@rpcbase/server 0.517.0 → 0.519.0

package/dist/handler-cwV5LCtl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handler-cwV5LCtl.js","sources":["../src/uploads/api/file-uploads/processors/sanitizeSvg.ts","../src/uploads/api/file-uploads/processors/index.ts","../src/uploads/api/file-uploads/handlers/completeUpload.ts","../src/uploads/api/file-uploads/handlers/getStatus.ts","../src/uploads/api/file-uploads/index.ts","../src/uploads/api/file-uploads/handlers/initUpload.ts","../src/uploads/api/file-uploads/handlers/uploadChunk.ts","../src/uploads/api/file-uploads/middleware/rawBodyParser.ts","../src/uploads/api/file-uploads/handler.ts"],"sourcesContent":["import { JSDOM } from \"jsdom\"\nimport createDOMPurify from \"dompurify\"\n\nimport type { UploadFileProcessor } from \"./index\"\n\n\nconst MAX_SVG_BYTES = 128 * 1024\n\nconst window = new JSDOM(\"\").window\nconst DOMPurify = createDOMPurify(window)\n\nconst normalizeForSniff = (raw: string): string => raw.replace(/^\\uFEFF/, \"\").trimStart()\n\nconst looksLikeSvgText = (text: string): boolean => {\n  const normalized = normalizeForSniff(text)\n  if (!normalized.startsWith(\"<\")) return false\n  return /<svg(?:\\s|>)/i.test(normalized)\n}\n\nexport const looksLikeSvg = (sniff: Buffer): boolean => looksLikeSvgText(sniff.toString(\"utf8\"))\n\nexport const sanitizeSvg = (svg: string): string =>\n  DOMPurify.sanitize(svg, {\n    USE_PROFILES: { svg: true, svgFilters: true },\n  })\n\nexport const sanitizeSvgProcessor: UploadFileProcessor = {\n  id: \"sanitize-svg\",\n  maxBytes: MAX_SVG_BYTES,\n  match: ({ sniff }) => looksLikeSvg(sniff),\n  process: (data): { data: Buffer; mimeType: string } => {\n    if (data.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const svgText = data.toString(\"utf8\")\n    if (!looksLikeSvgText(svgText)) {\n      throw new Error(\"svg_invalid\")\n    }\n\n    const sanitized = sanitizeSvg(svgText)\n    if (!sanitized.trim() || !looksLikeSvgText(sanitized)) {\n      throw new Error(\"svg_sanitize_failed\")\n    }\n\n    const sanitizedBuffer = Buffer.from(sanitized, \"utf8\")\n    if (sanitizedBuffer.length > MAX_SVG_BYTES) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    return { data: sanitizedBuffer, mimeType: \"image/svg+xml\" }\n  },\n}\n\n","import { sanitizeSvgProcessor } from \"./sanitizeSvg\"\n\n\nexport type UploadFileProcessorContext = {\n  filename: string\n  clientMimeType: string\n  totalSize: number\n  sniff: Buffer\n}\n\nexport type UploadFileProcessorResult = {\n  data: Buffer\n  mimeType?: string\n}\n\nexport type UploadFileProcessor = {\n  id: string\n  maxBytes: number\n  match: (ctx: UploadFileProcessorContext) => boolean\n  process: (data: Buffer, ctx: UploadFileProcessorContext) => Promise<UploadFileProcessorResult> | UploadFileProcessorResult\n}\n\nexport const uploadProcessors = Object.freeze([sanitizeSvgProcessor] satisfies UploadFileProcessor[])\n\nexport const getMaxUploadProcessorBytes = (): number =>\n  uploadProcessors.reduce((max, processor) => Math.max(max, processor.maxBytes), 0)\n\nexport const selectUploadProcessors = (ctx: UploadFileProcessorContext): UploadFileProcessor[] =>\n  uploadProcessors.filter((processor) => processor.match(ctx))\n\nexport const applyUploadProcessors = async (\n  data: Buffer,\n  ctx: Omit<UploadFileProcessorContext, \"sniff\" | \"totalSize\">,\n): Promise<{ data: Buffer; mimeType: string; applied: string[] }> => {\n  let currentData = data\n  let currentMimeType = ctx.clientMimeType\n  const applied: string[] = []\n\n  for (const processor of uploadProcessors) {\n    const processorCtx: UploadFileProcessorContext = {\n      filename: ctx.filename,\n      clientMimeType: currentMimeType,\n      totalSize: currentData.length,\n      sniff: currentData,\n    }\n\n    if (!processor.match(processorCtx)) continue\n\n    if (currentData.length > processor.maxBytes) {\n      throw new Error(\"processor_input_too_large\")\n    }\n\n    const result = await processor.process(currentData, processorCtx)\n    currentData = result.data\n    if (typeof result.mimeType === \"string\" && result.mimeType.trim()) {\n      currentMimeType = result.mimeType.trim()\n    }\n    applied.push(processor.id)\n  }\n\n  return {\n    data: currentData,\n    mimeType: currentMimeType,\n    applied,\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { getTenantFilesystemDb, models } from \"@rpcbase/db\"\nimport { GridFSBucket } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport { applyUploadProcessors, getMaxUploadProcessorBytes, selectUploadProcessors } from \"../processors\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  ensureUploadIndexes,\n  getBucketName,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n} from \"../shared\"\n\n\nconst waitForStreamFinished = async (stream: NodeJS.WritableStream): Promise<void> => new Promise((resolve, reject) => {\n  stream.once(\"finish\", resolve)\n  stream.once(\"error\", reject)\n})\n\nconst writeToStream = async (stream: NodeJS.WritableStream, chunk: Buffer): Promise<void> => {\n  const ok = stream.write(chunk)\n  if (ok) return\n  await new Promise<void>((resolve, reject) => {\n    const onDrain = () => {\n      cleanup()\n      resolve()\n    }\n\n    const onError = (error: unknown) => {\n      cleanup()\n      reject(error)\n    }\n\n    const cleanup = () => {\n      stream.off(\"drain\", onDrain)\n      stream.off(\"error\", onError)\n    }\n\n    stream.on(\"drain\", onDrain)\n    stream.on(\"error\", onError)\n  })\n}\n\nconst abortUploadStream = async (stream: unknown): Promise<void> => {\n  if (!stream) return\n  if (typeof (stream as { abort?: unknown }).abort === \"function\") {\n    try {\n      await (stream as { abort: () => Promise<void> | void }).abort()\n      return\n    } catch {\n      //\n    }\n  }\n  try {\n    ;(stream as { destroy?: () => void }).destroy?.()\n  } catch {\n    //\n  }\n}\n\nexport const completeUpload: ApiHandler<Record<string, never>, Uploads.CompleteResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.CompleteResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const existing = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!existing) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (existing.status === \"done\" && existing.fileId) {\n    return { ok: true, fileId: existing.fileId }\n  }\n\n  const locked = await UploadSession.findOneAndUpdate(\n    { $and: [{ _id: uploadId }, { status: \"uploading\" }, getUploadSessionAccessQuery(ability, \"update\")] },\n    { $set: { status: \"assembling\" }, $unset: { error: \"\" } },\n    { returnDocument: \"after\" },\n  ).lean()\n\n  if (!locked) {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  await ensureUploadIndexes(UploadSession, UploadChunk)\n\n  const fsDb = await getTenantFilesystemDb(tenantId)\n  const nativeDb = fsDb.db\n  if (!nativeDb) {\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: \"filesystem_db_unavailable\" } },\n    )\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n  const bucketName = getBucketName()\n  const bucket = new GridFSBucket(nativeDb, { bucketName })\n\n  const lockedUserId = typeof locked.userId === \"string\" ? locked.userId : undefined\n  const maxProcessorBytes = getMaxUploadProcessorBytes()\n  const shouldBufferForProcessing = locked.totalSize <= maxProcessorBytes\n  const declaredMimeType = locked.mimeType.trim().toLowerCase()\n  const declaredSvg = declaredMimeType === \"image/svg+xml\" || locked.filename.trim().toLowerCase().endsWith(\".svg\")\n\n  let uploadStream: NodeJS.WritableStream | null = null\n\n  try {\n    if (!shouldBufferForProcessing && declaredSvg) {\n      throw new Error(\"svg_too_large\")\n    }\n\n    const cursor = UploadChunk.find({ uploadId }).sort({ index: 1 }).cursor() as unknown as AsyncIterable<UploadChunkDoc> & {\n      close: () => Promise<void>\n    }\n\n    let expectedIndex = 0\n    const chunks: Buffer[] = []\n    let bufferedBytes = 0\n\n    const pendingChunks: Buffer[] = []\n    const sniffParts: Buffer[] = []\n    let sniffBytes = 0\n\n    try {\n      for await (const chunkDoc of cursor) {\n        if (chunkDoc.index !== expectedIndex) {\n          throw new Error(\"missing_chunks\")\n        }\n\n        const chunk = chunkDoc.data\n\n        if (shouldBufferForProcessing) {\n          chunks.push(chunk)\n          bufferedBytes += chunk.length\n        } else if (!uploadStream) {\n          pendingChunks.push(chunk)\n\n          if (sniffBytes < maxProcessorBytes) {\n            const slice = chunk.subarray(0, Math.min(chunk.length, maxProcessorBytes - sniffBytes))\n            if (slice.length) {\n              sniffParts.push(slice)\n              sniffBytes += slice.length\n            }\n          }\n\n          if (sniffBytes >= maxProcessorBytes) {\n            const sniff = Buffer.concat(sniffParts, sniffBytes)\n            const processors = selectUploadProcessors({\n              filename: locked.filename,\n              clientMimeType: locked.mimeType,\n              totalSize: locked.totalSize,\n              sniff,\n            })\n\n            if (processors.length) {\n              throw new Error(\"svg_too_large\")\n            }\n\n            uploadStream = bucket.openUploadStream(locked.filename, {\n              metadata: {\n                uploadId,\n                tenantId,\n                mimeType: locked.mimeType,\n                totalSize: locked.totalSize,\n                ...(typeof locked.isPublic === \"boolean\" ? { isPublic: locked.isPublic } : {}),\n                ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n                ...(lockedUserId ? { userId: lockedUserId } : {}),\n              },\n            })\n\n            for (const pending of pendingChunks) {\n              await writeToStream(uploadStream, pending)\n            }\n            pendingChunks.length = 0\n          }\n        } else {\n          await writeToStream(uploadStream, chunk)\n        }\n\n        expectedIndex += 1\n      }\n    } finally {\n      try {\n        await cursor.close()\n      } catch {\n        //\n      }\n    }\n\n    if (expectedIndex !== locked.chunksTotal) {\n      throw new Error(\"missing_chunks\")\n    }\n\n    if (shouldBufferForProcessing) {\n      const assembled = Buffer.concat(chunks, bufferedBytes)\n      const { data: processed, mimeType: processedMimeType, applied } = await applyUploadProcessors(assembled, {\n        filename: locked.filename,\n        clientMimeType: locked.mimeType,\n      })\n\n      uploadStream = bucket.openUploadStream(locked.filename, {\n        metadata: {\n          uploadId,\n          tenantId,\n          mimeType: processedMimeType,\n          totalSize: locked.totalSize,\n          ...(applied.length ? { processors: applied, processedSize: processed.length } : {}),\n          ...(typeof locked.isPublic === \"boolean\" ? { isPublic: locked.isPublic } : {}),\n          ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n          ...(lockedUserId ? { userId: lockedUserId } : {}),\n        },\n      })\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end(processed)\n      await finished\n    } else {\n      if (!uploadStream) {\n        const sniff = Buffer.concat(sniffParts, sniffBytes)\n        const processors = selectUploadProcessors({\n          filename: locked.filename,\n          clientMimeType: locked.mimeType,\n          totalSize: locked.totalSize,\n          sniff,\n        })\n\n        if (processors.length) {\n          throw new Error(\"svg_too_large\")\n        }\n\n        uploadStream = bucket.openUploadStream(locked.filename, {\n          metadata: {\n            uploadId,\n            tenantId,\n            mimeType: locked.mimeType,\n            totalSize: locked.totalSize,\n            ...(typeof locked.isPublic === \"boolean\" ? { isPublic: locked.isPublic } : {}),\n            ...(typeof locked.ownerKeyHash === \"string\" ? { ownerKeyHash: locked.ownerKeyHash } : {}),\n            ...(lockedUserId ? { userId: lockedUserId } : {}),\n          },\n        })\n\n        for (const pending of pendingChunks) {\n          await writeToStream(uploadStream, pending)\n        }\n        pendingChunks.length = 0\n      }\n\n      const finished = waitForStreamFinished(uploadStream)\n      uploadStream.end()\n      await finished\n    }\n\n    const fileId = String((uploadStream as unknown as { id?: unknown }).id ?? \"\")\n    if (!fileId) {\n      throw new Error(\"missing_file_id\")\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"done\", fileId }, $unset: { error: \"\" } },\n    )\n\n    try {\n      await UploadChunk.deleteMany({ uploadId })\n    } catch {\n      //\n    }\n\n    return { ok: true, fileId }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n\n    await abortUploadStream(uploadStream)\n\n    if (message === \"missing_chunks\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"uploading\" } },\n      )\n      ctx.res.status(409)\n      return { ok: false, error: \"missing_chunks\" }\n    }\n\n    if (message === \"svg_too_large\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(413)\n      return { ok: false, error: message }\n    }\n\n    if (message === \"svg_invalid\" || message === \"svg_sanitize_failed\") {\n      await UploadSession.updateOne(\n        { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n        { $set: { status: \"error\", error: message } },\n      )\n      ctx.res.status(400)\n      return { ok: false, error: message }\n    }\n\n    await UploadSession.updateOne(\n      { $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] },\n      { $set: { status: \"error\", error: message } },\n    )\n\n    ctx.res.status(500)\n    return { ok: false, error: \"assembly_failed\" }\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n} from \"../shared\"\n\n\nexport const getStatus: ApiHandler<Record<string, never>, Uploads.StatusResponsePayload, SessionUser> = async (\n  _payload,\n  ctx,\n): Promise<Uploads.StatusResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  if (!uploadId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_upload_id\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"read\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"read\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  const receivedDocs = await UploadChunk.find(\n    { uploadId },\n    { index: 1, _id: 0 },\n  ).sort({ index: 1 }).lean()\n\n  const received = (receivedDocs as unknown as Array<{ index?: unknown }>)\n    .map((doc) => (typeof doc.index === \"number\" ? doc.index : -1))\n    .filter((n) => Number.isInteger(n) && n >= 0)\n\n  return {\n    ok: true,\n    status: session.status,\n    chunkSize: session.chunkSize,\n    chunksTotal: session.chunksTotal,\n    received,\n    ...(session.fileId ? { fileId: session.fileId } : {}),\n  }\n}\n","import { z } from \"zod\"\n\n\nexport const InitRoute = \"/api/rb/file-uploads\"\nexport const ChunkRoute = \"/api/rb/file-uploads/:uploadId/chunks/:index\"\nexport const StatusRoute = \"/api/rb/file-uploads/:uploadId/status\"\nexport const CompleteRoute = \"/api/rb/file-uploads/:uploadId/complete\"\n\nexport const initRequestSchema = z.object({\n  filename: z.string().min(1),\n  mimeType: z.string().min(1),\n  isPublic: z.boolean().optional(),\n  totalSize: z.number().int().min(1),\n})\n\nexport type InitRequestPayload = z.infer<typeof initRequestSchema>\n\nexport const initResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  uploadId: z.string().optional(),\n  uploadKey: z.string().optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n})\n\nexport type InitResponsePayload = z.infer<typeof initResponseSchema>\n\nexport const statusResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  status: z.enum([\"uploading\", \"assembling\", \"done\", \"error\"]).optional(),\n  chunkSize: z.number().int().optional(),\n  chunksTotal: z.number().int().optional(),\n  received: z.array(z.number().int().min(0)).optional(),\n  fileId: z.string().optional(),\n})\n\nexport type StatusResponsePayload = z.infer<typeof statusResponseSchema>\n\nexport const completeResponseSchema = z.object({\n  ok: z.boolean(),\n  error: z.string().optional(),\n  fileId: z.string().optional(),\n})\n\nexport type CompleteResponsePayload = z.infer<typeof completeResponseSchema>\n","import { randomBytes } from \"node:crypto\"\n\nimport { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport { ObjectId } from \"mongodb\"\nimport type { Model } from \"mongoose\"\n\nimport * as Uploads from \"../index\"\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureUploadIndexes,\n  getChunkSizeBytes,\n  getModelCtx,\n  getSessionTtlMs,\n  getTenantId,\n  getUserId,\n} from \"../shared\"\n\n\nexport const initUpload: ApiHandler<Uploads.InitRequestPayload, Uploads.InitResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<Uploads.InitResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const userId = getUserId(ctx)\n\n  const parsed = Uploads.initRequestSchema.safeParse(payload ?? {})\n  if (!parsed.success) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_payload\" }\n  }\n\n  const chunkSize = getChunkSizeBytes()\n  const { filename, mimeType, totalSize, isPublic } = parsed.data\n  const chunksTotal = Math.ceil(totalSize / chunkSize)\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  await ensureUploadIndexes(UploadSession, UploadChunk)\n\n  const uploadId = new ObjectId().toString()\n  const now = Date.now()\n  const expiresAt = new Date(now + getSessionTtlMs())\n\n  const uploadKey = userId ? null : randomBytes(32).toString(\"base64url\")\n  const ownerKeyHash = uploadKey ? computeSha256Hex(Buffer.from(uploadKey)) : undefined\n\n  await UploadSession.create({\n    _id: uploadId,\n    ...(userId ? { userId } : {}),\n    ...(ownerKeyHash ? { ownerKeyHash } : {}),\n    filename,\n    mimeType,\n    ...(typeof isPublic === \"boolean\" ? { isPublic } : {}),\n    totalSize,\n    chunkSize,\n    chunksTotal,\n    status: \"uploading\",\n    createdAt: new Date(now),\n    expiresAt,\n  })\n\n  return {\n    ok: true,\n    uploadId,\n    chunkSize,\n    chunksTotal,\n    ...(uploadKey ? { uploadKey } : {}),\n  }\n}\n","import { ApiHandler } from \"@rpcbase/api\"\nimport { models } from \"@rpcbase/db\"\nimport type { Model } from \"mongoose\"\n\nimport {\n  type SessionUser,\n  type UploadChunkDoc,\n  type UploadSessionDoc,\n  buildUploadsAbility,\n  computeSha256Hex,\n  ensureUploadIndexes,\n  getModelCtx,\n  getUploadSessionAccessQuery,\n  getTenantId,\n  normalizeSha256Hex,\n  toBufferPayload,\n} from \"../shared\"\n\n\ntype ChunkResponsePayload = {\n  ok: boolean\n  error?: string\n}\n\nexport const uploadChunk: ApiHandler<Buffer, ChunkResponsePayload, SessionUser> = async (\n  payload,\n  ctx,\n): Promise<ChunkResponsePayload> => {\n  const tenantId = getTenantId(ctx)\n  if (!tenantId) {\n    ctx.res.status(400)\n    return { ok: false, error: \"tenant_missing\" }\n  }\n\n  const uploadId = String(ctx.req.params?.uploadId ?? \"\").trim()\n  const indexRaw = String(ctx.req.params?.index ?? \"\").trim()\n  const index = Number(indexRaw)\n\n  if (!uploadId || !Number.isInteger(index) || index < 0) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_ref\" }\n  }\n\n  const ability = buildUploadsAbility(ctx, tenantId)\n  const modelCtx = getModelCtx(ctx, tenantId, ability)\n\n  const [UploadSession, UploadChunk] = await Promise.all([\n    models.get(\"RBUploadSession\", modelCtx) as Promise<Model<UploadSessionDoc>>,\n    models.get(\"RBUploadChunk\", modelCtx) as Promise<Model<UploadChunkDoc>>,\n  ])\n\n  if (!ability.can(\"update\", \"RBUploadSession\")) {\n    ctx.res.status(401)\n    return { ok: false, error: \"unauthorized\" }\n  }\n\n  const session = await UploadSession.findOne({ $and: [{ _id: uploadId }, getUploadSessionAccessQuery(ability, \"update\")] }).lean()\n  if (!session) {\n    ctx.res.status(404)\n    return { ok: false, error: \"not_found\" }\n  }\n\n  if (session.status !== \"uploading\") {\n    ctx.res.status(409)\n    return { ok: false, error: \"not_uploading\" }\n  }\n\n  if (index >= session.chunksTotal) {\n    ctx.res.status(400)\n    return { ok: false, error: \"index_out_of_range\" }\n  }\n\n  const data = toBufferPayload(payload)\n  if (!data) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_body\" }\n  }\n\n  const expectedSize = index === session.chunksTotal - 1\n    ? session.totalSize - session.chunkSize * (session.chunksTotal - 1)\n    : session.chunkSize\n\n  if (data.length > expectedSize) {\n    ctx.res.status(413)\n    return { ok: false, error: \"chunk_too_large\" }\n  }\n\n  if (data.length !== expectedSize) {\n    ctx.res.status(400)\n    return { ok: false, error: \"invalid_chunk_size\" }\n  }\n\n  const checksumHeader = ctx.req.get(\"X-Chunk-SHA256\")\n  const sha256 = checksumHeader ? computeSha256Hex(data) : undefined\n\n  if (checksumHeader) {\n    const expectedSha256 = normalizeSha256Hex(checksumHeader)\n    if (sha256 !== expectedSha256) {\n      ctx.res.status(400)\n      return { ok: false, error: \"checksum_mismatch\" }\n    }\n  }\n\n  await ensureUploadIndexes(UploadSession, UploadChunk)\n\n  await UploadChunk.updateOne(\n    { uploadId, index },\n    {\n      $set: {\n        uploadId,\n        index,\n        data,\n        size: data.length,\n        sha256,\n        expiresAt: session.expiresAt,\n      },\n      $setOnInsert: {\n        createdAt: new Date(),\n      },\n    },\n    { upsert: true },\n  )\n\n  ctx.res.status(204)\n  return { ok: true }\n}\n","export const rawBodyParser = ({\n  limitBytes,\n  maxClientBytesPerSecond,\n}: {\n  limitBytes: number\n  maxClientBytesPerSecond?: number | null\n}) => {\n  return (req: any, res: any, next: any) => {\n    const contentType = typeof req?.headers?.[\"content-type\"] === \"string\"\n      ? String(req.headers[\"content-type\"])\n      : \"\"\n\n    if (!contentType.includes(\"application/octet-stream\")) {\n      next()\n      return\n    }\n\n    let total = 0\n    const chunks: Buffer[] = []\n    let done = false\n    let paused = false\n    let throttleTimeout: ReturnType<typeof setTimeout> | null = null\n\n    const rateBytesPerSecond = typeof maxClientBytesPerSecond === \"number\" && maxClientBytesPerSecond > 0\n      ? maxClientBytesPerSecond\n      : null\n\n    const cleanup = () => {\n      req.off(\"data\", onData)\n      req.off(\"end\", onEnd)\n      req.off(\"error\", onError)\n      req.off(\"aborted\", onAborted)\n      if (throttleTimeout) {\n        clearTimeout(throttleTimeout)\n        throttleTimeout = null\n      }\n    }\n\n    const finish = (error?: unknown) => {\n      if (done) return\n      done = true\n\n      cleanup()\n\n      if (error) {\n        next(error)\n        return\n      }\n\n      req.body = Buffer.concat(chunks, total)\n      next()\n    }\n\n    const onData = (chunk: any) => {\n      if (done) return\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n      total += buffer.length\n\n      if (total > limitBytes) {\n        done = true\n        cleanup()\n        req.destroy()\n        res.status(413).json({ ok: false, error: \"chunk_too_large\" })\n        return\n      }\n\n      chunks.push(buffer)\n\n      if (!rateBytesPerSecond) return\n\n      const now = Date.now()\n      const clientKey = getClientKey(req)\n      const state = getClientRateState(clientKey, rateBytesPerSecond, now)\n      const waitMs = consumeRateBudget(state, buffer.length, rateBytesPerSecond, now)\n\n      if (waitMs > 0 && !paused) {\n        paused = true\n        req.pause()\n        throttleTimeout = setTimeout(() => {\n          throttleTimeout = null\n          paused = false\n          if (done) return\n          try {\n            req.resume()\n          } catch {\n            //\n          }\n        }, waitMs)\n      }\n    }\n\n    const onEnd = () => finish()\n    const onError = (err: unknown) => finish(err)\n    const onAborted = () => finish(new Error(\"request_aborted\"))\n\n    req.on(\"data\", onData)\n    req.on(\"end\", onEnd)\n    req.on(\"error\", onError)\n    req.on(\"aborted\", onAborted)\n  }\n}\n\ntype ClientRateState = {\n  tokens: number\n  lastRefillMs: number\n  lastSeenMs: number\n}\n\nconst MAX_BURST_SECONDS = 1\nconst STALE_CLIENT_MS = 15 * 60 * 1000\n\nconst clientRateStates = new Map<string, ClientRateState>()\nlet lastCleanupMs = 0\n\nconst getClientKey = (req: any): string => {\n  const rawClientIp = typeof req?.clientIp === \"string\" ? req.clientIp : \"\"\n  if (rawClientIp.trim()) return rawClientIp.trim()\n  const rawIp = typeof req?.ip === \"string\" ? req.ip : \"\"\n  return rawIp.trim() || \"unknown\"\n}\n\nconst maybeCleanupStates = (now: number) => {\n  if (now - lastCleanupMs < 60_000) return\n  lastCleanupMs = now\n\n  if (clientRateStates.size < 2000) return\n\n  for (const [key, state] of clientRateStates) {\n    if (now - state.lastSeenMs > STALE_CLIENT_MS) {\n      clientRateStates.delete(key)\n    }\n  }\n}\n\nconst getClientRateState = (key: string, rateBytesPerSecond: number, now: number): ClientRateState => {\n  maybeCleanupStates(now)\n\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const existing = clientRateStates.get(key)\n  if (existing) {\n    existing.lastSeenMs = now\n    existing.tokens = Math.min(capacity, existing.tokens)\n    return existing\n  }\n\n  const next: ClientRateState = {\n    tokens: capacity,\n    lastRefillMs: now,\n    lastSeenMs: now,\n  }\n  clientRateStates.set(key, next)\n  return next\n}\n\nconst consumeRateBudget = (\n  state: ClientRateState,\n  bytes: number,\n  rateBytesPerSecond: number,\n  now: number,\n): number => {\n  const capacity = rateBytesPerSecond * MAX_BURST_SECONDS\n  const elapsedMs = Math.max(0, now - state.lastRefillMs)\n\n  if (elapsedMs > 0) {\n    state.tokens = Math.min(capacity, state.tokens + (elapsedMs * rateBytesPerSecond) / 1000)\n    state.lastRefillMs = now\n  }\n\n  state.tokens -= bytes\n\n  if (state.tokens >= 0) return 0\n  return Math.ceil((-state.tokens / rateBytesPerSecond) * 1000)\n}\n","import { Api } from \"@rpcbase/api\"\n\nimport { completeUpload } from \"./handlers/completeUpload\"\nimport { getStatus } from \"./handlers/getStatus\"\nimport { initUpload } from \"./handlers/initUpload\"\nimport { uploadChunk } from \"./handlers/uploadChunk\"\nimport { rawBodyParser } from \"./middleware/rawBodyParser\"\nimport { getChunkSizeBytes, getMaxClientUploadBytesPerSecond, getRawBodyLimitBytes, type SessionUser } from \"./shared\"\n\nimport * as Uploads from \"./index\"\n\n\nexport default (api: Api<SessionUser>) => {\n  const chunkSizeBytes = getChunkSizeBytes()\n  api.use(\n    Uploads.InitRoute,\n    rawBodyParser({\n      limitBytes: getRawBodyLimitBytes(chunkSizeBytes),\n      maxClientBytesPerSecond: getMaxClientUploadBytesPerSecond(),\n    }),\n  )\n\n  api.post(Uploads.InitRoute, initUpload)\n  api.put(Uploads.ChunkRoute, uploadChunk)\n  api.get(Uploads.StatusRoute, getStatus)\n  api.post(Uploads.CompleteRoute, completeUpload)\n}\n"],"names":["MAX_SVG_BYTES","window","JSDOM","DOMPurify","createDOMPurify","normalizeForSniff","raw","replace","trimStart","looksLikeSvgText","text","normalized","startsWith","test","looksLikeSvg","sniff","toString","sanitizeSvg","svg","sanitize","USE_PROFILES","svgFilters","sanitizeSvgProcessor","id","maxBytes","match","process","data","length","Error","svgText","sanitized","trim","sanitizedBuffer","Buffer","from","mimeType","uploadProcessors","Object","freeze","getMaxUploadProcessorBytes","reduce","max","processor","Math","selectUploadProcessors","ctx","filter","applyUploadProcessors","currentData","currentMimeType","clientMimeType","applied","processorCtx","filename","totalSize","result","push","waitForStreamFinished","stream","Promise","resolve","reject","once","writeToStream","chunk","ok","write","onDrain","cleanup","onError","error","off","on","abortUploadStream","abort","destroy","completeUpload","_payload","tenantId","getTenantId","res","status","uploadId","String","req","params","ability","buildUploadsAbility","modelCtx","getModelCtx","UploadSession","UploadChunk","all","models","get","can","existing","findOne","$and","_id","getUploadSessionAccessQuery","lean","fileId","locked","findOneAndUpdate","$set","$unset","returnDocument","ensureUploadIndexes","fsDb","getTenantFilesystemDb","nativeDb","db","updateOne","bucketName","getBucketName","bucket","GridFSBucket","lockedUserId","userId","undefined","maxProcessorBytes","shouldBufferForProcessing","declaredMimeType","toLowerCase","declaredSvg","endsWith","uploadStream","cursor","find","sort","index","expectedIndex","chunks","bufferedBytes","pendingChunks","sniffParts","sniffBytes","chunkDoc","slice","subarray","min","concat","processors","openUploadStream","metadata","isPublic","ownerKeyHash","pending","close","chunksTotal","assembled","processed","processedMimeType","processedSize","finished","end","deleteMany","message","getStatus","session","receivedDocs","received","map","doc","n","Number","isInteger","chunkSize","InitRoute","ChunkRoute","StatusRoute","CompleteRoute","initRequestSchema","z","string","boolean","optional","number","int","uploadKey","initUpload","payload","getUserId","parsed","Uploads","safeParse","success","getChunkSizeBytes","ceil","ObjectId","now","Date","expiresAt","getSessionTtlMs","randomBytes","computeSha256Hex","create","createdAt","uploadChunk","indexRaw","toBufferPayload","expectedSize","checksumHeader","sha256","expectedSha256","normalizeSha256Hex","size","$setOnInsert","upsert","rawBodyParser","limitBytes","maxClientBytesPerSecond","next","contentType","headers","includes","total","done","paused","throttleTimeout","rateBytesPerSecond","onData","onEnd","onAborted","clearTimeout","finish","body","buffer","isBuffer","json","clientKey","getClientKey","state","getClientRateState","waitMs","consumeRateBudget","pause","setTimeout","resume","err","MAX_BURST_SECONDS","STALE_CLIENT_MS","clientRateStates","Map","lastCleanupMs","rawClientIp","clientIp","rawIp","ip","maybeCleanupStates","key","lastSeenMs","delete","capacity","tokens","lastRefillMs","set","bytes","elapsedMs","api","chunkSizeBytes","use","getRawBodyLimitBytes","getMaxClientUploadBytesPerSecond","post","put"],"mappings":";;;;;;;AAMA,MAAMA,gBAAgB,MAAM;AAE5B,MAAMC,SAAS,IAAIC,MAAM,EAAE,EAAED;AAC7B,MAAME,YAAYC,gBAAgBH,MAAM;AAExC,MAAMI,oBAAoBA,CAACC,QAAwBA,IAAIC,QAAQ,WAAW,EAAE,EAAEC,UAAAA;AAE9E,MAAMC,mBAAmBA,CAACC,SAA0B;AAClD,QAAMC,aAAaN,kBAAkBK,IAAI;AACzC,MAAI,CAACC,WAAWC,WAAW,GAAG,EAAG,QAAO;AACxC,SAAO,gBAAgBC,KAAKF,UAAU;AACxC;AAEO,MAAMG,eAAeA,CAACC,UAA2BN,iBAAiBM,MAAMC,SAAS,MAAM,CAAC;AAExF,MAAMC,cAAcA,CAACC,QAC1Bf,UAAUgB,SAASD,KAAK;AAAA,EACtBE,cAAc;AAAA,IAAEF,KAAK;AAAA,IAAMG,YAAY;AAAA,EAAA;AACzC,CAAC;AAEI,MAAMC,uBAA4C;AAAA,EACvDC,IAAI;AAAA,EACJC,UAAUxB;AAAAA,EACVyB,OAAOA,CAAC;AAAA,IAAEV;AAAAA,EAAAA,MAAYD,aAAaC,KAAK;AAAA,EACxCW,SAASA,CAACC,SAA6C;AACrD,QAAIA,KAAKC,SAAS5B,eAAe;AAC/B,YAAM,IAAI6B,MAAM,eAAe;AAAA,IACjC;AAEA,UAAMC,UAAUH,KAAKX,SAAS,MAAM;AACpC,QAAI,CAACP,iBAAiBqB,OAAO,GAAG;AAC9B,YAAM,IAAID,MAAM,aAAa;AAAA,IAC/B;AAEA,UAAME,YAAYd,YAAYa,OAAO;AACrC,QAAI,CAACC,UAAUC,KAAAA,KAAU,CAACvB,iBAAiBsB,SAAS,GAAG;AACrD,YAAM,IAAIF,MAAM,qBAAqB;AAAA,IACvC;AAEA,UAAMI,kBAAkBC,OAAOC,KAAKJ,WAAW,MAAM;AACrD,QAAIE,gBAAgBL,SAAS5B,eAAe;AAC1C,YAAM,IAAI6B,MAAM,eAAe;AAAA,IACjC;AAEA,WAAO;AAAA,MAAEF,MAAMM;AAAAA,MAAiBG,UAAU;AAAA,IAAA;AAAA,EAC5C;AACF;AC9BO,MAAMC,mBAAmBC,OAAOC,OAAO,CAACjB,oBAAoB,CAAiC;AAE7F,MAAMkB,6BAA6BA,MACxCH,iBAAiBI,OAAO,CAACC,KAAKC,cAAcC,KAAKF,IAAIA,KAAKC,UAAUnB,QAAQ,GAAG,CAAC;AAE3E,MAAMqB,yBAAyBA,CAACC,QACrCT,iBAAiBU,OAAQJ,CAAAA,cAAcA,UAAUlB,MAAMqB,GAAG,CAAC;AAEtD,MAAME,wBAAwB,OACnCrB,MACAmB,QACmE;AACnE,MAAIG,cAActB;AAClB,MAAIuB,kBAAkBJ,IAAIK;AAC1B,QAAMC,UAAoB,CAAA;AAE1B,aAAWT,aAAaN,kBAAkB;AACxC,UAAMgB,eAA2C;AAAA,MAC/CC,UAAUR,IAAIQ;AAAAA,MACdH,gBAAgBD;AAAAA,MAChBK,WAAWN,YAAYrB;AAAAA,MACvBb,OAAOkC;AAAAA,IAAAA;AAGT,QAAI,CAACN,UAAUlB,MAAM4B,YAAY,EAAG;AAEpC,QAAIJ,YAAYrB,SAASe,UAAUnB,UAAU;AAC3C,YAAM,IAAIK,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM2B,SAAS,MAAMb,UAAUjB,QAAQuB,aAAaI,YAAY;AAChEJ,kBAAcO,OAAO7B;AACrB,QAAI,OAAO6B,OAAOpB,aAAa,YAAYoB,OAAOpB,SAASJ,QAAQ;AACjEkB,wBAAkBM,OAAOpB,SAASJ,KAAAA;AAAAA,IACpC;AACAoB,YAAQK,KAAKd,UAAUpB,EAAE;AAAA,EAC3B;AAEA,SAAO;AAAA,IACLI,MAAMsB;AAAAA,IACNb,UAAUc;AAAAA,IACVE;AAAAA,EAAAA;AAEJ;AC7CA,MAAMM,wBAAwB,OAAOC,WAAiD,IAAIC,QAAQ,CAACC,SAASC,WAAW;AACrHH,SAAOI,KAAK,UAAUF,OAAO;AAC7BF,SAAOI,KAAK,SAASD,MAAM;AAC7B,CAAC;AAED,MAAME,gBAAgB,OAAOL,QAA+BM,UAAiC;AAC3F,QAAMC,KAAKP,OAAOQ,MAAMF,KAAK;AAC7B,MAAIC,GAAI;AACR,QAAM,IAAIN,QAAc,CAACC,SAASC,WAAW;AAC3C,UAAMM,UAAUA,MAAM;AACpBC,cAAAA;AACAR,cAAAA;AAAAA,IACF;AAEA,UAAMS,UAAUA,CAACC,UAAmB;AAClCF,cAAAA;AACAP,aAAOS,KAAK;AAAA,IACd;AAEA,UAAMF,UAAUA,MAAM;AACpBV,aAAOa,IAAI,SAASJ,OAAO;AAC3BT,aAAOa,IAAI,SAASF,OAAO;AAAA,IAC7B;AAEAX,WAAOc,GAAG,SAASL,OAAO;AAC1BT,WAAOc,GAAG,SAASH,OAAO;AAAA,EAC5B,CAAC;AACH;AAEA,MAAMI,oBAAoB,OAAOf,WAAmC;AAClE,MAAI,CAACA,OAAQ;AACb,MAAI,OAAQA,OAA+BgB,UAAU,YAAY;AAC/D,QAAI;AACF,YAAOhB,OAAiDgB,MAAAA;AACxD;AAAA,IACF,QAAQ;AAAA,IACN;AAAA,EAEJ;AACA,MAAI;AACF;AAAEhB,WAAoCiB,UAAAA;AAAAA,EACxC,QAAQ;AAAA,EACN;AAEJ;AAEO,MAAMC,iBAAkG,OAC7GC,UACAhC,QAC6C;AAC7C,QAAMiC,WAAWC,YAAYlC,GAAG;AAChC,MAAI,CAACiC,UAAU;AACbjC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMY,WAAWC,OAAOtC,IAAIuC,IAAIC,QAAQH,YAAY,EAAE,EAAEnD,KAAAA;AACxD,MAAI,CAACmD,UAAU;AACbrC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMgB,UAAUC,oBAAoB1C,KAAKiC,QAAQ;AACjD,QAAMU,WAAWC,YAAY5C,KAAKiC,UAAUQ,OAAO;AAEnD,QAAM,CAACI,eAAeC,WAAW,IAAI,MAAMhC,QAAQiC,IAAI,CACrDC,OAAOC,IAAI,mBAAmBN,QAAQ,GACtCK,OAAOC,IAAI,iBAAiBN,QAAQ,CAAmC,CACxE;AAED,MAAI,CAACF,QAAQS,IAAI,UAAU,iBAAiB,GAAG;AAC7ClD,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAM0B,WAAW,MAAMN,cAAcO,QAAQ;AAAA,IAAEC,MAAM,CAAC;AAAA,MAAEC,KAAKjB;AAAAA,IAAAA,GAAYkB,4BAA4Bd,SAAS,MAAM,CAAC;AAAA,EAAA,CAAG,EAAEe,KAAAA;AAC1H,MAAI,CAACL,UAAU;AACbnD,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,MAAI0B,SAASf,WAAW,UAAUe,SAASM,QAAQ;AACjD,WAAO;AAAA,MAAErC,IAAI;AAAA,MAAMqC,QAAQN,SAASM;AAAAA,IAAAA;AAAAA,EACtC;AAEA,QAAMC,SAAS,MAAMb,cAAcc,iBACjC;AAAA,IAAEN,MAAM,CAAC;AAAA,MAAEC,KAAKjB;AAAAA,IAAAA,GAAY;AAAA,MAAED,QAAQ;AAAA,IAAA,GAAemB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,EAAA,GACnG;AAAA,IAAEmB,MAAM;AAAA,MAAExB,QAAQ;AAAA,IAAA;AAAA,IAAgByB,QAAQ;AAAA,MAAEpC,OAAO;AAAA,IAAA;AAAA,EAAG,GACtD;AAAA,IAAEqC,gBAAgB;AAAA,EAAA,CACpB,EAAEN,KAAAA;AAEF,MAAI,CAACE,QAAQ;AACX1D,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMsC,oBAAoBlB,eAAeC,WAAW;AAEpD,QAAMkB,OAAO,MAAMC,sBAAsBhC,QAAQ;AACjD,QAAMiC,WAAWF,KAAKG;AACtB,MAAI,CAACD,UAAU;AACb,UAAMrB,cAAcuB,UAClB;AAAA,MAAEf,MAAM,CAAC;AAAA,QAAEC,KAAKjB;AAAAA,MAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,IAAA,GAC1E;AAAA,MAAEmB,MAAM;AAAA,QAAExB,QAAQ;AAAA,QAASX,OAAO;AAAA,MAAA;AAAA,IAA4B,CAChE;AACAzB,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AACA,QAAM4C,aAAaC,cAAAA;AACnB,QAAMC,SAAS,IAAIC,aAAaN,UAAU;AAAA,IAAEG;AAAAA,EAAAA,CAAY;AAExD,QAAMI,eAAe,OAAOf,OAAOgB,WAAW,WAAWhB,OAAOgB,SAASC;AACzE,QAAMC,oBAAoBlF,2BAAAA;AAC1B,QAAMmF,4BAA4BnB,OAAOjD,aAAamE;AACtD,QAAME,mBAAmBpB,OAAOpE,SAASJ,KAAAA,EAAO6F,YAAAA;AAChD,QAAMC,cAAcF,qBAAqB,mBAAmBpB,OAAOlD,SAAStB,OAAO6F,YAAAA,EAAcE,SAAS,MAAM;AAEhH,MAAIC,eAA6C;AAEjD,MAAI;AACF,QAAI,CAACL,6BAA6BG,aAAa;AAC7C,YAAM,IAAIjG,MAAM,eAAe;AAAA,IACjC;AAEA,UAAMoG,SAASrC,YAAYsC,KAAK;AAAA,MAAE/C;AAAAA,IAAAA,CAAU,EAAEgD,KAAK;AAAA,MAAEC,OAAO;AAAA,IAAA,CAAG,EAAEH,OAAAA;AAIjE,QAAII,gBAAgB;AACpB,UAAMC,SAAmB,CAAA;AACzB,QAAIC,gBAAgB;AAEpB,UAAMC,gBAA0B,CAAA;AAChC,UAAMC,aAAuB,CAAA;AAC7B,QAAIC,aAAa;AAEjB,QAAI;AACF,uBAAiBC,YAAYV,QAAQ;AACnC,YAAIU,SAASP,UAAUC,eAAe;AACpC,gBAAM,IAAIxG,MAAM,gBAAgB;AAAA,QAClC;AAEA,cAAMoC,QAAQ0E,SAAShH;AAEvB,YAAIgG,2BAA2B;AAC7BW,iBAAO7E,KAAKQ,KAAK;AACjBsE,2BAAiBtE,MAAMrC;AAAAA,QACzB,WAAW,CAACoG,cAAc;AACxBQ,wBAAc/E,KAAKQ,KAAK;AAExB,cAAIyE,aAAahB,mBAAmB;AAClC,kBAAMkB,QAAQ3E,MAAM4E,SAAS,GAAGjG,KAAKkG,IAAI7E,MAAMrC,QAAQ8F,oBAAoBgB,UAAU,CAAC;AACtF,gBAAIE,MAAMhH,QAAQ;AAChB6G,yBAAWhF,KAAKmF,KAAK;AACrBF,4BAAcE,MAAMhH;AAAAA,YACtB;AAAA,UACF;AAEA,cAAI8G,cAAchB,mBAAmB;AACnC,kBAAM3G,QAAQmB,OAAO6G,OAAON,YAAYC,UAAU;AAClD,kBAAMM,aAAanG,uBAAuB;AAAA,cACxCS,UAAUkD,OAAOlD;AAAAA,cACjBH,gBAAgBqD,OAAOpE;AAAAA,cACvBmB,WAAWiD,OAAOjD;AAAAA,cAClBxC;AAAAA,YAAAA,CACD;AAED,gBAAIiI,WAAWpH,QAAQ;AACrB,oBAAM,IAAIC,MAAM,eAAe;AAAA,YACjC;AAEAmG,2BAAeX,OAAO4B,iBAAiBzC,OAAOlD,UAAU;AAAA,cACtD4F,UAAU;AAAA,gBACR/D;AAAAA,gBACAJ;AAAAA,gBACA3C,UAAUoE,OAAOpE;AAAAA,gBACjBmB,WAAWiD,OAAOjD;AAAAA,gBAClB,GAAI,OAAOiD,OAAO2C,aAAa,YAAY;AAAA,kBAAEA,UAAU3C,OAAO2C;AAAAA,gBAAAA,IAAa,CAAA;AAAA,gBAC3E,GAAI,OAAO3C,OAAO4C,iBAAiB,WAAW;AAAA,kBAAEA,cAAc5C,OAAO4C;AAAAA,gBAAAA,IAAiB,CAAA;AAAA,gBACtF,GAAI7B,eAAe;AAAA,kBAAEC,QAAQD;AAAAA,gBAAAA,IAAiB,CAAA;AAAA,cAAC;AAAA,YACjD,CACD;AAED,uBAAW8B,WAAWb,eAAe;AACnC,oBAAMxE,cAAcgE,cAAcqB,OAAO;AAAA,YAC3C;AACAb,0BAAc5G,SAAS;AAAA,UACzB;AAAA,QACF,OAAO;AACL,gBAAMoC,cAAcgE,cAAc/D,KAAK;AAAA,QACzC;AAEAoE,yBAAiB;AAAA,MACnB;AAAA,IACF,UAAA;AACE,UAAI;AACF,cAAMJ,OAAOqB,MAAAA;AAAAA,MACf,QAAQ;AAAA,MACN;AAAA,IAEJ;AAEA,QAAIjB,kBAAkB7B,OAAO+C,aAAa;AACxC,YAAM,IAAI1H,MAAM,gBAAgB;AAAA,IAClC;AAEA,QAAI8F,2BAA2B;AAC7B,YAAM6B,YAAYtH,OAAO6G,OAAOT,QAAQC,aAAa;AACrD,YAAM;AAAA,QAAE5G,MAAM8H;AAAAA,QAAWrH,UAAUsH;AAAAA,QAAmBtG;AAAAA,MAAAA,IAAY,MAAMJ,sBAAsBwG,WAAW;AAAA,QACvGlG,UAAUkD,OAAOlD;AAAAA,QACjBH,gBAAgBqD,OAAOpE;AAAAA,MAAAA,CACxB;AAED4F,qBAAeX,OAAO4B,iBAAiBzC,OAAOlD,UAAU;AAAA,QACtD4F,UAAU;AAAA,UACR/D;AAAAA,UACAJ;AAAAA,UACA3C,UAAUsH;AAAAA,UACVnG,WAAWiD,OAAOjD;AAAAA,UAClB,GAAIH,QAAQxB,SAAS;AAAA,YAAEoH,YAAY5F;AAAAA,YAASuG,eAAeF,UAAU7H;AAAAA,UAAAA,IAAW,CAAA;AAAA,UAChF,GAAI,OAAO4E,OAAO2C,aAAa,YAAY;AAAA,YAAEA,UAAU3C,OAAO2C;AAAAA,UAAAA,IAAa,CAAA;AAAA,UAC3E,GAAI,OAAO3C,OAAO4C,iBAAiB,WAAW;AAAA,YAAEA,cAAc5C,OAAO4C;AAAAA,UAAAA,IAAiB,CAAA;AAAA,UACtF,GAAI7B,eAAe;AAAA,YAAEC,QAAQD;AAAAA,UAAAA,IAAiB,CAAA;AAAA,QAAC;AAAA,MACjD,CACD;AAED,YAAMqC,WAAWlG,sBAAsBsE,YAAY;AACnDA,mBAAa6B,IAAIJ,SAAS;AAC1B,YAAMG;AAAAA,IACR,OAAO;AACL,UAAI,CAAC5B,cAAc;AACjB,cAAMjH,QAAQmB,OAAO6G,OAAON,YAAYC,UAAU;AAClD,cAAMM,aAAanG,uBAAuB;AAAA,UACxCS,UAAUkD,OAAOlD;AAAAA,UACjBH,gBAAgBqD,OAAOpE;AAAAA,UACvBmB,WAAWiD,OAAOjD;AAAAA,UAClBxC;AAAAA,QAAAA,CACD;AAED,YAAIiI,WAAWpH,QAAQ;AACrB,gBAAM,IAAIC,MAAM,eAAe;AAAA,QACjC;AAEAmG,uBAAeX,OAAO4B,iBAAiBzC,OAAOlD,UAAU;AAAA,UACtD4F,UAAU;AAAA,YACR/D;AAAAA,YACAJ;AAAAA,YACA3C,UAAUoE,OAAOpE;AAAAA,YACjBmB,WAAWiD,OAAOjD;AAAAA,YAClB,GAAI,OAAOiD,OAAO2C,aAAa,YAAY;AAAA,cAAEA,UAAU3C,OAAO2C;AAAAA,YAAAA,IAAa,CAAA;AAAA,YAC3E,GAAI,OAAO3C,OAAO4C,iBAAiB,WAAW;AAAA,cAAEA,cAAc5C,OAAO4C;AAAAA,YAAAA,IAAiB,CAAA;AAAA,YACtF,GAAI7B,eAAe;AAAA,cAAEC,QAAQD;AAAAA,YAAAA,IAAiB,CAAA;AAAA,UAAC;AAAA,QACjD,CACD;AAED,mBAAW8B,WAAWb,eAAe;AACnC,gBAAMxE,cAAcgE,cAAcqB,OAAO;AAAA,QAC3C;AACAb,sBAAc5G,SAAS;AAAA,MACzB;AAEA,YAAMgI,WAAWlG,sBAAsBsE,YAAY;AACnDA,mBAAa6B,IAAAA;AACb,YAAMD;AAAAA,IACR;AAEA,UAAMrD,SAASnB,OAAQ4C,aAA6CzG,MAAM,EAAE;AAC5E,QAAI,CAACgF,QAAQ;AACX,YAAM,IAAI1E,MAAM,iBAAiB;AAAA,IACnC;AAEA,UAAM8D,cAAcuB,UAClB;AAAA,MAAEf,MAAM,CAAC;AAAA,QAAEC,KAAKjB;AAAAA,MAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,IAAA,GAC1E;AAAA,MAAEmB,MAAM;AAAA,QAAExB,QAAQ;AAAA,QAAQqB;AAAAA,MAAAA;AAAAA,MAAUI,QAAQ;AAAA,QAAEpC,OAAO;AAAA,MAAA;AAAA,IAAG,CAC1D;AAEA,QAAI;AACF,YAAMqB,YAAYkE,WAAW;AAAA,QAAE3E;AAAAA,MAAAA,CAAU;AAAA,IAC3C,QAAQ;AAAA,IACN;AAGF,WAAO;AAAA,MAAEjB,IAAI;AAAA,MAAMqC;AAAAA,IAAAA;AAAAA,EACrB,SAAShC,OAAO;AACd,UAAMwF,UAAUxF,iBAAiB1C,QAAQ0C,MAAMwF,UAAU3E,OAAOb,KAAK;AAErE,UAAMG,kBAAkBsD,YAAY;AAEpC,QAAI+B,YAAY,kBAAkB;AAChC,YAAMpE,cAAcuB,UAClB;AAAA,QAAEf,MAAM,CAAC;AAAA,UAAEC,KAAKjB;AAAAA,QAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,MAAA,GAC1E;AAAA,QAAEmB,MAAM;AAAA,UAAExB,QAAQ;AAAA,QAAA;AAAA,MAAY,CAChC;AACApC,UAAImC,IAAIC,OAAO,GAAG;AAClB,aAAO;AAAA,QAAEhB,IAAI;AAAA,QAAOK,OAAO;AAAA,MAAA;AAAA,IAC7B;AAEA,QAAIwF,YAAY,iBAAiB;AAC/B,YAAMpE,cAAcuB,UAClB;AAAA,QAAEf,MAAM,CAAC;AAAA,UAAEC,KAAKjB;AAAAA,QAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,MAAA,GAC1E;AAAA,QAAEmB,MAAM;AAAA,UAAExB,QAAQ;AAAA,UAASX,OAAOwF;AAAAA,QAAAA;AAAAA,MAAQ,CAC5C;AACAjH,UAAImC,IAAIC,OAAO,GAAG;AAClB,aAAO;AAAA,QAAEhB,IAAI;AAAA,QAAOK,OAAOwF;AAAAA,MAAAA;AAAAA,IAC7B;AAEA,QAAIA,YAAY,iBAAiBA,YAAY,uBAAuB;AAClE,YAAMpE,cAAcuB,UAClB;AAAA,QAAEf,MAAM,CAAC;AAAA,UAAEC,KAAKjB;AAAAA,QAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,MAAA,GAC1E;AAAA,QAAEmB,MAAM;AAAA,UAAExB,QAAQ;AAAA,UAASX,OAAOwF;AAAAA,QAAAA;AAAAA,MAAQ,CAC5C;AACAjH,UAAImC,IAAIC,OAAO,GAAG;AAClB,aAAO;AAAA,QAAEhB,IAAI;AAAA,QAAOK,OAAOwF;AAAAA,MAAAA;AAAAA,IAC7B;AAEA,UAAMpE,cAAcuB,UAClB;AAAA,MAAEf,MAAM,CAAC;AAAA,QAAEC,KAAKjB;AAAAA,MAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,IAAA,GAC1E;AAAA,MAAEmB,MAAM;AAAA,QAAExB,QAAQ;AAAA,QAASX,OAAOwF;AAAAA,MAAAA;AAAAA,IAAQ,CAC5C;AAEAjH,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AACF;ACvUO,MAAMyF,YAA2F,OACtGlF,UACAhC,QAC2C;AAC3C,QAAMiC,WAAWC,YAAYlC,GAAG;AAChC,MAAI,CAACiC,UAAU;AACbjC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMY,WAAWC,OAAOtC,IAAIuC,IAAIC,QAAQH,YAAY,EAAE,EAAEnD,KAAAA;AACxD,MAAI,CAACmD,UAAU;AACbrC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMgB,UAAUC,oBAAoB1C,KAAKiC,QAAQ;AACjD,QAAMU,WAAWC,YAAY5C,KAAKiC,UAAUQ,OAAO;AAEnD,QAAM,CAACI,eAAeC,WAAW,IAAI,MAAMhC,QAAQiC,IAAI,CACrDC,OAAOC,IAAI,mBAAmBN,QAAQ,GACtCK,OAAOC,IAAI,iBAAiBN,QAAQ,CAAmC,CACxE;AAED,MAAI,CAACF,QAAQS,IAAI,QAAQ,iBAAiB,GAAG;AAC3ClD,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAM0F,UAAU,MAAMtE,cAAcO,QAAQ;AAAA,IAAEC,MAAM,CAAC;AAAA,MAAEC,KAAKjB;AAAAA,IAAAA,GAAYkB,4BAA4Bd,SAAS,MAAM,CAAC;AAAA,EAAA,CAAG,EAAEe,KAAAA;AACzH,MAAI,CAAC2D,SAAS;AACZnH,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAM2F,eAAe,MAAMtE,YAAYsC,KACrC;AAAA,IAAE/C;AAAAA,EAAAA,GACF;AAAA,IAAEiD,OAAO;AAAA,IAAGhC,KAAK;AAAA,EAAA,CACnB,EAAE+B,KAAK;AAAA,IAAEC,OAAO;AAAA,EAAA,CAAG,EAAE9B,KAAAA;AAErB,QAAM6D,WAAYD,aACfE,IAAKC,SAAS,OAAOA,IAAIjC,UAAU,WAAWiC,IAAIjC,QAAQ,EAAG,EAC7DrF,OAAQuH,CAAAA,MAAMC,OAAOC,UAAUF,CAAC,KAAKA,KAAK,CAAC;AAE9C,SAAO;AAAA,IACLpG,IAAI;AAAA,IACJgB,QAAQ+E,QAAQ/E;AAAAA,IAChBuF,WAAWR,QAAQQ;AAAAA,IACnBlB,aAAaU,QAAQV;AAAAA,IACrBY;AAAAA,IACA,GAAIF,QAAQ1D,SAAS;AAAA,MAAEA,QAAQ0D,QAAQ1D;AAAAA,IAAAA,IAAW,CAAA;AAAA,EAAC;AAEvD;ACjEO,MAAMmE,YAAY;AAClB,MAAMC,aAAa;AACnB,MAAMC,cAAc;AACpB,MAAMC,gBAAgB;AAEtB,MAAMC,oBAAoBC,OAAS;AAAA,EACxCzH,UAAUyH,OAAEC,EAASlC,IAAI,CAAC;AAAA,EAC1B1G,UAAU2I,OAAEC,EAASlC,IAAI,CAAC;AAAA,EAC1BK,UAAU4B,QAAEE,EAAUC,SAAAA;AAAAA,EACtB3H,WAAWwH,OAAEI,EAASC,IAAAA,EAAMtC,IAAI,CAAC;AACnC,CAAC;AAIiCiC,OAAS;AAAA,EACzC7G,IAAI6G,QAAEE;AAAAA,EACN1G,OAAOwG,OAAEC,EAASE,SAAAA;AAAAA,EAClB/F,UAAU4F,OAAEC,EAASE,SAAAA;AAAAA,EACrBG,WAAWN,OAAEC,EAASE,SAAAA;AAAAA,EACtBT,WAAWM,OAAEI,EAASC,IAAAA,EAAMF,SAAAA;AAAAA,EAC5B3B,aAAawB,OAAEI,EAASC,IAAAA,EAAMF,SAAAA;AAChC,CAAC;AAImCH,OAAS;AAAA,EAC3C7G,IAAI6G,QAAEE;AAAAA,EACN1G,OAAOwG,OAAEC,EAASE,SAAAA;AAAAA,EAClBhG,QAAQ6F,MAAO,CAAC,aAAa,cAAc,QAAQ,OAAO,CAAC,EAAEG,SAAAA;AAAAA,EAC7DT,WAAWM,OAAEI,EAASC,IAAAA,EAAMF,SAAAA;AAAAA,EAC5B3B,aAAawB,OAAEI,EAASC,IAAAA,EAAMF,SAAAA;AAAAA,EAC9Bf,UAAUY,MAAQA,SAAWK,IAAAA,EAAMtC,IAAI,CAAC,CAAC,EAAEoC,SAAAA;AAAAA,EAC3C3E,QAAQwE,OAAEC,EAASE,SAAAA;AACrB,CAAC;AAIqCH,OAAS;AAAA,EAC7C7G,IAAI6G,QAAEE;AAAAA,EACN1G,OAAOwG,OAAEC,EAASE,SAAAA;AAAAA,EAClB3E,QAAQwE,OAAEC,EAASE,SAAAA;AACrB,CAAC;ACrBM,MAAMI,aAA+F,OAC1GC,SACAzI,QACyC;AACzC,QAAMiC,WAAWC,YAAYlC,GAAG;AAChC,MAAI,CAACiC,UAAU;AACbjC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMiD,SAASgE,UAAU1I,GAAG;AAE5B,QAAM2I,SAASC,kBAA0BC,UAAUJ,WAAW,CAAA,CAAE;AAChE,MAAI,CAACE,OAAOG,SAAS;AACnB9I,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMkG,YAAYoB,kBAAAA;AAClB,QAAM;AAAA,IAAEvI;AAAAA,IAAUlB;AAAAA,IAAUmB;AAAAA,IAAW4F;AAAAA,EAAAA,IAAasC,OAAO9J;AAC3D,QAAM4H,cAAc3G,KAAKkJ,KAAKvI,YAAYkH,SAAS;AAEnD,QAAMlF,UAAUC,oBAAoB1C,KAAKiC,QAAQ;AACjD,QAAMU,WAAWC,YAAY5C,KAAKiC,UAAUQ,OAAO;AAEnD,QAAM,CAACI,eAAeC,WAAW,IAAI,MAAMhC,QAAQiC,IAAI,CACrDC,OAAOC,IAAI,mBAAmBN,QAAQ,GACtCK,OAAOC,IAAI,iBAAiBN,QAAQ,CAAmC,CACxE;AAED,QAAMoB,oBAAoBlB,eAAeC,WAAW;AAEpD,QAAMT,WAAW,IAAI4G,SAAAA,EAAW/K,SAAAA;AAChC,QAAMgL,MAAMC,KAAKD,IAAAA;AACjB,QAAME,YAAY,IAAID,KAAKD,MAAMG,iBAAiB;AAElD,QAAMd,YAAY7D,SAAS,OAAO4E,YAAY,EAAE,EAAEpL,SAAS,WAAW;AACtE,QAAMoI,eAAeiC,YAAYgB,iBAAiBnK,OAAOC,KAAKkJ,SAAS,CAAC,IAAI5D;AAE5E,QAAM9B,cAAc2G,OAAO;AAAA,IACzBlG,KAAKjB;AAAAA,IACL,GAAIqC,SAAS;AAAA,MAAEA;AAAAA,IAAAA,IAAW,CAAA;AAAA,IAC1B,GAAI4B,eAAe;AAAA,MAAEA;AAAAA,IAAAA,IAAiB,CAAA;AAAA,IACtC9F;AAAAA,IACAlB;AAAAA,IACA,GAAI,OAAO+G,aAAa,YAAY;AAAA,MAAEA;AAAAA,IAAAA,IAAa,CAAA;AAAA,IACnD5F;AAAAA,IACAkH;AAAAA,IACAlB;AAAAA,IACArE,QAAQ;AAAA,IACRqH,WAAW,IAAIN,KAAKD,GAAG;AAAA,IACvBE;AAAAA,EAAAA,CACD;AAED,SAAO;AAAA,IACLhI,IAAI;AAAA,IACJiB;AAAAA,IACAsF;AAAAA,IACAlB;AAAAA,IACA,GAAI8B,YAAY;AAAA,MAAEA;AAAAA,IAAAA,IAAc,CAAA;AAAA,EAAC;AAErC;AC5DO,MAAMmB,cAAqE,OAChFjB,SACAzI,QACkC;AAClC,QAAMiC,WAAWC,YAAYlC,GAAG;AAChC,MAAI,CAACiC,UAAU;AACbjC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMY,WAAWC,OAAOtC,IAAIuC,IAAIC,QAAQH,YAAY,EAAE,EAAEnD,KAAAA;AACxD,QAAMyK,WAAWrH,OAAOtC,IAAIuC,IAAIC,QAAQ8C,SAAS,EAAE,EAAEpG,KAAAA;AACrD,QAAMoG,QAAQmC,OAAOkC,QAAQ;AAE7B,MAAI,CAACtH,YAAY,CAACoF,OAAOC,UAAUpC,KAAK,KAAKA,QAAQ,GAAG;AACtDtF,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMgB,UAAUC,oBAAoB1C,KAAKiC,QAAQ;AACjD,QAAMU,WAAWC,YAAY5C,KAAKiC,UAAUQ,OAAO;AAEnD,QAAM,CAACI,eAAeC,WAAW,IAAI,MAAMhC,QAAQiC,IAAI,CACrDC,OAAOC,IAAI,mBAAmBN,QAAQ,GACtCK,OAAOC,IAAI,iBAAiBN,QAAQ,CAAmC,CACxE;AAED,MAAI,CAACF,QAAQS,IAAI,UAAU,iBAAiB,GAAG;AAC7ClD,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAM0F,UAAU,MAAMtE,cAAcO,QAAQ;AAAA,IAAEC,MAAM,CAAC;AAAA,MAAEC,KAAKjB;AAAAA,IAAAA,GAAYkB,4BAA4Bd,SAAS,QAAQ,CAAC;AAAA,EAAA,CAAG,EAAEe,KAAAA;AAC3H,MAAI,CAAC2D,SAAS;AACZnH,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,MAAI0F,QAAQ/E,WAAW,aAAa;AAClCpC,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,MAAI6D,SAAS6B,QAAQV,aAAa;AAChCzG,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAM5C,OAAO+K,gBAAgBnB,OAAO;AACpC,MAAI,CAAC5J,MAAM;AACTmB,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMoI,eAAevE,UAAU6B,QAAQV,cAAc,IACjDU,QAAQ1G,YAAY0G,QAAQQ,aAAaR,QAAQV,cAAc,KAC/DU,QAAQQ;AAEZ,MAAI9I,KAAKC,SAAS+K,cAAc;AAC9B7J,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,MAAI5C,KAAKC,WAAW+K,cAAc;AAChC7J,QAAImC,IAAIC,OAAO,GAAG;AAClB,WAAO;AAAA,MAAEhB,IAAI;AAAA,MAAOK,OAAO;AAAA,IAAA;AAAA,EAC7B;AAEA,QAAMqI,iBAAiB9J,IAAIuC,IAAIU,IAAI,gBAAgB;AACnD,QAAM8G,SAASD,iBAAiBP,iBAAiB1K,IAAI,IAAI8F;AAEzD,MAAImF,gBAAgB;AAClB,UAAME,iBAAiBC,mBAAmBH,cAAc;AACxD,QAAIC,WAAWC,gBAAgB;AAC7BhK,UAAImC,IAAIC,OAAO,GAAG;AAClB,aAAO;AAAA,QAAEhB,IAAI;AAAA,QAAOK,OAAO;AAAA,MAAA;AAAA,IAC7B;AAAA,EACF;AAEA,QAAMsC,oBAAoBlB,eAAeC,WAAW;AAEpD,QAAMA,YAAYsB,UAChB;AAAA,IAAE/B;AAAAA,IAAUiD;AAAAA,EAAAA,GACZ;AAAA,IACE1B,MAAM;AAAA,MACJvB;AAAAA,MACAiD;AAAAA,MACAzG;AAAAA,MACAqL,MAAMrL,KAAKC;AAAAA,MACXiL;AAAAA,MACAX,WAAWjC,QAAQiC;AAAAA,IAAAA;AAAAA,IAErBe,cAAc;AAAA,MACZV,+BAAeN,KAAAA;AAAAA,IAAK;AAAA,EACtB,GAEF;AAAA,IAAEiB,QAAQ;AAAA,EAAA,CACZ;AAEApK,MAAImC,IAAIC,OAAO,GAAG;AAClB,SAAO;AAAA,IAAEhB,IAAI;AAAA,EAAA;AACf;AC7HO,MAAMiJ,gBAAgBA,CAAC;AAAA,EAC5BC;AAAAA,EACAC;AAIF,MAAM;AACJ,SAAO,CAAChI,KAAUJ,KAAUqI,SAAc;AACxC,UAAMC,cAAc,OAAOlI,KAAKmI,UAAU,cAAc,MAAM,WAC1DpI,OAAOC,IAAImI,QAAQ,cAAc,CAAC,IAClC;AAEJ,QAAI,CAACD,YAAYE,SAAS,0BAA0B,GAAG;AACrDH,WAAAA;AACA;AAAA,IACF;AAEA,QAAII,QAAQ;AACZ,UAAMpF,SAAmB,CAAA;AACzB,QAAIqF,OAAO;AACX,QAAIC,SAAS;AACb,QAAIC,kBAAwD;AAE5D,UAAMC,qBAAqB,OAAOT,4BAA4B,YAAYA,0BAA0B,IAChGA,0BACA;AAEJ,UAAMhJ,UAAUA,MAAM;AACpBgB,UAAIb,IAAI,QAAQuJ,MAAM;AACtB1I,UAAIb,IAAI,OAAOwJ,KAAK;AACpB3I,UAAIb,IAAI,SAASF,OAAO;AACxBe,UAAIb,IAAI,WAAWyJ,SAAS;AAC5B,UAAIJ,iBAAiB;AACnBK,qBAAaL,eAAe;AAC5BA,0BAAkB;AAAA,MACpB;AAAA,IACF;AAEA,UAAMM,SAASA,CAAC5J,UAAoB;AAClC,UAAIoJ,KAAM;AACVA,aAAO;AAEPtJ,cAAAA;AAEA,UAAIE,OAAO;AACT+I,aAAK/I,KAAK;AACV;AAAA,MACF;AAEAc,UAAI+I,OAAOlM,OAAO6G,OAAOT,QAAQoF,KAAK;AACtCJ,WAAAA;AAAAA,IACF;AAEA,UAAMS,SAASA,CAAC9J,UAAe;AAC7B,UAAI0J,KAAM;AACV,YAAMU,SAASnM,OAAOoM,SAASrK,KAAK,IAAIA,QAAQ/B,OAAOC,KAAK8B,KAAK;AACjEyJ,eAASW,OAAOzM;AAEhB,UAAI8L,QAAQN,YAAY;AACtBO,eAAO;AACPtJ,gBAAAA;AACAgB,YAAIT,QAAAA;AACJK,YAAIC,OAAO,GAAG,EAAEqJ,KAAK;AAAA,UAAErK,IAAI;AAAA,UAAOK,OAAO;AAAA,QAAA,CAAmB;AAC5D;AAAA,MACF;AAEA+D,aAAO7E,KAAK4K,MAAM;AAElB,UAAI,CAACP,mBAAoB;AAEzB,YAAM9B,MAAMC,KAAKD,IAAAA;AACjB,YAAMwC,YAAYC,aAAapJ,GAAG;AAClC,YAAMqJ,QAAQC,mBAAmBH,WAAWV,oBAAoB9B,GAAG;AACnE,YAAM4C,SAASC,kBAAkBH,OAAOL,OAAOzM,QAAQkM,oBAAoB9B,GAAG;AAE9E,UAAI4C,SAAS,KAAK,CAAChB,QAAQ;AACzBA,iBAAS;AACTvI,YAAIyJ,MAAAA;AACJjB,0BAAkBkB,WAAW,MAAM;AACjClB,4BAAkB;AAClBD,mBAAS;AACT,cAAID,KAAM;AACV,cAAI;AACFtI,gBAAI2J,OAAAA;AAAAA,UACN,QAAQ;AAAA,UACN;AAAA,QAEJ,GAAGJ,MAAM;AAAA,MACX;AAAA,IACF;AAEA,UAAMZ,QAAQA,MAAMG,OAAAA;AACpB,UAAM7J,UAAUA,CAAC2K,QAAiBd,OAAOc,GAAG;AAC5C,UAAMhB,YAAYA,MAAME,OAAO,IAAItM,MAAM,iBAAiB,CAAC;AAE3DwD,QAAIZ,GAAG,QAAQsJ,MAAM;AACrB1I,QAAIZ,GAAG,OAAOuJ,KAAK;AACnB3I,QAAIZ,GAAG,SAASH,OAAO;AACvBe,QAAIZ,GAAG,WAAWwJ,SAAS;AAAA,EAC7B;AACF;AAQA,MAAMiB,oBAAoB;AAC1B,MAAMC,kBAAkB,KAAK,KAAK;AAElC,MAAMC,uCAAuBC,IAAAA;AAC7B,IAAIC,gBAAgB;AAEpB,MAAMb,eAAeA,CAACpJ,QAAqB;AACzC,QAAMkK,cAAc,OAAOlK,KAAKmK,aAAa,WAAWnK,IAAImK,WAAW;AACvE,MAAID,YAAYvN,KAAAA,EAAQ,QAAOuN,YAAYvN,KAAAA;AAC3C,QAAMyN,QAAQ,OAAOpK,KAAKqK,OAAO,WAAWrK,IAAIqK,KAAK;AACrD,SAAOD,MAAMzN,UAAU;AACzB;AAEA,MAAM2N,qBAAqBA,CAAC3D,QAAgB;AAC1C,MAAIA,MAAMsD,gBAAgB,IAAQ;AAClCA,kBAAgBtD;AAEhB,MAAIoD,iBAAiBpC,OAAO,IAAM;AAElC,aAAW,CAAC4C,KAAKlB,KAAK,KAAKU,kBAAkB;AAC3C,QAAIpD,MAAM0C,MAAMmB,aAAaV,iBAAiB;AAC5CC,uBAAiBU,OAAOF,GAAG;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,MAAMjB,qBAAqBA,CAACiB,KAAa9B,oBAA4B9B,QAAiC;AACpG2D,qBAAmB3D,GAAG;AAEtB,QAAM+D,WAAWjC,qBAAqBoB;AACtC,QAAMjJ,WAAWmJ,iBAAiBrJ,IAAI6J,GAAG;AACzC,MAAI3J,UAAU;AACZA,aAAS4J,aAAa7D;AACtB/F,aAAS+J,SAASpN,KAAKkG,IAAIiH,UAAU9J,SAAS+J,MAAM;AACpD,WAAO/J;AAAAA,EACT;AAEA,QAAMqH,OAAwB;AAAA,IAC5B0C,QAAQD;AAAAA,IACRE,cAAcjE;AAAAA,IACd6D,YAAY7D;AAAAA,EAAAA;AAEdoD,mBAAiBc,IAAIN,KAAKtC,IAAI;AAC9B,SAAOA;AACT;AAEA,MAAMuB,oBAAoBA,CACxBH,OACAyB,OACArC,oBACA9B,QACW;AACX,QAAM+D,WAAWjC,qBAAqBoB;AACtC,QAAMkB,YAAYxN,KAAKF,IAAI,GAAGsJ,MAAM0C,MAAMuB,YAAY;AAEtD,MAAIG,YAAY,GAAG;AACjB1B,UAAMsB,SAASpN,KAAKkG,IAAIiH,UAAUrB,MAAMsB,SAAUI,YAAYtC,qBAAsB,GAAI;AACxFY,UAAMuB,eAAejE;AAAAA,EACvB;AAEA0C,QAAMsB,UAAUG;AAEhB,MAAIzB,MAAMsB,UAAU,EAAG,QAAO;AAC9B,SAAOpN,KAAKkJ,KAAM,CAAC4C,MAAMsB,SAASlC,qBAAsB,GAAI;AAC9D;AChKA,MAAA,UAAe,CAACuC,QAA0B;AACxC,QAAMC,iBAAiBzE,kBAAAA;AACvBwE,MAAIE,IACF7E,WACAyB,cAAc;AAAA,IACZC,YAAYoD,qBAAqBF,cAAc;AAAA,IAC/CjD,yBAAyBoD,iCAAAA;AAAAA,EAAiC,CAC3D,CACH;AAEAJ,MAAIK,KAAKhF,WAAmBJ,UAAU;AACtC+E,MAAIM,IAAIjF,YAAoBc,WAAW;AACvC6D,MAAItK,IAAI2F,aAAqB1B,SAAS;AACtCqG,MAAIK,KAAKhF,eAAuB7G,cAAc;AAChD;"}

package/dist/queryExecutor-B7lb2FR1.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"queryExecutor-B7lb2FR1.js","sources":["../src/getDerivedKey.ts","../src/rts/queryExecutor.ts"],"sourcesContent":["import assert from \"assert\"\nimport { hkdfSync } from \"crypto\"\n\n\nexport const getDerivedKey = (\n  masterKey: string,\n  info: string,\n  length: number = 32, // Default to 256-bit keys\n  salt: string = \"\",\n): string => {\n  assert(masterKey?.length >= 32, \"MASTER_KEY must be 32 chars or longer.\")\n\n  return Buffer.from(hkdfSync(\n    \"sha256\",\n    masterKey,\n    Buffer.from(salt),\n    Buffer.from(info),\n    length,\n  )).toString(\"hex\")\n}\n","import type { Request } from \"express\"\nimport type { PaginationPageInfo, PaginationSpec } from \"@rpcbase/api\"\nimport { models, type LoadModelCtx } from \"@rpcbase/db\"\nimport { buildAbility, buildAbilityFromSession, getAccessibleByQuery, getTenantRolesFromSessionUser, type AclSubjectType, type AppAbility } from \"@rpcbase/db/acl\"\nimport type { Model } from \"mongoose\"\n\nimport { getDerivedKey } from \"../getDerivedKey\"\n\n\ntype JsonObject = Record<string, unknown>\n\ntype SessionUser = {\n  id?: unknown\n  currentTenantId?: unknown\n  signedInTenants?: unknown\n}\n\ntype HeaderUserDoc = {\n  tenants?: unknown\n  tenantRoles?: unknown\n}\n\nexport type RtsPopulateObject = {\n  path: string\n  model?: string\n  select?: string | JsonObject\n  match?: JsonObject\n  options?: {\n    sort?: Record<string, 1 | -1>\n    limit?: number\n  }\n  populate?: RtsPopulateOption\n}\n\nexport type RtsPopulateOption =\n  | string\n  | RtsPopulateObject\n  | Array<string | RtsPopulateObject>\n\nexport type RtsQueryOptions = {\n  projection?: JsonObject\n  sort?: Record<string, 1 | -1>\n  limit?: number\n  populate?: RtsPopulateOption\n  pagination?: PaginationSpec\n}\n\nexport type RtsQueryResult = {\n  data: unknown[]\n  pageInfo?: PaginationPageInfo\n}\n\nexport const RTS_TENANT_ID_QUERY_PARAM = \"rb-tenant-id\"\nexport const RTS_USER_ID_HEADER = \"rb-user-id\"\n\nconst QUERY_MAX_LIMIT = 4096\nconst INTERNAL_MODEL_NAMES = new Set([\"RBRtsChange\", \"RBRtsCounter\"])\nlet paginationCursorSigningSecret: string | null = null\n\nconst getPaginationCursorSigningSecret = (): string => {\n  if (paginationCursorSigningSecret) return paginationCursorSigningSecret\n  const masterKey = process.env.MASTER_KEY?.trim()\n  if (!masterKey) {\n    throw new Error(\"MASTER_KEY must be defined to derive pagination cursor signing secret\")\n  }\n  paginationCursorSigningSecret = getDerivedKey(masterKey, \"pagination_cursor_signing\")\n  return paginationCursorSigningSecret\n}\n\nconst normalizeTenantId = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized ? normalized : null\n}\n\nconst normalizeSignedInTenants = (value: unknown): string[] => {\n  if (!Array.isArray(value)) return []\n  return value\n    .map((tenantId) => normalizeTenantId(String(tenantId)))\n    .filter((tenantId): tenantId is string => Boolean(tenantId))\n}\n\nconst getTenantIdFromRequest = (req: Request): string | null => {\n  const rawQuery = req.query?.[RTS_TENANT_ID_QUERY_PARAM]\n  const queryTenantId = Array.isArray(rawQuery) ? rawQuery[0] : rawQuery\n  const normalizedFromQuery = normalizeTenantId(queryTenantId)\n  if (normalizedFromQuery) return normalizedFromQuery\n\n  return normalizeTenantId((req.session?.user as SessionUser | undefined)?.currentTenantId)\n}\n\nexport const resolveRtsRequestTenantId = (req: Request): string | null => {\n  return getTenantIdFromRequest(req)\n}\n\nexport const resolveRtsRequestUserId = (req: Request): string | null => {\n  const sessionUserId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.id)\n  if (sessionUserId) return sessionUserId\n\n  const headerValue = req.headers[RTS_USER_ID_HEADER]\n  const headerUserId = Array.isArray(headerValue) ? headerValue[0] : headerValue\n  return normalizeTenantId(headerUserId)\n}\n\nexport const isRtsRequestAuthorized = (req: Request, tenantId: string): boolean => {\n  const sessionUser = req.session?.user as SessionUser | undefined\n  if (!sessionUser) return false\n\n  const signedInTenants = normalizeSignedInTenants(sessionUser.signedInTenants)\n  if (signedInTenants.length > 0) {\n    return signedInTenants.includes(tenantId)\n  }\n\n  const currentTenantId = normalizeTenantId(sessionUser.currentTenantId)\n  if (!currentTenantId) return false\n  return currentTenantId === tenantId\n}\n\nexport const buildRtsAbilityFromRequest = async (\n  req: Request,\n  tenantId: string,\n): Promise<{ ability: AppAbility; userId: string | null }> => {\n  const sessionUserId = normalizeTenantId((req.session?.user as SessionUser | undefined)?.id)\n  if (sessionUserId) {\n    const ability = buildAbilityFromSession({ tenantId, session: req.session })\n    return { ability, userId: sessionUserId }\n  }\n\n  const headerValue = req.headers[RTS_USER_ID_HEADER]\n  const headerUserIdRaw = Array.isArray(headerValue) ? headerValue[0] : headerValue\n  const headerUserId = normalizeTenantId(headerUserIdRaw)\n  if (!headerUserId) {\n    const ability = buildAbilityFromSession({ tenantId, session: req.session })\n    return { ability, userId: null }\n  }\n\n  const rbCtx: LoadModelCtx = { req: { session: null } }\n  const User = await models.getGlobal(\"RBUser\", rbCtx)\n  const user = await User.findById(headerUserId, { tenants: 1, tenantRoles: 1 }).lean() as HeaderUserDoc | null\n\n  const tenantsRaw = user?.tenants\n  const tenants = Array.isArray(tenantsRaw) ? tenantsRaw.map((tenant) => String(tenant)) : []\n  if (!tenants.includes(tenantId)) {\n    throw new Error(\"Tenant not authorized for this session\")\n  }\n\n  const roles = getTenantRolesFromSessionUser(user, tenantId)\n  return {\n    ability: buildAbility({ tenantId, userId: headerUserId, roles: roles.length ? roles : [\"owner\"] }),\n    userId: headerUserId,\n  }\n}\n\nconst getTenantModel = async (tenantId: string, modelName: string, ability: AppAbility): Promise<Model<any>> => {\n  const ctx: LoadModelCtx = {\n    req: {\n      session: {\n        user: {\n          currentTenantId: tenantId,\n        },\n      },\n    },\n    ability,\n  }\n\n  return models.get(modelName, ctx)\n}\n\nconst normalizeLimit = (limit?: number): number => {\n  if (typeof limit !== \"number\") return QUERY_MAX_LIMIT\n  if (!Number.isFinite(limit)) return QUERY_MAX_LIMIT\n  return Math.min(QUERY_MAX_LIMIT, Math.abs(limit))\n}\n\nconst normalizeString = (value: unknown): string => {\n  return typeof value === \"string\" ? value.trim() : \"\"\n}\n\nconst normalizeObject = (value: unknown): JsonObject | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  return value as JsonObject\n}\n\nconst normalizePagination = (value: unknown): PaginationSpec | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  return value as PaginationSpec\n}\n\nconst normalizePopulateSelect = (value: unknown): string | JsonObject | undefined => {\n  if (typeof value === \"string\") {\n    const normalized = value.trim()\n    return normalized || undefined\n  }\n  return normalizeObject(value)\n}\n\nconst normalizePopulateOptions = (value: unknown): RtsPopulateObject[\"options\"] | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  const raw = value as { sort?: unknown; limit?: unknown }\n  const normalized: RtsPopulateObject[\"options\"] = {}\n\n  if (raw.sort && typeof raw.sort === \"object\" && !Array.isArray(raw.sort)) {\n    normalized.sort = raw.sort as Record<string, 1 | -1>\n  }\n\n  if (typeof raw.limit === \"number\" && Number.isFinite(raw.limit)) {\n    normalized.limit = Math.max(0, Math.floor(Math.abs(raw.limit)))\n  }\n\n  if (!normalized.sort && normalized.limit === undefined) return undefined\n  return normalized\n}\n\nconst normalizePopulateObject = (value: unknown): RtsPopulateObject | undefined => {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return undefined\n  const raw = value as Record<string, unknown>\n  const path = normalizeString(raw.path)\n  if (!path) return undefined\n\n  const normalized: RtsPopulateObject = { path }\n\n  const model = normalizeString(raw.model)\n  if (model) normalized.model = model\n\n  const select = normalizePopulateSelect(raw.select)\n  if (select !== undefined) normalized.select = select\n\n  const match = normalizeObject(raw.match)\n  if (match) normalized.match = match\n\n  const nestedPopulate = normalizeRtsPopulateOption(raw.populate)\n  if (nestedPopulate !== undefined) normalized.populate = nestedPopulate\n\n  const options = normalizePopulateOptions(raw.options)\n  if (options) normalized.options = options\n\n  return normalized\n}\n\nconst normalizeRtsPopulateOption = (value: unknown): RtsPopulateOption | undefined => {\n  if (typeof value === \"string\") {\n    const normalized = value.trim()\n    return normalized || undefined\n  }\n\n  if (Array.isArray(value)) {\n    const normalized = value\n      .map((entry) => {\n        if (typeof entry === \"string\") {\n          const path = entry.trim()\n          return path || null\n        }\n        return normalizePopulateObject(entry) ?? null\n      })\n      .filter((entry): entry is string | RtsPopulateObject => entry !== null)\n\n    return normalized.length > 0 ? normalized : undefined\n  }\n\n  return normalizePopulateObject(value)\n}\n\nconst normalizeModelName = (value: unknown): string | null => {\n  if (typeof value !== \"string\") return null\n  const normalized = value.trim()\n  return normalized || null\n}\n\nconst resolvePopulateRefModelName = (\n  model: Model<any>,\n  path: string,\n  explicitModelName: string | null,\n): string | null => {\n  if (explicitModelName) return explicitModelName\n\n  const schema = model.schema as any\n  const schemaPath = typeof schema.path === \"function\" ? schema.path(path) : null\n  const directRef = normalizeModelName(schemaPath?.options?.ref)\n  if (directRef) return directRef\n\n  const arrayRef = normalizeModelName(schemaPath?.caster?.options?.ref)\n  if (arrayRef) return arrayRef\n\n  const virtualPath = typeof schema.virtualpath === \"function\" ? schema.virtualpath(path) : null\n  const virtualRef = normalizeModelName(virtualPath?.options?.ref)\n  if (virtualRef) return virtualRef\n\n  return null\n}\n\nconst mergePopulateMatchWithAcl = (\n  populateMatch: JsonObject | undefined,\n  aclMatch: JsonObject,\n): JsonObject => {\n  if (!populateMatch || Object.keys(populateMatch).length === 0) return aclMatch\n  return { $and: [populateMatch, aclMatch] }\n}\n\ntype PreparedPopulateObject = {\n  path: string\n  model?: string\n  select?: string | JsonObject\n  match?: JsonObject\n  options?: {\n    sort?: Record<string, 1 | -1>\n    limit?: number\n  }\n  populate?: PreparedPopulateOption\n}\n\ntype PreparedPopulateOption =\n  | string\n  | PreparedPopulateObject\n  | Array<string | PreparedPopulateObject>\n\nconst resolvePopulateSpecForModel = async ({\n  tenantId,\n  model,\n  ability,\n  populate,\n  allowInternalModels,\n  modelCache,\n  dependencyModelNames,\n}: {\n  tenantId: string\n  model: Model<any>\n  ability: AppAbility\n  populate: RtsPopulateOption | undefined\n  allowInternalModels: boolean\n  modelCache: Map<string, Model<any>>\n  dependencyModelNames: Set<string>\n}): Promise<PreparedPopulateOption | undefined> => {\n  if (!populate) return undefined\n\n  const getModelCached = async (targetModelName: string): Promise<Model<any>> => {\n    const cached = modelCache.get(targetModelName)\n    if (cached) return cached\n    const loaded = await getTenantModel(tenantId, targetModelName, ability)\n    modelCache.set(targetModelName, loaded)\n    return loaded\n  }\n\n  const resolveOne = async (\n    entry: string | RtsPopulateObject,\n    parentModel: Model<any>,\n  ): Promise<string | PreparedPopulateObject | null> => {\n    if (typeof entry === \"string\") {\n      const path = entry.trim()\n      if (!path) return null\n\n      const refModelName = resolvePopulateRefModelName(parentModel, path, null)\n      if (!refModelName) return path\n      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {\n        throw new Error(\"Model not allowed\")\n      }\n      if (!ability.can(\"read\", refModelName as AclSubjectType)) {\n        throw new Error(\"forbidden\")\n      }\n\n      dependencyModelNames.add(refModelName)\n\n      const aclMatch = getAccessibleByQuery(\n        ability,\n        \"read\",\n        refModelName as Exclude<AclSubjectType, \"all\">,\n      )\n      return {\n        path,\n        match: aclMatch as JsonObject,\n      }\n    }\n\n    const path = entry.path.trim()\n    if (!path) return null\n\n    const explicitModelName = normalizeModelName(entry.model)\n    const refModelName = resolvePopulateRefModelName(parentModel, path, explicitModelName)\n    let nestedModel = parentModel\n\n    const normalizedEntry: PreparedPopulateObject = {\n      path,\n    }\n\n    if (entry.select !== undefined) normalizedEntry.select = entry.select\n    if (entry.options !== undefined) normalizedEntry.options = entry.options\n    if (explicitModelName) normalizedEntry.model = explicitModelName\n    if (entry.match !== undefined) normalizedEntry.match = entry.match\n\n    if (refModelName) {\n      if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(refModelName)) {\n        throw new Error(\"Model not allowed\")\n      }\n      if (!ability.can(\"read\", refModelName as AclSubjectType)) {\n        throw new Error(\"forbidden\")\n      }\n\n      dependencyModelNames.add(refModelName)\n      nestedModel = await getModelCached(refModelName)\n\n      const aclMatch = getAccessibleByQuery(\n        ability,\n        \"read\",\n        refModelName as Exclude<AclSubjectType, \"all\">,\n      ) as JsonObject\n      normalizedEntry.match = mergePopulateMatchWithAcl(\n        normalizedEntry.match,\n        aclMatch,\n      )\n    } else if (entry.populate !== undefined) {\n      throw new Error(\"Populate path must reference a model when nested populate is used\")\n    }\n\n    const nestedPopulate = await resolvePopulateSpecForModel({\n      tenantId,\n      model: nestedModel,\n      ability,\n      populate: entry.populate,\n      allowInternalModels,\n      modelCache,\n      dependencyModelNames,\n    })\n    if (nestedPopulate !== undefined) normalizedEntry.populate = nestedPopulate\n\n    return normalizedEntry\n  }\n\n  if (Array.isArray(populate)) {\n    const resolved = await Promise.all(populate.map((entry) => resolveOne(entry, model)))\n    const filtered = resolved.filter((entry): entry is string | PreparedPopulateObject => entry !== null)\n    return filtered.length > 0 ? filtered : undefined\n  }\n\n  const resolved = await resolveOne(populate, model)\n  return resolved ?? undefined\n}\n\nexport const normalizeRtsQueryOptions = (options: RtsQueryOptions | undefined): RtsQueryOptions => {\n  if (!options || typeof options !== \"object\") return {}\n  const normalized: RtsQueryOptions = {}\n\n  if (options.projection && typeof options.projection === \"object\" && !Array.isArray(options.projection)) {\n    normalized.projection = options.projection\n  }\n\n  if (options.sort && typeof options.sort === \"object\" && !Array.isArray(options.sort)) {\n    normalized.sort = options.sort\n  }\n\n  normalized.limit = normalizeLimit(options.limit)\n  normalized.populate = normalizeRtsPopulateOption(options.populate)\n  normalized.pagination = normalizePagination(options.pagination)\n\n  return normalized\n}\n\nexport const resolveRtsQueryDependencyModelNames = async ({\n  tenantId,\n  ability,\n  modelName,\n  options,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  options: RtsQueryOptions\n  allowInternalModels?: boolean\n}): Promise<string[]> => {\n  const model = await getTenantModel(tenantId, modelName, ability)\n  const modelCache = new Map<string, Model<any>>()\n  modelCache.set(modelName, model)\n\n  const dependencyModelNames = new Set<string>()\n  await resolvePopulateSpecForModel({\n    tenantId,\n    model,\n    ability,\n    populate: options.populate,\n    allowInternalModels,\n    modelCache,\n    dependencyModelNames,\n  })\n\n  return Array.from(dependencyModelNames)\n}\n\nexport const runRtsQuery = async ({\n  tenantId,\n  ability,\n  modelName,\n  query,\n  options,\n  allowInternalModels = false,\n}: {\n  tenantId: string\n  ability: AppAbility\n  modelName: string\n  query: JsonObject\n  options: RtsQueryOptions\n  allowInternalModels?: boolean\n}): Promise<RtsQueryResult> => {\n  if (!allowInternalModels && INTERNAL_MODEL_NAMES.has(modelName)) {\n    throw new Error(\"Model not allowed\")\n  }\n\n  if (!ability.can(\"read\", modelName as AclSubjectType)) {\n    throw new Error(\"forbidden\")\n  }\n\n  const model = await getTenantModel(tenantId, modelName, ability)\n  const projection = options.projection ?? undefined\n  const sort = options.sort\n  const limit = normalizeLimit(options.limit)\n  const modelCache = new Map<string, Model<any>>()\n  modelCache.set(modelName, model)\n\n  const populate = await resolvePopulateSpecForModel({\n    tenantId,\n    model,\n    ability,\n    populate: options.populate,\n    allowInternalModels,\n    modelCache,\n    dependencyModelNames: new Set<string>(),\n  })\n\n  const accessQuery = getAccessibleByQuery(ability, \"read\", modelName as Exclude<AclSubjectType, \"all\">)\n  const finalQuery: JsonObject = { $and: [query, accessQuery] }\n\n  if (options.pagination) {\n    const paginatedQuery = model.find(finalQuery, projection)\n    if (populate !== undefined) {\n      paginatedQuery.populate(populate as any)\n    }\n\n    const paginatedResult = await paginatedQuery.paginate(options.pagination, {\n      cursor: {\n        signingSecret: getPaginationCursorSigningSecret(),\n      },\n    })\n\n    return {\n      data: Array.isArray(paginatedResult.nodes) ? paginatedResult.nodes : [],\n      pageInfo: paginatedResult.pageInfo,\n    }\n  }\n\n  const queryPromise = model.find(finalQuery, projection)\n  if (populate !== undefined) {\n    queryPromise.populate(populate as any)\n  }\n  if (sort && Object.keys(sort).length) {\n    queryPromise.sort(sort)\n  }\n  queryPromise.limit(limit)\n\n  const data = await queryPromise\n  return { data: Array.isArray(data) ? data : [] }\n}\n"],"names":["getDerivedKey","masterKey","info","length","salt","assert","Buffer","from","hkdfSync","toString","RTS_TENANT_ID_QUERY_PARAM","RTS_USER_ID_HEADER","QUERY_MAX_LIMIT","INTERNAL_MODEL_NAMES","Set","paginationCursorSigningSecret","getPaginationCursorSigningSecret","process","env","MASTER_KEY","trim","Error","normalizeTenantId","value","normalized","normalizeSignedInTenants","Array","isArray","map","tenantId","String","filter","Boolean","getTenantIdFromRequest","req","rawQuery","query","queryTenantId","normalizedFromQuery","session","user","currentTenantId","resolveRtsRequestTenantId","isRtsRequestAuthorized","sessionUser","signedInTenants","includes","buildRtsAbilityFromRequest","sessionUserId","id","ability","buildAbilityFromSession","userId","headerValue","headers","headerUserIdRaw","headerUserId","rbCtx","User","models","getGlobal","findById","tenants","tenantRoles","lean","tenantsRaw","tenant","roles","getTenantRolesFromSessionUser","buildAbility","getTenantModel","modelName","ctx","get","normalizeLimit","limit","Number","isFinite","Math","min","abs","normalizeString","normalizeObject","undefined","normalizePagination","normalizePopulateSelect","normalizePopulateOptions","raw","sort","max","floor","normalizePopulateObject","path","model","select","match","nestedPopulate","normalizeRtsPopulateOption","populate","options","entry","normalizeModelName","resolvePopulateRefModelName","explicitModelName","schema","schemaPath","directRef","ref","arrayRef","caster","virtualPath","virtualpath","virtualRef","mergePopulateMatchWithAcl","populateMatch","aclMatch","Object","keys","$and","resolvePopulateSpecForModel","allowInternalModels","modelCache","dependencyModelNames","getModelCached","targetModelName","cached","loaded","set","resolveOne","parentModel","refModelName","has","can","add","getAccessibleByQuery","nestedModel","normalizedEntry","resolved","Promise","all","filtered","normalizeRtsQueryOptions","projection","pagination","resolveRtsQueryDependencyModelNames","Map","runRtsQuery","accessQuery","finalQuery","paginatedQuery","find","paginatedResult","paginate","cursor","signingSecret","data","nodes","pageInfo","queryPromise"],"mappings":";;;;AAIO,MAAMA,gBAAgBA,CAC3BC,WACAC,MACAC,SAAiB,IACjBC,OAAe,OACJ;AACXC,SAAOJ,WAAWE,UAAU,IAAI,wCAAwC;AAExE,SAAOG,OAAOC,KAAKC,SACjB,UACAP,WACAK,OAAOC,KAAKH,IAAI,GAChBE,OAAOC,KAAKL,IAAI,GAChBC,MACF,CAAC,EAAEM,SAAS,KAAK;AACnB;ACiCO,MAAMC,4BAA4B;AAClC,MAAMC,qBAAqB;AAElC,MAAMC,kBAAkB;AACxB,MAAMC,uBAAuB,oBAAIC,IAAI,CAAC,eAAe,cAAc,CAAC;AACpE,IAAIC,gCAA+C;AAEnD,MAAMC,mCAAmCA,MAAc;AACrD,MAAID,8BAA+B,QAAOA;AAC1C,QAAMd,YAAYgB,QAAQC,IAAIC,YAAYC,KAAAA;AAC1C,MAAI,CAACnB,WAAW;AACd,UAAM,IAAIoB,MAAM,uEAAuE;AAAA,EACzF;AACAN,kCAAgCf,cAAcC,WAAW,2BAA2B;AACpF,SAAOc;AACT;AAEA,MAAMO,oBAAoBA,CAACC,UAAkC;AAC3D,MAAI,OAAOA,UAAU,SAAU,QAAO;AACtC,QAAMC,aAAaD,MAAMH,KAAAA;AACzB,SAAOI,aAAaA,aAAa;AACnC;AAEA,MAAMC,2BAA2BA,CAACF,UAA6B;AAC7D,MAAI,CAACG,MAAMC,QAAQJ,KAAK,UAAU,CAAA;AAClC,SAAOA,MACJK,IAAKC,CAAAA,aAAaP,kBAAkBQ,OAAOD,QAAQ,CAAC,CAAC,EACrDE,OAAO,CAACF,aAAiCG,QAAQH,QAAQ,CAAC;AAC/D;AAEA,MAAMI,yBAAyBA,CAACC,QAAgC;AAC9D,QAAMC,WAAWD,IAAIE,QAAQ1B,yBAAyB;AACtD,QAAM2B,gBAAgBX,MAAMC,QAAQQ,QAAQ,IAAIA,SAAS,CAAC,IAAIA;AAC9D,QAAMG,sBAAsBhB,kBAAkBe,aAAa;AAC3D,MAAIC,oBAAqB,QAAOA;AAEhC,SAAOhB,kBAAmBY,IAAIK,SAASC,MAAkCC,eAAe;AAC1F;AAEO,MAAMC,4BAA4BA,CAACR,QAAgC;AACxE,SAAOD,uBAAuBC,GAAG;AACnC;AAWO,MAAMS,yBAAyBA,CAACT,KAAcL,aAA8B;AACjF,QAAMe,cAAcV,IAAIK,SAASC;AACjC,MAAI,CAACI,YAAa,QAAO;AAEzB,QAAMC,kBAAkBpB,yBAAyBmB,YAAYC,eAAe;AAC5E,MAAIA,gBAAgB1C,SAAS,GAAG;AAC9B,WAAO0C,gBAAgBC,SAASjB,QAAQ;AAAA,EAC1C;AAEA,QAAMY,kBAAkBnB,kBAAkBsB,YAAYH,eAAe;AACrE,MAAI,CAACA,gBAAiB,QAAO;AAC7B,SAAOA,oBAAoBZ;AAC7B;AAEO,MAAMkB,6BAA6B,OACxCb,KACAL,aAC4D;AAC5D,QAAMmB,gBAAgB1B,kBAAmBY,IAAIK,SAASC,MAAkCS,EAAE;AAC1F,MAAID,eAAe;AACjB,UAAME,UAAUC,wBAAwB;AAAA,MAAEtB;AAAAA,MAAUU,SAASL,IAAIK;AAAAA,IAAAA,CAAS;AAC1E,WAAO;AAAA,MAAEW;AAAAA,MAASE,QAAQJ;AAAAA,IAAAA;AAAAA,EAC5B;AAEA,QAAMK,cAAcnB,IAAIoB,QAAQ3C,kBAAkB;AAClD,QAAM4C,kBAAkB7B,MAAMC,QAAQ0B,WAAW,IAAIA,YAAY,CAAC,IAAIA;AACtE,QAAMG,eAAelC,kBAAkBiC,eAAe;AACtD,MAAI,CAACC,cAAc;AACjB,UAAMN,UAAUC,wBAAwB;AAAA,MAAEtB;AAAAA,MAAUU,SAASL,IAAIK;AAAAA,IAAAA,CAAS;AAC1E,WAAO;AAAA,MAAEW;AAAAA,MAASE,QAAQ;AAAA,IAAA;AAAA,EAC5B;AAEA,QAAMK,QAAsB;AAAA,IAAEvB,KAAK;AAAA,MAAEK,SAAS;AAAA,IAAA;AAAA,EAAK;AACnD,QAAMmB,OAAO,MAAMC,OAAOC,UAAU,UAAUH,KAAK;AACnD,QAAMjB,OAAO,MAAMkB,KAAKG,SAASL,cAAc;AAAA,IAAEM,SAAS;AAAA,IAAGC,aAAa;AAAA,EAAA,CAAG,EAAEC,KAAAA;AAE/E,QAAMC,aAAazB,MAAMsB;AACzB,QAAMA,UAAUpC,MAAMC,QAAQsC,UAAU,IAAIA,WAAWrC,IAAKsC,CAAAA,WAAWpC,OAAOoC,MAAM,CAAC,IAAI,CAAA;AACzF,MAAI,CAACJ,QAAQhB,SAASjB,QAAQ,GAAG;AAC/B,UAAM,IAAIR,MAAM,wCAAwC;AAAA,EAC1D;AAEA,QAAM8C,QAAQC,8BAA8B5B,MAAMX,QAAQ;AAC1D,SAAO;AAAA,IACLqB,SAASmB,aAAa;AAAA,MAAExC;AAAAA,MAAUuB,QAAQI;AAAAA,MAAcW,OAAOA,MAAMhE,SAASgE,QAAQ,CAAC,OAAO;AAAA,IAAA,CAAG;AAAA,IACjGf,QAAQI;AAAAA,EAAAA;AAEZ;AAEA,MAAMc,iBAAiB,OAAOzC,UAAkB0C,WAAmBrB,YAA6C;AAC9G,QAAMsB,MAAoB;AAAA,IACxBtC,KAAK;AAAA,MACHK,SAAS;AAAA,QACPC,MAAM;AAAA,UACJC,iBAAiBZ;AAAAA,QAAAA;AAAAA,MACnB;AAAA,IACF;AAAA,IAEFqB;AAAAA,EAAAA;AAGF,SAAOS,OAAOc,IAAIF,WAAWC,GAAG;AAClC;AAEA,MAAME,iBAAiBA,CAACC,UAA2B;AACjD,MAAI,OAAOA,UAAU,SAAU,QAAO/D;AACtC,MAAI,CAACgE,OAAOC,SAASF,KAAK,EAAG,QAAO/D;AACpC,SAAOkE,KAAKC,IAAInE,iBAAiBkE,KAAKE,IAAIL,KAAK,CAAC;AAClD;AAEA,MAAMM,kBAAkBA,CAAC1D,UAA2B;AAClD,SAAO,OAAOA,UAAU,WAAWA,MAAMH,SAAS;AACpD;AAEA,MAAM8D,kBAAkBA,CAAC3D,UAA2C;AAClE,MAAI,CAACA,SAAS,OAAOA,UAAU,YAAYG,MAAMC,QAAQJ,KAAK,EAAG,QAAO4D;AACxE,SAAO5D;AACT;AAEA,MAAM6D,sBAAsBA,CAAC7D,UAA+C;AAC1E,MAAI,CAACA,SAAS,OAAOA,UAAU,YAAYG,MAAMC,QAAQJ,KAAK,EAAG,QAAO4D;AACxE,SAAO5D;AACT;AAEA,MAAM8D,0BAA0BA,CAAC9D,UAAoD;AACnF,MAAI,OAAOA,UAAU,UAAU;AAC7B,UAAMC,aAAaD,MAAMH,KAAAA;AACzB,WAAOI,cAAc2D;AAAAA,EACvB;AACA,SAAOD,gBAAgB3D,KAAK;AAC9B;AAEA,MAAM+D,2BAA2BA,CAAC/D,UAA6D;AAC7F,MAAI,CAACA,SAAS,OAAOA,UAAU,YAAYG,MAAMC,QAAQJ,KAAK,EAAG,QAAO4D;AACxE,QAAMI,MAAMhE;AACZ,QAAMC,aAA2C,CAAA;AAEjD,MAAI+D,IAAIC,QAAQ,OAAOD,IAAIC,SAAS,YAAY,CAAC9D,MAAMC,QAAQ4D,IAAIC,IAAI,GAAG;AACxEhE,eAAWgE,OAAOD,IAAIC;AAAAA,EACxB;AAEA,MAAI,OAAOD,IAAIZ,UAAU,YAAYC,OAAOC,SAASU,IAAIZ,KAAK,GAAG;AAC/DnD,eAAWmD,QAAQG,KAAKW,IAAI,GAAGX,KAAKY,MAAMZ,KAAKE,IAAIO,IAAIZ,KAAK,CAAC,CAAC;AAAA,EAChE;AAEA,MAAI,CAACnD,WAAWgE,QAAQhE,WAAWmD,UAAUQ,OAAW,QAAOA;AAC/D,SAAO3D;AACT;AAEA,MAAMmE,0BAA0BA,CAACpE,UAAkD;AACjF,MAAI,CAACA,SAAS,OAAOA,UAAU,YAAYG,MAAMC,QAAQJ,KAAK,EAAG,QAAO4D;AACxE,QAAMI,MAAMhE;AACZ,QAAMqE,OAAOX,gBAAgBM,IAAIK,IAAI;AACrC,MAAI,CAACA,KAAM,QAAOT;AAElB,QAAM3D,aAAgC;AAAA,IAAEoE;AAAAA,EAAAA;AAExC,QAAMC,QAAQZ,gBAAgBM,IAAIM,KAAK;AACvC,MAAIA,kBAAkBA,QAAQA;AAE9B,QAAMC,SAAST,wBAAwBE,IAAIO,MAAM;AACjD,MAAIA,WAAWX,OAAW3D,YAAWsE,SAASA;AAE9C,QAAMC,QAAQb,gBAAgBK,IAAIQ,KAAK;AACvC,MAAIA,kBAAkBA,QAAQA;AAE9B,QAAMC,iBAAiBC,2BAA2BV,IAAIW,QAAQ;AAC9D,MAAIF,mBAAmBb,OAAW3D,YAAW0E,WAAWF;AAExD,QAAMG,UAAUb,yBAAyBC,IAAIY,OAAO;AACpD,MAAIA,oBAAoBA,UAAUA;AAElC,SAAO3E;AACT;AAEA,MAAMyE,6BAA6BA,CAAC1E,UAAkD;AACpF,MAAI,OAAOA,UAAU,UAAU;AAC7B,UAAMC,aAAaD,MAAMH,KAAAA;AACzB,WAAOI,cAAc2D;AAAAA,EACvB;AAEA,MAAIzD,MAAMC,QAAQJ,KAAK,GAAG;AACxB,UAAMC,aAAaD,MAChBK,IAAKwE,CAAAA,UAAU;AACd,UAAI,OAAOA,UAAU,UAAU;AAC7B,cAAMR,OAAOQ,MAAMhF,KAAAA;AACnB,eAAOwE,QAAQ;AAAA,MACjB;AACA,aAAOD,wBAAwBS,KAAK,KAAK;AAAA,IAC3C,CAAC,EACArE,OAAO,CAACqE,UAA+CA,UAAU,IAAI;AAExE,WAAO5E,WAAWrB,SAAS,IAAIqB,aAAa2D;AAAAA,EAC9C;AAEA,SAAOQ,wBAAwBpE,KAAK;AACtC;AAEA,MAAM8E,qBAAqBA,CAAC9E,UAAkC;AAC5D,MAAI,OAAOA,UAAU,SAAU,QAAO;AACtC,QAAMC,aAAaD,MAAMH,KAAAA;AACzB,SAAOI,cAAc;AACvB;AAEA,MAAM8E,8BAA8BA,CAClCT,OACAD,MACAW,sBACkB;AAClB,MAAIA,kBAAmB,QAAOA;AAE9B,QAAMC,SAASX,MAAMW;AACrB,QAAMC,aAAa,OAAOD,OAAOZ,SAAS,aAAaY,OAAOZ,KAAKA,IAAI,IAAI;AAC3E,QAAMc,YAAYL,mBAAmBI,YAAYN,SAASQ,GAAG;AAC7D,MAAID,UAAW,QAAOA;AAEtB,QAAME,WAAWP,mBAAmBI,YAAYI,QAAQV,SAASQ,GAAG;AACpE,MAAIC,SAAU,QAAOA;AAErB,QAAME,cAAc,OAAON,OAAOO,gBAAgB,aAAaP,OAAOO,YAAYnB,IAAI,IAAI;AAC1F,QAAMoB,aAAaX,mBAAmBS,aAAaX,SAASQ,GAAG;AAC/D,MAAIK,WAAY,QAAOA;AAEvB,SAAO;AACT;AAEA,MAAMC,4BAA4BA,CAChCC,eACAC,aACe;AACf,MAAI,CAACD,iBAAiBE,OAAOC,KAAKH,aAAa,EAAE/G,WAAW,EAAG,QAAOgH;AACtE,SAAO;AAAA,IAAEG,MAAM,CAACJ,eAAeC,QAAQ;AAAA,EAAA;AACzC;AAmBA,MAAMI,8BAA8B,OAAO;AAAA,EACzC1F;AAAAA,EACAgE;AAAAA,EACA3C;AAAAA,EACAgD;AAAAA,EACAsB;AAAAA,EACAC;AAAAA,EACAC;AASF,MAAmD;AACjD,MAAI,CAACxB,SAAU,QAAOf;AAEtB,QAAMwC,iBAAiB,OAAOC,oBAAiD;AAC7E,UAAMC,SAASJ,WAAWhD,IAAImD,eAAe;AAC7C,QAAIC,OAAQ,QAAOA;AACnB,UAAMC,SAAS,MAAMxD,eAAezC,UAAU+F,iBAAiB1E,OAAO;AACtEuE,eAAWM,IAAIH,iBAAiBE,MAAM;AACtC,WAAOA;AAAAA,EACT;AAEA,QAAME,aAAa,OACjB5B,OACA6B,gBACoD;AACpD,QAAI,OAAO7B,UAAU,UAAU;AAC7B,YAAMR,QAAOQ,MAAMhF,KAAAA;AACnB,UAAI,CAACwE,MAAM,QAAO;AAElB,YAAMsC,gBAAe5B,4BAA4B2B,aAAarC,OAAM,IAAI;AACxE,UAAI,CAACsC,cAAc,QAAOtC;AAC1B,UAAI,CAAC4B,uBAAuB3G,qBAAqBsH,IAAID,aAAY,GAAG;AAClE,cAAM,IAAI7G,MAAM,mBAAmB;AAAA,MACrC;AACA,UAAI,CAAC6B,QAAQkF,IAAI,QAAQF,aAA8B,GAAG;AACxD,cAAM,IAAI7G,MAAM,WAAW;AAAA,MAC7B;AAEAqG,2BAAqBW,IAAIH,aAAY;AAErC,YAAMf,WAAWmB,qBACfpF,SACA,QACAgF,aACF;AACA,aAAO;AAAA,QACLtC,MAAAA;AAAAA,QACAG,OAAOoB;AAAAA,MAAAA;AAAAA,IAEX;AAEA,UAAMvB,OAAOQ,MAAMR,KAAKxE,KAAAA;AACxB,QAAI,CAACwE,KAAM,QAAO;AAElB,UAAMW,oBAAoBF,mBAAmBD,MAAMP,KAAK;AACxD,UAAMqC,eAAe5B,4BAA4B2B,aAAarC,MAAMW,iBAAiB;AACrF,QAAIgC,cAAcN;AAElB,UAAMO,kBAA0C;AAAA,MAC9C5C;AAAAA,IAAAA;AAGF,QAAIQ,MAAMN,WAAWX,OAAWqD,iBAAgB1C,SAASM,MAAMN;AAC/D,QAAIM,MAAMD,YAAYhB,OAAWqD,iBAAgBrC,UAAUC,MAAMD;AACjE,QAAII,mCAAmCV,QAAQU;AAC/C,QAAIH,MAAML,UAAUZ,OAAWqD,iBAAgBzC,QAAQK,MAAML;AAE7D,QAAImC,cAAc;AAChB,UAAI,CAACV,uBAAuB3G,qBAAqBsH,IAAID,YAAY,GAAG;AAClE,cAAM,IAAI7G,MAAM,mBAAmB;AAAA,MACrC;AACA,UAAI,CAAC6B,QAAQkF,IAAI,QAAQF,YAA8B,GAAG;AACxD,cAAM,IAAI7G,MAAM,WAAW;AAAA,MAC7B;AAEAqG,2BAAqBW,IAAIH,YAAY;AACrCK,oBAAc,MAAMZ,eAAeO,YAAY;AAE/C,YAAMf,WAAWmB,qBACfpF,SACA,QACAgF,YACF;AACAM,sBAAgBzC,QAAQkB,0BACtBuB,gBAAgBzC,OAChBoB,QACF;AAAA,IACF,WAAWf,MAAMF,aAAaf,QAAW;AACvC,YAAM,IAAI9D,MAAM,mEAAmE;AAAA,IACrF;AAEA,UAAM2E,iBAAiB,MAAMuB,4BAA4B;AAAA,MACvD1F;AAAAA,MACAgE,OAAO0C;AAAAA,MACPrF;AAAAA,MACAgD,UAAUE,MAAMF;AAAAA,MAChBsB;AAAAA,MACAC;AAAAA,MACAC;AAAAA,IAAAA,CACD;AACD,QAAI1B,mBAAmBb,OAAWqD,iBAAgBtC,WAAWF;AAE7D,WAAOwC;AAAAA,EACT;AAEA,MAAI9G,MAAMC,QAAQuE,QAAQ,GAAG;AAC3B,UAAMuC,YAAW,MAAMC,QAAQC,IAAIzC,SAAStE,IAAKwE,CAAAA,UAAU4B,WAAW5B,OAAOP,KAAK,CAAC,CAAC;AACpF,UAAM+C,WAAWH,UAAS1G,OAAO,CAACqE,UAAoDA,UAAU,IAAI;AACpG,WAAOwC,SAASzI,SAAS,IAAIyI,WAAWzD;AAAAA,EAC1C;AAEA,QAAMsD,WAAW,MAAMT,WAAW9B,UAAUL,KAAK;AACjD,SAAO4C,YAAYtD;AACrB;AAEO,MAAM0D,2BAA2BA,CAAC1C,YAA0D;AACjG,MAAI,CAACA,WAAW,OAAOA,YAAY,iBAAiB,CAAA;AACpD,QAAM3E,aAA8B,CAAA;AAEpC,MAAI2E,QAAQ2C,cAAc,OAAO3C,QAAQ2C,eAAe,YAAY,CAACpH,MAAMC,QAAQwE,QAAQ2C,UAAU,GAAG;AACtGtH,eAAWsH,aAAa3C,QAAQ2C;AAAAA,EAClC;AAEA,MAAI3C,QAAQX,QAAQ,OAAOW,QAAQX,SAAS,YAAY,CAAC9D,MAAMC,QAAQwE,QAAQX,IAAI,GAAG;AACpFhE,eAAWgE,OAAOW,QAAQX;AAAAA,EAC5B;AAEAhE,aAAWmD,QAAQD,eAAeyB,QAAQxB,KAAK;AAC/CnD,aAAW0E,WAAWD,2BAA2BE,QAAQD,QAAQ;AACjE1E,aAAWuH,aAAa3D,oBAAoBe,QAAQ4C,UAAU;AAE9D,SAAOvH;AACT;AAEO,MAAMwH,sCAAsC,OAAO;AAAA,EACxDnH;AAAAA,EACAqB;AAAAA,EACAqB;AAAAA,EACA4B;AAAAA,EACAqB,sBAAsB;AAOxB,MAAyB;AACvB,QAAM3B,QAAQ,MAAMvB,eAAezC,UAAU0C,WAAWrB,OAAO;AAC/D,QAAMuE,iCAAiBwB,IAAAA;AACvBxB,aAAWM,IAAIxD,WAAWsB,KAAK;AAE/B,QAAM6B,2CAA2B5G,IAAAA;AACjC,QAAMyG,4BAA4B;AAAA,IAChC1F;AAAAA,IACAgE;AAAAA,IACA3C;AAAAA,IACAgD,UAAUC,QAAQD;AAAAA,IAClBsB;AAAAA,IACAC;AAAAA,IACAC;AAAAA,EAAAA,CACD;AAED,SAAOhG,MAAMnB,KAAKmH,oBAAoB;AACxC;AAEO,MAAMwB,cAAc,OAAO;AAAA,EAChCrH;AAAAA,EACAqB;AAAAA,EACAqB;AAAAA,EACAnC;AAAAA,EACA+D;AAAAA,EACAqB,sBAAsB;AAQxB,MAA+B;AAC7B,MAAI,CAACA,uBAAuB3G,qBAAqBsH,IAAI5D,SAAS,GAAG;AAC/D,UAAM,IAAIlD,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI,CAAC6B,QAAQkF,IAAI,QAAQ7D,SAA2B,GAAG;AACrD,UAAM,IAAIlD,MAAM,WAAW;AAAA,EAC7B;AAEA,QAAMwE,QAAQ,MAAMvB,eAAezC,UAAU0C,WAAWrB,OAAO;AAC/D,QAAM4F,aAAa3C,QAAQ2C,cAAc3D;AACzC,QAAMK,OAAOW,QAAQX;AACrB,QAAMb,QAAQD,eAAeyB,QAAQxB,KAAK;AAC1C,QAAM8C,iCAAiBwB,IAAAA;AACvBxB,aAAWM,IAAIxD,WAAWsB,KAAK;AAE/B,QAAMK,WAAW,MAAMqB,4BAA4B;AAAA,IACjD1F;AAAAA,IACAgE;AAAAA,IACA3C;AAAAA,IACAgD,UAAUC,QAAQD;AAAAA,IAClBsB;AAAAA,IACAC;AAAAA,IACAC,0CAA0B5G,IAAAA;AAAAA,EAAY,CACvC;AAED,QAAMqI,cAAcb,qBAAqBpF,SAAS,QAAQqB,SAA2C;AACrG,QAAM6E,aAAyB;AAAA,IAAE9B,MAAM,CAAClF,OAAO+G,WAAW;AAAA,EAAA;AAE1D,MAAIhD,QAAQ4C,YAAY;AACtB,UAAMM,iBAAiBxD,MAAMyD,KAAKF,YAAYN,UAAU;AACxD,QAAI5C,aAAaf,QAAW;AAC1BkE,qBAAenD,SAASA,QAAe;AAAA,IACzC;AAEA,UAAMqD,kBAAkB,MAAMF,eAAeG,SAASrD,QAAQ4C,YAAY;AAAA,MACxEU,QAAQ;AAAA,QACNC,eAAe1I,iCAAAA;AAAAA,MAAiC;AAAA,IAClD,CACD;AAED,WAAO;AAAA,MACL2I,MAAMjI,MAAMC,QAAQ4H,gBAAgBK,KAAK,IAAIL,gBAAgBK,QAAQ,CAAA;AAAA,MACrEC,UAAUN,gBAAgBM;AAAAA,IAAAA;AAAAA,EAE9B;AAEA,QAAMC,eAAejE,MAAMyD,KAAKF,YAAYN,UAAU;AACtD,MAAI5C,aAAaf,QAAW;AAC1B2E,iBAAa5D,SAASA,QAAe;AAAA,EACvC;AACA,MAAIV,QAAQ4B,OAAOC,KAAK7B,IAAI,EAAErF,QAAQ;AACpC2J,iBAAatE,KAAKA,IAAI;AAAA,EACxB;AACAsE,eAAanF,MAAMA,KAAK;AAExB,QAAMgF,OAAO,MAAMG;AACnB,SAAO;AAAA,IAAEH,MAAMjI,MAAMC,QAAQgI,IAAI,IAAIA,OAAO,CAAA;AAAA,EAAA;AAC9C;"}