@proteinjs/user-server 1.7.0 → 1.9.0

package/dist/test/ValidateResetToken.test.js

@@ -0,0 +1,170 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var user_1 = require("@proteinjs/user");
+var validateResetPasswordToken_1 = require("../src/routes/validateResetPasswordToken");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var invokeValidate = function (query) { return __awaiter(void 0, void 0, void 0, function () {
+    var outcome, response;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                outcome = {};
+                response = {
+                    status: function (code) {
+                        outcome.status = code;
+                        return this;
+                    },
+                    send: function (body) {
+                        outcome.body = body;
+                    },
+                };
+                return [4 /*yield*/, validateResetPasswordToken_1.validateResetPasswordToken.onRequest({ query: query }, response)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/, outcome];
+        }
+    });
+}); };
+var armResetToken = function (email, token, expiration) { return __awaiter(void 0, void 0, void 0, function () {
+    var user;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: email })];
+            case 1:
+                user = _a.sent();
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                        id: user.id,
+                        passwordResetToken: token,
+                        passwordResetTokenExpiration: expiration,
+                    })];
+            case 2:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+describe('validateResetPasswordToken route', function () {
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a valid token resolves isValid WITH the account email (the reset form identifier)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-valid@test.local', 'tok-valid-1', (0, moment_1.default)().add(1, 'hour'))];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, invokeValidate({ token: 'tok-valid-1' })];
+                case 2:
+                    outcome = _a.sent();
+                    expect(outcome.status).toBe(200);
+                    expect(outcome.body).toEqual({ isValid: true, email: 'reset-valid@test.local' });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an expired token resolves invalid and leaks no email', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, armResetToken('reset-expired@test.local', 'tok-expired-1', (0, moment_1.default)().subtract(1, 'minute'))];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, invokeValidate({ token: 'tok-expired-1' })];
+                case 2:
+                    outcome = _a.sent();
+                    expect(outcome.status).toBe(200);
+                    expect(outcome.body.isValid).toBe(false);
+                    expect(outcome.body.email).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an unknown token resolves invalid and leaks no email', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, invokeValidate({ token: 'tok-never-issued' })];
+                case 1:
+                    outcome = _a.sent();
+                    expect(outcome.status).toBe(200);
+                    expect(outcome.body.isValid).toBe(false);
+                    expect(outcome.body.email).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a missing token is a 400', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, invokeValidate({})];
+                case 1:
+                    outcome = _a.sent();
+                    expect(outcome.status).toBe(400);
+                    expect(outcome.body.isValid).toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=ValidateResetToken.test.js.map

package/dist/test/ValidateResetToken.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ValidateResetToken.test.js","sourceRoot":"","sources":["../../test/ValidateResetToken.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAA8C;AAC9C,wCAAyC;AACzC,uFAAsF;AACtF,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAahD,IAAM,cAAc,GAAG,UAAO,KAA8B;;;;;gBACpD,OAAO,GAAiB,EAAE,CAAC;gBAC3B,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;iBACF,CAAC;gBACF,qBAAM,uDAA0B,CAAC,SAAS,CAAC,EAAE,KAAK,OAAA,EAAW,EAAE,QAAiB,CAAC,EAAA;;gBAAjF,SAAiF,CAAC;gBAClF,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AAEF,IAAM,aAAa,GAAG,UAAO,KAAa,EAAE,KAAa,EAAE,UAAyB;;;;oBACrE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA9D,IAAI,GAAG,SAAuD;gBACpE,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;wBACxC,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,kBAAkB,EAAE,KAAK;wBACzB,4BAA4B,EAAE,UAAU;qBACzC,CAAC,EAAA;;gBAJF,SAIE,CAAC;;;;KACJ,CAAC;AAEF,QAAQ,CAAC,kCAAkC,EAAE;IAC3C,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;wBACtF,qBAAM,aAAa,CAAC,wBAAwB,EAAE,aAAa,EAAE,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAA;;oBAArF,SAAqF,CAAC;oBAEtE,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAAxD,OAAO,GAAG,SAA8C;oBAE9D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;;;;SAClF,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;;;;wBACzD,qBAAM,aAAa,CAAC,0BAA0B,EAAE,eAAe,EAAE,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAA;;oBAAhG,SAAgG,CAAC;oBAEjF,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC5C,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;;;;wBACzC,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAA7D,OAAO,GAAG,SAAmD;oBAEnE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC5C,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE;;;;wBACb,qBAAM,cAAc,CAAC,EAAE,CAAC,EAAA;;oBAAlC,OAAO,GAAG,SAAwB;oBAExC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;;;SAC1C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/passportSessionHarness.d.ts

@@ -0,0 +1,31 @@
+/** Session-lifecycle events in call order — the session-establishment contract under test. */
+export type SessionEvent = 'regenerate' | 'login' | 'save';
+export type PassportRequest = {
+    /** Express-shaped request whose `login`/`logout` are REAL passport machinery. */
+    request: any;
+    /**
+     * 'regenerate' / 'login' / 'save' in call order. The full contract of session establishment:
+     * regenerate FIRST (a fresh session id on privilege change — session fixation), then the bind
+     * of the account onto the fresh session, then save (the row must commit before the response).
+     */
+    events: SessionEvent[];
+};
+/**
+ * Builds a request whose `request.login` / `request.logout` are the GENUINE passport 0.6
+ * machinery, wired through `authenticator.initialize()` — the same middleware the server runs —
+ * over an express-session-shaped session mock.
+ *
+ * Why real passport and not a hand-mocked `login`: since passport 0.6 (the CVE-2022-25896
+ * session-fixation fix), the regenerate and the commit-before-response save live INSIDE
+ * `request.login` (SessionManager.logIn: regenerate → serializeUser → bind → save). A mocked
+ * `login` would assert nothing about either — the door suites must drive the real owner to
+ * prove the doors inherit the contract.
+ *
+ * serializeUser mirrors @proteinjs/server's identity pass-through (the session stores the
+ * account email directly), instrumented to record the bind ('login') between 'regenerate' and
+ * 'save'. The session mock replicates the one express-session behavior passport depends on:
+ * `regenerate` REPLACES `request.session` with a fresh session (new id, no passport state), so
+ * the bind provably lands on the post-regeneration session.
+ */
+export declare const createPassportRequest: (extra?: Record<string, unknown>) => Promise<PassportRequest>;
+//# sourceMappingURL=passportSessionHarness.d.ts.map

package/dist/test/passportSessionHarness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passportSessionHarness.d.ts","sourceRoot":"","sources":["../../test/passportSessionHarness.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,OAAO,EAAE,GAAG,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,WAAiB,OAAO,MAAM,EAAE,OAAO,CAAC,KAAQ,QAAQ,eAAe,CAwBxG,CAAC"}

package/dist/test/passportSessionHarness.js

@@ -0,0 +1,107 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPassportRequest = void 0;
+var passport_1 = __importDefault(require("passport"));
+/**
+ * Builds a request whose `request.login` / `request.logout` are the GENUINE passport 0.6
+ * machinery, wired through `authenticator.initialize()` — the same middleware the server runs —
+ * over an express-session-shaped session mock.
+ *
+ * Why real passport and not a hand-mocked `login`: since passport 0.6 (the CVE-2022-25896
+ * session-fixation fix), the regenerate and the commit-before-response save live INSIDE
+ * `request.login` (SessionManager.logIn: regenerate → serializeUser → bind → save). A mocked
+ * `login` would assert nothing about either — the door suites must drive the real owner to
+ * prove the doors inherit the contract.
+ *
+ * serializeUser mirrors @proteinjs/server's identity pass-through (the session stores the
+ * account email directly), instrumented to record the bind ('login') between 'regenerate' and
+ * 'save'. The session mock replicates the one express-session behavior passport depends on:
+ * `regenerate` REPLACES `request.session` with a fresh session (new id, no passport state), so
+ * the bind provably lands on the post-regeneration session.
+ */
+var createPassportRequest = function (extra) {
+    if (extra === void 0) { extra = {}; }
+    return __awaiter(void 0, void 0, void 0, function () {
+        var events, authenticator, request, makeSession;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    events = [];
+                    authenticator = new passport_1.default.Passport();
+                    authenticator.serializeUser(function (user, done) {
+                        events.push('login');
+                        done(null, user);
+                    });
+                    request = __assign({}, extra);
+                    makeSession = function () { return ({
+                        regenerate: function (done) {
+                            events.push('regenerate');
+                            request.session = makeSession();
+                            done();
+                        },
+                        save: function (done) {
+                            events.push('save');
+                            done();
+                        },
+                    }); };
+                    request.session = makeSession();
+                    return [4 /*yield*/, new Promise(function (resolve) { return authenticator.initialize()(request, {}, function () { return resolve(); }); })];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/, { request: request, events: events }];
+            }
+        });
+    });
+};
+exports.createPassportRequest = createPassportRequest;
+//# sourceMappingURL=passportSessionHarness.js.map

package/dist/test/passportSessionHarness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passportSessionHarness.js","sourceRoot":"","sources":["../../test/passportSessionHarness.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,sDAAgC;AAgBhC;;;;;;;;;;;;;;;;GAgBG;AACI,IAAM,qBAAqB,GAAG,UAAO,KAAmC;IAAnC,sBAAA,EAAA,UAAmC;;;;;;oBACvE,MAAM,GAAmB,EAAE,CAAC;oBAC5B,aAAa,GAAG,IAAI,kBAAQ,CAAC,QAAQ,EAAE,CAAC;oBAC9C,aAAa,CAAC,aAAa,CAAC,UAAC,IAAa,EAAE,IAA0C;wBACpF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBACrB,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACnB,CAAC,CAAC,CAAC;oBAEG,OAAO,gBAAa,KAAK,CAAE,CAAC;oBAC5B,WAAW,GAAG,cAAW,OAAA,CAAC;wBAC9B,UAAU,EAAE,UAAC,IAA6B;4BACxC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;4BAC1B,OAAO,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;4BAChC,IAAI,EAAE,CAAC;wBACT,CAAC;wBACD,IAAI,EAAE,UAAC,IAA6B;4BAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;4BACpB,IAAI,EAAE,CAAC;wBACT,CAAC;qBACF,CAAC,EAV6B,CAU7B,CAAC;oBACH,OAAO,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;oBAEhC,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,IAAK,OAAA,aAAa,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAW,EAAE,cAAM,OAAA,OAAO,EAAE,EAAT,CAAS,CAAC,EAAjE,CAAiE,CAAC,EAAA;;oBAAvG,SAAuG,CAAC;oBACxG,sBAAO,EAAE,OAAO,SAAA,EAAE,MAAM,QAAA,EAAE,EAAC;;;;CAC5B,CAAC;AAxBW,QAAA,qBAAqB,yBAwBhC"}