@mieweb/pulsevault 0.0.2 → 0.1.1

package/dist/core.js

@@ -0,0 +1,494 @@
+import send from '@fastify/send';
+import { createPulsevaultTusServer, pulseVaultTusContext, artifactIdFromUploadId, } from './lib/pulsevaultTus.js';
+import { pulseVaultError, statusCodeOf } from './lib/errors.js';
+import { isUuid } from './lib/uuid.js';
+import { consoleLogger } from './lib/request.js';
+import { parseUploadKind, UPLOAD_KINDS } from './storage/types.js';
+import { normalizeAllowedExtensions, validateBasePath, validateMaxUploadSize, validateUploadUnit, validateAllowedExtensions, warnIfUsingDeprecatedProjectHooks, composeValidatePayload, composeOnUploadComplete, } from './lib/options.js';
+/** Wire protocol version this release implements. See `/capabilities` and `PROTOCOL.md`. */
+export const PROTOCOL_VERSION = 1;
+const MIN_SUPPORTED_PROTOCOL_VERSION = 1;
+const MAX_SUPPORTED_PROTOCOL_VERSION = 1;
+/**
+ * Pull `artifactId` (or the legacy `videoid`/`projectid` aliases), `kind`,
+ * and `relatedTo` out of a raw `Upload-Metadata` header. Format is a
+ * comma-separated list of `<key> <base64-value>` pairs (tus v1 creation
+ * extension).
+ *
+ * Alias precedence is a fixed priority (`artifactId` beats `videoid` beats
+ * `projectid`, regardless of header order) so this always agrees with
+ * `namingFunction` in `lib/pulsevaultTus.ts` — which uses the same
+ * `?? `-chain precedence to decide what's actually reserved/written to
+ * storage. If these two disagreed, `authorize()` could validate ownership of
+ * a different artifactId than the one the upload actually lands under.
+ */
+function parseUploadMetadata(header) {
+    let artifactIdRaw;
+    let videoidRaw;
+    let projectidRaw;
+    let kind = 'video';
+    let relatedTo;
+    for (const pair of header.split(',')) {
+        const trimmed = pair.trim();
+        if (!trimmed)
+            continue;
+        const sep = trimmed.indexOf(' ');
+        if (sep < 0)
+            continue;
+        const key = trimmed.slice(0, sep);
+        const value = trimmed.slice(sep + 1).trim();
+        if (!value)
+            continue;
+        try {
+            const decoded = Buffer.from(value, 'base64').toString('utf8');
+            if (key === 'artifactId') {
+                artifactIdRaw ??= decoded;
+            }
+            else if (key === 'videoid') {
+                videoidRaw ??= decoded;
+            }
+            else if (key === 'projectid') {
+                projectidRaw ??= decoded;
+            }
+            else if (key === 'kind') {
+                kind = parseUploadKind(decoded);
+            }
+            else if (key === 'relatedTo' && !relatedTo) {
+                relatedTo = isUuid(decoded) ? decoded : undefined;
+            }
+        }
+        catch {
+            // ignore malformed base64
+        }
+    }
+    const candidate = (artifactIdRaw ?? videoidRaw ?? projectidRaw ?? '').trim();
+    const artifactId = isUuid(candidate) ? candidate : undefined;
+    return { artifactId, kind, relatedTo };
+}
+/**
+ * `@tus/server`'s `BaseHandler.getFileIdFromRequest` — the function that
+ * ultimately decides which upload a PATCH/HEAD/DELETE actually operates on —
+ * extracts its file id from the request URL's *last* `/`-delimited segment
+ * (`reExtractFileID = /([^/]+)\/?$/`), not from the first segment after
+ * `/upload/`. This MUST mirror that exact regex: a URL with extra path
+ * segments after the real id (Fastify's `/upload/*` route accepts them) would
+ * otherwise let `authorize()` see and approve one artifactId (whichever this
+ * function resolved) while `@tus/server` writes the request body against a
+ * *different* one (whichever it resolved) — an attacker holding a valid
+ * token for their own artifact could smuggle a second, victim artifactId as
+ * a trailing path segment and have their bytes land there instead, fully
+ * bypassing authorization for the artifact actually written to.
+ *
+ * Implemented with plain string ops (not the regex itself) because the
+ * unanchored-start regex is polynomial on adversarial inputs (CodeQL
+ * js/polynomial-redos). Semantics are identical: after stripping at most one
+ * trailing `/`, the match is the non-empty run of non-`/` characters at the
+ * end of the string, or no match if that run is empty (e.g. `a//`).
+ */
+function tusLastUrlSegment(url) {
+    const trimmed = url.endsWith('/') ? url.slice(0, -1) : url;
+    const segment = trimmed.slice(trimmed.lastIndexOf('/') + 1);
+    return segment.length > 0 ? segment : undefined;
+}
+/**
+ * Decode the tus file id (base64url-encoded, shaped `<kind>/<artifactId><ext>`
+ * by `namingFunction` in `lib/pulsevaultTus.ts`) that `@tus/server` itself
+ * will resolve a PATCH/HEAD/DELETE request to, and recover the artifactId via
+ * the exact same parser `onUploadFinish` uses — so this can never drift from
+ * what `@tus/server` actually operates on. See `tusLastUrlSegment` above
+ * for why this must match the *last* URL segment, not the first one after
+ * `/upload/`.
+ */
+function artifactIdFromTusUrl(url) {
+    const rawSegment = tusLastUrlSegment(url);
+    if (!rawSegment)
+        return undefined;
+    let lastSegment;
+    try {
+        lastSegment = decodeURIComponent(rawSegment);
+    }
+    catch {
+        return undefined;
+    }
+    let decoded;
+    try {
+        decoded = Buffer.from(lastSegment, 'base64url').toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+    return artifactIdFromUploadId(decoded);
+}
+/**
+ * Resolve the artifact kind for an artifactId from storage. Duck-typed so it
+ * works with any adapter (those without `getKind` return `"video"`).
+ */
+async function resolveStorageKind(storage, artifactId) {
+    const candidate = storage.getKind;
+    if (typeof candidate !== 'function')
+        return 'video';
+    const result = await candidate(artifactId);
+    return result ?? 'video';
+}
+/** Resolve the `relatedTo` artifact for an artifactId from storage, if the adapter supports it. */
+async function resolveStorageRelatedTo(storage, artifactId) {
+    const candidate = storage.getRelatedTo;
+    if (typeof candidate !== 'function')
+        return undefined;
+    const result = await candidate(artifactId);
+    return result ?? undefined;
+}
+function extractAuthzMessage(err) {
+    if (err instanceof Error && err.message)
+        return err.message;
+    return 'Forbidden';
+}
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(body));
+}
+/**
+ * Every response from a pulsevault route carries the wire protocol version
+ * it implements, so a client can detect "this server is too old/new for me"
+ * without a dedicated round-trip. Called at the top of each granular handler
+ * (rather than only in the aggregate `handler`) so it's also applied when a
+ * host framework — e.g. the Fastify adapter, which hijacks the reply and
+ * calls these directly — bypasses the aggregate router entirely. Must run
+ * before any `writeHead`/`end` call below: `setHeader` values merge into
+ * whatever headers object a later `writeHead` call passes.
+ */
+function stampProtocolVersion(res) {
+    res.setHeader('Protocol-Version', String(PROTOCOL_VERSION));
+}
+/** Same augmentation as `augment.ts`'s `FastifyRequest.pulseVault`, applied to a raw request. */
+function stashPulseVaultContext(req, ctx) {
+    req.pulseVault = ctx;
+}
+/**
+ * Build the framework-agnostic core: the same authorize/validatePayload/
+ * onUploadComplete/onArtifactEvent orchestration, tus glue, capabilities
+ * payload, and artifact GET/DELETE logic the Fastify plugin uses, operating
+ * on raw `(req, res)` instead of Fastify's `request`/`reply` wrappers. Both
+ * the Fastify plugin and this factory ultimately call into the same
+ * `lib/pulsevaultTus.js` tus server, so behavior can't drift between them.
+ */
+export function createPulseVaultCore(options) {
+    validateBasePath(options.basePath, 'basePath');
+    validateMaxUploadSize(options.maxUploadSize);
+    validateUploadUnit(options.uploadUnit);
+    validateAllowedExtensions(options.allowedExtensions);
+    warnIfUsingDeprecatedProjectHooks(options);
+    const { storage, basePath, maxUploadSize, cache, authorize, onArtifactEvent } = options;
+    const stripBasePath = options.stripBasePath ?? true;
+    const uploadUnit = options.uploadUnit ?? 'segment';
+    const allowedExtensions = normalizeAllowedExtensions(options.allowedExtensions);
+    const validatePayload = composeValidatePayload(options.validatePayload, options.validateProjectPayload);
+    const onUploadComplete = composeOnUploadComplete(options.onUploadComplete, options.onProjectUploadComplete);
+    const logger = options.logger ?? consoleLogger;
+    const tusPath = `${basePath}/upload`;
+    const tusServer = createPulsevaultTusServer({
+        storage,
+        tusPath,
+        maxSize: maxUploadSize,
+        allowedExtensions,
+        validatePayload,
+        onUploadComplete,
+        onArtifactEvent,
+        logger,
+    });
+    /**
+     * Run the consumer's `authorize` hook (if any) for a TUS request. Returns
+     * `true` iff the request may proceed; on rejection, this function already
+     * wrote the response.
+     */
+    const runAuthorize = async (req, res, phase) => {
+        let artifactId;
+        let kind = 'video';
+        let relatedTo;
+        if (phase === 'create') {
+            const meta = req.headers['upload-metadata'];
+            if (typeof meta === 'string') {
+                ({ artifactId, kind, relatedTo } = parseUploadMetadata(meta));
+            }
+        }
+        else {
+            artifactId = artifactIdFromTusUrl(req.url ?? '');
+            if (artifactId) {
+                kind = await resolveStorageKind(storage, artifactId);
+                relatedTo = await resolveStorageRelatedTo(storage, artifactId);
+            }
+        }
+        if (artifactId) {
+            stashPulseVaultContext(req, { artifactId, kind, relatedTo });
+        }
+        if (!authorize) {
+            return { ok: true, artifactId, kind, relatedTo };
+        }
+        if (!artifactId && phase === 'patch') {
+            // PROTOCOL.md §5.2: failing to resolve the artifactId for an in-flight
+            // upload request is an authorization failure — reject, don't fall
+            // through to "no artifactId to check, so allow".
+            logger.info({ url: req.url, phase }, 'pulsevault authorize rejected: unresolvable artifactId');
+            writeJson(res, 403, pulseVaultError('Unable to resolve artifact for authorization'));
+            return { ok: false };
+        }
+        if (!artifactId) {
+            return { ok: true, artifactId, kind, relatedTo };
+        }
+        try {
+            await authorize(req, { phase, artifactId, kind, relatedTo });
+            return { ok: true, artifactId, kind, relatedTo };
+        }
+        catch (err) {
+            const statusCode = statusCodeOf(err, 403);
+            const message = extractAuthzMessage(err);
+            logger.info({ err, artifactId, phase, statusCode }, 'pulsevault authorize rejected');
+            if (phase === 'create') {
+                await onArtifactEvent?.({ phase: 'authorize', artifactId, kind, reason: message });
+            }
+            writeJson(res, statusCode, pulseVaultError(message));
+            return { ok: false };
+        }
+    };
+    /**
+     * Fail closed on an unexpected handler error. Host frameworks call these
+     * handlers on a *hijacked* socket (e.g. Fastify's `reply.hijack()`), so a
+     * thrown error is never turned into a response by the framework — without
+     * this the socket would hang until the client/server timeout. If headers are
+     * already on the wire we can only destroy the socket; otherwise emit a 500.
+     */
+    const failClosed = (res, err, context) => {
+        logger.error({ err }, `pulsevault ${context} failed`);
+        if (res.headersSent || res.writableEnded) {
+            res.destroy();
+            return;
+        }
+        res.statusCode = 500;
+        res.setHeader('content-type', 'text/plain; charset=utf-8');
+        res.end('Internal Server Error');
+    };
+    const handleTus = async (req, res) => {
+        stampProtocolVersion(res);
+        // A client that drops the connection mid-request — a mobile app killed during a PATCH, a
+        // network reset, a cancelled upload — makes Node emit an 'error' ('aborted' / ECONNRESET) on
+        // the raw request (and sometimes response) stream. Node treats an unhandled 'error' event as
+        // fatal: with no listener it re-throws and crashes the whole process, killing every other
+        // in-flight upload. It fires from the socket-close handler on a later tick, so the try/catch
+        // below never sees it. Attach no-op listeners so an aborted connection is just a dropped
+        // request: @tus/server sees the truncated body, the stored offset simply doesn't advance, and
+        // the client resumes from the last persisted byte on its next PATCH.
+        req.on('error', () => { });
+        res.on('error', () => { });
+        const phase = req.method === 'POST' ? 'create' : 'patch';
+        try {
+            // Inside the try: runAuthorize does storage I/O (kind/relatedTo resolution)
+            // and header writes of its own — an adapter fault or a consumer error with
+            // a bogus statusCode there must fail closed too, not hang the hijacked socket.
+            const authz = await runAuthorize(req, res, phase);
+            if (!authz.ok)
+                return;
+            await pulseVaultTusContext.run({ request: req, artifactId: authz.artifactId }, () => tusServer.handle(req, res));
+        }
+        catch (err) {
+            failClosed(res, err, 'tus handler');
+        }
+    };
+    const handleCapabilities = async (_req, res) => {
+        stampProtocolVersion(res);
+        try {
+            writeJson(res, 200, {
+                protocolVersion: PROTOCOL_VERSION,
+                minSupportedVersion: MIN_SUPPORTED_PROTOCOL_VERSION,
+                maxSupportedVersion: MAX_SUPPORTED_PROTOCOL_VERSION,
+                uploadUnit,
+                kinds: [...UPLOAD_KINDS],
+                allowedExtensions,
+                maxUploadSize,
+                checksum: { algorithms: ['sha256', 'sha1', 'md5'] },
+            });
+        }
+        catch (err) {
+            failClosed(res, err, 'capabilities');
+        }
+    };
+    /**
+     * Shared prelude for the artifact GET/DELETE handlers: resolve `kind`/
+     * `relatedTo` from storage, stash the request context, then run `authorize`
+     * (if configured) for the given phase. Returns `undefined` (having already
+     * written the response) when validation fails or `authorize` rejects.
+     */
+    const prepareArtifactRequest = async (req, res, artifactId, phase, token) => {
+        if (!isUuid(artifactId)) {
+            writeJson(res, 400, pulseVaultError('`artifactId` must be a valid UUID'));
+            return undefined;
+        }
+        const kind = await resolveStorageKind(storage, artifactId);
+        const relatedTo = await resolveStorageRelatedTo(storage, artifactId);
+        stashPulseVaultContext(req, { artifactId, kind, relatedTo });
+        if (!authorize)
+            return { kind, relatedTo };
+        try {
+            await authorize(req, { phase, artifactId, kind, relatedTo, token });
+            return { kind, relatedTo };
+        }
+        catch (err) {
+            const statusCode = statusCodeOf(err, 403);
+            const message = extractAuthzMessage(err);
+            logger.info({ err, artifactId, phase, statusCode }, 'pulsevault authorize rejected');
+            await onArtifactEvent?.({ phase: 'authorize', artifactId, kind, reason: message });
+            writeJson(res, statusCode, pulseVaultError(message));
+            return undefined;
+        }
+    };
+    const handleArtifactDelete = async (req, res, artifactId) => {
+        stampProtocolVersion(res);
+        try {
+            const prepared = await prepareArtifactRequest(req, res, artifactId, 'delete');
+            if (!prepared)
+                return;
+            if (typeof storage.remove !== 'function') {
+                writeJson(res, 501, pulseVaultError('Storage adapter does not support delete'));
+                return;
+            }
+            const removed = await storage.remove(artifactId);
+            if (!removed) {
+                writeJson(res, 404, pulseVaultError('Artifact not found'));
+                return;
+            }
+            res.writeHead(204);
+            res.end();
+        }
+        catch (err) {
+            failClosed(res, err, 'artifact delete');
+        }
+    };
+    const handleArtifactGet = async (req, res, artifactId, token) => {
+        stampProtocolVersion(res);
+        try {
+            const prepared = await prepareArtifactRequest(req, res, artifactId, 'resolve', token);
+            if (!prepared)
+                return;
+            const resolved = await storage.resolve(artifactId);
+            if (!resolved) {
+                writeJson(res, 404, pulseVaultError('Artifact not found'));
+                return;
+            }
+            if (resolved.kind === 'redirect') {
+                res.writeHead(resolved.statusCode ?? 302, { Location: resolved.url });
+                res.end();
+                return;
+            }
+            const result = await send(req, resolved.filename, { root: resolved.root, ...cache });
+            if (result.type === 'error') {
+                writeJson(res, result.statusCode, pulseVaultError(result.metadata.error.message));
+                return;
+            }
+            const headers = { ...result.headers };
+            // If the storage adapter provided an explicit content type (e.g. for
+            // non-standard extensions like `.pulse`), override what @fastify/send
+            // would otherwise infer from the filename.
+            if (resolved.contentType) {
+                headers['content-type'] = resolved.contentType;
+            }
+            res.writeHead(result.statusCode, headers);
+            // Headers are on the wire now, so a mid-stream read error (file removed
+            // after stat, disk error) can't become a 500 — destroy the socket instead
+            // of letting an unhandled 'error' crash the process. Destroy the source on
+            // client disconnect so the file descriptor is never leaked.
+            result.stream.on('error', (err) => failClosed(res, err, 'artifact stream'));
+            // A client that aborts mid-download makes the *response* stream emit its own
+            // 'error' (ECONNRESET / EPIPE). `.pipe` doesn't forward that, and an unhandled
+            // 'error' on `res` is fatal to the process — so swallow it (the 'close' handler
+            // above already tears down the source and reclaims the fd).
+            res.on('error', () => { });
+            res.on('close', () => result.stream.destroy());
+            result.stream.pipe(res);
+        }
+        catch (err) {
+            failClosed(res, err, 'artifact get');
+        }
+    };
+    const handler = async (req, res, next) => {
+        // (Protocol-Version is stamped by each granular handler below, so it's
+        // applied consistently whether reached through this router or called
+        // directly by a host framework's own routing.)
+        const notFound = () => {
+            if (next) {
+                next();
+                return;
+            }
+            res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Not Found');
+        };
+        // A raw socket can present a request-target `new URL` refuses to parse
+        // (e.g. an absolute-form or garbage target from a non-HTTP client probing
+        // the port) — that's the client's malformed request, not our 500, and it
+        // must not escape as an uncaught throw on a hijacked/raw response.
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://internal');
+        }
+        catch {
+            res.writeHead(400, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Bad Request');
+            return;
+        }
+        let pathname = url.pathname;
+        if (stripBasePath && basePath !== '') {
+            if (pathname === basePath) {
+                pathname = '';
+            }
+            else if (pathname.startsWith(`${basePath}/`)) {
+                pathname = pathname.slice(basePath.length);
+            }
+            else {
+                notFound();
+                return;
+            }
+        }
+        if (pathname === '')
+            pathname = '/';
+        if (pathname === '/upload' || pathname.startsWith('/upload/')) {
+            await handleTus(req, res);
+            return;
+        }
+        if (pathname === '/capabilities' && req.method === 'GET') {
+            await handleCapabilities(req, res);
+            return;
+        }
+        const artifactMatch = pathname.match(/^\/artifacts\/([^/]+)$/);
+        if (artifactMatch?.[1]) {
+            const artifactId = artifactMatch[1];
+            if (req.method === 'GET') {
+                await handleArtifactGet(req, res, artifactId, url.searchParams.get('token') ?? undefined);
+                return;
+            }
+            if (req.method === 'DELETE') {
+                await handleArtifactDelete(req, res, artifactId);
+                return;
+            }
+        }
+        notFound();
+    };
+    return {
+        handler,
+        shutdown: async () => {
+            await storage.shutdown?.();
+        },
+        handleTus,
+        handleCapabilities,
+        handleArtifactGet,
+        handleArtifactDelete,
+    };
+}
+// Re-exported so a non-Fastify consumer never needs to import from both `.`
+// and `./core` for a normal setup — these are already framework-agnostic
+// and identical to what the `.` (Fastify) entry point re-exports.
+export { createLocalStorage } from './storage/local.js';
+export { createS3Storage } from './storage/s3.js';
+export { sniffMp4, createMp4Sniffer, createS3Mp4Sniffer } from './lib/magic.js';
+export { buildUploadLink } from './lib/deeplinks.js';
+export { issueCapabilityToken, verifyCapabilityToken, createCapabilityAuthorize, } from './lib/capability-token.js';
+export { createChecksumValidator, createS3ChecksumValidator, parseChecksumMetadata, } from './lib/checksum.js';
+export {} from './lib/request.js';
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,GAGvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAyB,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAE1B,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAwFzC;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAAC,MAAc;IAKzC,IAAI,aAAiC,CAAC;IACtC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,GAAe,OAAO,CAAC;IAC/B,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;gBACzB,aAAa,KAAK,OAAO,CAAC;YAC5B,CAAC;iBAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,UAAU,KAAK,OAAO,CAAC;YACzB,CAAC;iBAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/B,YAAY,KAAK,OAAO,CAAC;YAC3B,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7C,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,aAAa,IAAI,UAAU,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAA0B,EAC1B,UAAkB;IAElB,MAAM,SAAS,GAAI,OAAiC,CAAC,OAAO,CAAC;IAC7D,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,MAAM,GAAG,MAAO,SAAwD,CAAC,UAAU,CAAC,CAAC;IAC3F,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,uBAAuB,CACpC,OAA0B,EAC1B,UAAkB;IAElB,MAAM,SAAS,GAAI,OAAsC,CAAC,YAAY,CAAC;IACvE,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,MAAO,SAAoD,CAAC,UAAU,CAAC,CAAC;IACvF,OAAO,MAAM,IAAI,SAAS,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC5D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,GAAmB,EAAE,UAAkB,EAAE,IAAa;IACvE,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAmB;IAC/C,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC9D,CAAC;AAID,iGAAiG;AACjG,SAAS,sBAAsB,CAAC,GAAoB,EAAE,GAA6B;IAChF,GAAmE,CAAC,UAAU,GAAG,GAAG,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7C,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IACnD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,sBAAsB,CAC5C,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,sBAAsB,CAC/B,CAAC;IACF,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,uBAAuB,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAE/C,MAAM,OAAO,GAAG,GAAG,QAAQ,SAAS,CAAC;IACrC,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC1C,OAAO;QACP,OAAO;QACP,OAAO,EAAE,aAAa;QACtB,iBAAiB;QACjB,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,MAAM;KACP,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,YAAY,GAAG,KAAK,EACxB,GAAoB,EACpB,GAAmB,EACnB,KAAyB,EAIzB,EAAE;QACF,IAAI,UAA8B,CAAC;QACnC,IAAI,IAAI,GAAe,OAAO,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACrD,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,sBAAsB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACrC,uEAAuE;YACvE,kEAAkE;YAClE,iDAAiD;YACjD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,wDAAwD,CAAC,CAAC;YAC/F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACrF,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,UAAU,GAAG,CAAC,GAAmB,EAAE,GAAY,EAAE,OAAe,EAAQ,EAAE;QAC9E,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,cAAc,OAAO,SAAS,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACnF,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,qEAAqE;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAuB,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7E,IAAI,CAAC;YACH,4EAA4E;YAC5E,2EAA2E;YAC3E,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO;YAEtB,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAClF,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAC3B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAqB,EAAE,GAAmB,EAAiB,EAAE;QAC7F,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,eAAe,EAAE,gBAAgB;gBACjC,mBAAmB,EAAE,8BAA8B;gBACnD,mBAAmB,EAAE,8BAA8B;gBACnD,UAAU;gBACV,KAAK,EAAE,CAAC,GAAG,YAAY,CAAC;gBACxB,iBAAiB;gBACjB,aAAa;gBACb,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,GAAoB,EACpB,GAAmB,EACnB,UAAkB,EAClB,KAA2B,EAC3B,KAAc,EAC4D,EAAE;QAC5E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,mCAAmC,CAAC,CAAC,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrE,sBAAsB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7D,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACrF,MAAM,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAG,KAAK,EAChC,GAAoB,EACpB,GAAmB,EACnB,UAAkB,EACH,EAAE;QACjB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC9E,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACzC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,yCAAyC,CAAC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAC7B,GAAoB,EACpB,GAAmB,EACnB,UAAkB,EAClB,KAAyB,EACV,EAAE;QACjB,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACtF,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACtE,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAErF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,qEAAqE;YACrE,sEAAsE;YACtE,2CAA2C;YAC3C,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,OAAO,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;YACjD,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1C,wEAAwE;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC5E,6EAA6E;YAC7E,+EAA+E;YAC/E,gFAAgF;YAChF,4DAA4D;YAC5D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,GAAoB,EACpB,GAAmB,EACnB,IAAkB,EACH,EAAE;QACjB,uEAAuE;QACvE,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC5B,IAAI,aAAa,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACrC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC/C,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,QAAQ,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,EAAE;YAAE,QAAQ,GAAG,GAAG,CAAC;QAEpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;gBAC1F,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,CAAC;QACD,SAAS;QACT,kBAAkB;QAClB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAkBlD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAiD,MAAM,kBAAkB,CAAC"}

package/dist/lib/authorize.d.ts

@@ -0,0 +1,19 @@
+import type { PulseVaultRequest } from './request.js';
+import type { UploadKind } from '../storage/types.js';
+export type PulseVaultAuthorizePhase = 'create' | 'patch' | 'resolve' | 'delete';
+export type PulseVaultAuthorizeContext = {
+    phase: PulseVaultAuthorizePhase;
+    artifactId: string;
+    /** Artifact kind: `"video"`, `"project"`, `"captions"`, or `"thumbnail"`. Always present. */
+    kind: UploadKind;
+    /** Bearer / query-string token forwarded from the watch URL, if present. Only populated during the `"resolve"` phase. */
+    token?: string;
+    /**
+     * The session-anchor artifact this one declared via `Upload-Metadata.relatedTo`,
+     * if any. Lets `createCapabilityAuthorize` authorize an artifact against a
+     * token scoped to the session it belongs to rather than its own id.
+     */
+    relatedTo?: string;
+};
+export type PulseVaultAuthorize = (request: PulseVaultRequest, ctx: PulseVaultAuthorizeContext) => void | Promise<void>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/lib/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/lib/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,wBAAwB,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,IAAI,EAAE,UAAU,CAAC;IACjB,yHAAyH;IACzH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,0BAA0B,KAC5B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/lib/authorize.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorize.js.map

package/dist/lib/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/lib/authorize.ts"],"names":[],"mappings":""}

package/dist/lib/capability-token.d.ts

@@ -0,0 +1,80 @@
+import type { PulseVaultAuthorize } from './authorize.js';
+/**
+ * Claims signed into a capability token. `kid` lets a secret be rotated with
+ * an overlap window (old + new key both verify) instead of instantly
+ * invalidating every outstanding token; `iat` closes a clock-skew gap where
+ * signing only `exp` would let a slow server clock accept an already-expired
+ * token; `issuer` binds the token to the issuing deployment's identity so a
+ * secret accidentally shared between two independent orgs can't be replayed
+ * across them.
+ */
+export type CapabilityTokenClaims = {
+    /** The artifact (or session-anchor artifact — see `relatedTo`) this token authorizes. */
+    artifactId: string;
+    /** Issued-at, seconds since epoch. */
+    iat: number;
+    /** Expiry, seconds since epoch. */
+    exp: number;
+    /** Key id, looked up via `lookupSecret` at verify time. */
+    kid: string;
+    /** Issuing deployment's identity, e.g. `"https://vault.acme-hospital.org"`. */
+    issuer: string;
+};
+export type IssueCapabilityTokenOptions = {
+    /** Key id this token is signed under. Required so rotation has an explicit overlap window. */
+    keyId: string;
+    /** Issuing deployment's identity. Required so cross-issuer replay can be rejected at verify time. */
+    issuer: string;
+    /** Token lifetime in seconds. Defaults to 1800 (30 minutes). */
+    expirySeconds?: number;
+};
+/**
+ * Mint a stateless, HMAC-signed capability token scoped to one artifact (or
+ * session-anchor artifact). No server-side session table — verification is a
+ * pure function of `(token, secret)`, so the issuing deployment can rotate
+ * keys, change its TTL policy, or revoke at the artifact level entirely on
+ * its own schedule. See `createCapabilityAuthorize` to use this as the
+ * plugin's `authorize` hook directly.
+ */
+export declare function issueCapabilityToken(artifactId: string, secret: string, opts: IssueCapabilityTokenOptions): string;
+/** Look up the signing secret for a given key id. Return `null`/`undefined` for an unrecognized `kid`. */
+export type LookupSecret = (keyId: string) => string | null | undefined;
+export type VerifyCapabilityTokenOptions = {
+    /** Must match the token's `issuer` claim exactly. */
+    issuer: string;
+    /** Clock-skew tolerance in seconds applied to both `iat` and `exp` checks. Defaults to 30. */
+    clockToleranceSeconds?: number;
+};
+/**
+ * Verify a token minted by `issueCapabilityToken`. Returns the authorized
+ * `artifactId` on success, or `null` for any failure (malformed token,
+ * unknown `kid`, bad signature, expired, issued too far in the future, or
+ * issuer mismatch) — deliberately collapsed to one failure shape so callers
+ * can't accidentally branch on *why* a token failed and leak which part was
+ * wrong to an attacker.
+ */
+export declare function verifyCapabilityToken(token: string, lookupSecret: LookupSecret, opts: VerifyCapabilityTokenOptions): {
+    artifactId: string;
+} | null;
+/**
+ * Ready-made `authorize` hook backed by `verifyCapabilityToken`. Pass this
+ * directly as the plugin's `authorize` option for a secure-by-default setup
+ * with no custom auth code:
+ *
+ * ```ts
+ * await app.register(pulseVault, {
+ *   // ...
+ *   authorize: createCapabilityAuthorize((kid) => keys[kid] ?? null, {
+ *     issuer: "https://vault.acme-hospital.org",
+ *   }),
+ * });
+ * ```
+ *
+ * Authorizes the request if the token's `artifactId` matches either the
+ * artifact being acted on, or that artifact's `relatedTo` session anchor —
+ * so one token issued for a video also covers its captions/manifest/thumbnail
+ * and (under `uploadUnit: "segment"`) every clip and the ordering manifest
+ * uploaded in the same session, without minting a token per artifact.
+ */
+export declare function createCapabilityAuthorize(lookupSecret: LookupSecret, opts: VerifyCapabilityTokenOptions): PulseVaultAuthorize;
+//# sourceMappingURL=capability-token.d.ts.map

package/dist/lib/capability-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-token.d.ts","sourceRoot":"","sources":["../../src/lib/capability-token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAA8B,MAAM,gBAAgB,CAAC;AAEtF;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAqBF,MAAM,MAAM,2BAA2B,GAAG;IACxC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,2BAA2B,GAChC,MAAM,CAWR;AAED,0GAA0G;AAC1G,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAExE,MAAM,MAAM,4BAA4B,GAAG;IACzC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,4BAA4B,GACjC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuC/B;AAgBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,4BAA4B,GACjC,mBAAmB,CAcrB"}