,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC,CAAA;gBAC/E,OAAM;YACR,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,KAAK,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAA;YACvE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAM;YACnD,0HAA0H;YAC1H,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjJ,kBAAkB,CAAC,GAAG,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;YACD,iHAAiH;YACjH,2CAA2C;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAA;YAC5D,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7G,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAChE,OAAM;YACR,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;gBAAE,OAAM;YACjE,uGAAuG;YACvG,wGAAwG;YACxG,0GAA0G;YAC1G,2GAA2G;YAC3G,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAC3G,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC9D,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;oBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,iBAAiB,CAAC,GAAG,CAAC,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBAC7F,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBAC3F,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;oBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6DAA6D,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBACnG,OAAM;gBACR,CAAC;gBACD,YAAY,GAAG,KAAK,CAAA;YACtB,CAAC;YACD,8GAA8G;YAC9G,iHAAiH;YACjH,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACxH,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,IAAI,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAM;gBAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;oBACpC,qBAAqB,CAAC,GAAG,CAAC,CAAA;oBAC1B,OAAM;gBACR,CAAC;gBACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;oBAC5B,YAAY,CAAC,GAAG,CAAC,CAAA;oBACjB,OAAM;gBACR,CAAC;gBACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;gBAChC,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACtB,OAAM;gBACR,CAAC;gBACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;gBAChC,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,GAAG,CAAC,GAAG,CAAC,CAAA;oBACd,OAAM;gBACR,CAAC;gBACD,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAA;gBACzD,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;oBAC9B,MAAM,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;oBACvD,OAAM;gBACR,CAAC;gBACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBACjE,OAAM;gBACR,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;gBACjC,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACtB,OAAM;gBACR,CAAC;YACH,CAAC;YACD,4GAA4G;YAC5G,+DAA+D;YAC/D,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;YAC5C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,2BAA2B,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;gBACxE,OAAM;YACR,CAAC;YACD,oGAAoG;YACpG,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAA;YAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,mBAAmB,EAAE,CAAC;gBACjH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,MAAM,CAAC,QAAQ,CAAC,eAAe,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC9H,OAAM;YACR,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YACrE,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBAChC,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAM;YAC1B,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpI,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,EAAE,EAAE,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,OAAkB;IACnC,MAAM,GAAG,GAAsC,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAA;IACtE,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Cookie parsing and `Set-Cookie` formatting matching Python `http.cookies`
+ * output byte for byte (attribute order: HttpOnly, Max-Age, Path, SameSite, Secure).
+ */
+/** RFC 6265 cookie-name token (Python `_COOKIE_NAME_RE`). */
+export declare const COOKIE_NAME_RE: RegExp;
+/** Parse a `Cookie` header into name → value; quoted values are unquoted like `SimpleCookie`. */
+export declare function parseCookieHeader(header: string | undefined): Map<string, string>;
+export interface CookieAttrs {
+    httpOnly?: boolean;
+    maxAge?: number | string;
+    path?: string;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+    secure?: boolean;
+}
+/** `SimpleCookie(...).OutputString()`: an empty value renders as `""`. */
+export declare function formatSetCookie(name: string, value: string, attrs: CookieAttrs): string;

package/dist/auth/cookies.js

@@ -0,0 +1,42 @@
+/**
+ * Cookie parsing and `Set-Cookie` formatting matching Python `http.cookies`
+ * output byte for byte (attribute order: HttpOnly, Max-Age, Path, SameSite, Secure).
+ */
+/** RFC 6265 cookie-name token (Python `_COOKIE_NAME_RE`). */
+export const COOKIE_NAME_RE = /^[-!#$%&'*+.^_`|~0-9A-Za-z]+$/;
+/** Parse a `Cookie` header into name → value; quoted values are unquoted like `SimpleCookie`. */
+export function parseCookieHeader(header) {
+    const out = new Map();
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const at = part.indexOf('=');
+        if (at < 0)
+            continue;
+        const name = part.slice(0, at).trim();
+        let value = part.slice(at + 1).trim();
+        if (!name || !COOKIE_NAME_RE.test(name))
+            continue;
+        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"'))
+            value = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');
+        // Python `SimpleCookie.load`: a repeated name keeps the last morsel.
+        out.set(name, value);
+    }
+    return out;
+}
+/** `SimpleCookie(...).OutputString()`: an empty value renders as `""`. */
+export function formatSetCookie(name, value, attrs) {
+    const parts = [`${name}=${value === '' ? '""' : value}`];
+    if (attrs.httpOnly)
+        parts.push('HttpOnly');
+    if (attrs.maxAge !== undefined)
+        parts.push(`Max-Age=${attrs.maxAge}`);
+    if (attrs.path)
+        parts.push(`Path=${attrs.path}`);
+    if (attrs.sameSite)
+        parts.push(`SameSite=${attrs.sameSite}`);
+    if (attrs.secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,+BAA+B,CAAA;AAE7D,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAA;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QACjD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7I,qEAAqE;QACrE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAID,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,KAAkB;IAC7E,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IACxD,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACrE,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC5D,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/auth/crypto.d.ts

@@ -0,0 +1,9 @@
+export declare const PBKDF2_ITERATIONS = 600000;
+export declare function hashPassword(password: string, salt: Buffer): Promise<string>;
+export declare function hmacHex(key: Buffer, message: string): string;
+/** Constant-time string comparison that never throws on length mismatch. */
+export declare function safeEqual(a: string, b: string): boolean;
+export declare function newSessionToken(): string;
+export declare function newKey(): Buffer;
+/** Split `<token>.<sig>` on the last dot (Python `rsplit('.', 1)`). */
+export declare function splitSigned(value: string): [string, string] | null;

package/dist/auth/crypto.js

@@ -0,0 +1,38 @@
+/**
+ * Byte-compatible primitives of Python `api/auth.py`: PBKDF2-HMAC-SHA256
+ * (600k iterations, salted with the per-install `.pbkdf2_key`), HMAC-SHA256
+ * session/CSRF/profile signatures keyed by `.signing_key`.
+ */
+import { createHmac, pbkdf2, randomBytes, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+const pbkdf2Async = promisify(pbkdf2);
+export const PBKDF2_ITERATIONS = 600_000;
+export async function hashPassword(password, salt) {
+    const dk = await pbkdf2Async(Buffer.from(password, 'utf8'), salt, PBKDF2_ITERATIONS, 32, 'sha256');
+    return dk.toString('hex');
+}
+export function hmacHex(key, message) {
+    return createHmac('sha256', key).update(message, 'utf8').digest('hex');
+}
+/** Constant-time string comparison that never throws on length mismatch. */
+export function safeEqual(a, b) {
+    const ab = Buffer.from(a, 'utf8');
+    const bb = Buffer.from(b, 'utf8');
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+export function newSessionToken() {
+    return randomBytes(32).toString('hex');
+}
+export function newKey() {
+    return randomBytes(32);
+}
+/** Split `<token>.<sig>` on the last dot (Python `rsplit('.', 1)`). */
+export function splitSigned(value) {
+    const at = value.lastIndexOf('.');
+    if (at < 0)
+        return null;
+    return [value.slice(0, at), value.slice(at + 1)];
+}
+//# sourceMappingURL=crypto.js.map

package/dist/auth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/auth/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAExC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IAC/D,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;IAClG,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,OAAe;IAClD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IACjC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzC,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;AACxB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC"}