@remnic/core 10.0.92 → 10.0.93

package/dist/chunk-QJPJXCS4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/support-passport/public-http.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { isIP } from \"node:net\";\n\nimport { abortError, isAbortError } from \"../abort-error.js\";\nimport { type OperationName, getOperation } from \"../access-boundary.js\";\nimport type { EngramAccessService } from \"../access-service.js\";\nimport { SupportPassportError } from \"./errors.js\";\n\nconst PUBLIC_RATE_LIMIT_MAX_KEYS = 20_000;\nconst PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK = 8;\nconst PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL = 256;\nconst PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK = 8;\nconst PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL = 256;\n\nexport const SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES = [\n  {\n    method: \"GET\",\n    pathname: \"/engram/v1/support-passport/public/grants/:id\",\n    operation: \"support_passport_grant_read\",\n  },\n  {\n    method: \"POST\",\n    pathname: \"/engram/v1/support-passport/public/grants/:id/ask\",\n    operation: \"support_passport_grant_ask\",\n  },\n] as const satisfies ReadonlyArray<{ method: string; pathname: string; operation: OperationName }>;\n\nexport type SupportPassportExternalRequestHandler = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  ctx: {\n    authorized: boolean;\n    tokenAuthorized: boolean;\n  }\n) => Promise<boolean>;\n\ninterface WindowEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface WindowReservation {\n  commit(): void;\n  release(): void;\n}\n\nclass UnreadSupportPassportRequestError extends Error {\n  constructor(readonly response: SupportPassportError) {\n    super(response.message);\n    this.name = \"UnreadSupportPassportRequestError\";\n  }\n}\n\nclass FixedWindowLimiter {\n  private readonly entries = new Map<string, WindowEntry>();\n\n  constructor(\n    private readonly limit: number,\n    private readonly windowMs: number,\n    private readonly now: () => number\n  ) {}\n\n  consume(key: string): boolean {\n    const reservation = this.reserve(key);\n    if (!reservation) return false;\n    reservation.commit();\n    return true;\n  }\n\n  reserve(key: string): WindowReservation | undefined {\n    const now = this.now();\n    let entry = this.entries.get(key);\n    if (!entry || entry.resetAt <= now) {\n      if (!entry && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {\n        this.prune(now);\n        if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return undefined;\n      }\n      entry = { count: 0, resetAt: now + this.windowMs };\n      this.entries.set(key, entry);\n    }\n    if (entry.count >= this.limit) return undefined;\n    entry.count += 1;\n    let active = true;\n    return {\n      commit: () => {\n        active = false;\n      },\n      release: () => {\n        if (!active) return;\n        active = false;\n        if (this.entries.get(key) !== entry) return;\n        entry.count -= 1;\n        if (entry.count === 0) this.entries.delete(key);\n      },\n    };\n  }\n\n  allows(key: string): boolean {\n    const now = this.now();\n    const current = this.entries.get(key);\n    if (current && current.resetAt > now) return current.count < this.limit;\n    if (!current && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {\n      this.prune(now);\n      if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return false;\n    }\n    return true;\n  }\n\n  private prune(now: number): void {\n    for (const [key, entry] of this.entries) {\n      if (entry.resetAt <= now) this.entries.delete(key);\n    }\n  }\n}\n\nclass InFlightLimiter {\n  private readonly counts = new Map<string, number>();\n  private total = 0;\n\n  constructor(\n    private readonly perKeyLimit: number,\n    private readonly totalLimit: number\n  ) {}\n\n  reserve(key: string): (() => void) | undefined {\n    const current = this.counts.get(key) ?? 0;\n    if (current >= this.perKeyLimit || this.total >= this.totalLimit) return undefined;\n    this.counts.set(key, current + 1);\n    this.total += 1;\n    let active = true;\n    return () => {\n      if (!active) return;\n      active = false;\n      const count = this.counts.get(key) ?? 0;\n      if (count <= 1) this.counts.delete(key);\n      else this.counts.set(key, count - 1);\n      this.total -= 1;\n    };\n  }\n}\n\ninterface PublicRateLimits {\n  authentications: InFlightLimiter;\n  modelCalls: InFlightLimiter;\n  grantReads: FixedWindowLimiter;\n  networkReads: FixedWindowLimiter;\n  networkReadFailures: FixedWindowLimiter;\n  grantQuestions: FixedWindowLimiter;\n  networkQuestions: FixedWindowLimiter;\n  networkQuestionFailures: FixedWindowLimiter;\n}\n\nexport interface SupportPassportPublicHandlerOptions {\n  now?: () => number;\n  trustedProxyAddresses?: readonly string[];\n}\n\nfunction createRateLimits(now: () => number): PublicRateLimits {\n  return {\n    authentications: new InFlightLimiter(PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL),\n    modelCalls: new InFlightLimiter(PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL),\n    grantReads: new FixedWindowLimiter(60, 60_000, now),\n    networkReads: new FixedWindowLimiter(60, 60_000, now),\n    networkReadFailures: new FixedWindowLimiter(60, 60_000, now),\n    grantQuestions: new FixedWindowLimiter(20, 10 * 60_000, now),\n    networkQuestions: new FixedWindowLimiter(20, 10 * 60_000, now),\n    networkQuestionFailures: new FixedWindowLimiter(20, 10 * 60_000, now),\n  };\n}\n\nfunction rateLimited(): SupportPassportError {\n  return new SupportPassportError(\"rate_limited\", \"Too many helper requests.\", 429);\n}\n\nasync function runPublicOperation(\n  service: EngramAccessService,\n  name: \"support_passport_grant_read\" | \"support_passport_grant_ask\",\n  input: Record<string, unknown>,\n  signal?: AbortSignal\n): Promise<unknown> {\n  const operation = getOperation(name);\n  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);\n  const output = (await operation.run(input, {\n    service,\n    ...(signal ? { abortSignal: signal } : {}),\n  })) as { result: unknown };\n  return output.result;\n}\n\nfunction reserveAuthenticatedLimits(\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  networkKey: string,\n  grantId: string\n): WindowReservation {\n  const network = networkLimiter.reserve(networkKey);\n  if (!network) throw rateLimited();\n  const grant = grantLimiter.reserve(grantId);\n  if (!grant) {\n    network.release();\n    throw rateLimited();\n  }\n  let active = true;\n  return {\n    commit: () => {\n      if (!active) return;\n      active = false;\n      network.commit();\n      grant.commit();\n    },\n    release: () => {\n      if (!active) return;\n      active = false;\n      grant.release();\n      network.release();\n    },\n  };\n}\n\nasync function readGrantUnderAuthenticationReservation(\n  service: EngramAccessService,\n  grantId: string,\n  secret: string,\n  networkKey: string,\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  failureLimiter: FixedWindowLimiter\n) {\n  if (!failureLimiter.allows(networkKey)) throw rateLimited();\n  const limits = reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId);\n  let guide: Awaited<ReturnType<EngramAccessService[\"supportPassportReadGrant\"]>>;\n  try {\n    guide = (await runPublicOperation(service, \"support_passport_grant_read\", { grantId, secret })) as Awaited<\n      ReturnType<EngramAccessService[\"supportPassportReadGrant\"]>\n    >;\n  } catch (error) {\n    if (error instanceof SupportPassportError) {\n      if (error.code === \"grant_not_found\") {\n        limits.release();\n        if (!failureLimiter.consume(networkKey)) throw rateLimited();\n      } else {\n        limits.commit();\n      }\n    } else {\n      limits.release();\n    }\n    throw error;\n  }\n  limits.commit();\n  return guide;\n}\n\nasync function readGrantWithRateLimits(\n  service: EngramAccessService,\n  grantId: string,\n  secret: string,\n  networkKey: string,\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  failureLimiter: FixedWindowLimiter,\n  authenticationLimiter: InFlightLimiter\n) {\n  const releaseAuthentication = authenticationLimiter.reserve(networkKey);\n  if (!releaseAuthentication) throw rateLimited();\n  try {\n    return await readGrantUnderAuthenticationReservation(\n      service,\n      grantId,\n      secret,\n      networkKey,\n      networkLimiter,\n      grantLimiter,\n      failureLimiter\n    );\n  } finally {\n    releaseAuthentication();\n  }\n}\n\nexport function normalizeSupportPassportNetworkAddress(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  const address = value.trim().toLowerCase();\n  const family = isIP(address);\n  if (family === 0) return undefined;\n  if (family === 4) return address;\n  const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);\n  const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);\n  if (!mapped) return canonical;\n  const high = Number.parseInt(mapped[1] ?? \"\", 16);\n  const low = Number.parseInt(mapped[2] ?? \"\", 16);\n  return `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;\n}\n\nfunction requestNetworkAddress(req: IncomingMessage, trustedProxyAddresses: ReadonlySet<string>): string {\n  const directAddress = normalizeSupportPassportNetworkAddress(req.socket.remoteAddress) ?? \"unknown\";\n  if (!trustedProxyAddresses.has(directAddress)) return directAddress;\n  const forwarded = req.headers[\"x-forwarded-for\"];\n  if (typeof forwarded !== \"string\") return directAddress;\n  const rawAddresses = forwarded.split(\",\");\n  if (rawAddresses.length < 1 || rawAddresses.length > 32) return directAddress;\n  const addresses = rawAddresses.map((address) => normalizeSupportPassportNetworkAddress(address));\n  if (addresses.some((address) => address === undefined)) return directAddress;\n  for (let index = addresses.length - 1; index >= 0; index -= 1) {\n    const address = addresses[index];\n    if (address && !trustedProxyAddresses.has(address)) return address;\n  }\n  return addresses[0] ?? directAddress;\n}\n\nfunction networkDigest(req: IncomingMessage, trustedProxyAddresses: ReadonlySet<string>): string {\n  return createHash(\"sha256\")\n    .update(requestNetworkAddress(req, trustedProxyAddresses))\n    .digest(\"hex\");\n}\n\nfunction parseSecret(req: IncomingMessage): string | undefined {\n  const raw = req.headers.authorization;\n  if (typeof raw !== \"string\") return undefined;\n  const match = /^(\\S+)[ \\t]+(\\S+)$/.exec(raw);\n  if (!match || match[1]?.toLowerCase() !== \"supportpassport\") return undefined;\n  const secret = match[2] ?? \"\";\n  if (!/^[A-Za-z0-9_-]{32,256}$/.test(secret)) return undefined;\n  return secret;\n}\n\nfunction requestDeclaresBody(req: IncomingMessage): boolean {\n  const contentLength = req.headers[\"content-length\"];\n  const transferEncoding = req.headers[\"transfer-encoding\"];\n  return transferEncoding !== undefined || (contentLength !== undefined && contentLength !== \"0\");\n}\n\nfunction respondJson(res: ServerResponse, status: number, payload: unknown): void {\n  const body = JSON.stringify(payload);\n  res.statusCode = status;\n  res.setHeader(\"cache-control\", \"private, no-store\");\n  res.setHeader(\"vary\", \"Authorization\");\n  res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n  res.setHeader(\"content-length\", String(Buffer.byteLength(body)));\n  res.end(body);\n}\n\nfunction respondJsonAndCloseUnreadRequest(\n  req: IncomingMessage,\n  res: ServerResponse,\n  status: number,\n  payload: unknown\n): void {\n  res.shouldKeepAlive = false;\n  res.setHeader(\"connection\", \"close\");\n  res.once(\"finish\", () => req.destroy());\n  respondJson(res, status, payload);\n}\n\nfunction respondBeforeReadingBody(\n  req: IncomingMessage,\n  res: ServerResponse,\n  status: number,\n  payload: unknown\n): void {\n  if (requestDeclaresBody(req)) {\n    respondJsonAndCloseUnreadRequest(req, res, status, payload);\n    return;\n  }\n  respondJson(res, status, payload);\n}\n\nasync function readQuestionBody(req: IncomingMessage, signal: AbortSignal): Promise<string> {\n  const content = await new Promise<Buffer>((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let bytes = 0;\n    let settled = false;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      req.off(\"aborted\", onAborted);\n      signal.removeEventListener(\"abort\", onSignalAbort);\n    };\n    const fail = (error: unknown) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      reject(error);\n    };\n    const helperLeft = () =>\n      isAbortError(signal.reason) ? signal.reason : abortError(\"The helper left.\");\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n      bytes += buffer.length;\n      if (bytes > 4_096) {\n        req.pause();\n        fail(\n          new UnreadSupportPassportRequestError(\n            new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400)\n          )\n        );\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      resolve(Buffer.concat(chunks, bytes));\n    };\n    const onError = (error: Error) => fail(signal.aborted || req.aborted ? helperLeft() : error);\n    const onAborted = () => fail(helperLeft());\n    const onSignalAbort = () => fail(helperLeft());\n    req.on(\"data\", onData);\n    req.once(\"end\", onEnd);\n    req.once(\"error\", onError);\n    req.once(\"aborted\", onAborted);\n    signal.addEventListener(\"abort\", onSignalAbort, { once: true });\n    if (signal.aborted) onSignalAbort();\n  });\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(content.toString(\"utf8\"));\n  } catch {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  const body = parsed as Record<string, unknown>;\n  if (Object.keys(body).length !== 1 || typeof body.question !== \"string\") {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  const question = body.question.trim();\n  if (question.length < 1 || question.length > 500) {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  return question;\n}\n\nfunction requestSignal(req: IncomingMessage, res: ServerResponse): { signal: AbortSignal; cleanup(): void } {\n  const controller = new AbortController();\n  const abort = () => {\n    if (!res.writableFinished && !controller.signal.aborted) controller.abort(abortError(\"The helper left.\"));\n  };\n  req.once(\"aborted\", abort);\n  res.once(\"close\", abort);\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      req.off(\"aborted\", abort);\n      res.off(\"close\", abort);\n    },\n  };\n}\n\nfunction decodeGrantId(raw: string): string | undefined {\n  try {\n    const value = decodeURIComponent(raw);\n    return /^[A-Za-z0-9_-]{1,128}$/.test(value) ? value.toLowerCase() : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function buildSupportPassportPublicRequestHandler(\n  service: EngramAccessService,\n  options: SupportPassportPublicHandlerOptions = {}\n): SupportPassportExternalRequestHandler {\n  const rateLimits = createRateLimits(options.now ?? Date.now);\n  const trustedProxyAddresses = new Set(\n    (options.trustedProxyAddresses ?? [])\n      .map((address) => normalizeSupportPassportNetworkAddress(address))\n      .filter((address): address is string => address !== undefined)\n  );\n  return async (req, res) => {\n    let parsed: URL;\n    try {\n      parsed = new URL(req.url ?? \"/\", \"http://placeholder\");\n    } catch {\n      return false;\n    }\n    const readMatch = /^\\/engram\\/v1\\/support-passport\\/public\\/grants\\/([^/]+)$/.exec(parsed.pathname);\n    const askMatch = /^\\/engram\\/v1\\/support-passport\\/public\\/grants\\/([^/]+)\\/ask$/.exec(parsed.pathname);\n    const ownedRead = req.method === \"GET\" && readMatch;\n    const ownedQuestion = req.method === \"POST\" && askMatch;\n    if (!ownedRead && !ownedQuestion) return false;\n\n    res.setHeader(\"cache-control\", \"private, no-store\");\n    res.setHeader(\"vary\", \"Authorization\");\n    const grantId = decodeGrantId((ownedRead ? readMatch?.[1] : askMatch?.[1]) ?? \"\");\n    const secret = parseSecret(req);\n    if (parsed.search.length > 0) {\n      respondBeforeReadingBody(req, res, 400, {\n        error: \"The share link request is invalid.\",\n        code: \"invalid_input\",\n      });\n      return true;\n    }\n    if (ownedRead && requestDeclaresBody(req)) {\n      respondJsonAndCloseUnreadRequest(req, res, 400, {\n        error: \"The share link request is invalid.\",\n        code: \"invalid_input\",\n      });\n      return true;\n    }\n    if (!grantId || !secret) {\n      respondBeforeReadingBody(req, res, 404, {\n        error: \"The share link was not found.\",\n        code: \"grant_not_found\",\n      });\n      return true;\n    }\n\n    const lifecycle = requestSignal(req, res);\n    try {\n      const digest = networkDigest(req, trustedProxyAddresses);\n      if (ownedRead) {\n        const guide = await readGrantWithRateLimits(\n          service,\n          grantId,\n          secret,\n          digest,\n          rateLimits.networkReads,\n          rateLimits.grantReads,\n          rateLimits.networkReadFailures,\n          rateLimits.authentications\n        );\n        respondJson(res, 200, guide);\n      } else {\n        let releaseAuthentication = rateLimits.authentications.reserve(digest);\n        if (!releaseAuthentication) throw new UnreadSupportPassportRequestError(rateLimited());\n        try {\n          let question: string;\n          const bodyFailure = rateLimits.networkQuestionFailures.reserve(digest);\n          if (!bodyFailure) throw new UnreadSupportPassportRequestError(rateLimited());\n          try {\n            question = await readQuestionBody(req, lifecycle.signal);\n            bodyFailure.release();\n          } catch (error) {\n            const supportError =\n              error instanceof UnreadSupportPassportRequestError ? error.response : error;\n            if (supportError instanceof SupportPassportError && supportError.code === \"invalid_input\") {\n              bodyFailure.commit();\n            } else {\n              bodyFailure.release();\n            }\n            throw error;\n          }\n          const releaseModelCall = rateLimits.modelCalls.reserve(digest);\n          if (!releaseModelCall) throw rateLimited();\n          try {\n            await readGrantUnderAuthenticationReservation(\n              service,\n              grantId,\n              secret,\n              digest,\n              rateLimits.networkQuestions,\n              rateLimits.grantQuestions,\n              rateLimits.networkQuestionFailures\n            );\n            releaseAuthentication();\n            releaseAuthentication = undefined;\n            const answer = await runPublicOperation(\n              service,\n              \"support_passport_grant_ask\",\n              { grantId, secret, question },\n              lifecycle.signal\n            );\n            respondJson(res, 200, answer);\n          } finally {\n            releaseModelCall();\n          }\n        } finally {\n          releaseAuthentication?.();\n        }\n      }\n    } catch (error) {\n      if (error instanceof UnreadSupportPassportRequestError) {\n        respondJsonAndCloseUnreadRequest(req, res, error.response.status, {\n          error: error.response.message,\n          code: error.response.code,\n        });\n        return true;\n      }\n      if (!(error instanceof SupportPassportError)) throw error;\n      respondJson(res, error.status, { error: error.message, code: error.code });\n    } finally {\n      lifecycle.cleanup();\n    }\n    return true;\n  };\n}\n\nexport function composeSupportPassportExternalRequestHandlers(\n  ...handlers: Array<SupportPassportExternalRequestHandler | undefined>\n): SupportPassportExternalRequestHandler {\n  return async (req, res, ctx) => {\n    for (const handler of handlers) {\n      if (handler && (await handler(req, res, ctx))) return true;\n    }\n    return false;\n  };\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,kBAAkB;AAE3B,SAAS,YAAY;AAOrB,IAAM,6BAA6B;AACnC,IAAM,wCAAwC;AAC9C,IAAM,kCAAkC;AACxC,IAAM,yCAAyC;AAC/C,IAAM,mCAAmC;AAElC,IAAM,sCAAsC;AAAA,EACjD;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACF;AAqBA,IAAM,oCAAN,cAAgD,MAAM;AAAA,EACpD,YAAqB,UAAgC;AACnD,UAAM,SAAS,OAAO;AADH;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAEA,IAAM,qBAAN,MAAyB;AAAA,EAGvB,YACmB,OACA,UACA,KACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA,EALF,UAAU,oBAAI,IAAyB;AAAA,EAQxD,QAAQ,KAAsB;AAC5B,UAAM,cAAc,KAAK,QAAQ,GAAG;AACpC,QAAI,CAAC,YAAa,QAAO;AACzB,gBAAY,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,KAA4C;AAClD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAChC,QAAI,CAAC,SAAS,MAAM,WAAW,KAAK;AAClC,UAAI,CAAC,SAAS,KAAK,QAAQ,QAAQ,4BAA4B;AAC7D,aAAK,MAAM,GAAG;AACd,YAAI,KAAK,QAAQ,QAAQ,2BAA4B,QAAO;AAAA,MAC9D;AACA,cAAQ,EAAE,OAAO,GAAG,SAAS,MAAM,KAAK,SAAS;AACjD,WAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC7B;AACA,QAAI,MAAM,SAAS,KAAK,MAAO,QAAO;AACtC,UAAM,SAAS;AACf,QAAI,SAAS;AACb,WAAO;AAAA,MACL,QAAQ,MAAM;AACZ,iBAAS;AAAA,MACX;AAAA,MACA,SAAS,MAAM;AACb,YAAI,CAAC,OAAQ;AACb,iBAAS;AACT,YAAI,KAAK,QAAQ,IAAI,GAAG,MAAM,MAAO;AACrC,cAAM,SAAS;AACf,YAAI,MAAM,UAAU,EAAG,MAAK,QAAQ,OAAO,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO,KAAsB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,KAAK,QAAQ,IAAI,GAAG;AACpC,QAAI,WAAW,QAAQ,UAAU,IAAK,QAAO,QAAQ,QAAQ,KAAK;AAClE,QAAI,CAAC,WAAW,KAAK,QAAQ,QAAQ,4BAA4B;AAC/D,WAAK,MAAM,GAAG;AACd,UAAI,KAAK,QAAQ,QAAQ,2BAA4B,QAAO;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,KAAmB;AAC/B,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS;AACvC,UAAI,MAAM,WAAW,IAAK,MAAK,QAAQ,OAAO,GAAG;AAAA,IACnD;AAAA,EACF;AACF;AAEA,IAAM,kBAAN,MAAsB;AAAA,EAIpB,YACmB,aACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EALF,SAAS,oBAAI,IAAoB;AAAA,EAC1C,QAAQ;AAAA,EAOhB,QAAQ,KAAuC;AAC7C,UAAM,UAAU,KAAK,OAAO,IAAI,GAAG,KAAK;AACxC,QAAI,WAAW,KAAK,eAAe,KAAK,SAAS,KAAK,WAAY,QAAO;AACzE,SAAK,OAAO,IAAI,KAAK,UAAU,CAAC;AAChC,SAAK,SAAS;AACd,QAAI,SAAS;AACb,WAAO,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,YAAM,QAAQ,KAAK,OAAO,IAAI,GAAG,KAAK;AACtC,UAAI,SAAS,EAAG,MAAK,OAAO,OAAO,GAAG;AAAA,UACjC,MAAK,OAAO,IAAI,KAAK,QAAQ,CAAC;AACnC,WAAK,SAAS;AAAA,IAChB;AAAA,EACF;AACF;AAkBA,SAAS,iBAAiB,KAAqC;AAC7D,SAAO;AAAA,IACL,iBAAiB,IAAI,gBAAgB,uCAAuC,+BAA+B;AAAA,IAC3G,YAAY,IAAI,gBAAgB,wCAAwC,gCAAgC;AAAA,IACxG,YAAY,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IAClD,cAAc,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IACpD,qBAAqB,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IAC3D,gBAAgB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,IAC3D,kBAAkB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,IAC7D,yBAAyB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,EACtE;AACF;AAEA,SAAS,cAAoC;AAC3C,SAAO,IAAI,qBAAqB,gBAAgB,6BAA6B,GAAG;AAClF;AAEA,eAAe,mBACb,SACA,MACA,OACA,QACkB;AAClB,QAAM,YAAY,aAAa,IAAI;AACnC,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;AACpF,QAAM,SAAU,MAAM,UAAU,IAAI,OAAO;AAAA,IACzC;AAAA,IACA,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,SAAO,OAAO;AAChB;AAEA,SAAS,2BACP,gBACA,cACA,YACA,SACmB;AACnB,QAAM,UAAU,eAAe,QAAQ,UAAU;AACjD,MAAI,CAAC,QAAS,OAAM,YAAY;AAChC,QAAM,QAAQ,aAAa,QAAQ,OAAO;AAC1C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ;AAChB,UAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS;AACb,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,cAAQ,OAAO;AACf,YAAM,OAAO;AAAA,IACf;AAAA,IACA,SAAS,MAAM;AACb,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,YAAM,QAAQ;AACd,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AACF;AAEA,eAAe,wCACb,SACA,SACA,QACA,YACA,gBACA,cACA,gBACA;AACA,MAAI,CAAC,eAAe,OAAO,UAAU,EAAG,OAAM,YAAY;AAC1D,QAAM,SAAS,2BAA2B,gBAAgB,cAAc,YAAY,OAAO;AAC3F,MAAI;AACJ,MAAI;AACF,YAAS,MAAM,mBAAmB,SAAS,+BAA+B,EAAE,SAAS,OAAO,CAAC;AAAA,EAG/F,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,UAAI,MAAM,SAAS,mBAAmB;AACpC,eAAO,QAAQ;AACf,YAAI,CAAC,eAAe,QAAQ,UAAU,EAAG,OAAM,YAAY;AAAA,MAC7D,OAAO;AACL,eAAO,OAAO;AAAA,MAChB;AAAA,IACF,OAAO;AACL,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AACA,SAAO,OAAO;AACd,SAAO;AACT;AAEA,eAAe,wBACb,SACA,SACA,QACA,YACA,gBACA,cACA,gBACA,uBACA;AACA,QAAM,wBAAwB,sBAAsB,QAAQ,UAAU;AACtE,MAAI,CAAC,sBAAuB,OAAM,YAAY;AAC9C,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,0BAAsB;AAAA,EACxB;AACF;AAEO,SAAS,uCAAuC,OAA+C;AACpG,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,WAAW,EAAG,QAAO;AACzB,QAAM,YAAY,IAAI,IAAI,WAAW,OAAO,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE;AACtE,QAAM,SAAS,2CAA2C,KAAK,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,OAAO,OAAO,SAAS,OAAO,CAAC,KAAK,IAAI,EAAE;AAChD,QAAM,MAAM,OAAO,SAAS,OAAO,CAAC,KAAK,IAAI,EAAE;AAC/C,SAAO,GAAG,SAAS,CAAC,IAAI,OAAO,GAAI,IAAI,QAAQ,CAAC,IAAI,MAAM,GAAI;AAChE;AAEA,SAAS,sBAAsB,KAAsB,uBAAoD;AACvG,QAAM,gBAAgB,uCAAuC,IAAI,OAAO,aAAa,KAAK;AAC1F,MAAI,CAAC,sBAAsB,IAAI,aAAa,EAAG,QAAO;AACtD,QAAM,YAAY,IAAI,QAAQ,iBAAiB;AAC/C,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,QAAM,eAAe,UAAU,MAAM,GAAG;AACxC,MAAI,aAAa,SAAS,KAAK,aAAa,SAAS,GAAI,QAAO;AAChE,QAAM,YAAY,aAAa,IAAI,CAAC,YAAY,uCAAuC,OAAO,CAAC;AAC/F,MAAI,UAAU,KAAK,CAAC,YAAY,YAAY,MAAS,EAAG,QAAO;AAC/D,WAAS,QAAQ,UAAU,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AAC7D,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,WAAW,CAAC,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAAA,EAC7D;AACA,SAAO,UAAU,CAAC,KAAK;AACzB;AAEA,SAAS,cAAc,KAAsB,uBAAoD;AAC/F,SAAO,WAAW,QAAQ,EACvB,OAAO,sBAAsB,KAAK,qBAAqB,CAAC,EACxD,OAAO,KAAK;AACjB;AAEA,SAAS,YAAY,KAA0C;AAC7D,QAAM,MAAM,IAAI,QAAQ;AACxB,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,qBAAqB,KAAK,GAAG;AAC3C,MAAI,CAAC,SAAS,MAAM,CAAC,GAAG,YAAY,MAAM,kBAAmB,QAAO;AACpE,QAAM,SAAS,MAAM,CAAC,KAAK;AAC3B,MAAI,CAAC,0BAA0B,KAAK,MAAM,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,KAA+B;AAC1D,QAAM,gBAAgB,IAAI,QAAQ,gBAAgB;AAClD,QAAM,mBAAmB,IAAI,QAAQ,mBAAmB;AACxD,SAAO,qBAAqB,UAAc,kBAAkB,UAAa,kBAAkB;AAC7F;AAEA,SAAS,YAAY,KAAqB,QAAgB,SAAwB;AAChF,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,MAAI,aAAa;AACjB,MAAI,UAAU,iBAAiB,mBAAmB;AAClD,MAAI,UAAU,QAAQ,eAAe;AACrC,MAAI,UAAU,gBAAgB,iCAAiC;AAC/D,MAAI,UAAU,kBAAkB,OAAO,OAAO,WAAW,IAAI,CAAC,CAAC;AAC/D,MAAI,IAAI,IAAI;AACd;AAEA,SAAS,iCACP,KACA,KACA,QACA,SACM;AACN,MAAI,kBAAkB;AACtB,MAAI,UAAU,cAAc,OAAO;AACnC,MAAI,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC;AACtC,cAAY,KAAK,QAAQ,OAAO;AAClC;AAEA,SAAS,yBACP,KACA,KACA,QACA,SACM;AACN,MAAI,oBAAoB,GAAG,GAAG;AAC5B,qCAAiC,KAAK,KAAK,QAAQ,OAAO;AAC1D;AAAA,EACF;AACA,cAAY,KAAK,QAAQ,OAAO;AAClC;AAEA,eAAe,iBAAiB,KAAsB,QAAsC;AAC1F,QAAM,UAAU,MAAM,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC7D,UAAM,SAAmB,CAAC;AAC1B,QAAI,QAAQ;AACZ,QAAI,UAAU;AACd,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,UAAI,IAAI,WAAW,SAAS;AAC5B,aAAO,oBAAoB,SAAS,aAAa;AAAA,IACnD;AACA,UAAM,OAAO,CAAC,UAAmB;AAC/B,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,aAAO,KAAK;AAAA,IACd;AACA,UAAM,aAAa,MACjB,aAAa,OAAO,MAAM,IAAI,OAAO,SAAS,WAAW,kBAAkB;AAC7E,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;AACjE,eAAS,OAAO;AAChB,UAAI,QAAQ,MAAO;AACjB,YAAI,MAAM;AACV;AAAA,UACE,IAAI;AAAA,YACF,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,UAClF;AAAA,QACF;AACA;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM;AAClB,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,cAAQ,OAAO,OAAO,QAAQ,KAAK,CAAC;AAAA,IACtC;AACA,UAAM,UAAU,CAAC,UAAiB,KAAK,OAAO,WAAW,IAAI,UAAU,WAAW,IAAI,KAAK;AAC3F,UAAM,YAAY,MAAM,KAAK,WAAW,CAAC;AACzC,UAAM,gBAAgB,MAAM,KAAK,WAAW,CAAC;AAC7C,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,KAAK,OAAO,KAAK;AACrB,QAAI,KAAK,SAAS,OAAO;AACzB,QAAI,KAAK,WAAW,SAAS;AAC7B,WAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;AAC9D,QAAI,OAAO,QAAS,eAAc;AAAA,EACpC,CAAC;AACD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,QAAQ,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,QAAM,OAAO;AACb,MAAI,OAAO,KAAK,IAAI,EAAE,WAAW,KAAK,OAAO,KAAK,aAAa,UAAU;AACvE,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,QAAM,WAAW,KAAK,SAAS,KAAK;AACpC,MAAI,SAAS,SAAS,KAAK,SAAS,SAAS,KAAK;AAChD,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,KAAsB,KAA+D;AAC1G,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,IAAI,oBAAoB,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM,WAAW,kBAAkB,CAAC;AAAA,EAC1G;AACA,MAAI,KAAK,WAAW,KAAK;AACzB,MAAI,KAAK,SAAS,KAAK;AACvB,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB,SAAS,MAAM;AACb,UAAI,IAAI,WAAW,KAAK;AACxB,UAAI,IAAI,SAAS,KAAK;AAAA,IACxB;AAAA,EACF;AACF;AAEA,SAAS,cAAc,KAAiC;AACtD,MAAI;AACF,UAAM,QAAQ,mBAAmB,GAAG;AACpC,WAAO,yBAAyB,KAAK,KAAK,IAAI,MAAM,YAAY,IAAI;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yCACd,SACA,UAA+C,CAAC,GACT;AACvC,QAAM,aAAa,iBAAiB,QAAQ,OAAO,KAAK,GAAG;AAC3D,QAAM,wBAAwB,IAAI;AAAA,KAC/B,QAAQ,yBAAyB,CAAC,GAChC,IAAI,CAAC,YAAY,uCAAuC,OAAO,CAAC,EAChE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAAA,EACjE;AACA,SAAO,OAAO,KAAK,QAAQ;AACzB,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB;AAAA,IACvD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,YAAY,4DAA4D,KAAK,OAAO,QAAQ;AAClG,UAAM,WAAW,iEAAiE,KAAK,OAAO,QAAQ;AACtG,UAAM,YAAY,IAAI,WAAW,SAAS;AAC1C,UAAM,gBAAgB,IAAI,WAAW,UAAU;AAC/C,QAAI,CAAC,aAAa,CAAC,cAAe,QAAO;AAEzC,QAAI,UAAU,iBAAiB,mBAAmB;AAClD,QAAI,UAAU,QAAQ,eAAe;AACrC,UAAM,UAAU,eAAe,YAAY,YAAY,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE;AAChF,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,+BAAyB,KAAK,KAAK,KAAK;AAAA,QACtC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,aAAa,oBAAoB,GAAG,GAAG;AACzC,uCAAiC,KAAK,KAAK,KAAK;AAAA,QAC9C,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,+BAAyB,KAAK,KAAK,KAAK;AAAA,QACtC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,cAAc,KAAK,GAAG;AACxC,QAAI;AACF,YAAM,SAAS,cAAc,KAAK,qBAAqB;AACvD,UAAI,WAAW;AACb,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AACA,oBAAY,KAAK,KAAK,KAAK;AAAA,MAC7B,OAAO;AACL,YAAI,wBAAwB,WAAW,gBAAgB,QAAQ,MAAM;AACrE,YAAI,CAAC,sBAAuB,OAAM,IAAI,kCAAkC,YAAY,CAAC;AACrF,YAAI;AACF,cAAI;AACJ,gBAAM,cAAc,WAAW,wBAAwB,QAAQ,MAAM;AACrE,cAAI,CAAC,YAAa,OAAM,IAAI,kCAAkC,YAAY,CAAC;AAC3E,cAAI;AACF,uBAAW,MAAM,iBAAiB,KAAK,UAAU,MAAM;AACvD,wBAAY,QAAQ;AAAA,UACtB,SAAS,OAAO;AACd,kBAAM,eACJ,iBAAiB,oCAAoC,MAAM,WAAW;AACxE,gBAAI,wBAAwB,wBAAwB,aAAa,SAAS,iBAAiB;AACzF,0BAAY,OAAO;AAAA,YACrB,OAAO;AACL,0BAAY,QAAQ;AAAA,YACtB;AACA,kBAAM;AAAA,UACR;AACA,gBAAM,mBAAmB,WAAW,WAAW,QAAQ,MAAM;AAC7D,cAAI,CAAC,iBAAkB,OAAM,YAAY;AACzC,cAAI;AACF,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AACA,kCAAsB;AACtB,oCAAwB;AACxB,kBAAM,SAAS,MAAM;AAAA,cACnB;AAAA,cACA;AAAA,cACA,EAAE,SAAS,QAAQ,SAAS;AAAA,cAC5B,UAAU;AAAA,YACZ;AACA,wBAAY,KAAK,KAAK,MAAM;AAAA,UAC9B,UAAE;AACA,6BAAiB;AAAA,UACnB;AAAA,QACF,UAAE;AACA,kCAAwB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,mCAAmC;AACtD,yCAAiC,KAAK,KAAK,MAAM,SAAS,QAAQ;AAAA,UAChE,OAAO,MAAM,SAAS;AAAA,UACtB,MAAM,MAAM,SAAS;AAAA,QACvB,CAAC;AACD,eAAO;AAAA,MACT;AACA,UAAI,EAAE,iBAAiB,sBAAuB,OAAM;AACpD,kBAAY,KAAK,MAAM,QAAQ,EAAE,OAAO,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;AAAA,IAC3E,UAAE;AACA,gBAAU,QAAQ;AAAA,IACpB;AACA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iDACX,UACoC;AACvC,SAAO,OAAO,KAAK,KAAK,QAAQ;AAC9B,eAAW,WAAW,UAAU;AAC9B,UAAI,WAAY,MAAM,QAAQ,KAAK,KAAK,GAAG,EAAI,QAAO;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACF;","names":[]}