@mieweb/pulsevault 0.0.1 → 0.1.0

package/dist/core.js

@@ -0,0 +1,431 @@
+import send from '@fastify/send';
+import { createPulsevaultTusServer, pulseVaultTusContext, artifactIdFromUploadId, } from './lib/pulsevaultTus.js';
+import { pulseVaultError } from './lib/errors.js';
+import { isUuid } from './lib/uuid.js';
+import { consoleLogger } from './lib/request.js';
+import { normalizeAllowedExtensions, validateBasePath, validateMaxUploadSize, validateUploadUnit, validateAllowedExtensions, warnIfUsingDeprecatedProjectHooks, composeValidatePayload, composeOnUploadComplete, } from './lib/options.js';
+/** Wire protocol version this release implements. See `/capabilities` and `PROTOCOL.md`. */
+export const PROTOCOL_VERSION = 1;
+const MIN_SUPPORTED_PROTOCOL_VERSION = 1;
+const MAX_SUPPORTED_PROTOCOL_VERSION = 1;
+/**
+ * Pull `artifactId` (or the legacy `videoid`/`projectid` aliases), `kind`,
+ * and `relatedTo` out of a raw `Upload-Metadata` header. Format is a
+ * comma-separated list of `<key> <base64-value>` pairs (tus v1 creation
+ * extension).
+ *
+ * Alias precedence is a fixed priority (`artifactId` beats `videoid` beats
+ * `projectid`, regardless of header order) so this always agrees with
+ * `namingFunction` in `lib/pulsevaultTus.ts` — which uses the same
+ * `?? `-chain precedence to decide what's actually reserved/written to
+ * storage. If these two disagreed, `authorize()` could validate ownership of
+ * a different artifactId than the one the upload actually lands under.
+ */
+function parseUploadMetadata(header) {
+    let artifactIdRaw;
+    let videoidRaw;
+    let projectidRaw;
+    let kind = 'video';
+    let relatedTo;
+    for (const pair of header.split(',')) {
+        const trimmed = pair.trim();
+        if (!trimmed)
+            continue;
+        const sep = trimmed.indexOf(' ');
+        if (sep < 0)
+            continue;
+        const key = trimmed.slice(0, sep);
+        const value = trimmed.slice(sep + 1).trim();
+        if (!value)
+            continue;
+        try {
+            const decoded = Buffer.from(value, 'base64').toString('utf8');
+            if (key === 'artifactId') {
+                artifactIdRaw ??= decoded;
+            }
+            else if (key === 'videoid') {
+                videoidRaw ??= decoded;
+            }
+            else if (key === 'projectid') {
+                projectidRaw ??= decoded;
+            }
+            else if (key === 'kind') {
+                const lower = decoded.trim().toLowerCase();
+                kind = lower === 'project' ? 'project' : lower === 'captions' ? 'captions' : 'video';
+            }
+            else if (key === 'relatedTo' && !relatedTo) {
+                relatedTo = isUuid(decoded) ? decoded : undefined;
+            }
+        }
+        catch {
+            // ignore malformed base64
+        }
+    }
+    const candidate = (artifactIdRaw ?? videoidRaw ?? projectidRaw ?? '').trim();
+    const artifactId = isUuid(candidate) ? candidate : undefined;
+    return { artifactId, kind, relatedTo };
+}
+/**
+ * `@tus/server`'s `BaseHandler.getFileIdFromRequest` — the function that
+ * ultimately decides which upload a PATCH/HEAD/DELETE actually operates on —
+ * extracts its file id from the request URL's *last* `/`-delimited segment
+ * (`reExtractFileID = /([^/]+)\/?$/`), not from the first segment after
+ * `/upload/`. This MUST mirror that exact regex: a URL with extra path
+ * segments after the real id (Fastify's `/upload/*` route accepts them) would
+ * otherwise let `authorize()` see and approve one artifactId (whichever this
+ * function resolved) while `@tus/server` writes the request body against a
+ * *different* one (whichever it resolved) — an attacker holding a valid
+ * token for their own artifact could smuggle a second, victim artifactId as
+ * a trailing path segment and have their bytes land there instead, fully
+ * bypassing authorization for the artifact actually written to.
+ */
+const TUS_LAST_URL_SEGMENT = /([^/]+)\/?$/;
+/**
+ * Decode the tus file id (base64url-encoded, shaped `<kind>/<artifactId><ext>`
+ * by `namingFunction` in `lib/pulsevaultTus.ts`) that `@tus/server` itself
+ * will resolve a PATCH/HEAD/DELETE request to, and recover the artifactId via
+ * the exact same parser `onUploadFinish` uses — so this can never drift from
+ * what `@tus/server` actually operates on. See `TUS_LAST_URL_SEGMENT` above
+ * for why this must match the *last* URL segment, not the first one after
+ * `/upload/`.
+ */
+function artifactIdFromTusUrl(url) {
+    const match = TUS_LAST_URL_SEGMENT.exec(url);
+    if (!match?.[1])
+        return undefined;
+    let lastSegment;
+    try {
+        lastSegment = decodeURIComponent(match[1]);
+    }
+    catch {
+        return undefined;
+    }
+    let decoded;
+    try {
+        decoded = Buffer.from(lastSegment, 'base64url').toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+    return artifactIdFromUploadId(decoded);
+}
+/**
+ * Resolve the artifact kind for an artifactId from storage. Duck-typed so it
+ * works with any adapter (those without `getKind` return `"video"`).
+ */
+async function resolveStorageKind(storage, artifactId) {
+    const candidate = storage.getKind;
+    if (typeof candidate !== 'function')
+        return 'video';
+    const result = await candidate(artifactId);
+    return result ?? 'video';
+}
+/** Resolve the `relatedTo` artifact for an artifactId from storage, if the adapter supports it. */
+async function resolveStorageRelatedTo(storage, artifactId) {
+    const candidate = storage.getRelatedTo;
+    if (typeof candidate !== 'function')
+        return undefined;
+    const result = await candidate(artifactId);
+    return result ?? undefined;
+}
+function extractAuthzStatus(err) {
+    const e = err;
+    if (typeof e?.statusCode === 'number')
+        return e.statusCode;
+    if (typeof e?.status_code === 'number')
+        return e.status_code;
+    return 403;
+}
+function extractAuthzMessage(err) {
+    if (err instanceof Error && err.message)
+        return err.message;
+    return 'Forbidden';
+}
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(body));
+}
+/**
+ * Every response from a pulsevault route carries the wire protocol version
+ * it implements, so a client can detect "this server is too old/new for me"
+ * without a dedicated round-trip. Called at the top of each granular handler
+ * (rather than only in the aggregate `handler`) so it's also applied when a
+ * host framework — e.g. the Fastify adapter, which hijacks the reply and
+ * calls these directly — bypasses the aggregate router entirely. Must run
+ * before any `writeHead`/`end` call below: `setHeader` values merge into
+ * whatever headers object a later `writeHead` call passes.
+ */
+function stampProtocolVersion(res) {
+    res.setHeader('Protocol-Version', String(PROTOCOL_VERSION));
+}
+/** Same augmentation as `augment.ts`'s `FastifyRequest.pulseVault`, applied to a raw request. */
+function stashPulseVaultContext(req, ctx) {
+    req.pulseVault = ctx;
+}
+/**
+ * Build the framework-agnostic core: the same authorize/validatePayload/
+ * onUploadComplete/onArtifactEvent orchestration, tus glue, capabilities
+ * payload, and artifact GET/DELETE logic the Fastify plugin uses, operating
+ * on raw `(req, res)` instead of Fastify's `request`/`reply` wrappers. Both
+ * the Fastify plugin and this factory ultimately call into the same
+ * `lib/pulsevaultTus.js` tus server, so behavior can't drift between them.
+ */
+export function createPulseVaultCore(options) {
+    validateBasePath(options.basePath, 'basePath');
+    validateMaxUploadSize(options.maxUploadSize);
+    validateUploadUnit(options.uploadUnit);
+    validateAllowedExtensions(options.allowedExtensions);
+    warnIfUsingDeprecatedProjectHooks(options);
+    const { storage, basePath, maxUploadSize, cache, authorize, onArtifactEvent } = options;
+    const stripBasePath = options.stripBasePath ?? true;
+    const uploadUnit = options.uploadUnit ?? 'beat';
+    const allowedExtensions = normalizeAllowedExtensions(options.allowedExtensions);
+    const validatePayload = composeValidatePayload(options.validatePayload, options.validateProjectPayload);
+    const onUploadComplete = composeOnUploadComplete(options.onUploadComplete, options.onProjectUploadComplete);
+    const logger = options.logger ?? consoleLogger;
+    const tusPath = `${basePath}/upload`;
+    const tusServer = createPulsevaultTusServer({
+        storage,
+        tusPath,
+        maxSize: maxUploadSize,
+        allowedExtensions,
+        validatePayload,
+        onUploadComplete,
+        onArtifactEvent,
+        logger,
+    });
+    /**
+     * Run the consumer's `authorize` hook (if any) for a TUS request. Returns
+     * `true` iff the request may proceed; on rejection, this function already
+     * wrote the response.
+     */
+    const runAuthorize = async (req, res, phase) => {
+        let artifactId;
+        let kind = 'video';
+        let relatedTo;
+        if (phase === 'create') {
+            const meta = req.headers['upload-metadata'];
+            if (typeof meta === 'string') {
+                ({ artifactId, kind, relatedTo } = parseUploadMetadata(meta));
+            }
+        }
+        else {
+            artifactId = artifactIdFromTusUrl(req.url ?? '');
+            if (artifactId) {
+                kind = await resolveStorageKind(storage, artifactId);
+                relatedTo = await resolveStorageRelatedTo(storage, artifactId);
+            }
+        }
+        if (artifactId) {
+            stashPulseVaultContext(req, { artifactId, kind, relatedTo });
+        }
+        if (!authorize) {
+            return { ok: true, artifactId, kind, relatedTo };
+        }
+        if (!artifactId && phase === 'patch') {
+            // PROTOCOL.md §5.2: failing to resolve the artifactId for an in-flight
+            // upload request is an authorization failure — reject, don't fall
+            // through to "no artifactId to check, so allow".
+            logger.info({ url: req.url, phase }, 'pulsevault authorize rejected: unresolvable artifactId');
+            writeJson(res, 403, pulseVaultError('Unable to resolve artifact for authorization'));
+            return { ok: false };
+        }
+        if (!artifactId) {
+            return { ok: true, artifactId, kind, relatedTo };
+        }
+        try {
+            await authorize(req, { phase, artifactId, kind, relatedTo });
+            return { ok: true, artifactId, kind, relatedTo };
+        }
+        catch (err) {
+            const statusCode = extractAuthzStatus(err);
+            const message = extractAuthzMessage(err);
+            logger.info({ err, artifactId, phase, statusCode }, 'pulsevault authorize rejected');
+            if (phase === 'create') {
+                await onArtifactEvent?.({ phase: 'authorize', artifactId, kind, reason: message });
+            }
+            writeJson(res, statusCode, pulseVaultError(message));
+            return { ok: false };
+        }
+    };
+    const handleTus = async (req, res) => {
+        stampProtocolVersion(res);
+        const phase = req.method === 'POST' ? 'create' : 'patch';
+        const authz = await runAuthorize(req, res, phase);
+        if (!authz.ok)
+            return;
+        try {
+            await pulseVaultTusContext.run({ request: req, artifactId: authz.artifactId }, () => tusServer.handle(req, res));
+        }
+        catch (err) {
+            logger.error({ err }, 'pulsevault tus handler failed');
+            if (res.headersSent || res.writableEnded) {
+                res.destroy();
+                return;
+            }
+            res.statusCode = 500;
+            res.setHeader('content-type', 'text/plain; charset=utf-8');
+            res.end('Internal Server Error');
+        }
+    };
+    const handleCapabilities = async (_req, res) => {
+        stampProtocolVersion(res);
+        writeJson(res, 200, {
+            protocolVersion: PROTOCOL_VERSION,
+            minSupportedVersion: MIN_SUPPORTED_PROTOCOL_VERSION,
+            maxSupportedVersion: MAX_SUPPORTED_PROTOCOL_VERSION,
+            uploadUnit,
+            kinds: ['video', 'project', 'captions'],
+            allowedExtensions,
+            maxUploadSize,
+            checksum: { algorithms: ['sha256', 'sha1', 'md5'] },
+        });
+    };
+    /**
+     * Shared prelude for the artifact GET/DELETE handlers: resolve `kind`/
+     * `relatedTo` from storage, stash the request context, then run `authorize`
+     * (if configured) for the given phase. Returns `undefined` (having already
+     * written the response) when validation fails or `authorize` rejects.
+     */
+    const prepareArtifactRequest = async (req, res, artifactId, phase, token) => {
+        if (!isUuid(artifactId)) {
+            writeJson(res, 400, pulseVaultError('`artifactId` must be a valid UUID'));
+            return undefined;
+        }
+        const kind = await resolveStorageKind(storage, artifactId);
+        const relatedTo = await resolveStorageRelatedTo(storage, artifactId);
+        stashPulseVaultContext(req, { artifactId, kind, relatedTo });
+        if (!authorize)
+            return { kind, relatedTo };
+        try {
+            await authorize(req, { phase, artifactId, kind, relatedTo, token });
+            return { kind, relatedTo };
+        }
+        catch (err) {
+            const statusCode = extractAuthzStatus(err);
+            const message = extractAuthzMessage(err);
+            logger.info({ err, artifactId, phase, statusCode }, 'pulsevault authorize rejected');
+            await onArtifactEvent?.({ phase: 'authorize', artifactId, kind, reason: message });
+            writeJson(res, statusCode, pulseVaultError(message));
+            return undefined;
+        }
+    };
+    const handleArtifactDelete = async (req, res, artifactId) => {
+        stampProtocolVersion(res);
+        const prepared = await prepareArtifactRequest(req, res, artifactId, 'delete');
+        if (!prepared)
+            return;
+        if (typeof storage.remove !== 'function') {
+            writeJson(res, 501, pulseVaultError('Storage adapter does not support delete'));
+            return;
+        }
+        const removed = await storage.remove(artifactId);
+        if (!removed) {
+            writeJson(res, 404, pulseVaultError('Artifact not found'));
+            return;
+        }
+        res.writeHead(204);
+        res.end();
+    };
+    const handleArtifactGet = async (req, res, artifactId, token) => {
+        stampProtocolVersion(res);
+        const prepared = await prepareArtifactRequest(req, res, artifactId, 'resolve', token);
+        if (!prepared)
+            return;
+        const resolved = await storage.resolve(artifactId);
+        if (!resolved) {
+            writeJson(res, 404, pulseVaultError('Artifact not found'));
+            return;
+        }
+        if (resolved.kind === 'redirect') {
+            res.writeHead(resolved.statusCode ?? 302, { Location: resolved.url });
+            res.end();
+            return;
+        }
+        const result = await send(req, resolved.filename, { root: resolved.root, ...cache });
+        if (result.type === 'error') {
+            writeJson(res, result.statusCode, pulseVaultError(result.metadata.error.message));
+            return;
+        }
+        const headers = { ...result.headers };
+        // If the storage adapter provided an explicit content type (e.g. for
+        // non-standard extensions like `.pulse`), override what @fastify/send
+        // would otherwise infer from the filename.
+        if (resolved.contentType) {
+            headers['content-type'] = resolved.contentType;
+        }
+        res.writeHead(result.statusCode, headers);
+        result.stream.pipe(res);
+    };
+    const handler = async (req, res, next) => {
+        // (Protocol-Version is stamped by each granular handler below, so it's
+        // applied consistently whether reached through this router or called
+        // directly by a host framework's own routing.)
+        const notFound = () => {
+            if (next) {
+                next();
+                return;
+            }
+            res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Not Found');
+        };
+        const url = new URL(req.url ?? '/', 'http://internal');
+        let pathname = url.pathname;
+        if (stripBasePath && basePath !== '') {
+            if (pathname === basePath) {
+                pathname = '';
+            }
+            else if (pathname.startsWith(`${basePath}/`)) {
+                pathname = pathname.slice(basePath.length);
+            }
+            else {
+                notFound();
+                return;
+            }
+        }
+        if (pathname === '')
+            pathname = '/';
+        if (pathname === '/upload' || pathname.startsWith('/upload/')) {
+            await handleTus(req, res);
+            return;
+        }
+        if (pathname === '/capabilities' && req.method === 'GET') {
+            await handleCapabilities(req, res);
+            return;
+        }
+        const artifactMatch = pathname.match(/^\/artifacts\/([^/]+)$/);
+        if (artifactMatch?.[1]) {
+            const artifactId = artifactMatch[1];
+            if (req.method === 'GET') {
+                await handleArtifactGet(req, res, artifactId, url.searchParams.get('token') ?? undefined);
+                return;
+            }
+            if (req.method === 'DELETE') {
+                await handleArtifactDelete(req, res, artifactId);
+                return;
+            }
+        }
+        notFound();
+    };
+    return {
+        handler,
+        shutdown: async () => {
+            await storage.shutdown?.();
+        },
+        handleTus,
+        handleCapabilities,
+        handleArtifactGet,
+        handleArtifactDelete,
+    };
+}
+// Re-exported so a non-Fastify consumer never needs to import from both `.`
+// and `./core` for a normal setup — these are already framework-agnostic
+// and identical to what the `.` (Fastify) entry point re-exports.
+export { createLocalStorage } from './storage/local.js';
+export { createS3Storage } from './storage/s3.js';
+export { sniffMp4, createMp4Sniffer, createS3Mp4Sniffer } from './lib/magic.js';
+export { buildUploadLink } from './lib/deeplinks.js';
+export { issueCapabilityToken, verifyCapabilityToken, createCapabilityAuthorize, } from './lib/capability-token.js';
+export { createChecksumValidator, createS3ChecksumValidator, parseChecksumMetadata, } from './lib/checksum.js';
+export {} from './lib/request.js';
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,GAGvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAyB,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAwFzC;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,MAAc;IAKzC,IAAI,aAAiC,CAAC;IACtC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,GAAe,OAAO,CAAC;IAC/B,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;gBACzB,aAAa,KAAK,OAAO,CAAC;YAC5B,CAAC;iBAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,UAAU,KAAK,OAAO,CAAC;YACzB,CAAC;iBAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/B,YAAY,KAAK,OAAO,CAAC;YAC3B,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC3C,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YACvF,CAAC;iBAAM,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7C,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,aAAa,IAAI,UAAU,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAE3C;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAA0B,EAC1B,UAAkB;IAElB,MAAM,SAAS,GAAI,OAAiC,CAAC,OAAO,CAAC;IAC7D,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,MAAM,GAAG,MAAO,SAAwD,CAAC,UAAU,CAAC,CAAC;IAC3F,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,uBAAuB,CACpC,OAA0B,EAC1B,UAAkB;IAElB,MAAM,SAAS,GAAI,OAAsC,CAAC,YAAY,CAAC;IACvE,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,MAAO,SAAoD,CAAC,UAAU,CAAC,CAAC;IACvF,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,CAAC,GAAG,GAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC;IAC3D,IAAI,OAAO,CAAC,EAAE,WAAW,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,WAAW,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC5D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,UAAkB,EAAE,IAAa;IACvE,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAmB;IAC/C,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC9D,CAAC;AAID,iGAAiG;AACjG,SAAS,sBAAsB,CAAC,GAAoB,EAAE,GAA6B;IAChF,GAAmE,CAAC,UAAU,GAAG,GAAG,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7C,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,sBAAsB,CAC5C,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,sBAAsB,CAC/B,CAAC;IACF,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,uBAAuB,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAE/C,MAAM,OAAO,GAAG,GAAG,QAAQ,SAAS,CAAC;IACrC,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC1C,OAAO;QACP,OAAO;QACP,OAAO,EAAE,aAAa;QACtB,iBAAiB;QACjB,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,MAAM;KACP,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,GAAoB,EACpB,GAAmB,EACnB,KAAyB,EAIzB,EAAE;QACF,IAAI,UAA8B,CAAC;QACnC,IAAI,IAAI,GAAe,OAAO,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACrD,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,sBAAsB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACrC,uEAAuE;YACvE,kEAAkE;YAClE,iDAAiD;YACjD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,wDAAwD,CAAC,CAAC;YAC/F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACrF,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACnF,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAuB,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO;QAEtB,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAClF,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAC3B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACvD,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACzC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAqB,EAAE,GAAmB,EAAiB,EAAE;QAC7F,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;YAClB,eAAe,EAAE,gBAAgB;YACjC,mBAAmB,EAAE,8BAA8B;YACnD,mBAAmB,EAAE,8BAA8B;YACnD,UAAU;YACV,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;YACvC,iBAAiB;YACjB,aAAa;YACb,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;SACpD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,GAAoB,EACpB,GAAmB,EACnB,UAAkB,EAClB,KAA2B,EAC3B,KAAc,EAC4D,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,mCAAmC,CAAC,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrE,sBAAsB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7D,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACrF,MAAM,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAG,KAAK,EAChC,GAAoB,EACpB,GAAmB,EACnB,UAAkB,EACH,EAAE;QACjB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,yCAAyC,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAoB,EACpB,GAAmB,EACnB,UAAkB,EAClB,KAAyB,EACV,EAAE;QACjB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YACtE,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAErF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,qEAAqE;QACrE,sEAAsE;QACtE,2CAA2C;QAC3C,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;QACjD,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,GAAoB,EACpB,GAAmB,EACnB,IAAkB,EACH,EAAE;QACjB,uEAAuE;QACvE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvD,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC5B,IAAI,aAAa,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACrC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC/C,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,QAAQ,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,EAAE;YAAE,QAAQ,GAAG,GAAG,CAAC;QAEpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;gBAC1F,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,CAAC;QACD,SAAS;QACT,kBAAkB;QAClB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAkBlD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAiD,MAAM,kBAAkB,CAAC"}

package/dist/lib/authorize.d.ts

@@ -0,0 +1,19 @@
+import type { PulseVaultRequest } from './request.js';
+import type { UploadKind } from '../storage/types.js';
+export type PulseVaultAuthorizePhase = 'create' | 'patch' | 'resolve' | 'delete';
+export type PulseVaultAuthorizeContext = {
+    phase: PulseVaultAuthorizePhase;
+    artifactId: string;
+    /** Artifact kind: `"video"`, `"project"`, or `"captions"`. Always present. */
+    kind: UploadKind;
+    /** Bearer / query-string token forwarded from the watch URL, if present. Only populated during the `"resolve"` phase. */
+    token?: string;
+    /**
+     * The session-anchor artifact this one declared via `Upload-Metadata.relatedTo`,
+     * if any. Lets `createCapabilityAuthorize` authorize an artifact against a
+     * token scoped to the session it belongs to rather than its own id.
+     */
+    relatedTo?: string;
+};
+export type PulseVaultAuthorize = (request: PulseVaultRequest, ctx: PulseVaultAuthorizeContext) => void | Promise<void>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/lib/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/lib/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,wBAAwB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,IAAI,EAAE,UAAU,CAAC;IACjB,yHAAyH;IACzH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,0BAA0B,KAC5B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/lib/authorize.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorize.js.map

package/dist/lib/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/lib/authorize.ts"],"names":[],"mappings":""}

package/dist/lib/capability-token.d.ts

@@ -0,0 +1,80 @@
+import type { PulseVaultAuthorize } from './authorize.js';
+/**
+ * Claims signed into a capability token. `kid` lets a secret be rotated with
+ * an overlap window (old + new key both verify) instead of instantly
+ * invalidating every outstanding token; `iat` closes a clock-skew gap where
+ * signing only `exp` would let a slow server clock accept an already-expired
+ * token; `issuer` binds the token to the issuing deployment's identity so a
+ * secret accidentally shared between two independent orgs can't be replayed
+ * across them.
+ */
+export type CapabilityTokenClaims = {
+    /** The artifact (or session-anchor artifact — see `relatedTo`) this token authorizes. */
+    artifactId: string;
+    /** Issued-at, seconds since epoch. */
+    iat: number;
+    /** Expiry, seconds since epoch. */
+    exp: number;
+    /** Key id, looked up via `lookupSecret` at verify time. */
+    kid: string;
+    /** Issuing deployment's identity, e.g. `"https://vault.acme-hospital.org"`. */
+    issuer: string;
+};
+export type IssueCapabilityTokenOptions = {
+    /** Key id this token is signed under. Required so rotation has an explicit overlap window. */
+    keyId: string;
+    /** Issuing deployment's identity. Required so cross-issuer replay can be rejected at verify time. */
+    issuer: string;
+    /** Token lifetime in seconds. Defaults to 1800 (30 minutes). */
+    expirySeconds?: number;
+};
+/**
+ * Mint a stateless, HMAC-signed capability token scoped to one artifact (or
+ * session-anchor artifact). No server-side session table — verification is a
+ * pure function of `(token, secret)`, so the issuing deployment can rotate
+ * keys, change its TTL policy, or revoke at the artifact level entirely on
+ * its own schedule. See `createCapabilityAuthorize` to use this as the
+ * plugin's `authorize` hook directly.
+ */
+export declare function issueCapabilityToken(artifactId: string, secret: string, opts: IssueCapabilityTokenOptions): string;
+/** Look up the signing secret for a given key id. Return `null`/`undefined` for an unrecognized `kid`. */
+export type LookupSecret = (keyId: string) => string | null | undefined;
+export type VerifyCapabilityTokenOptions = {
+    /** Must match the token's `issuer` claim exactly. */
+    issuer: string;
+    /** Clock-skew tolerance in seconds applied to both `iat` and `exp` checks. Defaults to 30. */
+    clockToleranceSeconds?: number;
+};
+/**
+ * Verify a token minted by `issueCapabilityToken`. Returns the authorized
+ * `artifactId` on success, or `null` for any failure (malformed token,
+ * unknown `kid`, bad signature, expired, issued too far in the future, or
+ * issuer mismatch) — deliberately collapsed to one failure shape so callers
+ * can't accidentally branch on *why* a token failed and leak which part was
+ * wrong to an attacker.
+ */
+export declare function verifyCapabilityToken(token: string, lookupSecret: LookupSecret, opts: VerifyCapabilityTokenOptions): {
+    artifactId: string;
+} | null;
+/**
+ * Ready-made `authorize` hook backed by `verifyCapabilityToken`. Pass this
+ * directly as the plugin's `authorize` option for a secure-by-default setup
+ * with no custom auth code:
+ *
+ * ```ts
+ * await app.register(pulseVault, {
+ *   // ...
+ *   authorize: createCapabilityAuthorize((kid) => keys[kid] ?? null, {
+ *     issuer: "https://vault.acme-hospital.org",
+ *   }),
+ * });
+ * ```
+ *
+ * Authorizes the request if the token's `artifactId` matches either the
+ * artifact being acted on, or that artifact's `relatedTo` session anchor —
+ * so one token issued for a video also covers its captions and (under
+ * `uploadUnit: "beat"`) every beat and the pulse manifest uploaded in the
+ * same session, without minting a token per artifact.
+ */
+export declare function createCapabilityAuthorize(lookupSecret: LookupSecret, opts: VerifyCapabilityTokenOptions): PulseVaultAuthorize;
+//# sourceMappingURL=capability-token.d.ts.map

package/dist/lib/capability-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-token.d.ts","sourceRoot":"","sources":["../../src/lib/capability-token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAA8B,MAAM,gBAAgB,CAAC;AAEtF;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAqBF,MAAM,MAAM,2BAA2B,GAAG;IACxC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,GAChC,MAAM,CAWR;AAED,0GAA0G;AAC1G,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAExE,MAAM,MAAM,4BAA4B,GAAG;IACzC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,4BAA4B,GACjC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkC/B;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,4BAA4B,GACjC,mBAAmB,CAcrB"}