@schlessera/brain-ui-server 0.4.0

package/dist/middleware/passkeys.js

@@ -0,0 +1,427 @@
+import { Hono } from "hono";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse as realVerifyAuthentication, verifyRegistrationResponse as realVerifyRegistration, } from "@simplewebauthn/server";
+import { issueSessionCookie, consumeLoginToken, LOGIN_RATE_LIMIT, GLOBAL_LOGIN_RATE_LIMIT, } from "./auth.js";
+import { clientIp } from "./tailscale.js";
+import { getDb } from "../db/client.js";
+/**
+ * WebAuthn passkeys as an extension of `password` mode: the password bootstraps
+ * the first registration (and stays as recovery), passkeys are the day-to-day
+ * login. A successful assertion mints the same session cookie as password login
+ * (issueSessionCookie), so authGuard / isWsAuthorized / TTL are untouched.
+ *
+ * Self-contained on purpose — this module (plus its auth.ts imports) is slated
+ * to move wholesale into @schlessera/ui-server.
+ *
+ * Credentials are RP-scoped: a credential registered on localhost does not
+ * exist for the production domain and vice versa. Rows carry rp_id so all
+ * environments share the table.
+ */
+const CHALLENGE_TTL_MS = 120_000; // > the 60s ceremony timeout
+// Pending challenges are unauthenticated state; cap and evict oldest-first so
+// login-options spam can't grow memory. Losing one costs a retried ceremony.
+const MAX_PENDING_CHALLENGES = 100;
+const OPTIONS_RATE_LIMIT = 10; // login-options per IP per minute (own bucket)
+// Branding/identity are config-injected with the historical values as
+// defaults, so existing deployments keep their credentials.
+function rpName() {
+    return process.env.WEBAUTHN_RP_NAME || "Brain UI";
+}
+// The single "user" every passkey belongs to. Stable across registrations so
+// an authenticator overwrites its existing entry instead of stacking
+// duplicates for the same site.
+//
+// WARNING: the user handle is part of the WebAuthn wire contract — it is
+// burned into every resident credential at registration. Changing
+// WEBAUTHN_USER_ID on a deployment that already has passkeys orphans them
+// (authenticators will present a handle the server no longer recognizes as
+// the same user and re-registration stacks a second entry). Set it before the
+// first passkey is registered and never change it.
+function userName() {
+    return process.env.WEBAUTHN_USER_NAME || "owner";
+}
+/** WebAuthn caps `user.id` at 64 bytes; browsers reject anything longer. */
+const MAX_USER_ID_BYTES = 64;
+function userId() {
+    return new TextEncoder().encode(process.env.WEBAUTHN_USER_ID || "brain-ui-owner");
+}
+/**
+ * Refuse to boot on a WebAuthn user handle the browser would reject. Called
+ * from createApp(): an oversized handle otherwise produces registration
+ * options that look fine server-side and fail silently in every browser.
+ */
+export function assertPasskeyConfig() {
+    const bytes = userId().byteLength;
+    if (bytes > MAX_USER_ID_BYTES) {
+        throw new Error(`WEBAUTHN_USER_ID is ${bytes} bytes; WebAuthn allows at most ${MAX_USER_ID_BYTES}. ` +
+            "Pick a shorter stable identifier (it is burned into every credential).");
+    }
+}
+// ES256 + RS256 only: every mainstream authenticator supports ES256, and it
+// keeps Ed25519 (whose WebCrypto verify path on Bun is unproven) out of the
+// database. Widen once Bun's Ed25519 verify is validated.
+const SUPPORTED_ALGORITHM_IDS = [-7, -257];
+// --- challenge store (in-memory: single-process server; move to a shared
+// store if this ever runs multi-process) ---
+const pendingChallenges = new Map();
+function putChallenge(challenge, type, now) {
+    for (const [key, entry] of pendingChallenges) {
+        if (entry.expiresAt <= now)
+            pendingChallenges.delete(key);
+    }
+    while (pendingChallenges.size >= MAX_PENDING_CHALLENGES) {
+        const oldest = pendingChallenges.keys().next().value;
+        if (oldest === undefined)
+            break;
+        pendingChallenges.delete(oldest);
+    }
+    pendingChallenges.set(challenge, { type, expiresAt: now + CHALLENGE_TTL_MS });
+}
+/** Single-use: deleted before verification, so a failed verify still burns it. */
+function consumeChallenge(challenge, type, now) {
+    const entry = pendingChallenges.get(challenge);
+    if (!entry)
+        return false;
+    pendingChallenges.delete(challenge);
+    return entry.type === type && entry.expiresAt > now;
+}
+/** The challenge the browser actually signed, from clientDataJSON. */
+function challengeFromResponse(response) {
+    try {
+        const json = JSON.parse(Buffer.from(response.response.clientDataJSON, "base64url").toString("utf8"));
+        return typeof json.challenge === "string" ? json.challenge : null;
+    }
+    catch {
+        return null;
+    }
+}
+// --- RP / origin resolution ---
+function envList(name) {
+    return (process.env[name] ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function isLoopbackHostname(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+/**
+ * Derive the relying party from the request instead of demanding new env:
+ * same-origin deployments, split topology (ALLOWED_ORIGINS), and dev all work
+ * unconfigured. WEBAUTHN_ORIGINS / WEBAUTHN_RP_ID remain as overrides for
+ * proxies that rewrite Host.
+ */
+function resolveRp(c) {
+    const origin = c.req.header("origin");
+    if (!origin)
+        return null;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return null;
+    }
+    const allowed = envList("WEBAUTHN_ORIGINS").includes(origin) ||
+        envList("ALLOWED_ORIGINS").includes(origin) ||
+        url.host === c.req.header("host") ||
+        // Dev escape hatch: the vite proxy sets changeOrigin, so the server sees
+        // Host localhost:3000 but Origin http://localhost:5173. Opt-in via an
+        // explicit flag — NOT NODE_ENV, whose absence must never widen the RP.
+        (process.env.BRAIN_UI_ALLOW_LOOPBACK_ORIGIN === "1" &&
+            isLoopbackHostname(url.hostname));
+    if (!allowed)
+        return null;
+    return { rpID: process.env.WEBAUTHN_RP_ID ?? url.hostname, origin };
+}
+/** rpID for endpoints where same-origin GETs legitimately omit Origin. */
+function rpIdForRead(c) {
+    if (process.env.WEBAUTHN_RP_ID)
+        return process.env.WEBAUTHN_RP_ID;
+    const origin = c.req.header("origin");
+    if (origin) {
+        try {
+            return new URL(origin).hostname;
+        }
+        catch {
+            // fall through to Host
+        }
+    }
+    const host = c.req.header("host") ?? "localhost";
+    return host.replace(/:\d+$/, "");
+}
+/** Wire shape shared with the client (shared/protocol.ts PasskeySummary). */
+function toSummary(row) {
+    return {
+        id: row.id,
+        label: row.label,
+        rpId: row.rp_id,
+        createdAt: row.created_at,
+        lastUsedAt: row.last_used_at,
+        backedUp: row.backed_up === 1,
+        deviceType: row.device_type,
+        transports: row.transports ? JSON.parse(row.transports) : null,
+        aaguid: row.aaguid,
+    };
+}
+function credentialsForRp(rpID) {
+    return getDb()
+        .query("SELECT * FROM passkey_credentials WHERE rp_id = ?")
+        .all(rpID);
+}
+function credentialById(id) {
+    return getDb()
+        .query("SELECT * FROM passkey_credentials WHERE id = ?")
+        .get(id);
+}
+function toWebAuthnCredential(row) {
+    return {
+        id: row.id,
+        publicKey: new Uint8Array(row.public_key),
+        counter: row.counter,
+        transports: row.transports
+            ? JSON.parse(row.transports)
+            : undefined,
+    };
+}
+function sanitizeLabel(label) {
+    return typeof label === "string" ? label.trim().slice(0, 64) : "";
+}
+function notEnabled(c) {
+    return c.json({ error: "Passkey login is not enabled" }, 400);
+}
+/**
+ * Once a passkey exists for the request's RP, password login is disabled —
+ * the password becomes registration-bootstrap and break-glass recovery only
+ * (set BRAIN_UI_ALLOW_PASSWORD=1 to re-enable it, e.g. after losing every
+ * authenticator). Scoped per RP so e.g. localhost dev keeps password login
+ * until it has its own credential. Host-derived rpID is fine here: a forged
+ * Host can at most re-enable password auth, which still requires the password.
+ */
+export function passwordLoginDisabled(c) {
+    if (process.env.BRAIN_UI_ALLOW_PASSWORD === "1")
+        return false;
+    const row = getDb()
+        .query("SELECT COUNT(*) AS n FROM passkey_credentials WHERE rp_id = ?")
+        .get(rpIdForRead(c));
+    return row.n > 0;
+}
+/**
+ * Unauthenticated passkey routes. Mount BEFORE the auth guard, next to
+ * authRoutes.
+ */
+export function passkeyPublicRoutes(mode, deps = {}) {
+    const verifyAuthentication = deps.verifyAuthenticationResponse ?? realVerifyAuthentication;
+    const now = deps.now ?? Date.now;
+    const app = new Hono();
+    // Capability hint for the login screen: which methods can it offer?
+    app.get("/auth/methods", (c) => {
+        c.header("Cache-Control", "no-store");
+        if (mode !== "password") {
+            return c.json({ password: false, passkey: false });
+        }
+        const row = getDb()
+            .query("SELECT COUNT(*) AS n FROM passkey_credentials WHERE rp_id = ?")
+            .get(rpIdForRead(c));
+        return c.json({ password: !passwordLoginDisabled(c), passkey: row.n > 0 });
+    });
+    app.post("/auth/passkey/login-options", async (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        const ip = clientIp(c, process.env.TRUST_PROXY === "1") || "unknown";
+        // Own bucket: conditional-UI mounts fire this on every login-screen load
+        // and must not starve real verify attempts of their shared budget.
+        if (!consumeLoginToken(`pk-opt:${ip}`, OPTIONS_RATE_LIMIT)) {
+            return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
+        }
+        const rp = resolveRp(c);
+        if (!rp)
+            return c.json({ error: "Origin not allowed" }, 400);
+        // Empty allowCredentials + discoverable credentials = usernameless login.
+        const options = await generateAuthenticationOptions({
+            rpID: rp.rpID,
+            allowCredentials: [],
+            userVerification: "required",
+        });
+        putChallenge(options.challenge, "authentication", now());
+        return c.json(options);
+    });
+    app.post("/auth/passkey/login-verify", async (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        const ip = clientIp(c, process.env.TRUST_PROXY === "1") || "unknown";
+        // Same buckets as password login: one combined online-guess budget.
+        const perIpOk = consumeLoginToken(`ip:${ip}`, LOGIN_RATE_LIMIT);
+        const globalOk = consumeLoginToken("global", GLOBAL_LOGIN_RATE_LIMIT);
+        if (!perIpOk || !globalOk) {
+            return c.json({ error: "Too many attempts. Try again in a minute." }, 429);
+        }
+        const rp = resolveRp(c);
+        if (!rp)
+            return c.json({ error: "Origin not allowed" }, 400);
+        let response;
+        try {
+            response = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid request body" }, 400);
+        }
+        const fail = () => c.json({ error: "Passkey verification failed" }, 401);
+        const row = typeof response?.id === "string" ? credentialById(response.id) : null;
+        if (!row || row.rp_id !== rp.rpID)
+            return fail();
+        const challenge = challengeFromResponse(response);
+        if (!challenge || !consumeChallenge(challenge, "authentication", now())) {
+            return fail();
+        }
+        try {
+            const result = await verifyAuthentication({
+                response,
+                expectedChallenge: challenge,
+                expectedOrigin: rp.origin,
+                expectedRPID: rp.rpID,
+                credential: toWebAuthnCredential(row),
+            });
+            if (!result.verified)
+                return fail();
+            getDb()
+                .prepare("UPDATE passkey_credentials SET counter = ?, last_used_at = ? WHERE id = ?")
+                .run(result.authenticationInfo.newCounter, now(), row.id);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // The library throws on a counter regression — possible cloned
+            // credential. Cloud passkeys legitimately sit at 0, so warn, don't
+            // revoke.
+            if (/counter/i.test(message)) {
+                console.warn(`[passkeys] counter regression for credential ${row.id} — possible cloned credential`);
+            }
+            else {
+                console.warn(`[passkeys] authentication failed: ${message}`);
+            }
+            return fail();
+        }
+        await issueSessionCookie(c);
+        return c.json({ ok: true });
+    });
+    return app;
+}
+/**
+ * Session-gated passkey routes. Mount AFTER the auth guard — gating comes from
+ * mount position, not per-route checks.
+ */
+export function passkeyManagementRoutes(mode, deps = {}) {
+    const verifyRegistration = deps.verifyRegistrationResponse ?? realVerifyRegistration;
+    const now = deps.now ?? Date.now;
+    const app = new Hono();
+    app.post("/auth/passkey/register-options", async (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        const rp = resolveRp(c);
+        if (!rp)
+            return c.json({ error: "Origin not allowed" }, 400);
+        const options = await generateRegistrationOptions({
+            rpName: rpName(),
+            rpID: rp.rpID,
+            userName: userName(),
+            userID: userId(),
+            userDisplayName: rpName(),
+            attestationType: "none",
+            excludeCredentials: credentialsForRp(rp.rpID).map((row) => ({
+                id: row.id,
+                transports: toWebAuthnCredential(row).transports,
+            })),
+            authenticatorSelection: {
+                residentKey: "required",
+                userVerification: "required",
+            },
+            supportedAlgorithmIDs: SUPPORTED_ALGORITHM_IDS,
+        });
+        putChallenge(options.challenge, "registration", now());
+        return c.json(options);
+    });
+    app.post("/auth/passkey/register-verify", async (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        const rp = resolveRp(c);
+        if (!rp)
+            return c.json({ error: "Origin not allowed" }, 400);
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid request body" }, 400);
+        }
+        if (!body.response)
+            return c.json({ error: "Invalid request body" }, 400);
+        const challenge = challengeFromResponse(body.response);
+        if (!challenge || !consumeChallenge(challenge, "registration", now())) {
+            return c.json({ error: "Passkey registration failed" }, 400);
+        }
+        try {
+            const result = await verifyRegistration({
+                response: body.response,
+                expectedChallenge: challenge,
+                expectedOrigin: rp.origin,
+                expectedRPID: rp.rpID,
+            });
+            if (!result.verified || !result.registrationInfo) {
+                return c.json({ error: "Passkey registration failed" }, 400);
+            }
+            const { credential, aaguid, credentialDeviceType, credentialBackedUp } = result.registrationInfo;
+            const createdAt = now();
+            getDb()
+                .prepare(`INSERT INTO passkey_credentials
+             (id, public_key, counter, transports, rp_id, aaguid, device_type,
+              backed_up, label, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(credential.id, credential.publicKey, credential.counter, credential.transports ? JSON.stringify(credential.transports) : null, rp.rpID, aaguid || null, credentialDeviceType, credentialBackedUp ? 1 : 0, sanitizeLabel(body.label), createdAt);
+            const row = credentialById(credential.id);
+            return c.json({ ok: true, credential: row ? toSummary(row) : null });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.warn(`[passkeys] registration failed: ${message}`);
+            return c.json({ error: "Passkey registration failed" }, 400);
+        }
+    });
+    // All rows, not rpID-filtered: the prod panel must be able to show and
+    // delete stale localhost/dev credentials. The client badges foreign RPs.
+    app.get("/auth/passkey/list", (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        const rows = getDb()
+            .query("SELECT * FROM passkey_credentials ORDER BY created_at DESC")
+            .all();
+        return c.json({ credentials: rows.map(toSummary) });
+    });
+    app.put("/auth/passkey/:id", async (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid request body" }, 400);
+        }
+        const result = getDb()
+            .prepare("UPDATE passkey_credentials SET label = ? WHERE id = ?")
+            .run(sanitizeLabel(body.label), c.req.param("id"));
+        if (result.changes === 0)
+            return c.json({ error: "Unknown passkey" }, 404);
+        return c.json({ ok: true });
+    });
+    app.delete("/auth/passkey/:id", (c) => {
+        if (mode !== "password")
+            return notEnabled(c);
+        const result = getDb()
+            .prepare("DELETE FROM passkey_credentials WHERE id = ?")
+            .run(c.req.param("id"));
+        if (result.changes === 0)
+            return c.json({ error: "Unknown passkey" }, 404);
+        return c.json({ ok: true });
+    });
+    return app;
+}
+//# sourceMappingURL=passkeys.js.map

package/dist/middleware/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","sourceRoot":"","sources":["../../src/middleware/passkeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,IAAI,wBAAwB,EACxD,0BAA0B,IAAI,sBAAsB,GACrD,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC;;;;;;;;;;;;GAYG;AAEH,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,6BAA6B;AAC/D,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,CAAC,CAAC,+CAA+C;AAC9E,sEAAsE;AACtE,4DAA4D;AAC5D,SAAS,MAAM;IACb,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU,CAAC;AACpD,CAAC;AACD,6EAA6E;AAC7E,qEAAqE;AACrE,gCAAgC;AAChC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,mDAAmD;AACnD,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC;AACnD,CAAC;AACD,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,SAAS,MAAM;IACb,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,gBAAgB,CACtB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;IAClC,IAAI,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,mCAAmC,iBAAiB,IAAI;YAClF,wEAAwE,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AACD,4EAA4E;AAC5E,4EAA4E;AAC5E,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;AAW3C,0EAA0E;AAC1E,6CAA6C;AAE7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsD,CAAC;AAExF,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAmB,EAAE,GAAW;IACvE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,SAAiB,EAAE,IAAmB,EAAE,GAAW;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;AACtD,CAAC;AAED,sEAAsE;AACtE,SAAS,qBAAqB,CAAC,QAE9B;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjD,CAAC;QAC7B,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iCAAiC;AAEjC,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,GAAG;YACjD,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtE,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAkBD,6EAA6E;AAC7E,SAAS,SAAS,CAAC,GAAkB;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,KAAK;QACf,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,QAAQ,EAAE,GAAG,CAAC,SAAS,KAAK,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAc,CAAC,CAAC,CAAC,IAAI;QAC5E,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,KAAK,EAAE;SACX,KAAK,CAAC,mDAAmD,CAAC;SAC1D,GAAG,CAAC,IAAI,CAAoB,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,OAAO,KAAK,EAAE;SACX,KAAK,CAAC,gDAAgD,CAAC;SACvD,GAAG,CAAC,EAAE,CAAyB,CAAC;AACrC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAkB;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;YACxB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAsC;YAClE,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAK,EAAE;SAChB,KAAK,CAAC,+DAA+D,CAAC;SACtE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAkB,CAAC;IACxC,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,OAAoB,EAAE;IACxE,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,IAAI,wBAAwB,CAAC;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,EAAE;aAChB,KAAK,CAAC,+DAA+D,CAAC;aACtE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAkB,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC;QACrE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,UAAU;SAC7B,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC;QACrE,oEAAoE;QACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,GAAG,GAAG,OAAO,QAAQ,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAEjD,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,QAAQ;gBACR,iBAAiB,EAAE,SAAS;gBAC5B,cAAc,EAAE,EAAE,CAAC,MAAM;gBACzB,YAAY,EAAE,EAAE,CAAC,IAAI;gBACrB,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,OAAO,IAAI,EAAE,CAAC;YACpC,KAAK,EAAE;iBACJ,OAAO,CACN,2EAA2E,CAC5E;iBACA,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,+DAA+D;YAC/D,mEAAmE;YACnE,UAAU;YACV,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CACV,gDAAgD,GAAG,CAAC,EAAE,+BAA+B,CACtF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAc,EAAE,OAAoB,EAAE;IAC5E,MAAM,kBAAkB,GAAG,IAAI,CAAC,0BAA0B,IAAI,sBAAsB,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,MAAM,EAAE;YAChB,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,QAAQ,EAAE,QAAQ,EAAE;YACpB,MAAM,EAAE,MAAM,EAAE;YAChB,eAAe,EAAE,MAAM,EAAE;YACzB,eAAe,EAAE,MAAM;YACvB,kBAAkB,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1D,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,UAAU;aACjD,CAAC,CAAC;YACH,sBAAsB,EAAE;gBACtB,WAAW,EAAE,UAAU;gBACvB,gBAAgB,EAAE,UAAU;aAC7B;YACD,qBAAqB,EAAE,uBAAuB;SAC/C,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE7D,IAAI,IAA8D,CAAC;QACnE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE1E,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,iBAAiB,EAAE,SAAS;gBAC5B,cAAc,EAAE,EAAE,CAAC,MAAM;gBACzB,YAAY,EAAE,EAAE,CAAC,IAAI;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC,gBAAgB,CAAC;YAC1B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YACxB,KAAK,EAAE;iBACJ,OAAO,CACN;;;iDAGuC,CACxC;iBACA,GAAG,CACF,UAAU,CAAC,EAAE,EACb,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EACpE,EAAE,CAAC,IAAI,EACP,MAAM,IAAI,IAAI,EACd,oBAAoB,EACpB,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,SAAS,CACV,CAAC;YACJ,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,yEAAyE;IACzE,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,EAAE;aACjB,KAAK,CAAC,4DAA4D,CAAC;aACnE,GAAG,EAAqB,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE;aACnB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QACpC,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,EAAE;aACnB,OAAO,CAAC,8CAA8C,CAAC;aACvD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/middleware/tailscale.d.ts

@@ -0,0 +1,31 @@
+import type { Context, MiddlewareHandler } from "hono";
+/**
+ * Restrict access to Tailscale VPN clients (CGNAT range 100.64.0.0/10) or
+ * localhost.
+ *
+ * SECURITY: header trust is OFF by default. An exposed port lets anyone spoof
+ * `x-forwarded-for`, so the real socket address is used unless `TRUST_PROXY=1`
+ * — set that ONLY when a trusted reverse proxy in front of brain-ui sets the
+ * forwarding header.
+ */
+export interface TailscaleGuardOptions {
+    /** Trust x-forwarded-for / x-real-ip. Defaults to `TRUST_PROXY === "1"`. */
+    trustProxy?: boolean;
+}
+export declare function tailscaleGuard(options?: TailscaleGuardOptions): MiddlewareHandler;
+/** True when the request's client IP is a Tailscale or loopback address. */
+export declare function isTailscaleAllowed(c: Context, trustProxy: boolean): boolean;
+/**
+ * The client IP. With `trustProxy`, read the forwarding header a trusted proxy
+ * set; otherwise use the real socket address (unspoofable). Returns "" when the
+ * source is unavailable (e.g. Hono's `app.request()` has no socket) — callers
+ * treat "" as not-allowed.
+ *
+ * X-Forwarded-For is parsed RIGHT-TO-LEFT: each proxy appends the address it saw,
+ * so the rightmost entries are the trusted hops we control and the leftmost is
+ * client-controllable. `TRUST_PROXY_HOPS` (default 1) is how many proxies front
+ * this app; the client IP is the entry just before them. Taking the leftmost
+ * entry (the old behaviour) let a client spoof its address by pre-seeding XFF.
+ */
+export declare function clientIp(c: Context, trustProxy: boolean): string;
+//# sourceMappingURL=tailscale.d.ts.map

package/dist/middleware/tailscale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.d.ts","sourceRoot":"","sources":["../../src/middleware/tailscale.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,cAAc,CAC5B,OAAO,GAAE,qBAA0B,GAClC,iBAAiB,CASnB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAG3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAqBhE"}

package/dist/middleware/tailscale.js

@@ -0,0 +1,64 @@
+import { getConnInfo } from "hono/bun";
+export function tailscaleGuard(options = {}) {
+    const trustProxy = options.trustProxy ?? process.env.TRUST_PROXY === "1";
+    return async (c, next) => {
+        if (isTailscaleAllowed(c, trustProxy)) {
+            await next();
+        }
+        else {
+            return c.json({ error: "VPN access required" }, 403);
+        }
+    };
+}
+/** True when the request's client IP is a Tailscale or loopback address. */
+export function isTailscaleAllowed(c, trustProxy) {
+    const ip = clientIp(c, trustProxy);
+    return isTailscaleIp(ip) || isLocalIp(ip);
+}
+/**
+ * The client IP. With `trustProxy`, read the forwarding header a trusted proxy
+ * set; otherwise use the real socket address (unspoofable). Returns "" when the
+ * source is unavailable (e.g. Hono's `app.request()` has no socket) — callers
+ * treat "" as not-allowed.
+ *
+ * X-Forwarded-For is parsed RIGHT-TO-LEFT: each proxy appends the address it saw,
+ * so the rightmost entries are the trusted hops we control and the leftmost is
+ * client-controllable. `TRUST_PROXY_HOPS` (default 1) is how many proxies front
+ * this app; the client IP is the entry just before them. Taking the leftmost
+ * entry (the old behaviour) let a client spoof its address by pre-seeding XFF.
+ */
+export function clientIp(c, trustProxy) {
+    if (trustProxy) {
+        const forwarded = c.req.header("x-forwarded-for");
+        if (forwarded) {
+            const parts = forwarded
+                .split(",")
+                .map((part) => part.trim())
+                .filter(Boolean);
+            if (parts.length > 0) {
+                const hops = Math.max(1, Number(process.env.TRUST_PROXY_HOPS) || 1);
+                const ip = parts[Math.max(0, parts.length - hops)];
+                if (ip)
+                    return ip;
+            }
+        }
+        return c.req.header("x-real-ip") ?? "";
+    }
+    try {
+        return getConnInfo(c).remote.address ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function isTailscaleIp(ip) {
+    // Tailscale CGNAT range: 100.64.0.0/10 (100.64.0.0 - 100.127.255.255)
+    if (!ip.startsWith("100."))
+        return false;
+    const second = parseInt(ip.split(".")[1], 10);
+    return second >= 64 && second <= 127;
+}
+function isLocalIp(ip) {
+    return ip === "127.0.0.1" || ip === "::1" || ip === "localhost";
+}
+//# sourceMappingURL=tailscale.js.map

package/dist/middleware/tailscale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.js","sourceRoot":"","sources":["../../src/middleware/tailscale.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAgBvC,MAAM,UAAU,cAAc,CAC5B,UAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC;IACzE,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,kBAAkB,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,CAAU,EAAE,UAAmB;IAChE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,aAAa,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAU,EAAE,UAAmB;IACtD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,SAAS;iBACpB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;gBACnD,IAAI,EAAE;oBAAE,OAAO,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,sEAAsE;IACtE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,WAAW,CAAC;AAClE,CAAC"}

package/dist/render/template.d.ts

@@ -0,0 +1,7 @@
+import type { RenderContentType } from "@schlessera/brain-ui-sdk/protocol";
+export declare function buildHtmlDocument(opts: {
+    content: string;
+    contentType: RenderContentType;
+    title?: string;
+}): string;
+//# sourceMappingURL=template.d.ts.map

package/dist/render/template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/render/template.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAqG3E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAiBT"}