@opendatalabs/personal-server-ts-server 1.33.7 → 1.34.0

package/dist/pdpp/client-document-fetch.js

@@ -0,0 +1,254 @@
+/**
+ * Bounded production fetcher for a URL-hosted client identity document
+ * (Core §6). Implements `ClientDocumentFetcher` from
+ * `@opendatalabs/personal-server-ts-core/pdpp`.
+ *
+ * Invariants:
+ *   - HTTPS only.
+ *   - Every address actually dialed is checked: a hostname's DNS answers via
+ *     a custom `lookup` on the `undici` dispatcher (defends DNS rebinding —
+ *     `net`/`tls`/`undici` dial exactly the address `lookup` returns, so
+ *     there is no separate resolution to race), and a literal-IP URL
+ *     hostname separately, since that never reaches `dns.lookup` at all.
+ *   - No redirect is followed; a redirect or an oversized/rejected body is
+ *     drained (`discardBody`), never left dangling on the socket.
+ *   - One `AbortSignal`/timeout spans connect + headers + body + cleanup.
+ *   - The body is read incrementally and dropped past the byte cap.
+ *   - No credentials are forwarded.
+ */
+import dns from "node:dns";
+import net from "node:net";
+import { Agent, fetch as undiciFetch } from "undici";
+export const FETCH_TIMEOUT_MS = 5_000;
+export const MAX_RESPONSE_BYTES = 64 * 1024;
+/** Thrown by the connect-time guard; surfaces as a `fetch_failed` result. */
+export class BlockedAddressError extends Error {
+}
+/**
+ * Non-public address space, checked against the literal address a DNS
+ * answer resolved to — not the hostname string. `net.BlockList` normalizes
+ * both IPv4-mapped IPv6 forms (`::ffff:a.b.c.d` and `::ffff:7f00:1`) and the
+ * fully-expanded form (`0:0:0:0:0:0:0:1`) against the same IPv4/IPv6 rules,
+ * so listing each CIDR once covers all three.
+ */
+const blockedAddresses = new net.BlockList();
+for (const cidr of [
+    "0.0.0.0/8", // "this network" / unspecified-as-source
+    "10.0.0.0/8", // RFC1918 private
+    "100.64.0.0/10", // shared address space / CGNAT (RFC6598)
+    "127.0.0.0/8", // loopback
+    "169.254.0.0/16", // link-local, incl. cloud metadata
+    "172.16.0.0/12", // RFC1918 private
+    "192.0.0.0/24", // IETF protocol assignments
+    "192.0.2.0/24", // documentation (TEST-NET-1)
+    "192.168.0.0/16", // RFC1918 private
+    "198.18.0.0/15", // benchmarking
+    "198.51.100.0/24", // documentation (TEST-NET-2)
+    "203.0.113.0/24", // documentation (TEST-NET-3)
+    "224.0.0.0/4", // multicast
+    "240.0.0.0/4", // reserved
+    "255.255.255.255/32", // limited broadcast
+]) {
+    const [address, prefix] = cidr.split("/");
+    blockedAddresses.addSubnet(address, Number(prefix), "ipv4");
+}
+for (const cidr of [
+    "::/128", // unspecified
+    "::1/128", // loopback
+    "fc00::/7", // unique local (ULA)
+    "fe80::/10", // link-local
+    "ff00::/8", // multicast
+]) {
+    const [address, prefix] = cidr.split("/");
+    blockedAddresses.addSubnet(address, Number(prefix), "ipv6");
+}
+export function isBlockedAddress(address) {
+    const version = net.isIP(address);
+    if (version === 0)
+        return true; // not a literal address — refuse, don't guess
+    return blockedAddresses.check(address, version === 4 ? "ipv4" : "ipv6");
+}
+/**
+ * A URL hostname that is itself a literal IP (e.g. `https://127.0.0.1/`,
+ * `https://[::1]/`) never reaches `dns.lookup` — `net`/`tls`/`undici` dial it
+ * directly, so the guarded `lookup` in {@link buildGuardedLookup} never runs.
+ * Must be checked separately, before the dial, against the same predicate.
+ */
+function literalHostAddress(hostname) {
+    const unbracketed = hostname.startsWith("[") && hostname.endsWith("]")
+        ? hostname.slice(1, -1)
+        : hostname;
+    return net.isIP(unbracketed) === 0 ? null : unbracketed;
+}
+/**
+ * Build a `lookup`-compatible function (the shape `node:net`/`node:tls` and
+ * `undici`'s connector accept) that refuses to resolve to a blocked address.
+ * Delegates the actual resolution to `node:dns`, always requesting every
+ * answer so a rebinding attempt cannot hide a blocked address behind a
+ * permitted one that happens to sort first.
+ *
+ * `isBlocked` defaults to {@link isBlockedAddress}; overriding it is a
+ * test-only seam (see `__testing`) so tests can run a real loopback server
+ * without disabling the guard's own logic, which is what the override would
+ * do if it replaced `lookup` entirely instead of only the address predicate.
+ */
+function buildGuardedLookup(isBlocked = isBlockedAddress) {
+    return (hostname, options, callback) => {
+        // Always ask `dns.lookup` for every answer so a blocked address cannot
+        // hide behind a permitted one that happens to sort first, regardless of
+        // whether the caller itself wanted `all`.
+        dns.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+            if (err)
+                return callback(err, "", undefined);
+            const list = addresses;
+            if (list.length === 0) {
+                return callback(new BlockedAddressError(`${hostname} resolved to no addresses`), "", undefined);
+            }
+            const blocked = list.find((a) => isBlocked(a.address));
+            if (blocked) {
+                return callback(new BlockedAddressError(`${hostname} resolved to a blocked address: ${blocked.address}`), "", undefined);
+            }
+            // Reply in the shape the caller actually requested: the array form
+            // when `options.all` was set (as undici's connector does), otherwise
+            // the single-address form `net`/`tls` expect.
+            if (options.all) {
+                return callback(null, list, undefined);
+            }
+            callback(null, list[0].address, list[0].family);
+        });
+    };
+}
+/**
+ * Build a dispatcher that only ever connects to an address that passes the
+ * guard, bundled with the exact predicate it was built with so a caller
+ * can't pass a mismatched one to the pre-dial literal-IP check in
+ * {@link createBoundedFetcher}. `tlsOpts` is exposed solely so tests can
+ * trust a local self-signed certificate; `isBlocked` lets tests run against
+ * loopback without disabling the guard mechanism itself. Production code
+ * must call {@link boundedClientDocumentFetcher}, which passes neither.
+ */
+function buildGuardedAgent(tlsOpts) {
+    const { isBlocked = isBlockedAddress, ...rest } = tlsOpts ?? {};
+    return {
+        dispatcher: new Agent({
+            connect: { lookup: buildGuardedLookup(isBlocked), ...rest },
+        }),
+        isBlocked,
+    };
+}
+/** One dispatcher, reused across calls; the guard is stateless per lookup. */
+const guarded = buildGuardedAgent();
+/**
+ * Read a response body, aborting the moment it exceeds `limit` bytes.
+ * Mirrors `readCapped` in core's `declaration.ts` — same bound, same
+ * reasoning: `.text()` would buffer the whole body before the cap could act.
+ */
+async function readCapped(response, limit) {
+    const stream = response.body;
+    if (!stream) {
+        const buffered = await response.text();
+        return Buffer.byteLength(buffered, "utf8") > limit ? null : buffered;
+    }
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > limit) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf8");
+}
+/**
+ * Build a bounded `ClientDocumentFetcher`. HTTPS-only, no redirects, one
+ * connect+headers+body timeout, a streamed byte cap, and address validation
+ * on every DNS answer *and* on a literal-IP hostname (which never reaches
+ * `dns.lookup`, so the dispatcher's guarded `lookup` alone would miss it).
+ *
+ * Takes {@link buildGuardedAgent}'s return value as a whole (not just its
+ * `dispatcher`) so the pre-dial literal-IP check always uses the exact same
+ * predicate the dispatcher's `lookup` guard was built with — there is no
+ * call shape that lets the two diverge.
+ */
+function createBoundedFetcher({ dispatcher, isBlocked, }) {
+    return async (url) => {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:") {
+            throw new Error(`client_id document fetch requires https, got ${parsed.protocol}`);
+        }
+        const literal = literalHostAddress(parsed.hostname);
+        if (literal && isBlocked(literal)) {
+            throw new BlockedAddressError(`client_id document fetch refuses a blocked literal address: ${literal}`);
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        try {
+            const response = await undiciFetch(parsed.toString(), {
+                redirect: "manual",
+                signal: controller.signal,
+                dispatcher,
+                // No forwarded credentials: no cookies, no stored authorization.
+            });
+            if (response.status >= 300 && response.status < 400) {
+                await discardBody(response);
+                throw new Error(`client_id document fetch refuses to follow a redirect (status ${response.status})`);
+            }
+            const declaredLength = response.headers.get("content-length");
+            if (declaredLength && Number(declaredLength) > MAX_RESPONSE_BYTES) {
+                await discardBody(response);
+                return { status: response.status, body: "", finalUrl: url };
+            }
+            const body = await readCapped(response, MAX_RESPONSE_BYTES);
+            if (body === null) {
+                // Oversized: reported as a non-200 empty body so the resolver's
+                // generic "unexpected status" handling covers it without a new code
+                // path duplicating the size check `resolveUrlHostedClientIdentity`
+                // already performs on the string it receives.
+                return { status: 0, body: "", finalUrl: url };
+            }
+            return { status: response.status, body, finalUrl: parsed.toString() };
+        }
+        finally {
+            // Cleared last: the deadline must still apply while a rejected
+            // response's body is drained/destroyed above, not just during the
+            // initial connect+headers await.
+            clearTimeout(timer);
+        }
+    };
+}
+/**
+ * Drop a response body we're not going to read, rather than leaving it
+ * unconsumed. Called before `finally` clears the timer, so a hostile server
+ * stalling this drain still hits the request's own deadline instead of
+ * hanging past it.
+ */
+async function discardBody(response) {
+    const stream = response.body;
+    if (!stream)
+        return;
+    try {
+        await stream.cancel();
+    }
+    catch {
+        // A destroyed/errored stream may reject cancel(); the socket is already
+        // gone either way.
+    }
+}
+/** The production fetcher: no test-only overrides reach this path. */
+export const boundedClientDocumentFetcher = createBoundedFetcher(guarded);
+/** Test-only seam: same bounds, with a dispatcher that trusts a test CA. */
+export const __testing = { createBoundedFetcher, buildGuardedAgent };
+//# sourceMappingURL=client-document-fetch.js.map

package/dist/pdpp/client-document-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-document-fetch.js","sourceRoot":"","sources":["../../src/pdpp/client-document-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AAKrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AACtC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;CAAG;AAEjD;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;AAC7C,KAAK,MAAM,IAAI,IAAI;IACjB,WAAW,EAAE,yCAAyC;IACtD,YAAY,EAAE,kBAAkB;IAChC,eAAe,EAAE,yCAAyC;IAC1D,aAAa,EAAE,WAAW;IAC1B,gBAAgB,EAAE,mCAAmC;IACrD,eAAe,EAAE,kBAAkB;IACnC,cAAc,EAAE,4BAA4B;IAC5C,cAAc,EAAE,6BAA6B;IAC7C,gBAAgB,EAAE,kBAAkB;IACpC,eAAe,EAAE,eAAe;IAChC,iBAAiB,EAAE,6BAA6B;IAChD,gBAAgB,EAAE,6BAA6B;IAC/C,aAAa,EAAE,YAAY;IAC3B,aAAa,EAAE,WAAW;IAC1B,oBAAoB,EAAE,oBAAoB;CAC3C,EAAE,CAAC;IACF,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AACD,KAAK,MAAM,IAAI,IAAI;IACjB,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,qBAAqB;IACjC,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;CACzB,EAAE,CAAC;IACF,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;IAC9E,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,WAAW,GACf,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACf,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,YAA0C,gBAAgB;IAE1D,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrC,uEAAuE;QACvE,wEAAwE;QACxE,0CAA0C;QAC1C,GAAG,CAAC,MAAM,CACR,QAAQ,EACR,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EACzB,CAAC,GAAiC,EAAE,SAAS,EAAE,EAAE;YAC/C,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAW,EAAE,SAAkB,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,SAAkD,CAAC;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,QAAQ,CACb,IAAI,mBAAmB,CACrB,GAAG,QAAQ,2BAA2B,CACd,EAC1B,EAAW,EACX,SAAkB,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,QAAQ,CACb,IAAI,mBAAmB,CACrB,GAAG,QAAQ,mCAAmC,OAAO,CAAC,OAAO,EAAE,CACvC,EAC1B,EAAW,EACX,SAAkB,CACnB,CAAC;YACJ,CAAC;YACD,mEAAmE;YACnE,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAa,EAAE,SAAkB,CAAC,CAAC;YAC3D,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAG1B;IACC,MAAM,EAAE,SAAS,GAAG,gBAAgB,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAChE,OAAO;QACL,UAAU,EAAE,IAAI,KAAK,CAAC;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE;SAC5D,CAAC;QACF,SAAS;KACV,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;AAEpC;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,QAAwB,EACxB,KAAa;IAEb,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,EAC5B,UAAU,EACV,SAAS,GAC4B;IACrC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,QAAQ,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAC3B,+DAA+D,OAAO,EAAE,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;gBACpD,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,UAAU;gBACV,iEAAiE;aAClE,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACpD,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,iEAAiE,QAAQ,CAAC,MAAM,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9D,IAAI,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,kBAAkB,EAAE,CAAC;gBAClE,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC5D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,gEAAgE;gBAChE,oEAAoE;gBACpE,mEAAmE;gBACnE,8CAA8C;gBAC9C,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YAChD,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,+DAA+D;YAC/D,kEAAkE;YAClE,iCAAiC;YACjC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,QAAwB;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,mBAAmB;IACrB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GACvC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/pdpp/declaration-registry.d.ts

@@ -0,0 +1,83 @@
+/**
+ * A declaration registry that can change while the server is running.
+ *
+ * `buildDeclarationRegistry` (deployment.ts) parses `config.pdpp
+ * .declarationPaths` once at construction and pins the survivors. That is the
+ * right shape for a deployment whose declarations are config, and it stays
+ * exactly as it was. What it cannot do is accept a candidate: offering one
+ * means editing config and restarting, so a caller cannot ask "would you
+ * accept this?" and get an answer in the same server lifetime.
+ *
+ * This is that acceptance surface's storage. Two properties it must have that
+ * the boot-time registry does not:
+ *
+ *   - **Mutable in place.** The AS's `resolveDeclaration` lookup must see an
+ *     accepted declaration immediately, or an acceptance is indistinguishable
+ *     from a refusal until the next restart.
+ *   - **Durable.** An operator who submitted a declaration must not silently
+ *     lose it on restart, which would make acceptance look transactional and
+ *     behave like a cache.
+ *
+ * ## Why this is a separate table from `pdpp_declarations`
+ *
+ * The auth store's `pdpp_declarations` retains a snapshot per
+ * `(source_id, version)` and is deliberately immutable — it is the evidence an
+ * ISSUED GRANT points at, and rewriting it would change what an owner
+ * consented to after the fact. This table answers a different question:
+ * *which* version is currently authoritative for a source. Those must not
+ * share a row, because accepting a new version has to move the current
+ * pointer while leaving every retained revision a live grant depends on
+ * exactly where it was.
+ */
+import type { DeclarationFailure, DeclarationSnapshot } from "@opendatalabs/personal-server-ts-core/pdpp";
+import type { Logger } from "pino";
+export interface MutableDeclarationRegistry {
+    /** The live lookup the AS consumes. Null when nothing is retained. */
+    resolve(sourceId: string): DeclarationSnapshot | null;
+    /** The exact retained bytes for a source, for digest verification. */
+    documentFor(sourceId: string): string | null;
+    /** Every currently-authoritative declaration. */
+    list(): DeclarationSnapshot[];
+    /**
+     * Validate a candidate and, on success, make it authoritative for its
+     * source. A refusal changes nothing — in particular it must not displace an
+     * already-retained declaration, or one malformed submission would disarm a
+     * working grant surface.
+     */
+    submit(document: string): DeclarationSubmissionResult;
+    close(): void;
+}
+export type DeclarationSubmissionResult = {
+    ok: true;
+    snapshot: DeclarationSnapshot;
+} | {
+    ok: false;
+    failure: DeclarationFailure;
+};
+export interface OpenDeclarationRegistryOptions {
+    /** SQLite file. Use `:memory:` for a registry that does not outlive it. */
+    path: string;
+    /**
+     * The connector inventory this PS serves. A SUBMITTED declaration naming a
+     * source this server holds no data for is refused: a grant over data that
+     * cannot exist here is at best useless, and at worst a consent screen
+     * showing an owner something they are not sharing. Seeds are not gated;
+     * see `seed`.
+     */
+    supportedConnectors: string[];
+    logger: Logger;
+    /**
+     * Declarations from `config.pdpp.declarationPaths`, seeded on open.
+     * Configuration is the operator's admission decision, so seeds skip the
+     * connector gate: a fresh server with no legacy data must still mount the
+     * sources it was configured for. Submitted declarations win over seeds for
+     * the same source: an operator's explicit later decision is the more
+     * recent one.
+     */
+    seed?: {
+        sourceId: string;
+        document: string;
+    }[];
+}
+export declare function openDeclarationRegistry(options: OpenDeclarationRegistryOptions): MutableDeclarationRegistry;
+//# sourceMappingURL=declaration-registry.d.ts.map

package/dist/pdpp/declaration-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration-registry.d.ts","sourceRoot":"","sources":["../../src/pdpp/declaration-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAyBnC,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAAC;IACtD,sEAAsE;IACtE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC7C,iDAAiD;IACjD,IAAI,IAAI,mBAAmB,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,2BAA2B,CAAC;IACtD,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,8BAA8B;IAC7C,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,0BAA0B,CAkK5B"}

package/dist/pdpp/declaration-registry.js

@@ -0,0 +1,251 @@
+/**
+ * A declaration registry that can change while the server is running.
+ *
+ * `buildDeclarationRegistry` (deployment.ts) parses `config.pdpp
+ * .declarationPaths` once at construction and pins the survivors. That is the
+ * right shape for a deployment whose declarations are config, and it stays
+ * exactly as it was. What it cannot do is accept a candidate: offering one
+ * means editing config and restarting, so a caller cannot ask "would you
+ * accept this?" and get an answer in the same server lifetime.
+ *
+ * This is that acceptance surface's storage. Two properties it must have that
+ * the boot-time registry does not:
+ *
+ *   - **Mutable in place.** The AS's `resolveDeclaration` lookup must see an
+ *     accepted declaration immediately, or an acceptance is indistinguishable
+ *     from a refusal until the next restart.
+ *   - **Durable.** An operator who submitted a declaration must not silently
+ *     lose it on restart, which would make acceptance look transactional and
+ *     behave like a cache.
+ *
+ * ## Why this is a separate table from `pdpp_declarations`
+ *
+ * The auth store's `pdpp_declarations` retains a snapshot per
+ * `(source_id, version)` and is deliberately immutable — it is the evidence an
+ * ISSUED GRANT points at, and rewriting it would change what an owner
+ * consented to after the fact. This table answers a different question:
+ * *which* version is currently authoritative for a source. Those must not
+ * share a row, because accepting a new version has to move the current
+ * pointer while leaving every retained revision a live grant depends on
+ * exactly where it was.
+ */
+import Database from "better-sqlite3";
+import { isDeepStrictEqual } from "node:util";
+import { parseDeclaration } from "@opendatalabs/personal-server-ts-core/pdpp";
+const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS pdpp_current_declarations (
+  source_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  digest TEXT NOT NULL,
+  snapshot_json TEXT NOT NULL,
+  -- The exact submitted bytes. snapshot_json is the parsed projection, so
+  -- re-digesting it does NOT reproduce digest; a producer's claimed digest
+  -- can only honestly be checked against what was actually submitted.
+  document TEXT NOT NULL,
+  accepted_at TEXT NOT NULL,
+  is_current INTEGER NOT NULL DEFAULT 1,
+  -- 'configured' (seeded from config at boot) or 'submitted' (runtime
+  -- route). Boot config follows the current configured declaration, but
+  -- never displaces a submission.
+  origin TEXT NOT NULL DEFAULT 'configured',
+  PRIMARY KEY (source_id, version)
+);
+
+CREATE INDEX IF NOT EXISTS pdpp_current_declarations_current_idx
+  ON pdpp_current_declarations (source_id, is_current);
+`;
+export function openDeclarationRegistry(options) {
+    const db = new Database(options.path);
+    db.pragma("journal_mode = WAL");
+    migrateSchema(db);
+    const supported = new Set(options.supportedConnectors);
+    function accept(document, admission) {
+        // The submitted document names its own source, so there is no separately
+        // supplied id to cross-check it against. Reading the claim first and
+        // parsing against it means `source_id_mismatch` stays reachable for a
+        // document whose nested `source.id` disagrees with its normalized form,
+        // rather than being unreachable here by construction.
+        const claimed = claimedSourceId(document);
+        if (claimed === null) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_document",
+                    message: "declaration is not valid JSON, or declares no source id",
+                },
+            };
+        }
+        const parsed = parseDeclaration(document, claimed);
+        if (!parsed.ok)
+            return parsed;
+        const connector = connectorNameFor(parsed.snapshot.source_id);
+        if (admission === "submitted" && !supported.has(connector)) {
+            // `untrusted_source` rather than `invalid_document`: the document may
+            // be perfectly well formed. What is refused is its authority here.
+            return {
+                ok: false,
+                failure: {
+                    code: "untrusted_source",
+                    message: `this server does not serve the '${connector}' connector, so it does not accept a declaration for it`,
+                },
+            };
+        }
+        const existing = db
+            .prepare(`SELECT snapshot_json, is_current FROM pdpp_current_declarations
+         WHERE source_id = ? AND version = ?`)
+            .get(parsed.snapshot.source_id, parsed.snapshot.version);
+        if (existing) {
+            const retained = JSON.parse(existing.snapshot_json);
+            if (!sameDeclarationContent(retained, parsed.snapshot)) {
+                return {
+                    ok: false,
+                    failure: {
+                        code: "declaration_equivocation",
+                        message: "different content was already accepted under this (source.id, declaration_version) key",
+                    },
+                };
+            }
+            // Configuration names the version that is current now, so a
+            // configured downgrade re-points to the retained earlier revision.
+            if (admission === "configured" && !existing.is_current) {
+                db.transaction(() => {
+                    db.prepare("UPDATE pdpp_current_declarations SET is_current = 0 WHERE source_id = ?").run(parsed.snapshot.source_id);
+                    db.prepare(`UPDATE pdpp_current_declarations SET is_current = 1
+             WHERE source_id = ? AND version = ?`).run(parsed.snapshot.source_id, parsed.snapshot.version);
+                })();
+            }
+            return { ok: true, snapshot: retained };
+        }
+        db.transaction(() => {
+            db.prepare("UPDATE pdpp_current_declarations SET is_current = 0 WHERE source_id = ?").run(parsed.snapshot.source_id);
+            db.prepare(`INSERT INTO pdpp_current_declarations
+           (source_id, version, digest, snapshot_json, document, accepted_at, is_current, origin)
+         VALUES (?, ?, ?, ?, ?, ?, 1, ?)`).run(parsed.snapshot.source_id, parsed.snapshot.version, parsed.snapshot.digest, JSON.stringify(parsed.snapshot), document, new Date().toISOString(), admission);
+        })();
+        return { ok: true, snapshot: parsed.snapshot };
+    }
+    // Seeds go through the same `accept` as a submission — one acceptance path,
+    // so a configured declaration and a submitted one cannot diverge on what
+    // counts as valid. A seed for a source whose current declaration was
+    // submitted is skipped: the operator's later explicit decision wins over
+    // boot config. Otherwise the seed becomes current, so an installer that
+    // upgrades a declaration and restarts the server is followed.
+    for (const seed of options.seed ?? []) {
+        const submitted = db
+            .prepare(`SELECT 1 FROM pdpp_current_declarations
+         WHERE source_id = ? AND is_current = 1 AND origin = 'submitted'`)
+            .get(seed.sourceId);
+        if (submitted)
+            continue;
+        const result = accept(seed.document, "configured");
+        if (!result.ok) {
+            options.logger.warn({ sourceId: seed.sourceId, reason: result.failure.message }, "PDPP declaration rejected: not retained");
+        }
+    }
+    return {
+        resolve(sourceId) {
+            const row = db
+                .prepare(`SELECT snapshot_json FROM pdpp_current_declarations
+           WHERE source_id = ? AND is_current = 1`)
+                .get(sourceId);
+            return row
+                ? JSON.parse(row.snapshot_json)
+                : null;
+        },
+        documentFor(sourceId) {
+            const row = db
+                .prepare(`SELECT document FROM pdpp_current_declarations
+           WHERE source_id = ? AND is_current = 1`)
+                .get(sourceId);
+            return row?.document ?? null;
+        },
+        list() {
+            const rows = db
+                .prepare(`SELECT snapshot_json FROM pdpp_current_declarations
+           WHERE is_current = 1 ORDER BY source_id`)
+                .all();
+            return rows.map((r) => JSON.parse(r.snapshot_json));
+        },
+        submit: (document) => accept(document, "submitted"),
+        close() {
+            db.close();
+        },
+    };
+}
+function migrateSchema(db) {
+    const columns = db
+        .prepare("PRAGMA table_info(pdpp_current_declarations)")
+        .all();
+    if (columns.length === 0) {
+        db.exec(SCHEMA_SQL);
+        return;
+    }
+    if (columns.some((column) => column.name === "is_current")) {
+        if (!columns.some((column) => column.name === "origin")) {
+            // Rows written before `origin` existed cannot be told apart. Treating
+            // them as configured lets boot config move past them; a submission
+            // that should outrank config must be submitted again.
+            db.exec("ALTER TABLE pdpp_current_declarations ADD COLUMN origin TEXT NOT NULL DEFAULT 'configured'");
+        }
+        db.exec(SCHEMA_SQL);
+        return;
+    }
+    db.transaction(() => {
+        db.exec("ALTER TABLE pdpp_current_declarations RENAME TO pdpp_current_declarations_legacy");
+        db.exec(SCHEMA_SQL);
+        db.exec(`INSERT INTO pdpp_current_declarations
+         (source_id, version, digest, snapshot_json, document, accepted_at, is_current)
+       SELECT source_id, version, digest, snapshot_json, document, accepted_at, 1
+       FROM pdpp_current_declarations_legacy`);
+        db.exec("DROP TABLE pdpp_current_declarations_legacy");
+    })();
+}
+function sameDeclarationContent(a, b) {
+    const { digest: _aDigest, ...aContent } = a;
+    const { digest: _bDigest, ...bContent } = b;
+    return isDeepStrictEqual(aContent, bContent);
+}
+/**
+ * The source id a document claims, read without validating anything else.
+ *
+ * Accepts both the normative nested shape (`source: { id }`) and the internal
+ * flat one (`source_id`), because `parseDeclaration` normalizes between them
+ * and this has to agree with whichever it will read.
+ */
+function claimedSourceId(document) {
+    let doc;
+    try {
+        doc = JSON.parse(document);
+    }
+    catch {
+        return null;
+    }
+    if (typeof doc !== "object" || doc === null)
+        return null;
+    const record = doc;
+    const nested = record.source?.id;
+    if (typeof nested === "string" && nested.length > 0)
+        return nested;
+    if (typeof record.source_id === "string" && record.source_id.length > 0) {
+        return record.source_id;
+    }
+    return null;
+}
+/**
+ * The connector a source id belongs to — the last path segment of the URI
+ * (`https://registry.pdpp.dev/connectors/spotify` → `spotify`). Falls back to
+ * the whole id for an unparseable value, so an odd source fails the supported
+ * check rather than silently matching a connector it is not.
+ */
+function connectorNameFor(sourceId) {
+    try {
+        const segments = new URL(sourceId).pathname
+            .split("/")
+            .filter((s) => s.length > 0);
+        return segments[segments.length - 1] ?? sourceId;
+    }
+    catch {
+        return sourceId;
+    }
+}
+//# sourceMappingURL=declaration-registry.js.map

package/dist/pdpp/declaration-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration-registry.js","sourceRoot":"","sources":["../../src/pdpp/declaration-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAO9E,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBlB,CAAC;AA8CF,MAAM,UAAU,uBAAuB,CACrC,OAAuC;IAEvC,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChC,aAAa,CAAC,EAAE,CAAC,CAAC;IAElB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvD,SAAS,MAAM,CACb,QAAgB,EAChB,SAAqC;QAErC,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,yDAAyD;iBACnE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAE9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,sEAAsE;YACtE,mEAAmE;YACnE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,mCAAmC,SAAS,yDAAyD;iBAC/G;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE;aAChB,OAAO,CACN;6CACqC,CACtC;aACA,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CACE,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,QAAQ,CAAC,aAAa,CACA,CAAC;YACzB,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE;wBACP,IAAI,EAAE,0BAA0B;wBAChC,OAAO,EACL,wFAAwF;qBAC3F;iBACF,CAAC;YACJ,CAAC;YACD,4DAA4D;YAC5D,mEAAmE;YACnE,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvD,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;oBAClB,EAAE,CAAC,OAAO,CACR,yEAAyE,CAC1E,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACjC,EAAE,CAAC,OAAO,CACR;iDACqC,CACtC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;QAED,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClB,EAAE,CAAC,OAAO,CACR,yEAAyE,CAC1E,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjC,EAAE,CAAC,OAAO,CACR;;yCAEiC,CAClC,CAAC,GAAG,CACH,MAAM,CAAC,QAAQ,CAAC,SAAS,EACzB,MAAM,CAAC,QAAQ,CAAC,OAAO,EACvB,MAAM,CAAC,QAAQ,CAAC,MAAM,EACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC/B,QAAQ,EACR,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,8DAA8D;IAC9D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,EAAE;aACjB,OAAO,CACN;yEACiE,CAClE;aACA,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,SAAS;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAC3D,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,CAAC,QAAQ;YACd,MAAM,GAAG,GAAG,EAAE;iBACX,OAAO,CACN;kDACwC,CACzC;iBACA,GAAG,CAAC,QAAQ,CAA0C,CAAC;YAC1D,OAAO,GAAG;gBACR,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAyB;gBACxD,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,WAAW,CAAC,QAAQ;YAClB,MAAM,GAAG,GAAG,EAAE;iBACX,OAAO,CACN;kDACwC,CACzC;iBACA,GAAG,CAAC,QAAQ,CAAqC,CAAC;YACrD,OAAO,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI;YACF,MAAM,IAAI,GAAG,EAAE;iBACZ,OAAO,CACN;mDACyC,CAC1C;iBACA,GAAG,EAAiC,CAAC;YACxC,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAwB,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC;QACnD,KAAK;YACH,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,EAAqB;IAC1C,MAAM,OAAO,GAAG,EAAE;SACf,OAAO,CAAC,8CAA8C,CAAC;SACvD,GAAG,EAAwB,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxD,sEAAsE;YACtE,mEAAmE;YACnE,sDAAsD;YACtD,EAAE,CAAC,IAAI,CACL,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IAED,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClB,EAAE,CAAC,IAAI,CACL,kFAAkF,CACnF,CAAC;QACF,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,EAAE,CAAC,IAAI,CACL;;;6CAGuC,CACxC,CAAC;QACF,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACzD,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,sBAAsB,CAC7B,CAAsB,EACtB,CAAsB;IAEtB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,GAAyD,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ;aACxC,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}