@relume_io/partner-node 2.0.1 → 2.1.0

package/dist/chunk-HPVVBUR7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/guards.ts","../src/response.ts","../src/session.ts","../src/signing.ts"],"sourcesContent":["// Value checks shared by the call handler (calls.ts) and the conformance\n// checker (check.ts): the checker is only useful if it accepts exactly what\n// the handler, and Relume behind it, accept.\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function isString(\n  value: unknown,\n  min: number,\n  max: number,\n): value is string {\n  return (\n    typeof value === 'string' && value.length >= min && value.length <= max\n  );\n}\n\nexport function isWhole(value: unknown, min: number): value is number {\n  return (\n    typeof value === 'number' && Number.isSafeInteger(value) && value >= min\n  );\n}\n\n/** null and '' count as a field left out, as they do for Relume. */\nexport function absent(value: unknown): boolean {\n  return value === undefined || value === null || value === '';\n}\n\n// Zod 4's default email pattern, which Relume validates user.get with\n// (backend/src/services/partners/partner-calls.ts). Change both together.\nconst EMAIL =\n  /^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/;\n\nexport function isEmail(value: unknown): value is string {\n  return typeof value === 'string' && EMAIL.test(value);\n}\n\nexport function isHttpsUrl(value: unknown): value is string {\n  if (typeof value !== 'string') return false;\n  try {\n    return new URL(value).protocol === 'https:';\n  } catch {\n    return false;\n  }\n}\n","import type { RelumeResponse } from './types.ts';\n\n/** Bodies above this are refused with 413. Relume's calls are a few hundred bytes. */\nexport const MAX_BODY_BYTES = 1024 * 1024;\n\nconst JSON_HEADERS = {\n  'Content-Type': 'application/json; charset=utf-8',\n  'Cache-Control': 'no-store',\n} as const;\n\nexport function jsonResponse(\n  status: number,\n  body: unknown,\n  headers: Record<string, string> = {},\n): RelumeResponse {\n  return { status, headers: { ...JSON_HEADERS, ...headers }, body };\n}\n\nexport function errorResponse(\n  status: number,\n  code: string,\n  message: string,\n  headers?: Record<string, string>,\n): RelumeResponse {\n  return jsonResponse(status, { error: { code, message } }, headers);\n}\n\nexport type Route = 'session' | 'calls';\n\nconst METHOD_FOR: Record<Route, string> = { session: 'GET', calls: 'POST' };\n\n/**\n * fetchHandler: which route a path is for, by its last segment. The framework\n * already routed the request here (a Next.js route file, Hono's\n * `app.all('/relume/*')`), so this works under any prefix.\n */\nexport function routeOf(pathname: string): Route | null {\n  const last = pathname.replace(/\\/+$/, '').split('/').pop();\n  return last === 'session' || last === 'calls' ? last : null;\n}\n\n/**\n * express(): exact paths only. Middleware sees every request in the app, so\n * matching any path ending in /calls would swallow the partner's own routes.\n * Under app.use('/relume', …) Express strips the mount path (and sets\n * req.baseUrl); mounted at the root, or behind bare node:http, the full\n * /relume/… path is expected.\n */\nexport function mountedRouteOf(\n  pathname: string,\n  mounted: boolean,\n): Route | null {\n  const path = pathname.replace(/(.)\\/+$/, '$1');\n  const prefix = mounted ? '' : '/relume';\n  if (path === `${prefix}/session`) return 'session';\n  if (path === `${prefix}/calls`) return 'calls';\n  return null;\n}\n\n/** A 405 for the wrong method on a known route, or null when it's right. */\nexport function methodNotAllowed(\n  route: Route,\n  method: string | undefined,\n): RelumeResponse | null {\n  const allowed = METHOD_FOR[route];\n  // No HEAD on the session route: it would mint a client secret per probe.\n  // OPTIONS is a CORS preflight, which the adapters leave to the app.\n  if (method === allowed) return null;\n  return errorResponse(\n    405,\n    'method_not_allowed',\n    `Use ${allowed} for this route.`,\n    { Allow: allowed },\n  );\n}\n\nexport function payloadTooLarge(): RelumeResponse {\n  return errorResponse(413, 'payload_too_large', 'The body is too large.');\n}\n\n/** A preflight that reached the handler: no CORS headers, so no grant. */\nexport function preflight(route: Route): RelumeResponse {\n  return { status: 204, headers: { Allow: METHOD_FOR[route] }, body: null };\n}\n\n/** The parts of a client the adapters use. */\nexport interface Handlers<TRequest> {\n  handleCall(input: {\n    rawBody: string | Uint8Array;\n    signatureHeader: string | null | undefined;\n    requestId?: string | null;\n  }): Promise<RelumeResponse>;\n  handleSession(request: TRequest): Promise<RelumeResponse>;\n}\n","// Defences for `GET /relume/session`, which mints a client secret for whoever\n// the request's cookies say is signed in. Any site can make a signed-in\n// user's browser send that request; only the partner's CORS stops it reading\n// the answer, and a CORS setup that reflects Origin would hand the secret\n// over. So the route also refuses what only another site sends.\n\nimport { isRecord } from './guards.ts';\nimport { errorResponse } from './response.ts';\nimport type { RelumeResponse } from './types.ts';\n\n/**\n * Sent by `@relume_io/partner-embed` on every session request. A custom\n * header makes a cross-origin request need a CORS preflight, which a plain\n * link, form or `<img>` on another site can't get.\n */\nexport const EMBED_HEADER = 'Relume-Embed';\nexport const EMBED_HEADER_VALUE = '1';\n\n/**\n * What `handleSession` needs from a request: its headers. The fetch\n * `Request`, Express's request and node:http's `IncomingMessage` all fit.\n */\nexport interface SessionRequest {\n  headers: unknown;\n}\n\ntype HeaderReader = (name: string) => string | null;\n\ninterface HeadersLike {\n  get(name: string): string | null;\n}\n\nfunction isHeadersLike(value: unknown): value is HeadersLike {\n  return isRecord(value) && typeof value.get === 'function';\n}\n\n/**\n * The request's headers, from a fetch `Request`, a node:http (Express)\n * request, or any object with `headers`. Null when it has none we can read.\n */\nfunction headerReader(request: unknown): HeaderReader | null {\n  const headers = isRecord(request) ? request.headers : undefined;\n  if (isHeadersLike(headers)) return (name) => headers.get(name);\n  if (!isRecord(headers)) return null;\n  return (name) => {\n    const wanted = name.toLowerCase();\n    for (const [key, value] of Object.entries(headers)) {\n      if (key.toLowerCase() !== wanted) continue;\n      const first = Array.isArray(value) ? value[0] : value;\n      return typeof first === 'string' ? first : null;\n    }\n    return null;\n  };\n}\n\nexport interface SessionRefusal {\n  response: RelumeResponse;\n  /** For onHandlerError: a refusal that points at the partner's setup. */\n  error?: Error;\n}\n\n/** Why the session route refuses this request, or null to go on. */\nexport function refuseSessionRequest(request: unknown): SessionRefusal | null {\n  const header = headerReader(request);\n  if (!header) {\n    return {\n      response: errorResponse(\n        500,\n        'internal_error',\n        'The partner failed to handle the call.',\n      ),\n      error: new TypeError(\n        \"handleSession couldn't read the request's headers. Pass it the fetch Request, the Node request, or an object with headers.\",\n      ),\n    };\n  }\n  // Browsers send Sec-Fetch-Site on every request. Another site is never a\n  // legitimate caller, whatever the partner's CORS allows.\n  if (header('sec-fetch-site')?.trim().toLowerCase() === 'cross-site') {\n    return {\n      response: errorResponse(\n        403,\n        'cross_site_request',\n        'The session route only answers your own pages.',\n      ),\n    };\n  }\n  if (header(EMBED_HEADER)?.trim() !== EMBED_HEADER_VALUE) {\n    return {\n      response: errorResponse(\n        400,\n        'embed_header_missing',\n        `The session route needs the ${EMBED_HEADER} header that @relume_io/partner-embed sends.`,\n      ),\n      error: new Error(\n        `GET /relume/session was refused: no ${EMBED_HEADER}: ${EMBED_HEADER_VALUE} header. @relume_io/partner-embed sends it from 2.0.0; update the script tag or package. On another origin, allow the header in the route's CORS preflight.`,\n      ),\n    };\n  }\n  return null;\n}\n","// Relume-Signature verification (docs/partner-protocol/v1.md section 6).\n//\n//   Relume-Signature: t=<unix seconds>,v1=<hex hmac-sha256(sk, t + \".\" + rawBody)>[,v1=…]\n//\n// Mirrors backend/src/services/partners/signing.ts and passes\n// docs/partner-protocol/test-vectors.json. Uses Web Crypto rather than\n// node:crypto so the same code runs on Node, Workers, Deno, Bun and edge\n// runtimes. Never log a secret or a signature.\n\nexport const SIGNATURE_HEADER = 'Relume-Signature';\nexport const REQUEST_ID_HEADER = 'Relume-Request-Id';\nexport const SIGNATURE_SCHEME = 'v1';\n/** How far a call's timestamp may be from this server's clock, either way. */\nexport const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;\n/** The current key plus the previous one during a rotation overlap. */\nexport const MAX_SIGNATURES = 2;\n\nconst HEX_SHA256 = /^[0-9a-f]{64}$/i;\n// Canonical decimal: other implementations HMAC the t= text as written, so a\n// leading zero would verify here and fail there.\nconst UNIX_SECONDS = /^(0|[1-9]\\d{0,11})$/;\n\nexport type SignatureFailure =\n  | 'malformed_header'\n  | 'signature_mismatch'\n  | 'timestamp_out_of_tolerance';\n\nexport type VerifySignatureResult =\n  | { valid: true; timestamp: number }\n  | { valid: false; reason: SignatureFailure };\n\nexport interface ParsedSignatureHeader {\n  timestamp: number;\n  /** Every v1= value in header order, including ones that aren't hex. */\n  signatures: string[];\n}\n\nconst encoder = new TextEncoder();\n\nfunction bodyBytes(rawBody: string | Uint8Array): Uint8Array {\n  return typeof rawBody === 'string' ? encoder.encode(rawBody) : rawBody;\n}\n\n/** `t + \".\" + rawBody` as bytes: the exact message the HMAC covers. */\nfunction signedMessage(\n  timestamp: number,\n  rawBody: string | Uint8Array,\n): Uint8Array<ArrayBuffer> {\n  const prefix = encoder.encode(`${timestamp}.`);\n  const body = bodyBytes(rawBody);\n  const message = new Uint8Array(prefix.length + body.length);\n  message.set(prefix, 0);\n  message.set(body, prefix.length);\n  return message;\n}\n\nfunction hmacKey(secret: string, usage: 'sign' | 'verify'): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    [usage],\n  );\n}\n\nfunction toHex(bytes: ArrayBuffer): string {\n  return Array.from(new Uint8Array(bytes), (byte) =>\n    byte.toString(16).padStart(2, '0'),\n  ).join('');\n}\n\nfunction fromHex(hex: string): Uint8Array<ArrayBuffer> {\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < bytes.length; i += 1) {\n    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nfunction assertTimestamp(timestamp: number): void {\n  if (!Number.isSafeInteger(timestamp) || timestamp < 0) {\n    throw new TypeError('timestamp must be whole unix seconds');\n  }\n}\n\n/** Lowercase hex HMAC-SHA256 of `t + \".\" + rawBody`, keyed by the secret key. */\nexport async function computeSignature(\n  secret: string,\n  timestamp: number,\n  rawBody: string | Uint8Array,\n): Promise<string> {\n  if (typeof secret !== 'string' || secret.length === 0) {\n    throw new TypeError('secret must be a non-empty string');\n  }\n  assertTimestamp(timestamp);\n  const key = await hmacKey(secret, 'sign');\n  return toHex(\n    await crypto.subtle.sign('HMAC', key, signedMessage(timestamp, rawBody)),\n  );\n}\n\n/**\n * Builds a Relume-Signature header the way Relume does: newest secret first,\n * a second one only during a rotation. For a partner's own tests; a partner's\n * server never needs to sign anything.\n */\nexport async function signCall(\n  secrets: string | readonly string[],\n  timestamp: number,\n  rawBody: string | Uint8Array,\n): Promise<string> {\n  const list = typeof secrets === 'string' ? [secrets] : secrets;\n  if (list.length === 0 || list.length > MAX_SIGNATURES) {\n    throw new TypeError(\n      `expected 1 to ${MAX_SIGNATURES} secrets, got ${list.length}`,\n    );\n  }\n  const signatures = await Promise.all(\n    list.map(async (secret) => {\n      const hex = await computeSignature(secret, timestamp, rawBody);\n      return `${SIGNATURE_SCHEME}=${hex}`;\n    }),\n  );\n  return [`t=${timestamp}`, ...signatures].join(',');\n}\n\n/**\n * Null when the header has no `t`, more than one `t`, a `t` that isn't\n * canonical unix seconds, no v1= value, or more than two v1= values. Entries\n * with another name (a future `v2=`) are ignored.\n */\nexport function parseSignatureHeader(\n  header: string,\n): ParsedSignatureHeader | null {\n  let timestamp: number | null = null;\n  const signatures: string[] = [];\n  for (const part of header.split(',')) {\n    const separator = part.indexOf('=');\n    if (separator === -1) continue;\n    const name = part.slice(0, separator).trim();\n    const value = part.slice(separator + 1).trim();\n    if (name === 't') {\n      if (timestamp !== null || !UNIX_SECONDS.test(value)) return null;\n      timestamp = Number(value);\n    } else if (name === SIGNATURE_SCHEME) {\n      if (signatures.length === MAX_SIGNATURES) return null;\n      signatures.push(value);\n    }\n  }\n  if (timestamp === null || signatures.length === 0) return null;\n  return { timestamp, signatures };\n}\n\n/**\n * Verifies a call: the header parses, any v1= value matches the HMAC under\n * `secret` (compared in constant time by Web Crypto), and `t` is within 300\n * seconds of `nowSeconds`. The signature is checked before the timestamp, so\n * a stale result is only reported for a call Relume really signed.\n */\nexport async function verifySignature(input: {\n  secret: string;\n  header: string | null | undefined;\n  rawBody: string | Uint8Array;\n  /** Defaults to the current time. */\n  nowSeconds?: number;\n}): Promise<VerifySignatureResult> {\n  const parsed = input.header ? parseSignatureHeader(input.header) : null;\n  if (parsed === null) return { valid: false, reason: 'malformed_header' };\n  // A blank key (an unset env var) rejects the call; it never skips the check.\n  if (typeof input.secret !== 'string' || input.secret.length === 0) {\n    return { valid: false, reason: 'signature_mismatch' };\n  }\n\n  const key = await hmacKey(input.secret, 'verify');\n  const message = signedMessage(parsed.timestamp, input.rawBody);\n  // Check every value, so the time taken doesn't depend on which one matched.\n  const results = await Promise.all(\n    parsed.signatures.map((signature) =>\n      HEX_SHA256.test(signature)\n        ? crypto.subtle.verify('HMAC', key, fromHex(signature), message)\n        : Promise.resolve(false),\n    ),\n  );\n  if (!results.includes(true)) {\n    return { valid: false, reason: 'signature_mismatch' };\n  }\n\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  if (Math.abs(now - parsed.timestamp) > SIGNATURE_TOLERANCE_SECONDS) {\n    return { valid: false, reason: 'timestamp_out_of_tolerance' };\n  }\n  return { valid: true, timestamp: parsed.timestamp };\n}\n"],"mappings":";AAIO,SAAS,SAAS,OAAkD;AACzE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,SACd,OACA,KACA,KACiB;AACjB,SACE,OAAO,UAAU,YAAY,MAAM,UAAU,OAAO,MAAM,UAAU;AAExE;AAEO,SAAS,QAAQ,OAAgB,KAA8B;AACpE,SACE,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS;AAEzE;AAGO,SAAS,OAAO,OAAyB;AAC9C,SAAO,UAAU,UAAa,UAAU,QAAQ,UAAU;AAC5D;AAIA,IAAM,QACJ;AAEK,SAAS,QAAQ,OAAiC;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,KAAK;AACtD;AAEO,SAAS,WAAW,OAAiC;AAC1D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE,aAAa;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC1CO,IAAM,iBAAiB,OAAO;AAErC,IAAM,eAAe;AAAA,EACnB,gBAAgB;AAAA,EAChB,iBAAiB;AACnB;AAEO,SAAS,aACd,QACA,MACA,UAAkC,CAAC,GACnB;AAChB,SAAO,EAAE,QAAQ,SAAS,EAAE,GAAG,cAAc,GAAG,QAAQ,GAAG,KAAK;AAClE;AAEO,SAAS,cACd,QACA,MACA,SACA,SACgB;AAChB,SAAO,aAAa,QAAQ,EAAE,OAAO,EAAE,MAAM,QAAQ,EAAE,GAAG,OAAO;AACnE;AAIA,IAAM,aAAoC,EAAE,SAAS,OAAO,OAAO,OAAO;AAOnE,SAAS,QAAQ,UAAgC;AACtD,QAAM,OAAO,SAAS,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI;AACzD,SAAO,SAAS,aAAa,SAAS,UAAU,OAAO;AACzD;AASO,SAAS,eACd,UACA,SACc;AACd,QAAM,OAAO,SAAS,QAAQ,WAAW,IAAI;AAC7C,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,SAAS,GAAG,MAAM,WAAY,QAAO;AACzC,MAAI,SAAS,GAAG,MAAM,SAAU,QAAO;AACvC,SAAO;AACT;AAGO,SAAS,iBACd,OACA,QACuB;AACvB,QAAM,UAAU,WAAW,KAAK;AAGhC,MAAI,WAAW,QAAS,QAAO;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,OAAO;AAAA,IACd,EAAE,OAAO,QAAQ;AAAA,EACnB;AACF;AAEO,SAAS,kBAAkC;AAChD,SAAO,cAAc,KAAK,qBAAqB,wBAAwB;AACzE;AAGO,SAAS,UAAU,OAA8B;AACtD,SAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,WAAW,KAAK,EAAE,GAAG,MAAM,KAAK;AAC1E;;;ACpEO,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAgBlC,SAAS,cAAc,OAAsC;AAC3D,SAAO,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ;AACjD;AAMA,SAAS,aAAa,SAAuC;AAC3D,QAAM,UAAU,SAAS,OAAO,IAAI,QAAQ,UAAU;AACtD,MAAI,cAAc,OAAO,EAAG,QAAO,CAAC,SAAS,QAAQ,IAAI,IAAI;AAC7D,MAAI,CAAC,SAAS,OAAO,EAAG,QAAO;AAC/B,SAAO,CAAC,SAAS;AACf,UAAM,SAAS,KAAK,YAAY;AAChC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAI,IAAI,YAAY,MAAM,OAAQ;AAClC,YAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAChD,aAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,IAC7C;AACA,WAAO;AAAA,EACT;AACF;AASO,SAAS,qBAAqB,SAAyC;AAC5E,QAAM,SAAS,aAAa,OAAO;AACnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,IAAI;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,gBAAgB,GAAG,KAAK,EAAE,YAAY,MAAM,cAAc;AACnE,WAAO;AAAA,MACL,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,YAAY,GAAG,KAAK,MAAM,oBAAoB;AACvD,WAAO;AAAA,MACL,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA,+BAA+B,YAAY;AAAA,MAC7C;AAAA,MACA,OAAO,IAAI;AAAA,QACT,uCAAuC,YAAY,KAAK,kBAAkB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;AC3FO,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB;AAEzB,IAAM,8BAA8B,IAAI;AAExC,IAAM,iBAAiB;AAE9B,IAAM,aAAa;AAGnB,IAAM,eAAe;AAiBrB,IAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,UAAU,SAA0C;AAC3D,SAAO,OAAO,YAAY,WAAW,QAAQ,OAAO,OAAO,IAAI;AACjE;AAGA,SAAS,cACP,WACA,SACyB;AACzB,QAAM,SAAS,QAAQ,OAAO,GAAG,SAAS,GAAG;AAC7C,QAAM,OAAO,UAAU,OAAO;AAC9B,QAAM,UAAU,IAAI,WAAW,OAAO,SAAS,KAAK,MAAM;AAC1D,UAAQ,IAAI,QAAQ,CAAC;AACrB,UAAQ,IAAI,MAAM,OAAO,MAAM;AAC/B,SAAO;AACT;AAEA,SAAS,QAAQ,QAAgB,OAA8C;AAC7E,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AACF;AAEA,SAAS,MAAM,OAA4B;AACzC,SAAO,MAAM;AAAA,IAAK,IAAI,WAAW,KAAK;AAAA,IAAG,CAAC,SACxC,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EACnC,EAAE,KAAK,EAAE;AACX;AAEA,SAAS,QAAQ,KAAsC;AACrD,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,UAAM,CAAC,IAAI,OAAO,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,WAAyB;AAChD,MAAI,CAAC,OAAO,cAAc,SAAS,KAAK,YAAY,GAAG;AACrD,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACF;AAGA,eAAsB,iBACpB,QACA,WACA,SACiB;AACjB,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,UAAM,IAAI,UAAU,mCAAmC;AAAA,EACzD;AACA,kBAAgB,SAAS;AACzB,QAAM,MAAM,MAAM,QAAQ,QAAQ,MAAM;AACxC,SAAO;AAAA,IACL,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,cAAc,WAAW,OAAO,CAAC;AAAA,EACzE;AACF;AAOA,eAAsB,SACpB,SACA,WACA,SACiB;AACjB,QAAM,OAAO,OAAO,YAAY,WAAW,CAAC,OAAO,IAAI;AACvD,MAAI,KAAK,WAAW,KAAK,KAAK,SAAS,gBAAgB;AACrD,UAAM,IAAI;AAAA,MACR,iBAAiB,cAAc,iBAAiB,KAAK,MAAM;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ;AAAA,IAC/B,KAAK,IAAI,OAAO,WAAW;AACzB,YAAM,MAAM,MAAM,iBAAiB,QAAQ,WAAW,OAAO;AAC7D,aAAO,GAAG,gBAAgB,IAAI,GAAG;AAAA,IACnC,CAAC;AAAA,EACH;AACA,SAAO,CAAC,KAAK,SAAS,IAAI,GAAG,UAAU,EAAE,KAAK,GAAG;AACnD;AAOO,SAAS,qBACd,QAC8B;AAC9B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,QAAI,cAAc,GAAI;AACtB,UAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAC3C,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAC7C,QAAI,SAAS,KAAK;AAChB,UAAI,cAAc,QAAQ,CAAC,aAAa,KAAK,KAAK,EAAG,QAAO;AAC5D,kBAAY,OAAO,KAAK;AAAA,IAC1B,WAAW,SAAS,kBAAkB;AACpC,UAAI,WAAW,WAAW,eAAgB,QAAO;AACjD,iBAAW,KAAK,KAAK;AAAA,IACvB;AAAA,EACF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,SAAO,EAAE,WAAW,WAAW;AACjC;AAQA,eAAsB,gBAAgB,OAMH;AACjC,QAAM,SAAS,MAAM,SAAS,qBAAqB,MAAM,MAAM,IAAI;AACnE,MAAI,WAAW,KAAM,QAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB;AAEvE,MAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,WAAW,GAAG;AACjE,WAAO,EAAE,OAAO,OAAO,QAAQ,qBAAqB;AAAA,EACtD;AAEA,QAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,QAAQ;AAChD,QAAM,UAAU,cAAc,OAAO,WAAW,MAAM,OAAO;AAE7D,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,OAAO,WAAW;AAAA,MAAI,CAAC,cACrB,WAAW,KAAK,SAAS,IACrB,OAAO,OAAO,OAAO,QAAQ,KAAK,QAAQ,SAAS,GAAG,OAAO,IAC7D,QAAQ,QAAQ,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAS,IAAI,GAAG;AAC3B,WAAO,EAAE,OAAO,OAAO,QAAQ,qBAAqB;AAAA,EACtD;AAEA,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,MAAI,KAAK,IAAI,MAAM,OAAO,SAAS,IAAI,6BAA6B;AAClE,WAAO,EAAE,OAAO,OAAO,QAAQ,6BAA6B;AAAA,EAC9D;AACA,SAAO,EAAE,OAAO,MAAM,WAAW,OAAO,UAAU;AACpD;","names":[]}