@profullstack/agenticjobs 0.1.0

package/dist/core/auth.js

@@ -0,0 +1,246 @@
+/**
+ * Who someone is, established four ways: a magic link, a passkey, an existing
+ * session cookie, or the device flow for anything without a browser.
+ *
+ * No passwords anywhere. That is the house rule and it is also the reason the
+ * device flow exists: a terminal cannot follow a magic link, so it asks the
+ * board for a short code instead and a browser approves it.
+ */
+import { hashToken, mintToken } from "../config.js";
+import { clean } from "../schema/text.js";
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const MAGIC_TTL_MS = 15 * 60 * 1000;
+const DEVICE_TTL_MS = 10 * 60 * 1000;
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+export const SESSION_COOKIE = 'aj_session';
+export function normaliseEmail(value) {
+    const email = clean(value, 200).toLowerCase();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
+        return null;
+    return email;
+}
+/**
+ * Find or create the account for an address.
+ *
+ * The first account on a board becomes its administrator. Any other rule
+ * requires a setup step someone has to be told about, and an installer that
+ * leaves the operator locked out of their own board is not an installer.
+ */
+export async function ensureUser(pool, email, name) {
+    const existing = await pool.query(`select id, email, name, is_admin from users where lower(email) = lower($1)`, [email]);
+    const found = existing.rows[0];
+    if (found !== undefined)
+        return found;
+    const created = await pool.query(`insert into users (email, name, is_admin)
+     values ($1, $2, (select count(*) = 0 from users))
+     returning id, email, name, is_admin`, [email, name === undefined ? null : clean(name, 120) || null]);
+    const row = created.rows[0];
+    if (row === undefined)
+        throw new Error('user insert returned no row');
+    return row;
+}
+export async function createSession(pool, userId, options = {}) {
+    const token = mintToken();
+    await pool.query(`insert into sessions (user_id, token_hash, label, via_token, expires_at)
+     values ($1, $2, $3, $4, now() + ($5 || ' milliseconds')::interval)`, [
+        userId,
+        hashToken(token),
+        clean(options.label, 80) || 'session',
+        options.viaToken === true,
+        String(options.ttlMs ?? SESSION_TTL_MS),
+    ]);
+    return token;
+}
+export async function viewerFromToken(pool, token) {
+    if (token.trim() === '')
+        return null;
+    const result = await pool.query(`select u.id, u.email, u.name, u.is_admin, s.via_token, s.id as session_id
+       from sessions s
+       join users u on u.id = s.user_id
+      where s.token_hash = $1 and s.expires_at > now()
+      limit 1`, [hashToken(token)]);
+    const row = result.rows[0];
+    if (row === undefined)
+        return null;
+    // Best effort: a failed touch must not cost the caller their request.
+    void pool
+        .query(`update sessions set last_used_at = now() where id = $1`, [row.session_id])
+        .catch(() => undefined);
+    return {
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        // A device-flow token is never an administrator, and that is enforced HERE
+        // rather than only at the routes: the token was typed into a terminal and
+        // lives in a file on disk, while a browser session was established in
+        // front of the person it belongs to. Reporting `isAdmin: true` for one and
+        // relying on every call site to also check `viaToken` is how the third
+        // call site gets it wrong.
+        isAdmin: row.is_admin && !row.via_token,
+        viaToken: row.via_token,
+    };
+}
+export async function revokeSession(pool, token) {
+    await pool.query(`delete from sessions where token_hash = $1`, [hashToken(token)]);
+}
+/**
+ * A device-flow token is never an administrator.
+ *
+ * The token was typed into a terminal and lives in a file on disk; a browser
+ * session was established in front of the person it belongs to. Treating them
+ * as equivalent would make every CLI token a full admin credential.
+ */
+export function requireAdmin(viewer) {
+    return viewer !== null && viewer.isAdmin && !viewer.viaToken;
+}
+/** Only same-origin paths. An open redirect on a login link is a phish. */
+export function safeRedirect(value) {
+    const raw = clean(value, 500);
+    if (raw === '' || !raw.startsWith('/') || raw.startsWith('//'))
+        return null;
+    return raw;
+}
+export async function startMagicLink(pool, email, redirect) {
+    const token = mintToken();
+    const result = await pool.query(`insert into magic_links (token_hash, email, redirect, expires_at)
+     values ($1, $2, $3, now() + ($4 || ' milliseconds')::interval)
+     returning expires_at`, [hashToken(token), email, redirect, String(MAGIC_TTL_MS)]);
+    return { token, expiresAt: result.rows[0]?.expires_at ?? new Date().toISOString() };
+}
+/**
+ * Spend a magic link.
+ *
+ * The update is what claims it, not a read followed by a write: two clicks
+ * arriving together (a mail client prefetching the link, then the person
+ * clicking it) would both pass a read-then-write check.
+ */
+export async function consumeMagicLink(pool, token) {
+    const claimed = await pool.query(`update magic_links
+        set used_at = now()
+      where token_hash = $1 and used_at is null and expires_at > now()
+      returning email, redirect`, [hashToken(token)]);
+    const row = claimed.rows[0];
+    if (row === undefined)
+        return null;
+    const user = await ensureUser(pool, row.email);
+    return { user, redirect: row.redirect };
+}
+/** No characters that look like each other when read off a screen. */
+const CODE_ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+function userCode() {
+    const bytes = new Uint8Array(8);
+    crypto.getRandomValues(bytes);
+    let out = '';
+    for (let index = 0; index < bytes.length; index += 1) {
+        if (index === 4)
+            out += '-';
+        out += CODE_ALPHABET[(bytes[index] ?? 0) % CODE_ALPHABET.length];
+    }
+    return out;
+}
+export async function startDeviceAuth(pool, label, publicUrl) {
+    const deviceCode = mintToken();
+    const code = userCode();
+    const result = await pool.query(`insert into device_codes (device_code_hash, user_code, label, expires_at)
+     values ($1, $2, $3, now() + ($4 || ' milliseconds')::interval)
+     returning expires_at`, [hashToken(deviceCode), code, clean(label, 80) || 'terminal', String(DEVICE_TTL_MS)]);
+    return {
+        deviceCode,
+        userCode: code,
+        verifyUrl: `${publicUrl}/device`,
+        interval: 2,
+        expiresAt: Date.parse(result.rows[0]?.expires_at ?? '') || Date.now() + DEVICE_TTL_MS,
+    };
+}
+/**
+ * Collect the token for an approved code.
+ *
+ * The token is cleared in the same statement that returns it, so it is handed
+ * over exactly once: a second poll with the same device code gets nothing,
+ * which is what makes a leaked poll response useless.
+ *
+ * An unknown or expired code reports `expired` rather than `pending`. A client
+ * told `pending` for a code the server has forgotten polls until its own
+ * timeout with no way to tell that it is waiting for nothing.
+ */
+export async function pollDeviceAuth(pool, deviceCode) {
+    const hash = hashToken(deviceCode);
+    // The token has to be read as it was BEFORE the update, and Postgres
+    // RETURNING gives post-update values - so a plain
+    // `update ... set token = null ... returning token` hands back the null it
+    // just wrote and the terminal waits forever. The CTE holds the old row (and
+    // locks it, so two polls cannot both claim), and RETURNING reads from that.
+    const claimed = await pool.query(`with claimed as (
+       select device_code_hash, token
+         from device_codes
+        where device_code_hash = $1 and status = 'approved' and token is not null
+        for update
+     )
+     update device_codes d
+        set token = null, status = 'collected'
+       from claimed
+      where d.device_code_hash = claimed.device_code_hash
+      returning claimed.token`, [hash]);
+    const token = claimed.rows[0]?.token;
+    if (typeof token === 'string')
+        return { status: 'approved', token };
+    const pending = await pool.query(`select status from device_codes
+      where device_code_hash = $1 and expires_at > now() and status = 'pending'`, [hash]);
+    return pending.rows.length > 0 ? { status: 'pending' } : { status: 'expired' };
+}
+export async function findDeviceCode(pool, code) {
+    const result = await pool.query(`select user_code, label from device_codes
+      where user_code = $1 and status = 'pending' and expires_at > now()`, [code.trim().toUpperCase()]);
+    const row = result.rows[0];
+    return row === undefined ? null : { userCode: row.user_code, label: row.label };
+}
+export async function approveDeviceCode(pool, code, userId) {
+    const label = await findDeviceCode(pool, code);
+    if (label === null)
+        return false;
+    // The terminal's token is marked via_token, which is what keeps it out of
+    // the admin routes for the rest of its life.
+    const token = await createSession(pool, userId, {
+        label: `terminal: ${label.label}`,
+        viaToken: true,
+    });
+    const updated = await pool.query(`update device_codes
+        set status = 'approved', user_id = $2, token = $3
+      where user_code = $1 and status = 'pending' and expires_at > now()`, [code.trim().toUpperCase(), userId, token]);
+    return (updated.rowCount ?? 0) > 0;
+}
+// --- webauthn challenges ------------------------------------------------
+export async function storeChallenge(pool, challenge, purpose, who) {
+    await pool.query(`insert into webauthn_challenges (challenge, email, user_id, purpose, expires_at)
+     values ($1, $2, $3, $4, now() + ($5 || ' milliseconds')::interval)
+     on conflict (challenge) do nothing`, [
+        challenge,
+        who.email ?? null,
+        who.userId ?? null,
+        purpose,
+        String(CHALLENGE_TTL_MS),
+    ]);
+}
+/** Claimed on read: a challenge is single use by definition. */
+export async function takeChallenge(pool, challenge) {
+    const result = await pool.query(`delete from webauthn_challenges
+      where challenge = $1 and expires_at > now()
+      returning challenge, email, user_id, purpose`, [challenge]);
+    const row = result.rows[0];
+    if (row === undefined)
+        return null;
+    return {
+        challenge: row.challenge,
+        email: row.email,
+        userId: row.user_id,
+        purpose: row.purpose,
+    };
+}
+/** Swept opportunistically rather than on a timer, so there is no worker. */
+export async function sweepExpired(pool) {
+    await pool.query(`delete from sessions where expires_at < now()`);
+    await pool.query(`delete from magic_links where expires_at < now()`);
+    await pool.query(`delete from device_codes where expires_at < now() - interval '1 hour'`);
+    await pool.query(`delete from webauthn_challenges where expires_at < now()`);
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAe1C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAa,EAAE,KAAa,EAAE,IAAa;IAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,4EAA4E,EAC5E,CAAC,KAAK,CAAC,CACR,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;yCAEqC,EACrC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAC9D,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,MAAc,EACd,UAAkE,EAAE;IAEpE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,IAAI,CAAC,KAAK,CACd;wEACoE,EACpE;QACE,MAAM;QACN,SAAS,CAAC,KAAK,CAAC;QAChB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS;QACrC,OAAO,CAAC,QAAQ,KAAK,IAAI;QACzB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;KACxC,CACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAa,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;cAIU,EACV,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACnB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,sEAAsE;IACtE,KAAK,IAAI;SACN,KAAK,CAAC,wDAAwD,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;SACjF,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,2BAA2B;QAC3B,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS;QACvC,QAAQ,EAAE,GAAG,CAAC,SAAS;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,KAAa;IAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;AAC/D,CAAC;AASD,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,KAAa,EACb,QAAuB;IAEvB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;0BAEsB,EACtB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AACtF,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;;gCAG4B,EAC5B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACnB,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAYD,sEAAsE;AACtE,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,SAAS,QAAQ;IACf,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,KAAK,CAAC;YAAE,GAAG,IAAI,GAAG,CAAC;QAC5B,GAAG,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAa,EACb,KAAa,EACb,SAAiB;IAEjB,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;0BAEsB,EACtB,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CACrF,CAAC;IACF,OAAO;QACL,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,GAAG,SAAS,SAAS;QAChC,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa;KACtF,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAa,EAAE,UAAkB;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACnC,qEAAqE;IACrE,kDAAkD;IAClD,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;;;;;;;;;8BAU0B,EAC1B,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAEpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;gFAC4E,EAC5E,CAAC,IAAI,CAAC,CACP,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACjF,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;yEACqE,EACrE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC5B,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAa,EACb,IAAY,EACZ,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;QAC9C,KAAK,EAAE,aAAa,KAAK,CAAC,KAAK,EAAE;QACjC,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B;;yEAEqE,EACrE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAC3C,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,2EAA2E;AAE3E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,SAAiB,EACjB,OAA6B,EAC7B,GAAwC;IAExC,MAAM,IAAI,CAAC,KAAK,CACd;;wCAEoC,EACpC;QACE,SAAS;QACT,GAAG,CAAC,KAAK,IAAI,IAAI;QACjB,GAAG,CAAC,MAAM,IAAI,IAAI;QAClB,OAAO;QACP,MAAM,CAAC,gBAAgB,CAAC;KACzB,CACF,CAAC;AACJ,CAAC;AASD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAM7B;;mDAE+C,EAC/C,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa;IAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,MAAM,IAAI,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,MAAM,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;AAC/E,CAAC"}

package/dist/core/import.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Turning whatever a candidate has into Markdown.
+ *
+ * The rule the rest of the board depends on: after this module runs there is
+ * exactly one representation of a resume, and it is Markdown the candidate can
+ * read and edit. An upload is an import step, not a storage format.
+ *
+ * Four inputs, in descending order of how well they survive the trip:
+ *
+ *   .md    used as-is; nothing is inferred and nothing is lost
+ *   .txt   structure guessed from blank lines and capitalisation, then edited
+ *   .docx  read directly here, because a .docx is a ZIP with one XML in it
+ *   .pdf   handed to pdftotext, because laying text back out of a PDF is a
+ *          genuinely hard problem and poppler has already solved it
+ *
+ * External tools are used when they are installed and their absence is
+ * reported as a sentence a person can act on, never as a stack trace. The
+ * container image installs both, so this only degrades on a bare laptop.
+ */
+export declare const MAX_UPLOAD_BYTES: number;
+export interface ImportResult {
+    markdown: string;
+    /** How it got here, for the "converted from your PDF" line on the editor. */
+    via: 'markdown' | 'text' | 'docx' | 'pdf' | 'pandoc';
+    warnings: string[];
+}
+export declare class ImportProblem extends Error {
+}
+export declare function extensionOf(filename: string): string;
+export declare function importDocument(filename: string, bytes: Buffer, mime?: string): Promise<ImportResult>;
+/**
+ * Plain text to Markdown.
+ *
+ * Deliberately conservative. Only two things are inferred - a line that is
+ * short, standalone and title-cased or upper-case becomes a heading, and a
+ * line already starting with a bullet character becomes a list item - because
+ * the candidate is about to see the result in an editor and a wrong guess
+ * costs them more than a missing one.
+ */
+export declare function textToMarkdown(source: string): string;
+/**
+ * .docx to Markdown, without a library.
+ *
+ * Word's XML is verbose but the parts that matter are few: a paragraph carries
+ * a style name that says whether it is a heading or a list item, and its text
+ * is the concatenation of the runs inside it. Bold and italic runs are mapped;
+ * everything else - fonts, colours, tracked changes - is dropped on purpose,
+ * because none of it survives into a Markdown resume anyway.
+ */
+export declare function docxToMarkdown(bytes: Buffer): Promise<ImportResult>;
+/** Laying text back out of a PDF is poppler's job, not ours. */
+export declare function pdfToMarkdown(bytes: Buffer): Promise<ImportResult>;

package/dist/core/import.js

@@ -0,0 +1,311 @@
+/**
+ * Turning whatever a candidate has into Markdown.
+ *
+ * The rule the rest of the board depends on: after this module runs there is
+ * exactly one representation of a resume, and it is Markdown the candidate can
+ * read and edit. An upload is an import step, not a storage format.
+ *
+ * Four inputs, in descending order of how well they survive the trip:
+ *
+ *   .md    used as-is; nothing is inferred and nothing is lost
+ *   .txt   structure guessed from blank lines and capitalisation, then edited
+ *   .docx  read directly here, because a .docx is a ZIP with one XML in it
+ *   .pdf   handed to pdftotext, because laying text back out of a PDF is a
+ *          genuinely hard problem and poppler has already solved it
+ *
+ * External tools are used when they are installed and their absence is
+ * reported as a sentence a person can act on, never as a stack trace. The
+ * container image installs both, so this only degrades on a bare laptop.
+ */
+import { execFile } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { readZipEntry, ZipProblem } from "./zip.js";
+const run = promisify(execFile);
+export const MAX_UPLOAD_BYTES = 8 * 1024 * 1024;
+export class ImportProblem extends Error {
+}
+export function extensionOf(filename) {
+    const match = /\.([A-Za-z0-9]+)$/.exec(filename.trim());
+    return (match?.[1] ?? '').toLowerCase();
+}
+export async function importDocument(filename, bytes, mime = '') {
+    if (bytes.length === 0)
+        throw new ImportProblem('That file is empty.');
+    if (bytes.length > MAX_UPLOAD_BYTES) {
+        throw new ImportProblem(`That file is ${Math.round(bytes.length / 1024 / 1024)}MB. The limit is ${MAX_UPLOAD_BYTES / 1024 / 1024}MB.`);
+    }
+    const extension = extensionOf(filename);
+    const kind = classify(extension, mime, bytes);
+    switch (kind) {
+        case 'markdown':
+            return { markdown: decodeText(bytes).trim(), via: 'markdown', warnings: [] };
+        case 'text':
+            return { markdown: textToMarkdown(decodeText(bytes)), via: 'text', warnings: [] };
+        case 'docx':
+            return docxToMarkdown(bytes);
+        case 'pdf':
+            return pdfToMarkdown(bytes);
+        default:
+            return legacyToMarkdown(bytes, extension);
+    }
+}
+function classify(extension, mime, bytes) {
+    // The magic bytes win over the extension. A resume renamed from .pdf to
+    // .docx is a mistake someone makes once, and the file itself is not lying.
+    if (bytes.subarray(0, 5).toString('latin1') === '%PDF-')
+        return 'pdf';
+    if (bytes.subarray(0, 2).toString('latin1') === 'PK' && (extension === 'docx' || mime.includes('wordprocessingml'))) {
+        return 'docx';
+    }
+    if (['md', 'markdown', 'mdown', 'mkd'].includes(extension))
+        return 'markdown';
+    if (extension === 'txt' || mime === 'text/plain')
+        return 'text';
+    if (extension === 'docx')
+        return 'docx';
+    if (extension === 'pdf')
+        return 'pdf';
+    if (['doc', 'odt', 'rtf', 'html', 'htm'].includes(extension))
+        return 'legacy';
+    // Anything that decodes cleanly as UTF-8 is treated as text rather than
+    // refused: a resume with no extension is still a resume.
+    return looksTextual(bytes) ? 'text' : 'legacy';
+}
+function looksTextual(bytes) {
+    const sample = bytes.subarray(0, 4096);
+    let control = 0;
+    for (const byte of sample) {
+        if (byte === 0)
+            return false;
+        if (byte < 9 || (byte > 13 && byte < 32))
+            control += 1;
+    }
+    return control / Math.max(1, sample.length) < 0.02;
+}
+function decodeText(bytes) {
+    // A BOM left in place shows up as a stray character in the first heading.
+    const text = bytes.toString('utf8');
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+/**
+ * Plain text to Markdown.
+ *
+ * Deliberately conservative. Only two things are inferred - a line that is
+ * short, standalone and title-cased or upper-case becomes a heading, and a
+ * line already starting with a bullet character becomes a list item - because
+ * the candidate is about to see the result in an editor and a wrong guess
+ * costs them more than a missing one.
+ */
+export function textToMarkdown(source) {
+    const lines = source.replace(/\r\n?/g, '\n').split('\n');
+    const out = [];
+    let first = true;
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = (lines[index] ?? '').trimEnd();
+        const trimmed = line.trim();
+        if (trimmed === '') {
+            out.push('');
+            continue;
+        }
+        const bullet = /^[•·▪●*+-]\s+(.*)$/.exec(trimmed);
+        if (bullet !== null) {
+            out.push(`- ${bullet[1] ?? ''}`);
+            continue;
+        }
+        if (first) {
+            out.push(`# ${trimmed}`);
+            first = false;
+            continue;
+        }
+        const previousBlank = (lines[index - 1] ?? '').trim() === '';
+        const nextBlank = (lines[index + 1] ?? '').trim() === '';
+        const heading = previousBlank &&
+            nextBlank &&
+            trimmed.length <= 60 &&
+            !trimmed.endsWith('.') &&
+            (trimmed === trimmed.toUpperCase() || /^[A-Z][a-z]+(\s+[A-Za-z&/]+){0,4}$/.test(trimmed));
+        out.push(heading ? `## ${titleCase(trimmed)}` : trimmed);
+    }
+    return collapseBlankRuns(out.join('\n')).trim();
+}
+function titleCase(value) {
+    if (value !== value.toUpperCase())
+        return value;
+    return value
+        .toLowerCase()
+        .replace(/\b([a-z])/g, (character) => character.toUpperCase());
+}
+function collapseBlankRuns(value) {
+    return value.replace(/\n{3,}/g, '\n\n');
+}
+/**
+ * .docx to Markdown, without a library.
+ *
+ * Word's XML is verbose but the parts that matter are few: a paragraph carries
+ * a style name that says whether it is a heading or a list item, and its text
+ * is the concatenation of the runs inside it. Bold and italic runs are mapped;
+ * everything else - fonts, colours, tracked changes - is dropped on purpose,
+ * because none of it survives into a Markdown resume anyway.
+ */
+export async function docxToMarkdown(bytes) {
+    const warnings = [];
+    let xml;
+    try {
+        xml = readZipEntry(bytes, 'word/document.xml');
+    }
+    catch (error) {
+        if (error instanceof ZipProblem)
+            throw new ImportProblem(error.message);
+        throw error;
+    }
+    if (xml === null) {
+        throw new ImportProblem('That .docx has no word/document.xml inside it.');
+    }
+    const document = xml.toString('utf8');
+    const out = [];
+    const paragraphs = document.match(/<w:p[ >][\s\S]*?<\/w:p>|<w:p\/>/g) ?? [];
+    for (const paragraph of paragraphs) {
+        const style = /<w:pStyle[^>]*w:val="([^"]+)"/.exec(paragraph)?.[1] ?? '';
+        const isList = /<w:numPr[ >]/.test(paragraph);
+        const text = runsToText(paragraph).trim();
+        if (text === '') {
+            out.push('');
+            continue;
+        }
+        const headingLevel = /^Heading(\d)$/i.exec(style)?.[1];
+        if (headingLevel !== undefined) {
+            out.push('', `${'#'.repeat(Math.min(6, Number(headingLevel)))} ${stripMarks(text)}`, '');
+            continue;
+        }
+        if (/^Title$/i.test(style)) {
+            out.push('', `# ${stripMarks(text)}`, '');
+            continue;
+        }
+        if (isList) {
+            out.push(`- ${text}`);
+            continue;
+        }
+        out.push(text);
+    }
+    const tables = (document.match(/<w:tbl[ >]/g) ?? []).length;
+    if (tables > 0) {
+        // Word tables are commonly used purely for two-column layout, so turning
+        // them into Markdown tables produces something worse than flat text.
+        warnings.push(`${tables} table${tables === 1 ? '' : 's'} in the document were flattened to plain lines. Check the layout.`);
+    }
+    const markdown = collapseBlankRuns(out.join('\n')).trim();
+    if (markdown === '')
+        throw new ImportProblem('No text could be read out of that .docx.');
+    return { markdown, via: 'docx', warnings };
+}
+function runsToText(paragraph) {
+    let out = '';
+    const runs = paragraph.match(/<w:r[ >][\s\S]*?<\/w:r>/g) ?? [];
+    for (const run of runs) {
+        const pieces = run.match(/<w:t(?:\s[^>]*)?>([\s\S]*?)<\/w:t>/g) ?? [];
+        let text = pieces
+            .map((piece) => decodeXml(piece.replace(/<[^>]+>/g, '')))
+            .join('');
+        if (text === '') {
+            // A tab or an explicit break carries meaning even with no text.
+            if (/<w:tab\b/.test(run))
+                out += '  ';
+            if (/<w:br\b/.test(run))
+                out += '\n';
+            continue;
+        }
+        if (/<w:b\/>|<w:b\s[^>]*w:val="(?:1|true|on)"/.test(run))
+            text = `**${text}**`;
+        if (/<w:i\/>|<w:i\s[^>]*w:val="(?:1|true|on)"/.test(run))
+            text = `*${text}*`;
+        out += text;
+    }
+    return out;
+}
+function stripMarks(value) {
+    return value.replace(/\*+/g, '').trim();
+}
+function decodeXml(value) {
+    return value
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&#(\d+);/g, (_whole, code) => String.fromCodePoint(Number(code)))
+        .replace(/&amp;/g, '&');
+}
+/** Laying text back out of a PDF is poppler's job, not ours. */
+export async function pdfToMarkdown(bytes) {
+    const text = await withTempFile(bytes, 'pdf', async (path) => {
+        try {
+            // -layout keeps columns apart, which is the difference between a
+            // readable resume and every line of a two-column CV interleaved.
+            const { stdout } = await run('pdftotext', ['-layout', '-nopgbrk', '-enc', 'UTF-8', path, '-'], {
+                maxBuffer: 16 * 1024 * 1024,
+            });
+            return stdout;
+        }
+        catch (error) {
+            if (isMissingBinary(error)) {
+                throw new ImportProblem('This board cannot read PDFs because pdftotext is not installed. Install poppler-utils, or upload a .md, .txt or .docx instead.');
+            }
+            throw new ImportProblem(`pdftotext could not read that PDF: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+    const markdown = textToMarkdown(text);
+    if (markdown.replace(/[#\s-]/g, '') === '') {
+        throw new ImportProblem('That PDF has no extractable text. It is probably a scan; upload a .md, .txt or .docx instead.');
+    }
+    return {
+        markdown,
+        via: 'pdf',
+        warnings: [
+            'Converted from a PDF, so the structure is a guess. Check the headings before you save.',
+        ],
+    };
+}
+/** .doc, .odt, .rtf and HTML, if pandoc happens to be installed. */
+async function legacyToMarkdown(bytes, extension) {
+    return withTempFile(bytes, extension || 'bin', async (path) => {
+        try {
+            const { stdout } = await run('pandoc', ['--from', pandocFormat(extension), '--to', 'gfm', '--wrap=none', path], { maxBuffer: 16 * 1024 * 1024 });
+            return { markdown: collapseBlankRuns(stdout).trim(), via: 'pandoc', warnings: [] };
+        }
+        catch (error) {
+            if (isMissingBinary(error)) {
+                throw new ImportProblem(`This board cannot read .${extension} files because pandoc is not installed. Upload a .md, .txt, .docx or .pdf instead.`);
+            }
+            throw new ImportProblem(`That .${extension} could not be converted: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+function pandocFormat(extension) {
+    if (extension === 'odt')
+        return 'odt';
+    if (extension === 'rtf')
+        return 'rtf';
+    if (extension === 'html' || extension === 'htm')
+        return 'html';
+    return 'doc';
+}
+function isMissingBinary(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}
+async function withTempFile(bytes, extension, work) {
+    const directory = await mkdtemp(join(tmpdir(), 'agenticjobs-'));
+    const path = join(directory, `upload.${extension}`);
+    try {
+        await writeFile(path, bytes);
+        return await work(path);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=import.js.map

package/dist/core/import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.js","sourceRoot":"","sources":["../../src/core/import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAShD,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,KAAa,EACb,IAAI,GAAG,EAAE;IAET,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,aAAa,CACrB,gBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,oBAAoB,gBAAgB,GAAG,IAAI,GAAG,IAAI,KAAK,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAE9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC/E,KAAK,MAAM;YACT,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpF,KAAK,MAAM;YACT,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,KAAK;YACR,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9B;YACE,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAID,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAAY,EAAE,KAAa;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACpH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9E,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAChE,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9E,wEAAwE;IACxE,yDAAyD;IACzD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,0EAA0E;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,IAAI,CAAC;IAEjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACzD,MAAM,OAAO,GACX,aAAa;YACb,SAAS;YACT,OAAO,CAAC,MAAM,IAAI,EAAE;YACpB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACtB,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5F,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU;YAAE,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,kCAAkC,CAAC,IAAI,EAAE,CAAC;IAE5E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,yEAAyE;QACzE,qEAAqE;QACrE,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,mEAAmE,CAC7G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,IAAI,GAAG,MAAM;aACd,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;aACxD,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,gEAAgE;YAChE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC;YACtC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC;QAC/E,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC;QAC7E,GAAG,IAAI,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SAClF,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,iEAAiE;YACjE,iEAAiE;YACjE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE;gBAC7F,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;aAC5B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CACrB,gIAAgI,CACjI,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,aAAa,CACrB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ;QACR,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE;YACR,wFAAwF;SACzF;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB;IAC9D,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,QAAQ,EACR,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EACvE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAChC,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,QAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CACrB,2BAA2B,SAAS,oFAAoF,CACzH,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,SAAS,SAAS,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACd,KAA2B,CAAC,IAAI,KAAK,QAAQ,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAa,EACb,SAAiB,EACjB,IAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,SAAS,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}