@opendatalabs/vana-sdk 4.4.0 → 4.5.0

package/dist/direct/connect-handler.js

@@ -0,0 +1,476 @@
+import {
+  isRequestId,
+  PROTOCOL_VERSION,
+  VANA_ACCOUNT_ORIGINS
+} from "../connect/protocol.js";
+import {
+  missingConnectCapabilities
+} from "./controller.js";
+import {
+  AccessNotApprovedError,
+  DirectConfigError,
+  PaymentRequiredError,
+  PersonalServerReadError,
+  ScopeNotApprovedError
+} from "./errors.js";
+import { buildApprovalUrl } from "./access-request-client.js";
+const nodeRemoteAddresses = /* @__PURE__ */ new WeakMap();
+function defaultClientIp(request) {
+  const header = (name) => {
+    const value = request.headers.get(name)?.trim();
+    return value ? value : null;
+  };
+  const forwarded = header("x-forwarded-for")?.split(",").map((hop) => hop.trim()).filter(Boolean);
+  return header("cf-connecting-ip") ?? header("x-real-ip") ?? forwarded?.[forwarded.length - 1] ?? nodeRemoteAddresses.get(request) ?? null;
+}
+function createMemoryRateLimit(options = {}) {
+  const max = options.max ?? 10;
+  const windowMs = options.windowMs ?? 6e4;
+  const maxKeys = options.maxKeys ?? 1e4;
+  const clientIp = options.clientIp ?? defaultClientIp;
+  const now = options.now ?? Date.now;
+  const windows = /* @__PURE__ */ new Map();
+  function prune(at) {
+    for (const [key, window] of windows) {
+      if (window.resetAt <= at) windows.delete(key);
+    }
+    for (const key of windows.keys()) {
+      if (windows.size < maxKeys) break;
+      windows.delete(key);
+    }
+  }
+  return ({ request, session }) => {
+    const at = now();
+    const keys = [`ip:${clientIp(request) ?? "unknown"}`];
+    if (session) keys.push(`session:${session}`);
+    let retryAfterMs = 0;
+    for (const key of keys) {
+      const window = windows.get(key);
+      if (window && window.resetAt > at && window.count >= max) {
+        retryAfterMs = Math.max(retryAfterMs, window.resetAt - at);
+      }
+    }
+    if (retryAfterMs > 0) {
+      return { ok: false, retryAfterSeconds: Math.ceil(retryAfterMs / 1e3) };
+    }
+    if (windows.size >= maxKeys) prune(at);
+    for (const key of keys) {
+      const window = windows.get(key);
+      if (window && window.resetAt > at) {
+        window.count += 1;
+      } else {
+        windows.delete(key);
+        windows.set(key, { count: 1, resetAt: at + windowMs });
+      }
+    }
+    return { ok: true };
+  };
+}
+const COOKIE_PREFIX = "vana_dcr_";
+const BINDING_VERSION = 1;
+const MIN_BINDING_MS = 60 * 60 * 1e3;
+const MAX_BINDING_MS = 7 * 24 * 60 * 60 * 1e3;
+const MAX_BODY_BYTES = 4096;
+const CONNECT_BINDING_KEY_PURPOSE = "vana-sdk/connect/request-binding/v1";
+const encoder = new TextEncoder();
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(value) {
+  if (!/^[A-Za-z0-9_-]*$/.test(value)) return null;
+  try {
+    const binary = atob(value.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function sha256(value) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
+  return base64url(new Uint8Array(digest));
+}
+function connectBindingCookieName(requestId) {
+  return `${COOKIE_PREFIX}${requestId}`;
+}
+function errorResponse(status, code, message, headers) {
+  return json({ error: { code, message } }, status, headers);
+}
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Cache-Control": "no-store",
+      ...headers
+    }
+  });
+}
+function readCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    if (part.slice(0, separator).trim() === name) {
+      return part.slice(separator + 1).trim();
+    }
+  }
+  return null;
+}
+function createVanaConnectHandler(options) {
+  const missing = missingConnectCapabilities(options.controller).filter(
+    (name) => !(name === "deriveSecret" && options.bindingSecret)
+  );
+  if (missing.length > 0) {
+    throw new DirectConfigError(
+      `createVanaConnectHandler needs a controller with ${missing.join(", ")} (createDirectDataController provides them)`,
+      { missing }
+    );
+  }
+  const controller = options.controller;
+  let returnOrigin;
+  try {
+    returnOrigin = new URL(options.returnUrl).origin;
+  } catch {
+    throw new DirectConfigError("returnUrl must be an absolute URL", {
+      returnUrl: options.returnUrl
+    });
+  }
+  const allowedOrigins = new Set(options.allowedOrigins ?? [returnOrigin]);
+  const now = options.now ?? Date.now;
+  const cookiePath = options.cookiePath ?? "/";
+  const rateLimit = options.rateLimit === false ? null : options.rateLimit ?? createMemoryRateLimit({ now });
+  let macKey = null;
+  function bindingKey() {
+    macKey ??= (async () => {
+      const raw = options.bindingSecret ? await crypto.subtle.digest(
+        "SHA-256",
+        encoder.encode(
+          `${CONNECT_BINDING_KEY_PURPOSE}\0${options.bindingSecret}`
+        )
+      ) : await controller.deriveSecret(CONNECT_BINDING_KEY_PURPOSE);
+      return crypto.subtle.importKey(
+        "raw",
+        raw,
+        { name: "HMAC", hash: "SHA-256" },
+        false,
+        ["sign"]
+      );
+    })();
+    return macKey;
+  }
+  async function tag(payload) {
+    const signature = await crypto.subtle.sign(
+      "HMAC",
+      await bindingKey(),
+      encoder.encode(`vana-connect-binding.${payload}`)
+    );
+    return base64url(new Uint8Array(signature));
+  }
+  async function sessionHash(request) {
+    if (!options.session) return void 0;
+    const id = await options.session(request);
+    return id ? sha256(id) : null;
+  }
+  async function bindingCookie(request, created, session) {
+    const current = now();
+    const requestExpiry = created.expiresAt ? Date.parse(created.expiresAt) : Number.NaN;
+    const expiresAt = Math.min(
+      current + MAX_BINDING_MS,
+      Math.max(
+        current + MIN_BINDING_MS,
+        Number.isFinite(requestExpiry) ? requestExpiry : 0
+      )
+    );
+    const payload = {
+      v: BINDING_VERSION,
+      r: created.requestId,
+      e: expiresAt,
+      ...session ? { s: session } : {}
+    };
+    const encoded = base64url(encoder.encode(JSON.stringify(payload)));
+    const attributes = [
+      `Path=${cookiePath}`,
+      `Max-Age=${Math.floor((expiresAt - current) / 1e3)}`,
+      "HttpOnly",
+      "SameSite=Lax",
+      ...new URL(request.url).protocol === "https:" ? ["Secure"] : []
+    ];
+    return `${connectBindingCookieName(created.requestId)}=${encoded}.${await tag(
+      encoded
+    )}; ${attributes.join("; ")}`;
+  }
+  async function readBinding(request, requestId, session) {
+    const value = readCookie(request, connectBindingCookieName(requestId));
+    if (!value || value.length > 1024) return null;
+    const separator = value.lastIndexOf(".");
+    if (separator <= 0) return null;
+    const encoded = value.slice(0, separator);
+    if (!constantTimeEqual(value.slice(separator + 1), await tag(encoded))) {
+      return null;
+    }
+    const bytes = fromBase64url(encoded);
+    if (!bytes) return null;
+    let payload;
+    try {
+      payload = JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      return null;
+    }
+    const binding = payload;
+    if (!binding || binding.v !== BINDING_VERSION || binding.r !== requestId || typeof binding.e !== "number" || binding.e <= now() || binding.s !== session) {
+      return null;
+    }
+    return binding;
+  }
+  function originRefused(request) {
+    const origin = request.headers.get("origin");
+    if (origin !== null && !allowedOrigins.has(origin)) return true;
+    return request.headers.get("sec-fetch-site") === "cross-site";
+  }
+  async function readBody(request) {
+    const text = await request.text();
+    if (text.length > MAX_BODY_BYTES) return null;
+    if (text.trim() === "") return {};
+    try {
+      const parsed = JSON.parse(text);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  function config() {
+    const endpoints = controller.getEndpoints();
+    const env = controller.getEnv();
+    return {
+      protocolVersion: PROTOCOL_VERSION,
+      env,
+      clientId: options.clientId ?? null,
+      appName: options.appName ?? controller.getAppIdentity().name,
+      // The controller's own environment decides; never a production default.
+      accountOrigin: endpoints.accountOrigin ?? VANA_ACCOUNT_ORIGINS[env]
+    };
+  }
+  async function postRequest(request, session) {
+    const body = await readBody(request);
+    if (!body) {
+      return errorResponse(
+        400,
+        "invalid_request",
+        "Body must be a JSON object."
+      );
+    }
+    if (body.requestId !== void 0) {
+      const requestId = body.requestId;
+      if (!isRequestId(requestId)) {
+        return errorResponse(
+          400,
+          "invalid_request",
+          "requestId is not a request id."
+        );
+      }
+      if (!await readBinding(request, requestId, session)) {
+        return notBound();
+      }
+      const endpoints = controller.getEndpoints();
+      return json({
+        request: {
+          requestId,
+          approvalUrl: buildApprovalUrl(
+            endpoints.approvalAppBaseUrl,
+            requestId
+          ),
+          appAddress: controller.appAddress
+        },
+        embed: {
+          id: requestId,
+          authorization: await controller.authorizeRequestRead(requestId)
+        }
+      });
+    }
+    if (rateLimit) {
+      const decision = await rateLimit({
+        request,
+        ...session ? { session } : {}
+      });
+      if (!decision.ok) {
+        return errorResponse(
+          429,
+          "rate_limited",
+          "Too many requests. Try again later.",
+          decision.retryAfterSeconds !== void 0 ? {
+            "Retry-After": String(
+              Math.max(0, Math.ceil(decision.retryAfterSeconds))
+            )
+          } : void 0
+        );
+      }
+    }
+    const created = await controller.createAccessRequest({
+      ...options.createOptions ? await options.createOptions(request) : {},
+      returnUrl: options.returnUrl
+    });
+    const sanitized = {
+      requestId: created.requestId,
+      approvalUrl: created.approvalUrl,
+      appAddress: created.appAddress,
+      ...created.network ? { network: created.network } : {},
+      ...created.expiresAt ? { expiresAt: created.expiresAt } : {},
+      ...created.mobileContinuationUrl ? { mobileContinuationUrl: created.mobileContinuationUrl } : {},
+      ...created.scopes ? { scopes: created.scopes } : {}
+    };
+    const embed = isRequestId(created.requestId) ? {
+      id: created.requestId,
+      authorization: await controller.authorizeRequestRead(
+        created.requestId
+      )
+    } : null;
+    return json({ request: sanitized, embed }, 200, {
+      "Set-Cookie": await bindingCookie(request, created, session)
+    });
+  }
+  function notBound() {
+    return errorResponse(
+      403,
+      "request_not_bound",
+      "This request was not created in this browser session."
+    );
+  }
+  async function boundRequestId(request, session) {
+    const values = new URL(request.url).searchParams.getAll("requestId");
+    const requestId = values.length === 1 ? values[0] : void 0;
+    if (!isRequestId(requestId)) {
+      return errorResponse(
+        400,
+        "invalid_request",
+        "A single requestId is required."
+      );
+    }
+    if (!await readBinding(request, requestId, session)) {
+      return notBound();
+    }
+    return requestId;
+  }
+  async function getStatus(request, session) {
+    const requestId = await boundRequestId(request, session);
+    if (requestId instanceof Response) return requestId;
+    const status = await controller.getAccessRequestStatus(requestId);
+    return json({
+      status: status.status,
+      ...status.mobileContinuationUrl ? { mobileContinuationUrl: status.mobileContinuationUrl } : {}
+    });
+  }
+  async function getData(request, session) {
+    const requestId = await boundRequestId(request, session);
+    if (requestId instanceof Response) return requestId;
+    const result = options.read ? await options.read({ controller, requestId, request }) : await controller.readApprovedData({ requestId });
+    return json(result);
+  }
+  return async function handle(request) {
+    const segments = new URL(request.url).pathname.split("/").filter(Boolean);
+    const action = segments[segments.length - 1];
+    const method = request.method.toUpperCase();
+    const route = (expected) => method === expected ? null : errorResponse(405, "method_not_allowed", `Use ${expected}.`, {
+      Allow: expected
+    });
+    try {
+      if (action === "config") {
+        return route("GET") ?? json(config());
+      }
+      if (action !== "request" && action !== "status" && action !== "data") {
+        return errorResponse(404, "not_found", "Unknown connect route.");
+      }
+      const wrongMethod = route(action === "request" ? "POST" : "GET");
+      if (wrongMethod) return wrongMethod;
+      if (action === "request" && originRefused(request)) {
+        return errorResponse(403, "forbidden_origin", "Origin not allowed.");
+      }
+      const session = await sessionHash(request);
+      if (session === null) {
+        return errorResponse(401, "unauthenticated", "Sign in first.");
+      }
+      if (action === "request") return await postRequest(request, session);
+      if (action === "status") return await getStatus(request, session);
+      return await getData(request, session);
+    } catch (error) {
+      return errorFor(error);
+    }
+  };
+}
+function errorFor(error) {
+  if (error instanceof AccessNotApprovedError) {
+    return errorResponse(409, "not_approved", error.message);
+  }
+  if (error instanceof ScopeNotApprovedError) {
+    return errorResponse(403, "scope_not_approved", error.message);
+  }
+  if (error instanceof PaymentRequiredError) {
+    return errorResponse(402, "payment_required", error.message);
+  }
+  if (error instanceof PersonalServerReadError) {
+    return errorResponse(502, "personal_server_error", error.message);
+  }
+  if (error instanceof DirectConfigError) {
+    return errorResponse(400, "invalid_request", error.message);
+  }
+  return errorResponse(500, "internal_error", "Something went wrong.");
+}
+function toNodeHandler(handler, options = {}) {
+  return async (req, res) => {
+    const header = (name) => {
+      const value = req.headers[name];
+      return Array.isArray(value) ? value[0] : value;
+    };
+    const origin = options.origin ?? `${header("x-forwarded-proto")?.split(",")[0]?.trim() ?? (req.socket?.encrypted ? "https" : "http")}://${header("host") ?? "localhost"}`;
+    const url = new URL(req.originalUrl ?? req.url ?? "/", origin);
+    const method = (req.method ?? "GET").toUpperCase();
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+      if (value === void 0) continue;
+      headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+    }
+    let body;
+    if (method !== "GET" && method !== "HEAD") {
+      if (req.body !== void 0) {
+        body = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+      } else {
+        const decoder = new TextDecoder();
+        body = "";
+        for await (const chunk of req) {
+          body += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+          if (body.length > MAX_BODY_BYTES) break;
+        }
+        body += decoder.decode();
+      }
+    }
+    const request = new Request(url, { method, headers, body });
+    if (req.socket?.remoteAddress) {
+      nodeRemoteAddresses.set(request, req.socket.remoteAddress);
+    }
+    const response = await handler(request);
+    res.statusCode = response.status;
+    response.headers.forEach((value, name) => {
+      if (name !== "set-cookie") res.setHeader(name, value);
+    });
+    const cookies = response.headers.getSetCookie();
+    if (cookies.length > 0) res.setHeader("set-cookie", cookies);
+    res.end(new Uint8Array(await response.arrayBuffer()));
+  };
+}
+export {
+  CONNECT_BINDING_KEY_PURPOSE,
+  connectBindingCookieName,
+  createMemoryRateLimit,
+  createVanaConnectHandler,
+  defaultClientIp,
+  toNodeHandler
+};
+//# sourceMappingURL=connect-handler.js.map

package/dist/direct/connect-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/direct/connect-handler.ts"],"sourcesContent":["/**\n * One Fetch-API handler for every backend route the connect flow needs.\n *\n * @remarks\n * `createVanaConnectHandler` answers four routes under one base path. The\n * action is the last path segment, so mount it as a catch-all\n * (`app/api/vana/[action]/route.ts` in Next.js, or `app.use(\"/api/vana\",\n * toNodeHandler(handler))` in Express):\n *\n * | Route                         | Does                                                 |\n * | ----------------------------- | ---------------------------------------------------- |\n * | `GET  config`                 | Sheet config: client id, app name, Account origin.   |\n * | `POST request`                | Create a request bound to this browser, or re-sign one it already holds. Returns `{ request, embed }`. |\n * | `GET  status?requestId=`      | Status of a bound request.                           |\n * | `GET  data?requestId=`        | Read the approved data of a bound request.           |\n *\n * Binding: a created request is bound to the browser by an HttpOnly,\n * `SameSite=Lax` cookie carrying an HMAC-SHA256 tag, keyed by a secret\n * derived from the app key with HKDF. The handler signs, reports and reads\n * only requests bound to the calling browser (and, with `session`, to the\n * app's own signed-in user). See `src/connect/WIRE_CONTRACT.md` for the\n * wire contract a non-JS backend implements instead.\n *\n * What a request asks for is the controller's: its PDPP `grants` (each\n * stream requested as `pdpp.<source>.<stream>`) and legacy `scopes`. The\n * browser never chooses; `POST request` reports the scopes it sent.\n *\n * Creating a request is rate limited (`rateLimit`; by default in memory,\n * per client IP and per session, which is not production-grade). In\n * production, require a signed-in user with `session` and put a shared\n * limiter in front of `POST request`.\n *\n * @category Direct\n * @module direct/connect-handler\n */\n\nimport {\n  isRequestId,\n  PROTOCOL_VERSION,\n  VANA_ACCOUNT_ORIGINS,\n} from \"../connect/protocol\";\nimport {\n  missingConnectCapabilities,\n  type ConnectCapableDirectDataController,\n  type DirectDataController,\n} from \"./controller\";\nimport {\n  AccessNotApprovedError,\n  DirectConfigError,\n  PaymentRequiredError,\n  PersonalServerReadError,\n  ScopeNotApprovedError,\n} from \"./errors\";\nimport { buildApprovalUrl } from \"./access-request-client\";\nimport type { AccessRequest } from \"./types\";\nimport type { VanaConnectConfig } from \"../connect/http-transports\";\n\nexport type { VanaConnectConfig };\n\n/** The create input the handler forwards, minus what it sets itself. */\nexport type VanaConnectCreateOptions = Omit<\n  Parameters<DirectDataController[\"createAccessRequest\"]>[0],\n  \"returnUrl\"\n>;\n\n/** What a {@link VanaConnectRateLimit} decides. */\nexport type VanaConnectRateLimitDecision =\n  | { ok: true }\n  | {\n      ok: false;\n      /** Sent as `Retry-After`, in whole seconds. */\n      retryAfterSeconds?: number;\n    };\n\n/**\n * Decide whether one `POST request` that creates a request may proceed.\n *\n * @remarks\n * Called after the origin and `session` checks and before the controller\n * creates anything. `session` is the hash of the app's session id when\n * `session` is configured. Re-signing a request the browser already holds is\n * not rate limited: it creates nothing and needs a valid binding.\n */\nexport type VanaConnectRateLimit = (input: {\n  request: Request;\n  session?: string;\n}) => VanaConnectRateLimitDecision | Promise<VanaConnectRateLimitDecision>;\n\n/** Options for {@link createMemoryRateLimit}. */\nexport interface MemoryRateLimitOptions {\n  /** Creates allowed per key per window. Defaults to 10. */\n  max?: number;\n  /** Window length in ms. Defaults to 60000. */\n  windowMs?: number;\n  /**\n   * The caller's IP. Defaults to {@link defaultClientIp}, which trusts proxy\n   * headers; behind anything else, supply the address your platform vouches\n   * for.\n   */\n  clientIp?: (request: Request) => string | null;\n  /** Keys kept before the oldest are dropped. Defaults to 10000. */\n  maxKeys?: number;\n  /** Clock in ms. Defaults to `Date.now`. */\n  now?: () => number;\n}\n\nconst nodeRemoteAddresses = new WeakMap<Request, string>();\n\n/**\n * The caller's IP as the default rate limit sees it.\n *\n * @remarks\n * `CF-Connecting-IP`, then `X-Real-IP`, then the last `X-Forwarded-For`\n * hop (the one your proxy appended), then the socket address when the\n * request came through {@link toNodeHandler}. Headers are only as honest as\n * the proxy in front of you: without one, a client can set them.\n *\n * @param request - The incoming request.\n * @returns An IP string, or `null` when nothing names one.\n */\nexport function defaultClientIp(request: Request): string | null {\n  const header = (name: string): string | null => {\n    const value = request.headers.get(name)?.trim();\n    return value ? value : null;\n  };\n  const forwarded = header(\"x-forwarded-for\")\n    ?.split(\",\")\n    .map((hop) => hop.trim())\n    .filter(Boolean);\n  return (\n    header(\"cf-connecting-ip\") ??\n    header(\"x-real-ip\") ??\n    forwarded?.[forwarded.length - 1] ??\n    nodeRemoteAddresses.get(request) ??\n    null\n  );\n}\n\n/**\n * An in-memory, fixed-window rate limit per client IP and per session.\n *\n * @remarks\n * The default for `createVanaConnectHandler`. Not production-grade: each\n * server instance (and each serverless cold start) counts on its own, and\n * the IP comes from headers a client can forge without a trusted proxy.\n * In production, require `session` and pass a `rateLimit` backed by a\n * shared store (Redis, your platform's limiter).\n *\n * @param options - Limit, window, IP source and memory bound.\n * @returns A {@link VanaConnectRateLimit}.\n */\nexport function createMemoryRateLimit(\n  options: MemoryRateLimitOptions = {},\n): VanaConnectRateLimit {\n  const max = options.max ?? 10;\n  const windowMs = options.windowMs ?? 60_000;\n  const maxKeys = options.maxKeys ?? 10_000;\n  const clientIp = options.clientIp ?? defaultClientIp;\n  const now = options.now ?? Date.now;\n  const windows = new Map<string, { count: number; resetAt: number }>();\n\n  function prune(at: number): void {\n    for (const [key, window] of windows) {\n      if (window.resetAt <= at) windows.delete(key);\n    }\n    // Still full: drop the oldest keys (Map keeps insertion order).\n    for (const key of windows.keys()) {\n      if (windows.size < maxKeys) break;\n      windows.delete(key);\n    }\n  }\n\n  return ({ request, session }) => {\n    const at = now();\n    const keys = [`ip:${clientIp(request) ?? \"unknown\"}`];\n    if (session) keys.push(`session:${session}`);\n    let retryAfterMs = 0;\n    for (const key of keys) {\n      const window = windows.get(key);\n      if (window && window.resetAt > at && window.count >= max) {\n        retryAfterMs = Math.max(retryAfterMs, window.resetAt - at);\n      }\n    }\n    if (retryAfterMs > 0) {\n      return { ok: false, retryAfterSeconds: Math.ceil(retryAfterMs / 1000) };\n    }\n    if (windows.size >= maxKeys) prune(at);\n    for (const key of keys) {\n      const window = windows.get(key);\n      if (window && window.resetAt > at) {\n        window.count += 1;\n      } else {\n        windows.delete(key);\n        windows.set(key, { count: 1, resetAt: at + windowMs });\n      }\n    }\n    return { ok: true };\n  };\n}\n\n/** Options for {@link createVanaConnectHandler}. */\nexport interface VanaConnectHandlerOptions {\n  /**\n   * The app's controller; it holds the key and talks to Vana. It must\n   * implement the connect methods (`authorizeRequestRead`, `getEndpoints`,\n   * `getEnv`, and `deriveSecret` unless `bindingSecret` is set), as every\n   * `createDirectDataController` controller does.\n   */\n  controller: DirectDataController;\n  /**\n   * Absolute URL Vana returns the person to after approving in a tab. Its\n   * origin is also the only `Origin` accepted on `POST` (see\n   * {@link VanaConnectHandlerOptions.allowedOrigins}).\n   */\n  returnUrl: string;\n  /**\n   * The embed client id Vana Account registered for this app's origin. Without\n   * it `GET config` reports `clientId: null` and the browser cannot open the\n   * sheet (it falls back to a tab).\n   */\n  clientId?: string;\n  /** Label on the sheet chrome. Defaults to the controller's app name. */\n  appName?: string;\n  /**\n   * Bind requests to the app's own signed-in user too. Return a stable user or\n   * session id, or `null` to refuse with `401`. Only a hash of it is stored.\n   *\n   * @remarks\n   * Recommended for production. Without it, anyone who can load your page\n   * can create requests on your app's behalf; the browser binding only stops\n   * them reading someone else's.\n   */\n  session?: (request: Request) => string | null | Promise<string | null>;\n  /**\n   * Extra create input per request (questions, owner, ...). Called on each\n   * create.\n   */\n  createOptions?: (\n    request: Request,\n  ) => VanaConnectCreateOptions | Promise<VanaConnectCreateOptions>;\n  /**\n   * Custom read for `GET data`. Defaults to\n   * `controller.readApprovedData({ requestId })`. The result is sent as JSON.\n   */\n  read?: (input: {\n    controller: DirectDataController;\n    requestId: string;\n    request: Request;\n  }) => Promise<unknown>;\n  /**\n   * Origins accepted on `POST`. Defaults to the origin of `returnUrl`. A\n   * request without an `Origin` header (a non-browser client) is accepted.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Secret for the binding cookie. Defaults to a key derived from the app key\n   * with HKDF-SHA256 (`controller.deriveSecret`). Set it to rotate bindings\n   * independently of the app key.\n   */\n  bindingSecret?: string;\n  /**\n   * Rate limit for creating requests. Defaults to\n   * {@link createMemoryRateLimit}() (10 per minute per IP and per session,\n   * in memory, not production-grade). Pass your own shared limiter in\n   * production, or `false` when one already sits in front of this route.\n   * A refusal answers `429 rate_limited` with `Retry-After`.\n   */\n  rateLimit?: VanaConnectRateLimit | false;\n  /** Cookie `Path`. Defaults to `/`. */\n  cookiePath?: string;\n  /** Clock in ms. Defaults to `Date.now`. */\n  now?: () => number;\n}\n\n/** A Fetch-API request handler. */\nexport type VanaConnectHandler = (request: Request) => Promise<Response>;\n\n/** Error codes in a handler error body: `{ error: { code, message } }`. */\nexport type VanaConnectErrorCode =\n  | \"not_found\"\n  | \"method_not_allowed\"\n  | \"invalid_request\"\n  | \"forbidden_origin\"\n  | \"unauthenticated\"\n  | \"request_not_bound\"\n  | \"not_approved\"\n  | \"scope_not_approved\"\n  | \"payment_required\"\n  | \"personal_server_error\"\n  | \"rate_limited\"\n  | \"internal_error\";\n\nconst COOKIE_PREFIX = \"vana_dcr_\";\nconst BINDING_VERSION = 1;\nconst MIN_BINDING_MS = 60 * 60 * 1000;\nconst MAX_BINDING_MS = 7 * 24 * 60 * 60 * 1000;\nconst MAX_BODY_BYTES = 4096;\n/** HKDF `info` the default binding key is derived with. */\nexport const CONNECT_BINDING_KEY_PURPOSE =\n  \"vana-sdk/connect/request-binding/v1\";\n\nconst encoder = new TextEncoder();\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nfunction fromBase64url(value: string): Uint8Array | null {\n  if (!/^[A-Za-z0-9_-]*$/.test(value)) return null;\n  try {\n    const binary = atob(value.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  } catch {\n    return null;\n  }\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  return diff === 0;\n}\n\nasync function sha256(value: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n  return base64url(new Uint8Array(digest));\n}\n\n/** Cookie name binding one request to the browser. */\nexport function connectBindingCookieName(requestId: string): string {\n  return `${COOKIE_PREFIX}${requestId}`;\n}\n\ninterface BindingPayload {\n  v: typeof BINDING_VERSION;\n  /** Request id. */\n  r: string;\n  /** Expiry, ms since epoch. */\n  e: number;\n  /** SHA-256 of the session id, when bound to a session. */\n  s?: string;\n}\n\nfunction errorResponse(\n  status: number,\n  code: VanaConnectErrorCode,\n  message: string,\n  headers?: Record<string, string>,\n): Response {\n  return json({ error: { code, message } }, status, headers);\n}\n\nfunction json(\n  body: unknown,\n  status = 200,\n  headers: Record<string, string> = {},\n): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json\",\n      \"Cache-Control\": \"no-store\",\n      ...headers,\n    },\n  });\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n  const header = request.headers.get(\"cookie\");\n  if (!header) return null;\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\");\n    if (separator < 0) continue;\n    if (part.slice(0, separator).trim() === name) {\n      return part.slice(separator + 1).trim();\n    }\n  }\n  return null;\n}\n\n/**\n * Create the connect handler.\n *\n * @example\n * ```typescript\n * // app/api/vana/[action]/route.ts\n * import { createVanaConnectHandler } from \"@opendatalabs/vana-sdk/server\";\n * // createDirectDataController({ grants: [{ source_id, streams }], ... })\n * import { vana } from \"@/lib/vana\";\n *\n * const handler = createVanaConnectHandler({\n *   controller: vana,\n *   returnUrl: `${process.env.APP_URL}/connect/return`,\n *   clientId: \"my-app\",\n * });\n * export { handler as GET, handler as POST };\n * ```\n *\n * @param options - Controller, return URL, sheet client id and hooks.\n * @returns A `(request: Request) => Promise<Response>` handler.\n * @throws {@link DirectConfigError} when `returnUrl` is not an absolute URL,\n * or the controller lacks a connect method it needs.\n */\nexport function createVanaConnectHandler(\n  options: VanaConnectHandlerOptions,\n): VanaConnectHandler {\n  const missing = missingConnectCapabilities(options.controller).filter(\n    (name) => !(name === \"deriveSecret\" && options.bindingSecret),\n  );\n  if (missing.length > 0) {\n    throw new DirectConfigError(\n      `createVanaConnectHandler needs a controller with ${missing.join(\", \")} (createDirectDataController provides them)`,\n      { missing },\n    );\n  }\n  // Checked above; `deriveSecret` is only called without `bindingSecret`.\n  const controller = options.controller as ConnectCapableDirectDataController;\n  let returnOrigin: string;\n  try {\n    returnOrigin = new URL(options.returnUrl).origin;\n  } catch {\n    throw new DirectConfigError(\"returnUrl must be an absolute URL\", {\n      returnUrl: options.returnUrl,\n    });\n  }\n  const allowedOrigins = new Set(options.allowedOrigins ?? [returnOrigin]);\n  const now = options.now ?? Date.now;\n  const cookiePath = options.cookiePath ?? \"/\";\n  const rateLimit =\n    options.rateLimit === false\n      ? null\n      : (options.rateLimit ?? createMemoryRateLimit({ now }));\n\n  let macKey: Promise<CryptoKey> | null = null;\n  function bindingKey(): Promise<CryptoKey> {\n    macKey ??= (async () => {\n      const raw = options.bindingSecret\n        ? await crypto.subtle.digest(\n            \"SHA-256\",\n            encoder.encode(\n              `${CONNECT_BINDING_KEY_PURPOSE}\\0${options.bindingSecret}`,\n            ),\n          )\n        : await controller.deriveSecret(CONNECT_BINDING_KEY_PURPOSE);\n      return crypto.subtle.importKey(\n        \"raw\",\n        raw,\n        { name: \"HMAC\", hash: \"SHA-256\" },\n        false,\n        [\"sign\"],\n      );\n    })();\n    return macKey;\n  }\n\n  async function tag(payload: string): Promise<string> {\n    const signature = await crypto.subtle.sign(\n      \"HMAC\",\n      await bindingKey(),\n      encoder.encode(`vana-connect-binding.${payload}`),\n    );\n    return base64url(new Uint8Array(signature));\n  }\n\n  async function sessionHash(\n    request: Request,\n  ): Promise<string | null | undefined> {\n    if (!options.session) return undefined;\n    const id = await options.session(request);\n    return id ? sha256(id) : null;\n  }\n\n  async function bindingCookie(\n    request: Request,\n    created: AccessRequest,\n    session: string | undefined,\n  ): Promise<string> {\n    const current = now();\n    const requestExpiry = created.expiresAt\n      ? Date.parse(created.expiresAt)\n      : Number.NaN;\n    const expiresAt = Math.min(\n      current + MAX_BINDING_MS,\n      Math.max(\n        current + MIN_BINDING_MS,\n        Number.isFinite(requestExpiry) ? requestExpiry : 0,\n      ),\n    );\n    const payload: BindingPayload = {\n      v: BINDING_VERSION,\n      r: created.requestId,\n      e: expiresAt,\n      ...(session ? { s: session } : {}),\n    };\n    const encoded = base64url(encoder.encode(JSON.stringify(payload)));\n    const attributes = [\n      `Path=${cookiePath}`,\n      `Max-Age=${Math.floor((expiresAt - current) / 1000)}`,\n      \"HttpOnly\",\n      \"SameSite=Lax\",\n      ...(new URL(request.url).protocol === \"https:\" ? [\"Secure\"] : []),\n    ];\n    return `${connectBindingCookieName(created.requestId)}=${encoded}.${await tag(\n      encoded,\n    )}; ${attributes.join(\"; \")}`;\n  }\n\n  /** The binding for `requestId`, or `null` when absent, forged or expired. */\n  async function readBinding(\n    request: Request,\n    requestId: string,\n    session: string | undefined,\n  ): Promise<BindingPayload | null> {\n    const value = readCookie(request, connectBindingCookieName(requestId));\n    if (!value || value.length > 1024) return null;\n    const separator = value.lastIndexOf(\".\");\n    if (separator <= 0) return null;\n    const encoded = value.slice(0, separator);\n    if (!constantTimeEqual(value.slice(separator + 1), await tag(encoded))) {\n      return null;\n    }\n    const bytes = fromBase64url(encoded);\n    if (!bytes) return null;\n    let payload: unknown;\n    try {\n      payload = JSON.parse(new TextDecoder().decode(bytes));\n    } catch {\n      return null;\n    }\n    const binding = payload as Partial<BindingPayload> | null;\n    if (\n      !binding ||\n      binding.v !== BINDING_VERSION ||\n      binding.r !== requestId ||\n      typeof binding.e !== \"number\" ||\n      binding.e <= now() ||\n      binding.s !== session\n    ) {\n      return null;\n    }\n    return binding as BindingPayload;\n  }\n\n  function originRefused(request: Request): boolean {\n    const origin = request.headers.get(\"origin\");\n    if (origin !== null && !allowedOrigins.has(origin)) return true;\n    return request.headers.get(\"sec-fetch-site\") === \"cross-site\";\n  }\n\n  async function readBody(\n    request: Request,\n  ): Promise<Record<string, unknown> | null> {\n    const text = await request.text();\n    if (text.length > MAX_BODY_BYTES) return null;\n    if (text.trim() === \"\") return {};\n    try {\n      const parsed: unknown = JSON.parse(text);\n      return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n        ? (parsed as Record<string, unknown>)\n        : null;\n    } catch {\n      return null;\n    }\n  }\n\n  function config(): VanaConnectConfig {\n    const endpoints = controller.getEndpoints();\n    const env = controller.getEnv();\n    return {\n      protocolVersion: PROTOCOL_VERSION,\n      env,\n      clientId: options.clientId ?? null,\n      appName: options.appName ?? controller.getAppIdentity().name,\n      // The controller's own environment decides; never a production default.\n      accountOrigin: endpoints.accountOrigin ?? VANA_ACCOUNT_ORIGINS[env],\n    };\n  }\n\n  async function postRequest(\n    request: Request,\n    session: string | undefined,\n  ): Promise<Response> {\n    const body = await readBody(request);\n    if (!body) {\n      return errorResponse(\n        400,\n        \"invalid_request\",\n        \"Body must be a JSON object.\",\n      );\n    }\n    if (body.requestId !== undefined) {\n      // Re-sign a request this browser already holds.\n      const requestId = body.requestId;\n      if (!isRequestId(requestId)) {\n        return errorResponse(\n          400,\n          \"invalid_request\",\n          \"requestId is not a request id.\",\n        );\n      }\n      if (!(await readBinding(request, requestId, session))) {\n        return notBound();\n      }\n      const endpoints = controller.getEndpoints();\n      return json({\n        request: {\n          requestId,\n          approvalUrl: buildApprovalUrl(\n            endpoints.approvalAppBaseUrl,\n            requestId,\n          ),\n          appAddress: controller.appAddress,\n        },\n        embed: {\n          id: requestId,\n          authorization: await controller.authorizeRequestRead(requestId),\n        },\n      });\n    }\n\n    if (rateLimit) {\n      const decision = await rateLimit({\n        request,\n        ...(session ? { session } : {}),\n      });\n      if (!decision.ok) {\n        return errorResponse(\n          429,\n          \"rate_limited\",\n          \"Too many requests. Try again later.\",\n          decision.retryAfterSeconds !== undefined\n            ? {\n                \"Retry-After\": String(\n                  Math.max(0, Math.ceil(decision.retryAfterSeconds)),\n                ),\n              }\n            : undefined,\n        );\n      }\n    }\n    const created = await controller.createAccessRequest({\n      ...(options.createOptions ? await options.createOptions(request) : {}),\n      returnUrl: options.returnUrl,\n    });\n    const sanitized: AccessRequest = {\n      requestId: created.requestId,\n      approvalUrl: created.approvalUrl,\n      appAddress: created.appAddress,\n      ...(created.network ? { network: created.network } : {}),\n      ...(created.expiresAt ? { expiresAt: created.expiresAt } : {}),\n      ...(created.mobileContinuationUrl\n        ? { mobileContinuationUrl: created.mobileContinuationUrl }\n        : {}),\n      ...(created.scopes ? { scopes: created.scopes } : {}),\n    };\n    const embed = isRequestId(created.requestId)\n      ? {\n          id: created.requestId,\n          authorization: await controller.authorizeRequestRead(\n            created.requestId,\n          ),\n        }\n      : null;\n    return json({ request: sanitized, embed }, 200, {\n      \"Set-Cookie\": await bindingCookie(request, created, session),\n    });\n  }\n\n  function notBound(): Response {\n    return errorResponse(\n      403,\n      \"request_not_bound\",\n      \"This request was not created in this browser session.\",\n    );\n  }\n\n  async function boundRequestId(\n    request: Request,\n    session: string | undefined,\n  ): Promise<string | Response> {\n    const values = new URL(request.url).searchParams.getAll(\"requestId\");\n    const requestId = values.length === 1 ? values[0] : undefined;\n    if (!isRequestId(requestId)) {\n      return errorResponse(\n        400,\n        \"invalid_request\",\n        \"A single requestId is required.\",\n      );\n    }\n    if (!(await readBinding(request, requestId, session))) {\n      return notBound();\n    }\n    return requestId;\n  }\n\n  async function getStatus(\n    request: Request,\n    session: string | undefined,\n  ): Promise<Response> {\n    const requestId = await boundRequestId(request, session);\n    if (requestId instanceof Response) return requestId;\n    const status = await controller.getAccessRequestStatus(requestId);\n    // Only what the browser flow needs: no Personal Server URL or grant id.\n    return json({\n      status: status.status,\n      ...(status.mobileContinuationUrl\n        ? { mobileContinuationUrl: status.mobileContinuationUrl }\n        : {}),\n    });\n  }\n\n  async function getData(\n    request: Request,\n    session: string | undefined,\n  ): Promise<Response> {\n    const requestId = await boundRequestId(request, session);\n    if (requestId instanceof Response) return requestId;\n    const result = options.read\n      ? await options.read({ controller, requestId, request })\n      : await controller.readApprovedData({ requestId });\n    return json(result);\n  }\n\n  return async function handle(request: Request): Promise<Response> {\n    const segments = new URL(request.url).pathname.split(\"/\").filter(Boolean);\n    const action = segments[segments.length - 1];\n    const method = request.method.toUpperCase();\n    const route = (expected: string) =>\n      method === expected\n        ? null\n        : errorResponse(405, \"method_not_allowed\", `Use ${expected}.`, {\n            Allow: expected,\n          });\n    try {\n      if (action === \"config\") {\n        return route(\"GET\") ?? json(config());\n      }\n      if (action !== \"request\" && action !== \"status\" && action !== \"data\") {\n        return errorResponse(404, \"not_found\", \"Unknown connect route.\");\n      }\n      const wrongMethod = route(action === \"request\" ? \"POST\" : \"GET\");\n      if (wrongMethod) return wrongMethod;\n      if (action === \"request\" && originRefused(request)) {\n        return errorResponse(403, \"forbidden_origin\", \"Origin not allowed.\");\n      }\n      const session = await sessionHash(request);\n      if (session === null) {\n        return errorResponse(401, \"unauthenticated\", \"Sign in first.\");\n      }\n      if (action === \"request\") return await postRequest(request, session);\n      if (action === \"status\") return await getStatus(request, session);\n      return await getData(request, session);\n    } catch (error) {\n      return errorFor(error);\n    }\n  };\n}\n\nfunction errorFor(error: unknown): Response {\n  if (error instanceof AccessNotApprovedError) {\n    return errorResponse(409, \"not_approved\", error.message);\n  }\n  if (error instanceof ScopeNotApprovedError) {\n    return errorResponse(403, \"scope_not_approved\", error.message);\n  }\n  if (error instanceof PaymentRequiredError) {\n    return errorResponse(402, \"payment_required\", error.message);\n  }\n  if (error instanceof PersonalServerReadError) {\n    return errorResponse(502, \"personal_server_error\", error.message);\n  }\n  if (error instanceof DirectConfigError) {\n    return errorResponse(400, \"invalid_request\", error.message);\n  }\n  // Unknown failures stay opaque to the browser.\n  return errorResponse(500, \"internal_error\", \"Something went wrong.\");\n}\n\n/** The parts of a Node `IncomingMessage` {@link toNodeHandler} reads. */\nexport interface NodeRequestLike {\n  method?: string;\n  url?: string;\n  /** Express sets this to the URL before mount-path stripping. */\n  originalUrl?: string;\n  headers: Record<string, string | string[] | undefined>;\n  /** A body already parsed by middleware (Express `json()`), if any. */\n  body?: unknown;\n  socket?: { encrypted?: boolean; remoteAddress?: string };\n  [Symbol.asyncIterator](): AsyncIterator<Uint8Array | string>;\n}\n\n/** The parts of a Node `ServerResponse` {@link toNodeHandler} writes. */\nexport interface NodeResponseLike {\n  statusCode: number;\n  setHeader(name: string, value: string | string[]): unknown;\n  end(chunk?: Uint8Array | string): unknown;\n}\n\n/** Options for {@link toNodeHandler}. */\nexport interface ToNodeHandlerOptions {\n  /**\n   * Public origin of the app (`https://app.example`). Defaults to the\n   * request's `Host` header and `X-Forwarded-Proto` (or the socket's TLS).\n   */\n  origin?: string;\n}\n\n/**\n * Adapt a Fetch-API handler to Node's `(req, res)` (http, Express, Fastify's\n * raw mode).\n *\n * @param handler - A handler such as {@link createVanaConnectHandler}'s.\n * @param options - Public origin override.\n * @returns A `(req, res) => Promise<void>` listener.\n */\nexport function toNodeHandler(\n  handler: VanaConnectHandler,\n  options: ToNodeHandlerOptions = {},\n): (req: NodeRequestLike, res: NodeResponseLike) => Promise<void> {\n  return async (req, res) => {\n    const header = (name: string): string | undefined => {\n      const value = req.headers[name];\n      return Array.isArray(value) ? value[0] : value;\n    };\n    const origin =\n      options.origin ??\n      `${header(\"x-forwarded-proto\")?.split(\",\")[0]?.trim() ?? (req.socket?.encrypted ? \"https\" : \"http\")}://${header(\"host\") ?? \"localhost\"}`;\n    const url = new URL(req.originalUrl ?? req.url ?? \"/\", origin);\n    const method = (req.method ?? \"GET\").toUpperCase();\n    const headers = new Headers();\n    for (const [name, value] of Object.entries(req.headers)) {\n      if (value === undefined) continue;\n      headers.set(name, Array.isArray(value) ? value.join(\", \") : value);\n    }\n    let body: string | undefined;\n    if (method !== \"GET\" && method !== \"HEAD\") {\n      if (req.body !== undefined) {\n        body =\n          typeof req.body === \"string\" ? req.body : JSON.stringify(req.body);\n      } else {\n        const decoder = new TextDecoder();\n        body = \"\";\n        for await (const chunk of req) {\n          body +=\n            typeof chunk === \"string\"\n              ? chunk\n              : decoder.decode(chunk, { stream: true });\n          if (body.length > MAX_BODY_BYTES) break;\n        }\n        body += decoder.decode();\n      }\n    }\n    const request = new Request(url, { method, headers, body });\n    if (req.socket?.remoteAddress) {\n      nodeRemoteAddresses.set(request, req.socket.remoteAddress);\n    }\n    const response = await handler(request);\n    res.statusCode = response.status;\n    response.headers.forEach((value, name) => {\n      if (name !== \"set-cookie\") res.setHeader(name, value);\n    });\n    const cookies = response.headers.getSetCookie();\n    if (cookies.length > 0) res.setHeader(\"set-cookie\", cookies);\n    res.end(new Uint8Array(await response.arrayBuffer()));\n  };\n}\n"],"mappings":"AAoCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AAqDjC,MAAM,sBAAsB,oBAAI,QAAyB;AAclD,SAAS,gBAAgB,SAAiC;AAC/D,QAAM,SAAS,CAAC,SAAgC;AAC9C,UAAM,QAAQ,QAAQ,QAAQ,IAAI,IAAI,GAAG,KAAK;AAC9C,WAAO,QAAQ,QAAQ;AAAA,EACzB;AACA,QAAM,YAAY,OAAO,iBAAiB,GACtC,MAAM,GAAG,EACV,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EACvB,OAAO,OAAO;AACjB,SACE,OAAO,kBAAkB,KACzB,OAAO,WAAW,KAClB,YAAY,UAAU,SAAS,CAAC,KAChC,oBAAoB,IAAI,OAAO,KAC/B;AAEJ;AAeO,SAAS,sBACd,UAAkC,CAAC,GACb;AACtB,QAAM,MAAM,QAAQ,OAAO;AAC3B,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,UAAU,oBAAI,IAAgD;AAEpE,WAAS,MAAM,IAAkB;AAC/B,eAAW,CAAC,KAAK,MAAM,KAAK,SAAS;AACnC,UAAI,OAAO,WAAW,GAAI,SAAQ,OAAO,GAAG;AAAA,IAC9C;AAEA,eAAW,OAAO,QAAQ,KAAK,GAAG;AAChC,UAAI,QAAQ,OAAO,QAAS;AAC5B,cAAQ,OAAO,GAAG;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,CAAC,EAAE,SAAS,QAAQ,MAAM;AAC/B,UAAM,KAAK,IAAI;AACf,UAAM,OAAO,CAAC,MAAM,SAAS,OAAO,KAAK,SAAS,EAAE;AACpD,QAAI,QAAS,MAAK,KAAK,WAAW,OAAO,EAAE;AAC3C,QAAI,eAAe;AACnB,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,QAAQ,IAAI,GAAG;AAC9B,UAAI,UAAU,OAAO,UAAU,MAAM,OAAO,SAAS,KAAK;AACxD,uBAAe,KAAK,IAAI,cAAc,OAAO,UAAU,EAAE;AAAA,MAC3D;AAAA,IACF;AACA,QAAI,eAAe,GAAG;AACpB,aAAO,EAAE,IAAI,OAAO,mBAAmB,KAAK,KAAK,eAAe,GAAI,EAAE;AAAA,IACxE;AACA,QAAI,QAAQ,QAAQ,QAAS,OAAM,EAAE;AACrC,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,QAAQ,IAAI,GAAG;AAC9B,UAAI,UAAU,OAAO,UAAU,IAAI;AACjC,eAAO,SAAS;AAAA,MAClB,OAAO;AACL,gBAAQ,OAAO,GAAG;AAClB,gBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,SAAS,KAAK,SAAS,CAAC;AAAA,MACvD;AAAA,IACF;AACA,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AACF;AA8FA,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;AACxB,MAAM,iBAAiB,KAAK,KAAK;AACjC,MAAM,iBAAiB,IAAI,KAAK,KAAK,KAAK;AAC1C,MAAM,iBAAiB;AAEhB,MAAM,8BACX;AAEF,MAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,UAAU,OAA2B;AAC5C,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,SAAS,cAAc,OAAkC;AACvD,MAAI,CAAC,mBAAmB,KAAK,KAAK,EAAG,QAAO;AAC5C,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAC/D,WAAO,WAAW,KAAK,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AAEA,eAAe,OAAO,OAAgC;AACpD,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,UAAU,IAAI,WAAW,MAAM,CAAC;AACzC;AAGO,SAAS,yBAAyB,WAA2B;AAClE,SAAO,GAAG,aAAa,GAAG,SAAS;AACrC;AAYA,SAAS,cACP,QACA,MACA,SACA,SACU;AACV,SAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,GAAG,QAAQ,OAAO;AAC3D;AAEA,SAAS,KACP,MACA,SAAS,KACT,UAAkC,CAAC,GACzB;AACV,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,GAAG;AAAA,IACL;AAAA,EACF,CAAC;AACH;AAEA,SAAS,WAAW,SAAkB,MAA6B;AACjE,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,YAAY,EAAG;AACnB,QAAI,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK,MAAM,MAAM;AAC5C,aAAO,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAAA,IACxC;AAAA,EACF;AACA,SAAO;AACT;AAyBO,SAAS,yBACd,SACoB;AACpB,QAAM,UAAU,2BAA2B,QAAQ,UAAU,EAAE;AAAA,IAC7D,CAAC,SAAS,EAAE,SAAS,kBAAkB,QAAQ;AAAA,EACjD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,oDAAoD,QAAQ,KAAK,IAAI,CAAC;AAAA,MACtE,EAAE,QAAQ;AAAA,IACZ;AAAA,EACF;AAEA,QAAM,aAAa,QAAQ;AAC3B,MAAI;AACJ,MAAI;AACF,mBAAe,IAAI,IAAI,QAAQ,SAAS,EAAE;AAAA,EAC5C,QAAQ;AACN,UAAM,IAAI,kBAAkB,qCAAqC;AAAA,MAC/D,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH;AACA,QAAM,iBAAiB,IAAI,IAAI,QAAQ,kBAAkB,CAAC,YAAY,CAAC;AACvE,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,YACJ,QAAQ,cAAc,QAClB,OACC,QAAQ,aAAa,sBAAsB,EAAE,IAAI,CAAC;AAEzD,MAAI,SAAoC;AACxC,WAAS,aAAiC;AACxC,gBAAY,YAAY;AACtB,YAAM,MAAM,QAAQ,gBAChB,MAAM,OAAO,OAAO;AAAA,QAClB;AAAA,QACA,QAAQ;AAAA,UACN,GAAG,2BAA2B,KAAK,QAAQ,aAAa;AAAA,QAC1D;AAAA,MACF,IACA,MAAM,WAAW,aAAa,2BAA2B;AAC7D,aAAO,OAAO,OAAO;AAAA,QACnB;AAAA,QACA;AAAA,QACA,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,QAChC;AAAA,QACA,CAAC,MAAM;AAAA,MACT;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,SAAkC;AACnD,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA,MAAM,WAAW;AAAA,MACjB,QAAQ,OAAO,wBAAwB,OAAO,EAAE;AAAA,IAClD;AACA,WAAO,UAAU,IAAI,WAAW,SAAS,CAAC;AAAA,EAC5C;AAEA,iBAAe,YACb,SACoC;AACpC,QAAI,CAAC,QAAQ,QAAS,QAAO;AAC7B,UAAM,KAAK,MAAM,QAAQ,QAAQ,OAAO;AACxC,WAAO,KAAK,OAAO,EAAE,IAAI;AAAA,EAC3B;AAEA,iBAAe,cACb,SACA,SACA,SACiB;AACjB,UAAM,UAAU,IAAI;AACpB,UAAM,gBAAgB,QAAQ,YAC1B,KAAK,MAAM,QAAQ,SAAS,IAC5B,OAAO;AACX,UAAM,YAAY,KAAK;AAAA,MACrB,UAAU;AAAA,MACV,KAAK;AAAA,QACH,UAAU;AAAA,QACV,OAAO,SAAS,aAAa,IAAI,gBAAgB;AAAA,MACnD;AAAA,IACF;AACA,UAAM,UAA0B;AAAA,MAC9B,GAAG;AAAA,MACH,GAAG,QAAQ;AAAA,MACX,GAAG;AAAA,MACH,GAAI,UAAU,EAAE,GAAG,QAAQ,IAAI,CAAC;AAAA,IAClC;AACA,UAAM,UAAU,UAAU,QAAQ,OAAO,KAAK,UAAU,OAAO,CAAC,CAAC;AACjE,UAAM,aAAa;AAAA,MACjB,QAAQ,UAAU;AAAA,MAClB,WAAW,KAAK,OAAO,YAAY,WAAW,GAAI,CAAC;AAAA,MACnD;AAAA,MACA;AAAA,MACA,GAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,IACjE;AACA,WAAO,GAAG,yBAAyB,QAAQ,SAAS,CAAC,IAAI,OAAO,IAAI,MAAM;AAAA,MACxE;AAAA,IACF,CAAC,KAAK,WAAW,KAAK,IAAI,CAAC;AAAA,EAC7B;AAGA,iBAAe,YACb,SACA,WACA,SACgC;AAChC,UAAM,QAAQ,WAAW,SAAS,yBAAyB,SAAS,CAAC;AACrE,QAAI,CAAC,SAAS,MAAM,SAAS,KAAM,QAAO;AAC1C,UAAM,YAAY,MAAM,YAAY,GAAG;AACvC,QAAI,aAAa,EAAG,QAAO;AAC3B,UAAM,UAAU,MAAM,MAAM,GAAG,SAAS;AACxC,QAAI,CAAC,kBAAkB,MAAM,MAAM,YAAY,CAAC,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG;AACtE,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,cAAc,OAAO;AACnC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAAA,IACtD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,UAAU;AAChB,QACE,CAAC,WACD,QAAQ,MAAM,mBACd,QAAQ,MAAM,aACd,OAAO,QAAQ,MAAM,YACrB,QAAQ,KAAK,IAAI,KACjB,QAAQ,MAAM,SACd;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,WAAS,cAAc,SAA2B;AAChD,UAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,QAAI,WAAW,QAAQ,CAAC,eAAe,IAAI,MAAM,EAAG,QAAO;AAC3D,WAAO,QAAQ,QAAQ,IAAI,gBAAgB,MAAM;AAAA,EACnD;AAEA,iBAAe,SACb,SACyC;AACzC,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAI,KAAK,SAAS,eAAgB,QAAO;AACzC,QAAI,KAAK,KAAK,MAAM,GAAI,QAAO,CAAC;AAChC,QAAI;AACF,YAAM,SAAkB,KAAK,MAAM,IAAI;AACvC,aAAO,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,IAC/D,SACD;AAAA,IACN,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,WAAS,SAA4B;AACnC,UAAM,YAAY,WAAW,aAAa;AAC1C,UAAM,MAAM,WAAW,OAAO;AAC9B,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB;AAAA,MACA,UAAU,QAAQ,YAAY;AAAA,MAC9B,SAAS,QAAQ,WAAW,WAAW,eAAe,EAAE;AAAA;AAAA,MAExD,eAAe,UAAU,iBAAiB,qBAAqB,GAAG;AAAA,IACpE;AAAA,EACF;AAEA,iBAAe,YACb,SACA,SACmB;AACnB,UAAM,OAAO,MAAM,SAAS,OAAO;AACnC,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,cAAc,QAAW;AAEhC,YAAM,YAAY,KAAK;AACvB,UAAI,CAAC,YAAY,SAAS,GAAG;AAC3B,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAE,MAAM,YAAY,SAAS,WAAW,OAAO,GAAI;AACrD,eAAO,SAAS;AAAA,MAClB;AACA,YAAM,YAAY,WAAW,aAAa;AAC1C,aAAO,KAAK;AAAA,QACV,SAAS;AAAA,UACP;AAAA,UACA,aAAa;AAAA,YACX,UAAU;AAAA,YACV;AAAA,UACF;AAAA,UACA,YAAY,WAAW;AAAA,QACzB;AAAA,QACA,OAAO;AAAA,UACL,IAAI;AAAA,UACJ,eAAe,MAAM,WAAW,qBAAqB,SAAS;AAAA,QAChE;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,WAAW;AACb,YAAM,WAAW,MAAM,UAAU;AAAA,QAC/B;AAAA,QACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC/B,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,sBAAsB,SAC3B;AAAA,YACE,eAAe;AAAA,cACb,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,iBAAiB,CAAC;AAAA,YACnD;AAAA,UACF,IACA;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,MAAM,WAAW,oBAAoB;AAAA,MACnD,GAAI,QAAQ,gBAAgB,MAAM,QAAQ,cAAc,OAAO,IAAI,CAAC;AAAA,MACpE,WAAW,QAAQ;AAAA,IACrB,CAAC;AACD,UAAM,YAA2B;AAAA,MAC/B,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,YAAY,QAAQ;AAAA,MACpB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,MACtD,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,wBACR,EAAE,uBAAuB,QAAQ,sBAAsB,IACvD,CAAC;AAAA,MACL,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AACA,UAAM,QAAQ,YAAY,QAAQ,SAAS,IACvC;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,eAAe,MAAM,WAAW;AAAA,QAC9B,QAAQ;AAAA,MACV;AAAA,IACF,IACA;AACJ,WAAO,KAAK,EAAE,SAAS,WAAW,MAAM,GAAG,KAAK;AAAA,MAC9C,cAAc,MAAM,cAAc,SAAS,SAAS,OAAO;AAAA,IAC7D,CAAC;AAAA,EACH;AAEA,WAAS,WAAqB;AAC5B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,eACb,SACA,SAC4B;AAC5B,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,OAAO,WAAW;AACnE,UAAM,YAAY,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI;AACpD,QAAI,CAAC,YAAY,SAAS,GAAG;AAC3B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAE,MAAM,YAAY,SAAS,WAAW,OAAO,GAAI;AACrD,aAAO,SAAS;AAAA,IAClB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,UACb,SACA,SACmB;AACnB,UAAM,YAAY,MAAM,eAAe,SAAS,OAAO;AACvD,QAAI,qBAAqB,SAAU,QAAO;AAC1C,UAAM,SAAS,MAAM,WAAW,uBAAuB,SAAS;AAEhE,WAAO,KAAK;AAAA,MACV,QAAQ,OAAO;AAAA,MACf,GAAI,OAAO,wBACP,EAAE,uBAAuB,OAAO,sBAAsB,IACtD,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAEA,iBAAe,QACb,SACA,SACmB;AACnB,UAAM,YAAY,MAAM,eAAe,SAAS,OAAO;AACvD,QAAI,qBAAqB,SAAU,QAAO;AAC1C,UAAM,SAAS,QAAQ,OACnB,MAAM,QAAQ,KAAK,EAAE,YAAY,WAAW,QAAQ,CAAC,IACrD,MAAM,WAAW,iBAAiB,EAAE,UAAU,CAAC;AACnD,WAAO,KAAK,MAAM;AAAA,EACpB;AAEA,SAAO,eAAe,OAAO,SAAqC;AAChE,UAAM,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACxE,UAAM,SAAS,SAAS,SAAS,SAAS,CAAC;AAC3C,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,UAAM,QAAQ,CAAC,aACb,WAAW,WACP,OACA,cAAc,KAAK,sBAAsB,OAAO,QAAQ,KAAK;AAAA,MAC3D,OAAO;AAAA,IACT,CAAC;AACP,QAAI;AACF,UAAI,WAAW,UAAU;AACvB,eAAO,MAAM,KAAK,KAAK,KAAK,OAAO,CAAC;AAAA,MACtC;AACA,UAAI,WAAW,aAAa,WAAW,YAAY,WAAW,QAAQ;AACpE,eAAO,cAAc,KAAK,aAAa,wBAAwB;AAAA,MACjE;AACA,YAAM,cAAc,MAAM,WAAW,YAAY,SAAS,KAAK;AAC/D,UAAI,YAAa,QAAO;AACxB,UAAI,WAAW,aAAa,cAAc,OAAO,GAAG;AAClD,eAAO,cAAc,KAAK,oBAAoB,qBAAqB;AAAA,MACrE;AACA,YAAM,UAAU,MAAM,YAAY,OAAO;AACzC,UAAI,YAAY,MAAM;AACpB,eAAO,cAAc,KAAK,mBAAmB,gBAAgB;AAAA,MAC/D;AACA,UAAI,WAAW,UAAW,QAAO,MAAM,YAAY,SAAS,OAAO;AACnE,UAAI,WAAW,SAAU,QAAO,MAAM,UAAU,SAAS,OAAO;AAChE,aAAO,MAAM,QAAQ,SAAS,OAAO;AAAA,IACvC,SAAS,OAAO;AACd,aAAO,SAAS,KAAK;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,SAAS,OAA0B;AAC1C,MAAI,iBAAiB,wBAAwB;AAC3C,WAAO,cAAc,KAAK,gBAAgB,MAAM,OAAO;AAAA,EACzD;AACA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO,cAAc,KAAK,sBAAsB,MAAM,OAAO;AAAA,EAC/D;AACA,MAAI,iBAAiB,sBAAsB;AACzC,WAAO,cAAc,KAAK,oBAAoB,MAAM,OAAO;AAAA,EAC7D;AACA,MAAI,iBAAiB,yBAAyB;AAC5C,WAAO,cAAc,KAAK,yBAAyB,MAAM,OAAO;AAAA,EAClE;AACA,MAAI,iBAAiB,mBAAmB;AACtC,WAAO,cAAc,KAAK,mBAAmB,MAAM,OAAO;AAAA,EAC5D;AAEA,SAAO,cAAc,KAAK,kBAAkB,uBAAuB;AACrE;AAuCO,SAAS,cACd,SACA,UAAgC,CAAC,GAC+B;AAChE,SAAO,OAAO,KAAK,QAAQ;AACzB,UAAM,SAAS,CAAC,SAAqC;AACnD,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,aAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAAA,IAC3C;AACA,UAAM,SACJ,QAAQ,UACR,GAAG,OAAO,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,QAAQ,YAAY,UAAU,OAAO,MAAM,OAAO,MAAM,KAAK,WAAW;AACxI,UAAM,MAAM,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM;AAC7D,UAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,UAAM,UAAU,IAAI,QAAQ;AAC5B,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACvD,UAAI,UAAU,OAAW;AACzB,cAAQ,IAAI,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK;AAAA,IACnE;AACA,QAAI;AACJ,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,UAAI,IAAI,SAAS,QAAW;AAC1B,eACE,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,MACrE,OAAO;AACL,cAAM,UAAU,IAAI,YAAY;AAChC,eAAO;AACP,yBAAiB,SAAS,KAAK;AAC7B,kBACE,OAAO,UAAU,WACb,QACA,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAC5C,cAAI,KAAK,SAAS,eAAgB;AAAA,QACpC;AACA,gBAAQ,QAAQ,OAAO;AAAA,MACzB;AAAA,IACF;AACA,UAAM,UAAU,IAAI,QAAQ,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AAC1D,QAAI,IAAI,QAAQ,eAAe;AAC7B,0BAAoB,IAAI,SAAS,IAAI,OAAO,aAAa;AAAA,IAC3D;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,QAAI,aAAa,SAAS;AAC1B,aAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,UAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,IACtD,CAAC;AACD,UAAM,UAAU,SAAS,QAAQ,aAAa;AAC9C,QAAI,QAAQ,SAAS,EAAG,KAAI,UAAU,cAAc,OAAO;AAC3D,QAAI,IAAI,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC,CAAC;AAAA,EACtD;AACF;","names":[]}

package/dist/direct/connect-handler.test.d.ts

@@ -0,0 +1 @@
+export {};