@shipfox/client-auth 6.0.2 → 6.0.3

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 41 files with swc (106.33ms)
+Successfully compiled: 41 files with swc (151.72ms)

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @shipfox/client-auth
 
+## 6.0.3
+
+### Patch Changes
+
+- e6f831e: Reject deeply encoded authentication and invitation redirect paths before they can bypass path validation.
+
 ## 6.0.2
 
 ### Patch Changes

package/dist/components/redirect-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-context.d.ts","sourceRoot":"","sources":["../../src/components/redirect-context.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAWpE"}
+{"version":3,"file":"redirect-context.d.ts","sourceRoot":"","sources":["../../src/components/redirect-context.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAQpE"}

package/dist/components/redirect-context.js

@@ -1,19 +1,16 @@
-import { sanitizeRedirectPath } from './redirect-target.js';
+import { isAuthPath, resolveRedirectPath } from './redirect-target.js';
 const INVITATION_ACCEPT_PATH = '/invitations/accept';
 /**
  * Separates a safe post-authentication destination from an invitation token.
  * The token never remains in `returnTo`, so callers can keep it in their
  * short-lived invitation flow instead of forwarding it through generic redirects.
  */ export function parseRedirectContext(value) {
-    const redirect = sanitizeRedirectPath(value);
-    if (!redirect) return {};
-    const decoded = decodeURIComponent(redirect);
-    const [path, queryString = ''] = decoded.split('?', 2);
-    if (path !== INVITATION_ACCEPT_PATH) return {
-        returnTo: redirect
+    const resolved = resolveRedirectPath(value);
+    if (!resolved || isAuthPath(resolved.pathname)) return {};
+    if (resolved.pathname !== INVITATION_ACCEPT_PATH) return {
+        returnTo: resolved.redirect
     };
-    const params = new URLSearchParams(queryString);
-    const invitationToken = params.get('token');
+    const invitationToken = resolved.target.searchParams.get('token');
     return invitationToken ? {
         invitationToken
     } : {};

package/dist/components/redirect-context.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/redirect-context.ts"],"sourcesContent":["import {sanitizeRedirectPath} from './redirect-target.js';\n\nconst INVITATION_ACCEPT_PATH = '/invitations/accept';\n\nexport interface RedirectContext {\n  invitationToken?: string;\n  returnTo?: string;\n}\n\n/**\n * Separates a safe post-authentication destination from an invitation token.\n * The token never remains in `returnTo`, so callers can keep it in their\n * short-lived invitation flow instead of forwarding it through generic redirects.\n */\nexport function parseRedirectContext(value: unknown): RedirectContext {\n  const redirect = sanitizeRedirectPath(value);\n  if (!redirect) return {};\n\n  const decoded = decodeURIComponent(redirect);\n  const [path, queryString = ''] = decoded.split('?', 2);\n  if (path !== INVITATION_ACCEPT_PATH) return {returnTo: redirect};\n\n  const params = new URLSearchParams(queryString);\n  const invitationToken = params.get('token');\n  return invitationToken ? {invitationToken} : {};\n}\n"],"names":["sanitizeRedirectPath","INVITATION_ACCEPT_PATH","parseRedirectContext","value","redirect","decoded","decodeURIComponent","path","queryString","split","returnTo","params","URLSearchParams","invitationToken","get"],"mappings":"AAAA,SAAQA,oBAAoB,QAAO,uBAAuB;AAE1D,MAAMC,yBAAyB;AAO/B;;;;CAIC,GACD,OAAO,SAASC,qBAAqBC,KAAc;IACjD,MAAMC,WAAWJ,qBAAqBG;IACtC,IAAI,CAACC,UAAU,OAAO,CAAC;IAEvB,MAAMC,UAAUC,mBAAmBF;IACnC,MAAM,CAACG,MAAMC,cAAc,EAAE,CAAC,GAAGH,QAAQI,KAAK,CAAC,KAAK;IACpD,IAAIF,SAASN,wBAAwB,OAAO;QAACS,UAAUN;IAAQ;IAE/D,MAAMO,SAAS,IAAIC,gBAAgBJ;IACnC,MAAMK,kBAAkBF,OAAOG,GAAG,CAAC;IACnC,OAAOD,kBAAkB;QAACA;IAAe,IAAI,CAAC;AAChD"}
+{"version":3,"sources":["../../src/components/redirect-context.ts"],"sourcesContent":["import {isAuthPath, resolveRedirectPath} from './redirect-target.js';\n\nconst INVITATION_ACCEPT_PATH = '/invitations/accept';\n\nexport interface RedirectContext {\n  invitationToken?: string;\n  returnTo?: string;\n}\n\n/**\n * Separates a safe post-authentication destination from an invitation token.\n * The token never remains in `returnTo`, so callers can keep it in their\n * short-lived invitation flow instead of forwarding it through generic redirects.\n */\nexport function parseRedirectContext(value: unknown): RedirectContext {\n  const resolved = resolveRedirectPath(value);\n  if (!resolved || isAuthPath(resolved.pathname)) return {};\n\n  if (resolved.pathname !== INVITATION_ACCEPT_PATH) return {returnTo: resolved.redirect};\n\n  const invitationToken = resolved.target.searchParams.get('token');\n  return invitationToken ? {invitationToken} : {};\n}\n"],"names":["isAuthPath","resolveRedirectPath","INVITATION_ACCEPT_PATH","parseRedirectContext","value","resolved","pathname","returnTo","redirect","invitationToken","target","searchParams","get"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,mBAAmB,QAAO,uBAAuB;AAErE,MAAMC,yBAAyB;AAO/B;;;;CAIC,GACD,OAAO,SAASC,qBAAqBC,KAAc;IACjD,MAAMC,WAAWJ,oBAAoBG;IACrC,IAAI,CAACC,YAAYL,WAAWK,SAASC,QAAQ,GAAG,OAAO,CAAC;IAExD,IAAID,SAASC,QAAQ,KAAKJ,wBAAwB,OAAO;QAACK,UAAUF,SAASG,QAAQ;IAAA;IAErF,MAAMC,kBAAkBJ,SAASK,MAAM,CAACC,YAAY,CAACC,GAAG,CAAC;IACzD,OAAOH,kBAAkB;QAACA;IAAe,IAAI,CAAC;AAChD"}

package/dist/components/redirect-target.d.ts

@@ -1,3 +1,10 @@
+export interface ResolvedRedirectPath {
+    pathname: string;
+    redirect: string;
+    target: URL;
+}
+export declare function resolveRedirectPath(value: unknown): ResolvedRedirectPath | undefined;
+export declare function isAuthPath(pathname: string): boolean;
 export declare function sanitizeRedirectPath(value: unknown): string | undefined;
 /**
  * Returns the destination used by the shared logout route.

package/dist/components/redirect-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-target.d.ts","sourceRoot":"","sources":["../../src/components/redirect-target.ts"],"names":[],"mappings":"AAkCA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvE;AAOD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjE"}
+{"version":3,"file":"redirect-target.d.ts","sourceRoot":"","sources":["../../src/components/redirect-target.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,GAAG,CAAC;CACb;AAyBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,GAAG,SAAS,CAyBpF;AAMD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEpD;AAID,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvE;AAOD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUjE"}

package/dist/components/redirect-target.js

@@ -3,7 +3,28 @@ const LOGIN_PATH = '/auth/login';
 const INVITATION_ACCEPT_PATH = '/invitations/accept';
 const DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;
 const TRAILING_SLASHES = /\/+$/;
-function resolveRedirectPath(value) {
+const MAX_PATH_DECODE_ITERATIONS = 10;
+// Repeated decoding can reveal `.`/`..` segments or a `//host` prefix that were
+// hidden behind extra encoding layers (e.g. `%25252e%25252e` -> `..`). Those only
+// get collapsed and re-checked against the origin by feeding the fully-decoded,
+// percent-free string back through the URL parser; without this, a multiply
+// encoded `/safe/../auth/login` or `/safe/../invitations/accept?token=...`
+// evades the pathname checks below even though this loop "sees" the real path.
+function decodePathToFixedPoint(pathname) {
+    let current = pathname;
+    for(let iteration = 0; iteration < MAX_PATH_DECODE_ITERATIONS; iteration += 1){
+        let decoded;
+        try {
+            decoded = decodeURIComponent(current);
+        } catch  {
+            return undefined;
+        }
+        if (decoded === current) return current;
+        current = decoded;
+    }
+    return undefined;
+}
+export function resolveRedirectPath(value) {
     if (typeof value !== 'string' || !value.startsWith('/')) return undefined;
     let decoded;
     try {
@@ -18,23 +39,36 @@ function resolveRedirectPath(value) {
         return undefined;
     }
     if (target.origin !== REDIRECT_ORIGIN) return undefined;
-    return target;
+    const decodedPathname = decodePathToFixedPoint(target.pathname);
+    if (decodedPathname === undefined) return undefined;
+    let canonical;
+    try {
+        canonical = new URL(decodedPathname, REDIRECT_ORIGIN);
+    } catch  {
+        return undefined;
+    }
+    if (canonical.origin !== REDIRECT_ORIGIN) return undefined;
+    return {
+        pathname: canonical.pathname,
+        redirect: formatRedirectPath(target),
+        target
+    };
 }
 function formatRedirectPath(target) {
     return `${target.pathname}${target.search}${target.hash}`;
 }
-function isAuthPath(pathname) {
+export function isAuthPath(pathname) {
     return pathname === '/auth' || pathname.startsWith('/auth/');
 }
 // Resolves and canonicalizes an internal path before returning it, so browser URL
 // parsing cannot turn a seemingly safe path into an external or auth route.
 export function sanitizeRedirectPath(value) {
-    const target = resolveRedirectPath(value);
-    if (!target || isAuthPath(target.pathname)) return undefined;
-    return formatRedirectPath(target);
+    const resolved = resolveRedirectPath(value);
+    if (!resolved || isAuthPath(resolved.pathname)) return undefined;
+    return resolved.redirect;
 }
-function containsInvitationToken(target) {
-    const normalizedPathname = target.pathname.replace(TRAILING_SLASHES, '') || '/';
+function containsInvitationToken(target, pathname) {
+    const normalizedPathname = pathname.replace(TRAILING_SLASHES, '') || '/';
     return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');
 }
 /**
@@ -43,12 +77,12 @@ function containsInvitationToken(target) {
  * Login is the only auth destination allowed, and invitation tokens never
  * survive this boundary. Invalid values fail closed to login.
  */ export function sanitizeLogoutRedirectPath(value) {
-    const target = resolveRedirectPath(value);
-    if (!target) return DEFAULT_LOGOUT_REDIRECT;
-    if (isAuthPath(target.pathname) || containsInvitationToken(target)) {
+    const resolved = resolveRedirectPath(value);
+    if (!resolved) return DEFAULT_LOGOUT_REDIRECT;
+    if (isAuthPath(resolved.pathname) || containsInvitationToken(resolved.target, resolved.pathname)) {
         return DEFAULT_LOGOUT_REDIRECT;
     }
-    return formatRedirectPath(target);
+    return resolved.redirect;
 }
 
 //# sourceMappingURL=redirect-target.js.map

package/dist/components/redirect-target.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/redirect-target.ts"],"sourcesContent":["const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';\nconst LOGIN_PATH = '/auth/login';\nconst INVITATION_ACCEPT_PATH = '/invitations/accept';\nconst DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;\nconst TRAILING_SLASHES = /\\/+$/;\n\nfunction resolveRedirectPath(value: unknown): URL | undefined {\n  if (typeof value !== 'string' || !value.startsWith('/')) return undefined;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    return undefined;\n  }\n  let target: URL;\n  try {\n    target = new URL(decoded, REDIRECT_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  if (target.origin !== REDIRECT_ORIGIN) return undefined;\n  return target;\n}\n\nfunction formatRedirectPath(target: URL): string {\n  return `${target.pathname}${target.search}${target.hash}`;\n}\n\nfunction isAuthPath(pathname: string): boolean {\n  return pathname === '/auth' || pathname.startsWith('/auth/');\n}\n\n// Resolves and canonicalizes an internal path before returning it, so browser URL\n// parsing cannot turn a seemingly safe path into an external or auth route.\nexport function sanitizeRedirectPath(value: unknown): string | undefined {\n  const target = resolveRedirectPath(value);\n  if (!target || isAuthPath(target.pathname)) return undefined;\n  return formatRedirectPath(target);\n}\n\nfunction containsInvitationToken(target: URL): boolean {\n  const normalizedPathname = target.pathname.replace(TRAILING_SLASHES, '') || '/';\n  return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');\n}\n\n/**\n * Returns the destination used by the shared logout route.\n *\n * Login is the only auth destination allowed, and invitation tokens never\n * survive this boundary. Invalid values fail closed to login.\n */\nexport function sanitizeLogoutRedirectPath(value: unknown): string {\n  const target = resolveRedirectPath(value);\n  if (!target) return DEFAULT_LOGOUT_REDIRECT;\n  if (isAuthPath(target.pathname) || containsInvitationToken(target)) {\n    return DEFAULT_LOGOUT_REDIRECT;\n  }\n  return formatRedirectPath(target);\n}\n"],"names":["REDIRECT_ORIGIN","LOGIN_PATH","INVITATION_ACCEPT_PATH","DEFAULT_LOGOUT_REDIRECT","TRAILING_SLASHES","resolveRedirectPath","value","startsWith","undefined","decoded","decodeURIComponent","target","URL","origin","formatRedirectPath","pathname","search","hash","isAuthPath","sanitizeRedirectPath","containsInvitationToken","normalizedPathname","replace","searchParams","has","sanitizeLogoutRedirectPath"],"mappings":"AAAA,MAAMA,kBAAkB;AACxB,MAAMC,aAAa;AACnB,MAAMC,yBAAyB;AAC/B,MAAMC,0BAA0BF;AAChC,MAAMG,mBAAmB;AAEzB,SAASC,oBAAoBC,KAAc;IACzC,IAAI,OAAOA,UAAU,YAAY,CAACA,MAAMC,UAAU,CAAC,MAAM,OAAOC;IAChE,IAAIC;IACJ,IAAI;QACFA,UAAUC,mBAAmBJ;IAC/B,EAAE,OAAM;QACN,OAAOE;IACT;IACA,IAAIG;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIH,SAAST;IAC5B,EAAE,OAAM;QACN,OAAOQ;IACT;IACA,IAAIG,OAAOE,MAAM,KAAKb,iBAAiB,OAAOQ;IAC9C,OAAOG;AACT;AAEA,SAASG,mBAAmBH,MAAW;IACrC,OAAO,GAAGA,OAAOI,QAAQ,GAAGJ,OAAOK,MAAM,GAAGL,OAAOM,IAAI,EAAE;AAC3D;AAEA,SAASC,WAAWH,QAAgB;IAClC,OAAOA,aAAa,WAAWA,SAASR,UAAU,CAAC;AACrD;AAEA,kFAAkF;AAClF,4EAA4E;AAC5E,OAAO,SAASY,qBAAqBb,KAAc;IACjD,MAAMK,SAASN,oBAAoBC;IACnC,IAAI,CAACK,UAAUO,WAAWP,OAAOI,QAAQ,GAAG,OAAOP;IACnD,OAAOM,mBAAmBH;AAC5B;AAEA,SAASS,wBAAwBT,MAAW;IAC1C,MAAMU,qBAAqBV,OAAOI,QAAQ,CAACO,OAAO,CAAClB,kBAAkB,OAAO;IAC5E,OAAOiB,uBAAuBnB,0BAA0BS,OAAOY,YAAY,CAACC,GAAG,CAAC;AAClF;AAEA;;;;;CAKC,GACD,OAAO,SAASC,2BAA2BnB,KAAc;IACvD,MAAMK,SAASN,oBAAoBC;IACnC,IAAI,CAACK,QAAQ,OAAOR;IACpB,IAAIe,WAAWP,OAAOI,QAAQ,KAAKK,wBAAwBT,SAAS;QAClE,OAAOR;IACT;IACA,OAAOW,mBAAmBH;AAC5B"}
+{"version":3,"sources":["../../src/components/redirect-target.ts"],"sourcesContent":["const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';\nconst LOGIN_PATH = '/auth/login';\nconst INVITATION_ACCEPT_PATH = '/invitations/accept';\nconst DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;\nconst TRAILING_SLASHES = /\\/+$/;\nconst MAX_PATH_DECODE_ITERATIONS = 10;\n\nexport interface ResolvedRedirectPath {\n  pathname: string;\n  redirect: string;\n  target: URL;\n}\n\n// Repeated decoding can reveal `.`/`..` segments or a `//host` prefix that were\n// hidden behind extra encoding layers (e.g. `%25252e%25252e` -> `..`). Those only\n// get collapsed and re-checked against the origin by feeding the fully-decoded,\n// percent-free string back through the URL parser; without this, a multiply\n// encoded `/safe/../auth/login` or `/safe/../invitations/accept?token=...`\n// evades the pathname checks below even though this loop \"sees\" the real path.\nfunction decodePathToFixedPoint(pathname: string): string | undefined {\n  let current = pathname;\n\n  for (let iteration = 0; iteration < MAX_PATH_DECODE_ITERATIONS; iteration += 1) {\n    let decoded: string;\n    try {\n      decoded = decodeURIComponent(current);\n    } catch {\n      return undefined;\n    }\n    if (decoded === current) return current;\n    current = decoded;\n  }\n\n  return undefined;\n}\n\nexport function resolveRedirectPath(value: unknown): ResolvedRedirectPath | undefined {\n  if (typeof value !== 'string' || !value.startsWith('/')) return undefined;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    return undefined;\n  }\n  let target: URL;\n  try {\n    target = new URL(decoded, REDIRECT_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  if (target.origin !== REDIRECT_ORIGIN) return undefined;\n  const decodedPathname = decodePathToFixedPoint(target.pathname);\n  if (decodedPathname === undefined) return undefined;\n  let canonical: URL;\n  try {\n    canonical = new URL(decodedPathname, REDIRECT_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  if (canonical.origin !== REDIRECT_ORIGIN) return undefined;\n  return {pathname: canonical.pathname, redirect: formatRedirectPath(target), target};\n}\n\nfunction formatRedirectPath(target: URL): string {\n  return `${target.pathname}${target.search}${target.hash}`;\n}\n\nexport function isAuthPath(pathname: string): boolean {\n  return pathname === '/auth' || pathname.startsWith('/auth/');\n}\n\n// Resolves and canonicalizes an internal path before returning it, so browser URL\n// parsing cannot turn a seemingly safe path into an external or auth route.\nexport function sanitizeRedirectPath(value: unknown): string | undefined {\n  const resolved = resolveRedirectPath(value);\n  if (!resolved || isAuthPath(resolved.pathname)) return undefined;\n  return resolved.redirect;\n}\n\nfunction containsInvitationToken(target: URL, pathname: string): boolean {\n  const normalizedPathname = pathname.replace(TRAILING_SLASHES, '') || '/';\n  return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');\n}\n\n/**\n * Returns the destination used by the shared logout route.\n *\n * Login is the only auth destination allowed, and invitation tokens never\n * survive this boundary. Invalid values fail closed to login.\n */\nexport function sanitizeLogoutRedirectPath(value: unknown): string {\n  const resolved = resolveRedirectPath(value);\n  if (!resolved) return DEFAULT_LOGOUT_REDIRECT;\n  if (\n    isAuthPath(resolved.pathname) ||\n    containsInvitationToken(resolved.target, resolved.pathname)\n  ) {\n    return DEFAULT_LOGOUT_REDIRECT;\n  }\n  return resolved.redirect;\n}\n"],"names":["REDIRECT_ORIGIN","LOGIN_PATH","INVITATION_ACCEPT_PATH","DEFAULT_LOGOUT_REDIRECT","TRAILING_SLASHES","MAX_PATH_DECODE_ITERATIONS","decodePathToFixedPoint","pathname","current","iteration","decoded","decodeURIComponent","undefined","resolveRedirectPath","value","startsWith","target","URL","origin","decodedPathname","canonical","redirect","formatRedirectPath","search","hash","isAuthPath","sanitizeRedirectPath","resolved","containsInvitationToken","normalizedPathname","replace","searchParams","has","sanitizeLogoutRedirectPath"],"mappings":"AAAA,MAAMA,kBAAkB;AACxB,MAAMC,aAAa;AACnB,MAAMC,yBAAyB;AAC/B,MAAMC,0BAA0BF;AAChC,MAAMG,mBAAmB;AACzB,MAAMC,6BAA6B;AAQnC,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,SAASC,uBAAuBC,QAAgB;IAC9C,IAAIC,UAAUD;IAEd,IAAK,IAAIE,YAAY,GAAGA,YAAYJ,4BAA4BI,aAAa,EAAG;QAC9E,IAAIC;QACJ,IAAI;YACFA,UAAUC,mBAAmBH;QAC/B,EAAE,OAAM;YACN,OAAOI;QACT;QACA,IAAIF,YAAYF,SAAS,OAAOA;QAChCA,UAAUE;IACZ;IAEA,OAAOE;AACT;AAEA,OAAO,SAASC,oBAAoBC,KAAc;IAChD,IAAI,OAAOA,UAAU,YAAY,CAACA,MAAMC,UAAU,CAAC,MAAM,OAAOH;IAChE,IAAIF;IACJ,IAAI;QACFA,UAAUC,mBAAmBG;IAC/B,EAAE,OAAM;QACN,OAAOF;IACT;IACA,IAAII;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIP,SAASV;IAC5B,EAAE,OAAM;QACN,OAAOY;IACT;IACA,IAAII,OAAOE,MAAM,KAAKlB,iBAAiB,OAAOY;IAC9C,MAAMO,kBAAkBb,uBAAuBU,OAAOT,QAAQ;IAC9D,IAAIY,oBAAoBP,WAAW,OAAOA;IAC1C,IAAIQ;IACJ,IAAI;QACFA,YAAY,IAAIH,IAAIE,iBAAiBnB;IACvC,EAAE,OAAM;QACN,OAAOY;IACT;IACA,IAAIQ,UAAUF,MAAM,KAAKlB,iBAAiB,OAAOY;IACjD,OAAO;QAACL,UAAUa,UAAUb,QAAQ;QAAEc,UAAUC,mBAAmBN;QAASA;IAAM;AACpF;AAEA,SAASM,mBAAmBN,MAAW;IACrC,OAAO,GAAGA,OAAOT,QAAQ,GAAGS,OAAOO,MAAM,GAAGP,OAAOQ,IAAI,EAAE;AAC3D;AAEA,OAAO,SAASC,WAAWlB,QAAgB;IACzC,OAAOA,aAAa,WAAWA,SAASQ,UAAU,CAAC;AACrD;AAEA,kFAAkF;AAClF,4EAA4E;AAC5E,OAAO,SAASW,qBAAqBZ,KAAc;IACjD,MAAMa,WAAWd,oBAAoBC;IACrC,IAAI,CAACa,YAAYF,WAAWE,SAASpB,QAAQ,GAAG,OAAOK;IACvD,OAAOe,SAASN,QAAQ;AAC1B;AAEA,SAASO,wBAAwBZ,MAAW,EAAET,QAAgB;IAC5D,MAAMsB,qBAAqBtB,SAASuB,OAAO,CAAC1B,kBAAkB,OAAO;IACrE,OAAOyB,uBAAuB3B,0BAA0Bc,OAAOe,YAAY,CAACC,GAAG,CAAC;AAClF;AAEA;;;;;CAKC,GACD,OAAO,SAASC,2BAA2BnB,KAAc;IACvD,MAAMa,WAAWd,oBAAoBC;IACrC,IAAI,CAACa,UAAU,OAAOxB;IACtB,IACEsB,WAAWE,SAASpB,QAAQ,KAC5BqB,wBAAwBD,SAASX,MAAM,EAAEW,SAASpB,QAAQ,GAC1D;QACA,OAAOJ;IACT;IACA,OAAOwB,SAASN,QAAQ;AAC1B"}