npm - @nexus_js/server - Versions diffs - 0.7.4 → 0.8.0 - Mend

@nexus_js/server 0.7.4 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (27) hide show

package/dist/actions.d.ts CHANGED Viewed

@@ -77,6 +77,12 @@ export interface ActionOptions {
     schema?: {
         parse: (data: unknown) => unknown;
     };
+    /**
+     * Maximum request body size in bytes. Default: 10 MB.
+     * Lower this for actions that only receive small form payloads (e.g. login forms).
+     * Set to 0 to disable the limit (not recommended).
+     */
+    maxBodyBytes?: number;
 }
 export interface ActionResult<T = unknown> {
     data?: T;
@@ -131,13 +137,28 @@ export declare class ActionAbortedError extends ActionError {
  */
 export declare function handleActionRequest(request: Request): Promise<Response>;
 /**
- * Validates that a request comes from a trusted Nexus client.
- * Checks x-nexus-action header and CSRF token.
+ * Validates that a request comes from a trusted Nexus client (inner CSRF check
+ * used by `createAction` wrappers). Verifies:
+ *  1. `x-nexus-action` custom header — cross-origin requests cannot add this
+ *     without a CORS preflight the server will reject.
+ *  2. `Origin` / `Referer` header sanity check — additional signal against
+ *     misconfigured CORS or non-standard clients.
  */
 export declare function validateRequest(ctx: NexusContext): Promise<void>;
 export { generateActionToken, validateActionToken, extractSessionId, generateSessionId } from './csrf.js';
 export { createRateLimiter, RateLimitError, parseWindow } from './rate-limit.js';
 export type { RateLimitConfig, RateLimitResult, RateLimiter } from './rate-limit.js';
+/**
+ * Returns `true` when `url` is a safe **public** `http:` / `https:` target for
+ * server-side `fetch` (not loopback, RFC1918, link-local, metadata IPs, etc.).
+ * Use before `fetch(userUrl)` to reduce blind SSRF risk.
+ */
+export declare function isSafeUrl(url: string): boolean;
+/**
+ * Returns `true` when a URL resolves to a private, loopback, or link-local
+ * address. Inverse of {@link isSafeUrl} for `http:` / `https:`.
+ */
+export declare function isInternalUrl(url: string): boolean;
 /**
  * Client-side AbortController factory.
  * Use this in island code to cancel in-flight action fetches

package/dist/actions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,~~EAIL~~,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;~~AAGzB~~,MAAM,MAAM,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KACxC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;KACnC,CAAC;~~CACH~~;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAyDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,EAC5D,QAAQ,EACJ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC5D,UAAU,GAAE,aAAkB,GAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAqC3B;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC9B,IAAI,GAAE,aAAkB,GACvB,IAAI,CAKN;AAED,8FAA8F;AAC9F,wBAAgB,wBAAwB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE9D;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM;aACd,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,MAAM,GAAE,MAAY,EACpB,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,WAAW;;CAIlD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,~~CAuS7E~~;AAED~~;;;GAGG~~;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,~~CAKtE~~;AAGD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;~~AAIrF~~;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,YAAuB,GAChC;IACD,GAAG,EAAE,MAAM,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CAyBA"}
1	+ {"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAKzB,MAAM,MAAM,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KACxC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;KACnC,CAAC;IACF;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAyDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,EAC5D,QAAQ,EACJ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC5D,UAAU,GAAE,aAAkB,GAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAqC3B;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC9B,IAAI,GAAE,aAAkB,GACvB,IAAI,CAKN;AAED,8FAA8F;AAC9F,wBAAgB,wBAAwB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE9D;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM;aACd,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,MAAM,GAAE,MAAY,EACpB,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,WAAW;;CAIlD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsY7E;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBtE;AAGD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAErF;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ9C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAkClD;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,YAAuB,GAChC;IACD,GAAG,EAAE,MAAM,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CAyBA"}

package/dist/actions.js CHANGED Viewed

@@ -30,8 +30,10 @@
 import { createContext, NotFoundSignal, RedirectSignal } from './context.js';
 import { serialize, deserialize } from '@nexus_js/serialize';
 import { validateActionToken, extractSessionId, ACTION_TOKEN_HEADER, } from './csrf.js';
-import { createRateLimiter, registerLimiter, RateLimitError, } from './rate-limit.js';
+import { createRateLimiter, registerLimiter, getLimiter, RateLimitError, } from './rate-limit.js';
+import { randomUUID } from 'node:crypto';
 import { emitDevRadar, newTraceId, sanitizeTelemetryValue } from './devradar.js';
+import { getExpectedNexusBuildId } from './build-id.js';
 const ACTION_PREFIX = '/_nexus/action/';
 const idempotencyCache = new Map();
 const IDEMPOTENCY_TTL = 30_000; // 30 seconds
@@ -163,54 +165,122 @@ export async function handleActionRequest(request) {
             headers: { allow: 'POST' },
         });
     }
-    const actionName = url.pathname.slice(ACTION_PREFIX.length);
+    // ── Guard: opaque (null) Origin ────────────────────────────────────────────
+    // Sandboxed iframes (<iframe sandbox> without allow-same-origin) and data:
+    // URIs send the string "null" as the Origin header. This is never a
+    // legitimate same-origin action call and must be rejected before any CSRF
+    // header check — otherwise the custom-header tier can be bypassed.
+    const rawOrigin = request.headers.get('origin');
+    if (rawOrigin === 'null') {
+        emitDevRadar({
+            type: 'security:audit',
+            payload: { kind: 'csrf_blocked', message: 'Opaque (null) origin rejected', action: '?' },
+        });
+        return jsonResponse({ error: 'Forbidden: opaque origin', status: 403, code: 'OPAQUE_ORIGIN' }, 403);
+    }
+    // ── Guard: action name validation ──────────────────────────────────────────
+    // Ensure the action name extracted from the URL only contains characters that
+    // can appear in a valid registered action name. Rejects path-traversal
+    // sequences (../../ etc.) and injection attempts before any registry lookup.
+    const rawActionName = url.pathname.slice(ACTION_PREFIX.length);
+    if (!/^[\w][\w.-]*$/.test(rawActionName) || rawActionName.includes('..')) {
+        return jsonResponse({ error: 'Invalid action name', status: 400, code: 'INVALID_ACTION_NAME' }, 400);
+    }
+    const actionName = rawActionName;
     const registered = actionRegistry.get(actionName);
     if (!registered) {
         return jsonResponse({ error: `Action "${actionName}" not found`, status: 404 }, 404);
     }
-    const { fn, opts } = registered;
-    const race = opts.race ?? 'cancel';
-    const timeout = opts.timeout ?? 30_000;
-    // ── CSRF token validation ──────────────────────────────────────────────────
-    if (opts.csrf !== false) {
-        const token = request.headers.get(ACTION_TOKEN_HEADER);
-        const secret = process.env['NEXUS_SECRET'] ?? 'nexus-dev-secret-change-me';
-        const sessionId = extractSessionId(request);
-        if (!token) {
+    // ── Build ID (client–server contract) ─────────────────────────────────────
+    // When `.nexus/build-id.json` exists (after `nexus build`), every action call
+    // must carry `x-nexus-build-id` matching that file. Stale tabs from a prior
+    // deploy get 412 so the runtime can reload and pick up new action signatures.
+    const expectedBuildId = getExpectedNexusBuildId();
+    if (expectedBuildId !== null) {
+        const sent = request.headers.get('x-nexus-build-id') ?? '';
+        if (sent !== expectedBuildId) {
             emitDevRadar({
                 type: 'security:audit',
                 payload: {
-                    kind: 'csrf_blocked',
-                    message: 'Missing action token',
+                    kind: 'build_mismatch',
+                    message: 'x-nexus-build-id does not match deployed build',
                     action: actionName,
                 },
             });
             return jsonResponse({
-                error: 'Missing action token — possible CSRF attack',
-                status: 403,
-                code: 'MISSING_CSRF_TOKEN',
-            }, 403);
+                error: 'Application was updated. Please reload the page.',
+                status: 412,
+                code: 'BUILD_MISMATCH',
+            }, 412);
         }
-        const validation = validateActionToken(token, sessionId, actionName, secret);
-        if (!validation.valid) {
+    }
+    const { fn, opts } = registered;
+    const race = opts.race ?? 'cancel';
+    const timeout = opts.timeout ?? 30_000;
+    // ── CSRF protection (dual-tier) ────────────────────────────────────────────
+    //
+    // Tier 1 — Custom header (default): Browsers cannot add arbitrary headers to
+    //   cross-origin requests without a CORS preflight the server will reject.
+    //   Requiring `x-nexus-action: 1` blocks all form-based CSRF attacks from
+    //   foreign origins without needing token generation on the server.
+    //
+    // Tier 2 — HMAC token (opt-in): When `x-nexus-action-token` is present the
+    //   server also validates the full HMAC-SHA256 signed, single-use, session-
+    //   bound token (generated via `generateActionToken`). This additionally
+    //   protects against same-origin XSS token theft.
+    //
+    // Flow:
+    //   token present  → Tier 2 full validation (strongest)
+    //   header present, no token → Tier 1 header check (standard)
+    //   neither present → 403 CSRF block
+    if (opts.csrf !== false) {
+        const token = request.headers.get(ACTION_TOKEN_HEADER);
+        const nexusHeader = request.headers.get('x-nexus-action');
+        if (token) {
+            // Tier 2: full HMAC validation
+            const secret = process.env['NEXUS_SECRET'] ?? 'nexus-dev-secret-change-me';
+            const sessionId = extractSessionId(request);
+            const validation = validateActionToken(token, sessionId, actionName, secret);
+            if (!validation.valid) {
+                emitDevRadar({
+                    type: 'security:audit',
+                    payload: {
+                        kind: validation.replayed ? 'replay' : 'csrf_blocked',
+                        message: validation.reason ?? 'Invalid action token',
+                        action: actionName,
+                    },
+                });
+                return jsonResponse({
+                    error: validation.reason ?? 'Invalid action token',
+                    status: 403,
+                    code: validation.replayed ? 'REPLAY_ATTACK' : 'INVALID_CSRF_TOKEN',
+                }, 403);
+            }
+        }
+        else if (!nexusHeader) {
+            // Neither token nor custom header → CSRF attack or missing client header
             emitDevRadar({
                 type: 'security:audit',
                 payload: {
-                    kind: validation.replayed ? 'replay' : 'csrf_blocked',
-                    message: validation.reason ?? 'Invalid action token',
+                    kind: 'csrf_blocked',
+                    message: 'Missing x-nexus-action header — possible CSRF attack',
                     action: actionName,
                 },
             });
             return jsonResponse({
-                error: validation.reason ?? 'Invalid action token',
+                error: 'Missing x-nexus-action header — possible CSRF attack',
                 status: 403,
-                code: validation.replayed ? 'REPLAY_ATTACK' : 'INVALID_CSRF_TOKEN',
+                code: 'MISSING_CSRF_HEADER',
             }, 403);
         }
+        // Tier 1 satisfied: nexusHeader present, no token → header-based CSRF protection
     }
     // ── Rate limiting ──────────────────────────────────────────────────────────
-    if (opts.rateLimit) {
-        const limiter = createRateLimiter(opts.rateLimit);
+    // Use the pre-registered limiter (created once at registerAction time).
+    // Previously, a new limiter instance was created per-request, which reset
+    // the sliding-window state and made rate limiting completely ineffective.
+    const limiter = getLimiter(actionName);
+    if (limiter) {
         const result = limiter.check(request);
         if (!result.allowed) {
             emitDevRadar({
@@ -294,7 +364,7 @@ export async function handleActionRequest(request) {
     const startTime = Date.now();
     try {
         // Deserialize input using Nexus transport (preserves Date, Map, Set, etc.)
-        const input = await deserializeInput(request);
+        const input = await deserializeInput(request, opts.maxBodyBytes ?? MAX_ACTION_BODY_BYTES);
         emitDevRadar({
             type: 'action:call',
             payload: {
@@ -399,17 +469,31 @@ export async function handleActionRequest(request) {
             });
             return jsonResponse({ error: err.message, status: err.status, code: err.code }, err.status);
         }
+        const errorId = randomUUID();
+        const mask = process.env['NEXUS_EXPOSE_ERRORS'] !== 'true' &&
+            process.env['NODE_ENV'] === 'production';
+        console.error(`[Nexus Action ${errorId}] "${actionName}" failed:`, err);
         emitDevRadar({
             type: 'action:error',
             payload: {
                 id: traceId,
                 name: actionName,
-                error: err instanceof Error ? err.message : String(err),
+                error: mask ? 'Internal Server Error' : (err instanceof Error ? err.message : String(err)),
                 duration: Date.now() - startTime,
+                ...(mask ? { errorId } : {}),
             },
         });
-        console.error(`[Nexus Action] "${actionName}" failed:`, err);
-        return jsonResponse({ error: 'Internal Server Error', status: 500 }, 500);
+        if (mask) {
+            return jsonResponse({
+                error: 'Internal Server Error',
+                status: 500,
+                errorId,
+            }, 500);
+        }
+        return jsonResponse({
+            error: err instanceof Error ? err.message : String(err),
+            status: 500,
+        }, 500);
     }
     finally {
         clearTimeout(timeoutId);
@@ -418,18 +502,90 @@ export async function handleActionRequest(request) {
     }
 }
 /**
- * Validates that a request comes from a trusted Nexus client.
- * Checks x-nexus-action header and CSRF token.
+ * Validates that a request comes from a trusted Nexus client (inner CSRF check
+ * used by `createAction` wrappers). Verifies:
+ *  1. `x-nexus-action` custom header — cross-origin requests cannot add this
+ *     without a CORS preflight the server will reject.
+ *  2. `Origin` / `Referer` header sanity check — additional signal against
+ *     misconfigured CORS or non-standard clients.
  */
 export async function validateRequest(ctx) {
     const nexusHeader = ctx.request.headers.get('x-nexus-action');
     if (!nexusHeader) {
-        throw new ActionError('Missing Nexus action header', 403, 'MISSING_HEADER');
+        throw new ActionError('Missing x-nexus-action header', 403, 'MISSING_HEADER');
+    }
+    // Origin / Referer check: block requests that carry an explicit foreign origin.
+    // Same-origin and same-site fetch() calls either omit Origin or match the host.
+    const origin = ctx.request.headers.get('origin');
+    const referer = ctx.request.headers.get('referer');
+    const host = ctx.request.headers.get('host') ?? '';
+    const suspectOrigin = origin && !origin.includes(host.split(':')[0] ?? host);
+    const suspectReferer = !origin && referer && !referer.includes(host.split(':')[0] ?? host);
+    if (suspectOrigin || suspectReferer) {
+        throw new ActionError(`Cross-origin action request blocked (host: ${host})`, 403, 'CROSS_ORIGIN_BLOCKED');
     }
 }
 // Re-export security primitives for use in app code
 export { generateActionToken, validateActionToken, extractSessionId, generateSessionId } from './csrf.js';
 export { createRateLimiter, RateLimitError, parseWindow } from './rate-limit.js';
+/**
+ * Returns `true` when `url` is a safe **public** `http:` / `https:` target for
+ * server-side `fetch` (not loopback, RFC1918, link-local, metadata IPs, etc.).
+ * Use before `fetch(userUrl)` to reduce blind SSRF risk.
+ */
+export function isSafeUrl(url) {
+    try {
+        const u = new URL(url);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:')
+            return false;
+    }
+    catch {
+        return false;
+    }
+    return !isInternalUrl(url);
+}
+/**
+ * Returns `true` when a URL resolves to a private, loopback, or link-local
+ * address. Inverse of {@link isSafeUrl} for `http:` / `https:`.
+ */
+export function isInternalUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false; // unparseable URLs are not our SSRF concern — let the caller decide
+    }
+    // Only http/https are fetched in typical web actions; block everything else
+    // (file://, ftp://, etc.) as they access local resources.
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return true;
+    const h = parsed.hostname.toLowerCase();
+    // Loopback
+    if (h === 'localhost' || h === '127.0.0.1' || h === '::1')
+        return true;
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h))
+        return true;
+    // Link-local (AWS/GCP/Azure metadata service lives at 169.254.169.254)
+    if (h.startsWith('169.254.'))
+        return true;
+    if (h === 'fe80::1' || h.startsWith('fe80:'))
+        return true;
+    // RFC 1918 private ranges
+    if (h.startsWith('10.'))
+        return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(h))
+        return true;
+    if (h.startsWith('192.168.'))
+        return true;
+    // Unique local IPv6
+    if (/^fd[0-9a-f]{2}:/i.test(h) || h.startsWith('fc'))
+        return true;
+    // Unspecified / broadcast
+    if (h === '0.0.0.0' || h === '255.255.255.255')
+        return true;
+    return false;
+}
 // ── Client-side race guard ────────────────────────────────────────────────────
 /**
  * Client-side AbortController factory.
@@ -470,10 +626,71 @@ export function createActionGuard(name, strategy = 'cancel') {
     };
 }
 // ── Helpers ───────────────────────────────────────────────────────────────────
-async function deserializeInput(request) {
+/** Maximum request body for a single server action (10 MB). Override per-action via opts.maxBodyBytes. */
+const MAX_ACTION_BODY_BYTES = 10 * 1_024 * 1_024;
+/** Maximum JSON object nesting depth. Prevents CPU DoS via pathological `{"a":{"b":{…}}}` inputs. */
+const MAX_JSON_DEPTH = 10;
+/** Maximum number of JSON object keys across all nesting levels. Prevents key-explosion attacks. */
+const MAX_JSON_KEYS = 1_000;
+/**
+ * Walks the raw JSON text character-by-character (O(n)) tracking nesting depth and
+ * key count WITHOUT running the full parser. Throws ActionError before `JSON.parse`
+ * touches the data — prevents CPU DoS from deeply nested or key-explosion payloads
+ * that fit within MAX_ACTION_BODY_BYTES but would block the event loop for seconds.
+ */
+function assertJsonComplexity(text) {
+    let depth = 0;
+    let keys = 0;
+    let inStr = false;
+    let esc = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (esc) {
+            esc = false;
+            continue;
+        }
+        if (ch === '\\' && inStr) {
+            esc = true;
+            continue;
+        }
+        if (ch === '"') {
+            inStr = !inStr;
+            continue;
+        }
+        if (inStr) {
+            continue;
+        }
+        if (ch === '{' || ch === '[') {
+            if (++depth > MAX_JSON_DEPTH) {
+                throw new ActionError(`JSON nesting too deep (limit ${MAX_JSON_DEPTH} levels)`, 400, 'JSON_TOO_DEEP');
+            }
+        }
+        else if (ch === '}' || ch === ']') {
+            depth--;
+        }
+        else if (ch === ':') {
+            if (++keys > MAX_JSON_KEYS) {
+                throw new ActionError(`JSON too complex (limit ${MAX_JSON_KEYS} keys)`, 400, 'JSON_TOO_COMPLEX');
+            }
+        }
+    }
+}
+async function deserializeInput(request, maxBytes = MAX_ACTION_BODY_BYTES) {
+    // DoS protection: reject oversized bodies before reading any bytes.
+    // Prevents memory exhaustion from clients that stream arbitrarily large payloads.
+    const cl = parseInt(request.headers.get('content-length') ?? '0', 10);
+    if (Number.isFinite(cl) && cl > maxBytes) {
+        throw new ActionError(`Request body too large (${cl} bytes, limit ${maxBytes})`, 413, 'PAYLOAD_TOO_LARGE');
+    }
     const contentType = request.headers.get('content-type') ?? '';
     if (contentType.includes('application/json')) {
         const text = await request.text();
+        if (text.length > maxBytes) {
+            throw new ActionError('Request body too large', 413, 'PAYLOAD_TOO_LARGE');
+        }
+        // Complexity guard: run BEFORE the parser so pathological payloads (deeply
+        // nested or key-explosion) are rejected without blocking the event loop.
+        assertJsonComplexity(text);
         try {
             return deserialize(text);
         }
@@ -485,7 +702,11 @@ async function deserializeInput(request) {
         contentType.includes('application/x-www-form-urlencoded')) {
         return request.formData();
     }
-    return request.text();
+    const text = await request.text();
+    if (text.length > maxBytes) {
+        throw new ActionError('Request body too large', 413, 'PAYLOAD_TOO_LARGE');
+    }
+    return text;
 }
 function jsonResponse(body, status) {
     return new Response(JSON.stringify(body), {

package/dist/actions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE7E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,GAEf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAiEjF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAQxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,aAAa;AAE7C,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAI3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;AAQrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,mCAAmC,CAAC,EAA8B,EAAE,IAAY;IACvF,MAAM,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE;QACpC,KAAK,EAAE,SAAS,oBAAoB;YAClC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5C,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG;YAChB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAC1B,QAE4D,EAC5D,aAA4B,EAAE;IAE9B,6EAA6E;IAC7E,MAAM,EAAE,GAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,OAAO,KAAK,EACV,KAAa,EACb,GAA2C,EACzB,EAAE;QACpB,qBAAqB;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC3E,MAAM,IAAI,WAAW,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAA8B,EAC9B,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,SAAiB,GAAG,EACpB,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,CAAC,0CAA0C,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAChC,MAAM,IAAI,GAAM,IAAI,CAAC,IAAI,IAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAEvC,8EAA8E;IAC9E,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,4BAA4B,CAAC;QAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,cAAc;oBACvB,OAAO,EAAE,sBAAsB;oBAC/B,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,6CAA6C;gBACrD,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,oBAAoB;aAC7B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;oBACxD,OAAO,EAAE,UAAU,CAAC,MAAM,IAAI,sBAAsB;oBACpD,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB;gBACnD,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;aACrE,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,cAAc;oBACvB,OAAO,EAAE,YAAY,MAAM,CAAC,UAAU,GAAG;oBACzC,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAQ,iCAAiC,MAAM,CAAC,UAAU,IAAI;gBACnE,MAAM,EAAO,GAAG;gBAChB,IAAI,EAAS,cAAc;gBAC3B,UAAU,EAAG,MAAM,CAAC,UAAU;gBAC9B,OAAO,EAAM,MAAM,CAAC,OAAO;aAC5B,CAAC,EACF;gBACE,MAAM,EAAG,GAAG;gBACZ,OAAO,EAAE;oBACP,cAAc,EAAG,kBAAkB;oBACnC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;IAErE,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,YAAY,CAAC;gBACX,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE;oBACP,EAAE,EAAQ,OAAO;oBACjB,IAAI,EAAM,UAAU;oBACpB,MAAM,EAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC/C,QAAQ,EAAE,CAAC;oBACX,MAAM,EAAI,IAAI;iBACf;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;IAE5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,mBAAmB;aAC1B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,sCAAsC;IACtC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9C,YAAY,CAAC;YACX,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE;gBACP,EAAE,EAAS,OAAO;gBAClB,IAAI,EAAO,UAAU;gBACrB,KAAK,EAAM,sBAAsB,CAAC,KAAK,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,cAAc,IAAI,IAAI,IAAI,cAAc,KAAK,EAAE;oBACjD,CAAC,CAAC,EAAE,cAAc,EAAE;oBACpB,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QAEH,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAE5C,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,YAAY,cAAc;oBAAE,MAAM,GAAG,CAAC;gBAC9E,QAAQ,EAAE,CAAC;gBACX,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,YAAY,kBAAkB;oBAAE,MAAM,GAAG,CAAC;gBAC/E,IAAI,QAAQ,IAAI,WAAW;oBAAE,MAAM,GAAG,CAAC;gBACvC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB;YACrD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,YAAY,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP,EAAE,EAAQ,OAAO;gBACjB,IAAI,EAAM,UAAU;gBACpB,MAAM,EAAI,sBAAsB,CAAC,MAAM,CAAC;gBACxC,QAAQ;gBACR,MAAM,EAAI,KAAK;aAChB;SACF,CAAC,CAAC;QAEH,2BAA2B;QAC3B,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE;gBACnC,MAAM;gBACN,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;aACxC,CAAC,CAAC;YACH,mCAAmC;YACnC,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QAED,0CAA0C;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACpC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,WAAW;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,YAAY,CAAC;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE;oBACP,EAAE,EAAE,OAAO;oBACX,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC;aACF,CAAC,CAAC;YACH,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,YAAY,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,EAAE,EAAQ,OAAO;oBACjB,IAAI,EAAM,UAAU;oBACpB,KAAK,EAAK,GAAG,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,YAAY,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,EAAE,EAAQ,OAAO;gBACjB,IAAI,EAAM,UAAU;gBACpB,KAAK,EAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC1D,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,mBAAmB,UAAU,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,6BAA6B,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjF,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAyB,QAAQ;IAOjC,IAAI,iBAAiB,GAA2B,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,GAAG;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,QAAQ,GAAG,IAAI,CAAC;YAChB,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,iBAAiB,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,KAAK;YACH,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC3B,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,OAAO;YACT,OAAO,iBAAiB,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,OAAO;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE9D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IACE,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EACzD,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAmB;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,kCAAkC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8BAA8B;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;AAC7D,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;YAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
1	+ {"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE7E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,cAAc,GAEf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAuExD,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAQxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,aAAa;AAE7C,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAI3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;AAQrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,mCAAmC,CAAC,EAA8B,EAAE,IAAY;IACvF,MAAM,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE;QACpC,KAAK,EAAE,SAAS,oBAAoB;YAClC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5C,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG;YAChB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAC1B,QAE4D,EAC5D,aAA4B,EAAE;IAE9B,6EAA6E;IAC7E,MAAM,EAAE,GAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,OAAO,KAAK,EACV,KAAa,EACb,GAA2C,EACzB,EAAE;QACpB,qBAAqB;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC3E,MAAM,IAAI,WAAW,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAA8B,EAC9B,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,SAAiB,GAAG,EACpB,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,CAAC,0CAA0C,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,YAAY,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,EAAE;SACzF,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IACtG,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC;IACjC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,eAAe,GAAG,uBAAuB,EAAE,CAAC;IAClD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,gBAAgB;oBACzB,OAAO,EAAE,gDAAgD;oBACzD,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CACjB;gBACE,KAAK,EAAG,kDAAkD;gBAC1D,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,gBAAgB;aACzB,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAChC,MAAM,IAAI,GAAM,IAAI,CAAC,IAAI,IAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAEvC,8EAA8E;IAC9E,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,kDAAkD;IAClD,EAAE;IACF,QAAQ;IACR,wDAAwD;IACxD,8DAA8D;IAC9D,qCAAqC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAS,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1D,IAAI,KAAK,EAAE,CAAC;YACV,+BAA+B;YAC/B,MAAM,MAAM,GAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,4BAA4B,CAAC;YAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,YAAY,CAAC;oBACX,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE;wBACP,IAAI,EAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;wBACxD,OAAO,EAAE,UAAU,CAAC,MAAM,IAAI,sBAAsB;wBACpD,MAAM,EAAG,UAAU;qBACpB;iBACF,CAAC,CAAC;gBACH,OAAO,YAAY,CAAC;oBAClB,KAAK,EAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB;oBACnD,MAAM,EAAE,GAAG;oBACX,IAAI,EAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;iBACrE,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxB,yEAAyE;YACzE,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,cAAc;oBACvB,OAAO,EAAE,sDAAsD;oBAC/D,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,sDAAsD;gBAC9D,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,qBAAqB;aAC9B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,iFAAiF;IACnF,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,cAAc;oBACvB,OAAO,EAAE,YAAY,MAAM,CAAC,UAAU,GAAG;oBACzC,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAQ,iCAAiC,MAAM,CAAC,UAAU,IAAI;gBACnE,MAAM,EAAO,GAAG;gBAChB,IAAI,EAAS,cAAc;gBAC3B,UAAU,EAAG,MAAM,CAAC,UAAU;gBAC9B,OAAO,EAAM,MAAM,CAAC,OAAO;aAC5B,CAAC,EACF;gBACE,MAAM,EAAG,GAAG;gBACZ,OAAO,EAAE;oBACP,cAAc,EAAG,kBAAkB;oBACnC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;IAErE,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,YAAY,CAAC;gBACX,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE;oBACP,EAAE,EAAQ,OAAO;oBACjB,IAAI,EAAM,UAAU;oBACpB,MAAM,EAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC/C,QAAQ,EAAE,CAAC;oBACX,MAAM,EAAI,IAAI;iBACf;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;IAE5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,mBAAmB;aAC1B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,sCAAsC;IACtC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;QAE1F,YAAY,CAAC;YACX,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE;gBACP,EAAE,EAAS,OAAO;gBAClB,IAAI,EAAO,UAAU;gBACrB,KAAK,EAAM,sBAAsB,CAAC,KAAK,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,cAAc,IAAI,IAAI,IAAI,cAAc,KAAK,EAAE;oBACjD,CAAC,CAAC,EAAE,cAAc,EAAE;oBACpB,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QAEH,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAE5C,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,YAAY,cAAc;oBAAE,MAAM,GAAG,CAAC;gBAC9E,QAAQ,EAAE,CAAC;gBACX,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,YAAY,kBAAkB;oBAAE,MAAM,GAAG,CAAC;gBAC/E,IAAI,QAAQ,IAAI,WAAW;oBAAE,MAAM,GAAG,CAAC;gBACvC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB;YACrD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,YAAY,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP,EAAE,EAAQ,OAAO;gBACjB,IAAI,EAAM,UAAU;gBACpB,MAAM,EAAI,sBAAsB,CAAC,MAAM,CAAC;gBACxC,QAAQ;gBACR,MAAM,EAAI,KAAK;aAChB;SACF,CAAC,CAAC;QAEH,2BAA2B;QAC3B,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE;gBACnC,MAAM;gBACN,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;aACxC,CAAC,CAAC;YACH,mCAAmC;YACnC,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QAED,0CAA0C;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACpC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,WAAW;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,YAAY,CAAC;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE;oBACP,EAAE,EAAE,OAAO;oBACX,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC;aACF,CAAC,CAAC;YACH,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,YAAY,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,EAAE,EAAQ,OAAO;oBACjB,IAAI,EAAM,UAAU;oBACpB,KAAK,EAAK,GAAG,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,MAAM;YAC7C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC;QAC3C,OAAO,CAAC,KAAK,CAAC,iBAAiB,OAAO,MAAM,UAAU,WAAW,EAAE,GAAG,CAAC,CAAC;QACxE,YAAY,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,EAAE,EAAQ,OAAO;gBACjB,IAAI,EAAM,UAAU;gBACpB,KAAK,EAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7F,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7B;SACF,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,YAAY,CACjB;gBACE,KAAK,EAAI,uBAAuB;gBAChC,MAAM,EAAG,GAAG;gBACZ,OAAO;aACR,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CACjB;YACE,KAAK,EAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,MAAM,EAAE,GAAG;SACZ,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,+BAA+B,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChF,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,MAAM,GAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEtD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAE3F,IAAI,aAAa,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CACnB,8CAA8C,IAAI,GAAG,EACrD,GAAG,EACH,sBAAsB,CACvB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjF;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,oEAAoE;IACpF,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAExC,WAAW;IACX,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5D,uEAAuE;IACvE,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,0BAA0B;IAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,oBAAoB;IACpB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,0BAA0B;IAC1B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAyB,QAAQ;IAOjC,IAAI,iBAAiB,GAA2B,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,GAAG;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,QAAQ,GAAG,IAAI,CAAC;YAChB,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,iBAAiB,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,KAAK;YACH,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC3B,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,OAAO;YACT,OAAO,iBAAiB,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,OAAO;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,0GAA0G;AAC1G,MAAM,qBAAqB,GAAG,EAAE,GAAG,KAAK,GAAG,KAAK,CAAC;AAEjD,qGAAqG;AACrG,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,oGAAoG;AACpG,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAI,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,GAAG,GAAK,KAAK,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,GAAG,EAAc,CAAC;YAAC,GAAG,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/C,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC;YAAE,SAAS;QAAC,CAAC;QACpD,IAAI,EAAE,KAAK,GAAG,EAAO,CAAC;YAAC,KAAK,GAAG,CAAC,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,KAAK,EAAY,CAAC;YAAC,SAAS;QAAC,CAAC;QAElC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,EAAE,KAAK,GAAG,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CACnB,gCAAgC,cAAc,UAAU,EACxD,GAAG,EACH,eAAe,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,EAAE,IAAI,GAAG,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,WAAW,CACnB,2BAA2B,aAAa,QAAQ,EAChD,GAAG,EACH,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,QAAQ,GAAG,qBAAqB;IAChF,oEAAoE;IACpE,kFAAkF;IAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,WAAW,CACnB,2BAA2B,EAAE,iBAAiB,QAAQ,GAAG,EACzD,GAAG,EACH,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE9D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IACE,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EACzD,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAmB;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,kCAAkC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8BAA8B;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;AAC7D,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;YAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/build-id.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+/**
+ * Production build identifier — written by `nexus build` to `.nexus/build-id.json`.
+ * Server and browser must agree on this value so stale tabs can be rejected with 412.
+ */
+/**
+ * Reads `.nexus/build-id.json` once and caches the result.
+ * Returns `null` if the file is missing (dev without prior build, or legacy deploy).
+ */
+export declare function loadAndCacheNexusBuildId(appRoot: string): string | null;
+/** Cached build id after {@link loadAndCacheNexusBuildId}; `null` if none loaded. */
+export declare function getExpectedNexusBuildId(): string | null;
+/** Test hook */
+export declare function resetNexusBuildIdCache(): void;
+//# sourceMappingURL=build-id.d.ts.map

package/dist/build-id.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"build-id.d.ts","sourceRoot":"","sources":["../src/build-id.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvE;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD;AAED,gBAAgB;AAChB,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/build-id.js ADDED Viewed

@@ -0,0 +1,40 @@
+/**
+ * Production build identifier — written by `nexus build` to `.nexus/build-id.json`.
+ * Server and browser must agree on this value so stale tabs can be rejected with 412.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+let cached;
+/**
+ * Reads `.nexus/build-id.json` once and caches the result.
+ * Returns `null` if the file is missing (dev without prior build, or legacy deploy).
+ */
+export function loadAndCacheNexusBuildId(appRoot) {
+    if (cached !== undefined)
+        return cached;
+    const p = join(appRoot, '.nexus', 'build-id.json');
+    try {
+        if (!existsSync(p)) {
+            cached = null;
+            return null;
+        }
+        const raw = readFileSync(p, 'utf-8');
+        const j = JSON.parse(raw);
+        const id = j.buildId;
+        cached =
+            typeof id === 'string' && id.length > 0 && id.length <= 256 ? id : null;
+    }
+    catch {
+        cached = null;
+    }
+    return cached;
+}
+/** Cached build id after {@link loadAndCacheNexusBuildId}; `null` if none loaded. */
+export function getExpectedNexusBuildId() {
+    return cached ?? null;
+}
+/** Test hook */
+export function resetNexusBuildIdCache() {
+    cached = undefined;
+}
+//# sourceMappingURL=build-id.js.map

package/dist/build-id.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"build-id.js","sourceRoot":"","sources":["../src/build-id.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,IAAI,MAAiC,CAAC;AAEtC;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,GAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACpD,MAAM,EAAE,GAAI,CAAC,CAAC,OAAO,CAAC;QACtB,MAAM;YACJ,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,uBAAuB;IACrC,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/dist/csrf.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;~~AAcH~~,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAK,OAAO,CAAC;IAClB,MAAM,CAAC,EAAG,MAAM,CAAC;IACjB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,MAAM,CAMR;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAO,MAAM,EAClB,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,qBAAqB,~~CAiDvB~~;AAkCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAczD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}
1	+ {"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA0BH,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAK,OAAO,CAAC;IAClB,MAAM,CAAC,EAAG,MAAM,CAAC;IACjB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,MAAM,CAMR;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAO,MAAM,EAClB,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,qBAAqB,CA6DvB;AAkCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAczD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}