@snagset/server 0.0.1

package/dist/routes/mcpAuth.js

@@ -0,0 +1,187 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { CREDENTIAL_PREFIX } from "../vendor/types/names.js";
+import { verifyMcpToken, touchMcpToken } from "./mcpToken.js";
+/**
+ * The write budget — 07 §8.4, `mcpw:token`, 20 writes per 10 minutes
+ * *(calibration)*, and §8.6 mitigation 5 is why it exists: *"An agent injected
+ * into 'resolve every thread' stops on the 21st and must tell its user."*
+ *
+ * Counted out of `events` rather than a bucket in memory, and that is not
+ * laziness. A budget in process memory resets when the process restarts and
+ * does not exist at all across two instances — so on the serverless entry
+ * (`serverless.ts`) an attacker gets 20 writes *per warm instance*, which is
+ * not a budget. §8.6 mitigation 8 already requires every agent write to land in
+ * `events` with the token id; counting the rows that must exist anyway makes
+ * the budget exactly as durable as the audit trail.
+ */
+export const WRITE_BUDGET = { writes: 20, windowMinutes: 10 };
+export function mcpAuth(sql) {
+    return async (c, next) => {
+        const presented = /^Bearer (.+)$/i.exec(c.req.header("Authorization") ?? "")?.[1];
+        // Not an MCP token — a reviewer bearer, or nothing. Costs one string
+        // comparison and no query, which is what keeps this mountable app-wide.
+        if (!presented?.startsWith(CREDENTIAL_PREFIX.mcp))
+            return next();
+        const claims = await verifyMcpToken(sql, presented);
+        if (!claims) {
+            return c.json({
+                error: {
+                    code: "unauthorized",
+                    // One sentence for unknown, revoked and expired alike. Which of
+                    // the three it was is exactly what a probe is trying to learn, and
+                    // the operator can see it with `snagset mcp-token list`.
+                    message: "That MCP token is not valid. It may have been revoked or have expired — " +
+                        "mint a new one with `snagset mcp-token create`.",
+                    requestId: c.get("requestId"),
+                },
+            }, 401);
+        }
+        c.set("mcp", claims);
+        /**
+         * The audit timestamp, and the address as a per-token salted hash.
+         *
+         * `void` on purpose — F29 reads `last_used_at`, but a failure to record it
+         * must never fail a request that otherwise succeeded.
+         *
+         * The salt is the token's OWN hash. 00 §14.2b puts the IP salt on
+         * `projects`, which works for a project-scoped token and has nothing to
+         * offer an org-wide one — and an org-wide token is what the CLI mints, so
+         * "use the project salt" would mean recording nothing in the common case
+         * and leaving F29 blind. `token_hash` is per-row, already stored, cannot
+         * predate the row it is on, and is not derivable by whoever is being
+         * hashed. The raw address is still never stored (08 §4.7).
+         */
+        void touchMcpToken(sql, claims.tokenId, hashAddress(c, claims)).catch(() => { });
+        return next();
+    };
+}
+function hashAddress(c, claims) {
+    const raw = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip")?.trim() || "";
+    if (!raw)
+        return null;
+    return createHash("sha256").update(raw, "utf8").update(claims.tokenId, "utf8").digest();
+}
+/**
+ * Does this token carry the scope, for this org?
+ *
+ * BOTH halves matter and the org half is the one that is easy to forget: a
+ * valid token for another org is a valid token, and every route here resolves
+ * its project independently of the credential. This is the same check
+ * `asOwner` makes (`owner.orgId === p.org_id`), for the same reason.
+ */
+export function mcpAllows(claims, orgId, scope) {
+    return !!claims && claims.orgId === orgId && claims.scopes.includes(scope);
+}
+/**
+ * The refusal, with the scope named — 05's registered `mcp_scope_denied`.
+ *
+ * The message says which scope and how to fix it, because the reader is an
+ * agent relaying to a developer who minted the token minutes ago and has no
+ * idea the default is read-only. "Forbidden" would send them to the dashboard
+ * looking for a permission that is not there.
+ */
+export function scopeDenied(c, scope) {
+    return c.json({
+        error: {
+            code: "mcp_scope_denied",
+            message: `This MCP token does not carry the "${scope}" scope. Mint one that does with ` +
+                `\`snagset mcp-token create <name> ${scope}\` — the default token is read-only on purpose.`,
+            requestId: c.get("requestId"),
+        },
+    }, 403);
+}
+/**
+ * Spend one write from the budget, or refuse.
+ *
+ * Returns null when the write may proceed. Deliberately checked BEFORE the
+ * write rather than after: a budget enforced by refusing the 21st response
+ * while having already made the 21st change is not a budget.
+ */
+export async function checkWriteBudget(sql, tokenId) {
+    const [row] = await sql `
+    SELECT count(*)::int AS n FROM events
+     WHERE actor_kind = 'integration'
+       AND payload->>'mcpTokenId' = ${tokenId}
+       AND created_at > now() - ${`${WRITE_BUDGET.windowMinutes} minutes`}::interval
+  `;
+    const spent = row?.n ?? 0;
+    return spent >= WRITE_BUDGET.writes ? spent : null;
+}
+/** 07 §8.4's stop signal, as an HTTP response. */
+export function budgetExhausted(c) {
+    return c.json({
+        error: {
+            code: "rate_limited",
+            message: `This agent has made ${WRITE_BUDGET.writes} writes in the last ` +
+                `${WRITE_BUDGET.windowMinutes} minutes, which is the limit. Stop and tell your user ` +
+                `what you were doing — do not retry.`,
+            requestId: c.get("requestId"),
+        },
+    }, 429);
+}
+/**
+ * The audit row — 07 §8.6 mitigation 8, *"so 'what did the agent do last
+ * Tuesday' is one query"*.
+ *
+ * Takes a transaction, and every caller passes the one doing the write. That
+ * is what makes the budget above sound: the audit row and the change it
+ * records commit together, so there is no window in which a write has happened
+ * and is not yet counted.
+ */
+export async function recordAgentWrite(tx, what) {
+    // `tx.json(…)`, NOT `JSON.stringify(…)::jsonb`.
+    //
+    // postgres.js JSON-encodes a string parameter bound to a jsonb column, so a
+    // stringified object arrives as a JSON *string scalar*: `jsonb_typeof` says
+    // `string`, and `payload->>'mcpTokenId'` is null. Which silently disabled the
+    // write budget — `checkWriteBudget` counted zero, forever, and an agent could
+    // write without limit. The audit rows were all there and all unqueryable.
+    //
+    // Missed by the unit test because that test SEEDED the rows itself, correctly,
+    // and then asserted the refusal. It proved the query, and the query was never
+    // the broken half. Caught by making 21 real writes through a published tarball
+    // and watching all 21 succeed.
+    await tx `
+    INSERT INTO events (id, org_id, project_id, type, actor_kind, actor_id, subject_type, subject_id, payload)
+    VALUES (${randomUUID()}, ${what.orgId}, ${what.projectId}, ${what.type}, 'integration',
+            ${what.reviewerId}, ${what.subjectType}, ${what.subjectId},
+            ${tx.json({ mcpTokenId: what.tokenId })})
+  `;
+}
+/**
+ * Find-or-create the agent's reviewer row — 07 §8.2 *Authorship*, and 05 §9.6's
+ * representation: `kind = 'guest'` with `is_agent = true` and
+ * `agent_mcp_token_id` set.
+ *
+ * **Never `verified`.** Draft 2 of 07 posted agent comments as `kind:
+ * 'verified'` with an `(agent)` name suffix and that is deleted: `verified`
+ * means the host application's server vouched for a named human, and it
+ * carries a moderation bypass. Laundering a machine credential into it hands
+ * an agent — possibly one acting on injected instructions — the highest trust
+ * tier in the system on the strength of a name convention.
+ *
+ * `holder_secret_hash` is 32 random bytes whose plaintext is DISCARDED here and
+ * never existed anywhere else. 0001's CHECK requires a non-verified row to be a
+ * credential holder, a studio member or a placeholder, and an agent is the
+ * first of those — its credential is the MCP token. Hashing something guessable
+ * instead (the token id, say) would make this row impersonable through
+ * `/sessions`' guest path by anyone who learned a uuid; hashing a secret nobody
+ * holds means that door is not merely locked, there is no key.
+ */
+export async function agentReviewer(tx, what) {
+    const [existing] = await tx `
+    SELECT id FROM reviewers
+     WHERE project_id = ${what.projectId}::uuid AND agent_mcp_token_id = ${what.tokenId}::uuid
+  `;
+    if (existing)
+        return existing.id;
+    const id = randomUUID();
+    await tx `
+    INSERT INTO reviewers (id, org_id, project_id, kind, name, holder_secret_hash, is_agent, agent_mcp_token_id)
+    VALUES (${id}::uuid, ${what.orgId}::uuid, ${what.projectId}::uuid, 'guest',
+            ${what.tokenName}, ${createHash("sha256").update(randomBytes(32)).digest()},
+            true, ${what.tokenId}::uuid)
+  `;
+    return id;
+}
+//# sourceMappingURL=mcpAuth.js.map

package/dist/routes/mcpAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAuth.js","sourceRoot":"","sources":["../../src/routes/mcpAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,eAAe,CAAC;AAiC9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAW,CAAC;AAEvE,MAAM,UAAU,OAAO,CAAC,GAAiB;IACvC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,qEAAqE;QACrE,wEAAwE;QACxE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,gEAAgE;oBAChE,mEAAmE;oBACnE,yDAAyD;oBACzD,OAAO,EACL,0EAA0E;wBAC1E,iDAAiD;oBACnD,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;iBAC9B;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAErB;;;;;;;;;;;;;WAaG;QACH,KAAK,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEhF,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,MAAiB;IAChD,MAAM,GAAG,GACP,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,MAA6B,EAAE,KAAa,EAAE,KAAa;IACnF,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU,EAAE,KAAa;IACnD,OAAO,CAAC,CAAC,IAAI,CACX;QACE,KAAK,EAAE;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,sCAAsC,KAAK,mCAAmC;gBAC9E,qCAAqC,KAAK,iDAAiD;YAC7F,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9B;KACF,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAiB,EAAE,OAAe;IACvE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAiB;;;sCAGJ,OAAO;kCACX,GAAG,YAAY,CAAC,aAAa,UAAU;GACtE,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,KAAK,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,CAAC,CAAC,IAAI,CACX;QACE,KAAK,EAAE;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,uBAAuB,YAAY,CAAC,MAAM,sBAAsB;gBAChE,GAAG,YAAY,CAAC,aAAa,wDAAwD;gBACrF,qCAAqC;YACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9B;KACF,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAA2B,EAC3B,IAQC;IAED,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,EAAE;IACF,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,+BAA+B;IAC/B,MAAM,EAAE,CAAA;;cAEI,UAAU,EAAE,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI;cAC5D,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,SAAS;cACvD,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;GAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAA2B,EAC3B,IAA8E;IAE9E,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAkB;;0BAErB,IAAI,CAAC,SAAS,mCAAmC,IAAI,CAAC,OAAO;GACpF,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IAEjC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,EAAE,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,SAAS;cAChD,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;oBAClE,IAAI,CAAC,OAAO;GAC7B,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/routes/mcpToken.js

@@ -0,0 +1,94 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { CREDENTIAL_PREFIX } from "../vendor/types/names.js";
+/** 07 §8.2's vocabulary. This spec owns it; the server enforces it. */
+export const MCP_SCOPES = [
+    "threads:read",
+    "context:read",
+    "comments:write",
+    "threads:write",
+    "source:map",
+];
+/**
+ * What the dashboard issues by default: **read-only, plus local source
+ * mapping**.
+ *
+ * 07 §8.2: *"The default token issued by the dashboard carries `threads:read`
+ * and `source:map` only."* `context:read` is separate on purpose — breadcrumbs
+ * and capture context are the personal-data-bearing half, and an agent that
+ * only needs "what is broken and where" should not be handed a console log.
+ */
+export const DEFAULT_SCOPES = ["threads:read", "source:map"];
+const hash = (token) => createHash("sha256").update(token, "utf8").digest();
+export async function mintMcpToken(sql, id, opts) {
+    const secret = randomBytes(32).toString("base64url");
+    const prefix = randomBytes(6).toString("base64url").slice(0, 8);
+    const token = `${CREDENTIAL_PREFIX.mcp}${prefix}_${secret}`;
+    const scopes = opts.scopes ?? DEFAULT_SCOPES;
+    for (const scope of scopes) {
+        if (!MCP_SCOPES.includes(scope)) {
+            throw new Error(`unknown MCP scope ${JSON.stringify(scope)}. Known: ${MCP_SCOPES.join(", ")}`);
+        }
+    }
+    await sql `
+    INSERT INTO mcp_tokens (id, org_id, project_id, name, prefix, token_hash, scopes, created_by, expires_at)
+    VALUES (${id}, ${opts.orgId}, ${opts.projectId ?? null}, ${opts.name}, ${prefix},
+            ${hash(token)}, ${sql.array(scopes)}, ${opts.createdBy ?? null},
+            ${opts.expiresAt ?? null})
+  `;
+    return { id, token, prefix };
+}
+/**
+ * Verify a presented token. Returns null for anything not currently valid —
+ * unknown, revoked, or expired — without saying which.
+ *
+ * The lookup is by HASH, so a token is found in one indexed comparison rather
+ * than by scanning and comparing; `timingSafeEqual` on the row that comes back
+ * closes the remaining timing channel.
+ */
+export async function verifyMcpToken(sql, presented, now = new Date()) {
+    if (!presented.startsWith(CREDENTIAL_PREFIX.mcp))
+        return null;
+    const digest = hash(presented);
+    const [row] = await sql `
+    SELECT id, name, org_id, project_id, scopes, confirm_writes, allow_remote_writes,
+           token_hash, revoked_at, expires_at
+      FROM mcp_tokens
+     WHERE token_hash = ${digest}
+     LIMIT 1
+  `;
+    if (!row)
+        return null;
+    if (row.token_hash.length !== digest.length || !timingSafeEqual(row.token_hash, digest))
+        return null;
+    if (row.revoked_at)
+        return null;
+    if (row.expires_at && row.expires_at <= now)
+        return null;
+    return {
+        tokenId: row.id,
+        name: row.name,
+        orgId: row.org_id,
+        projectId: row.project_id,
+        scopes: row.scopes,
+        confirmWrites: row.confirm_writes,
+        allowRemoteWrites: row.allow_remote_writes,
+    };
+}
+/**
+ * Record use — `last_used_at`, and the address as a SALTED HASH.
+ *
+ * 07 F29 reads this column and 00 §14.2b put the salt in migration 0001 so no
+ * historical hash predates it. The raw address is never stored anywhere in this
+ * system (08 §4.7), and a token audit trail is not the place to make the first
+ * exception.
+ *
+ * Deliberately fire-and-forget at the call site: a failure to write an audit
+ * timestamp must not fail the request that succeeded.
+ */
+export async function touchMcpToken(sql, tokenId, ipHash) {
+    await sql `
+    UPDATE mcp_tokens SET last_used_at = now(), last_used_ip = ${ipHash}
+     WHERE id = ${tokenId}
+  `;
+}
+//# sourceMappingURL=mcpToken.js.map

package/dist/routes/mcpToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpToken.js","sourceRoot":"","sources":["../../src/routes/mcpToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAqCzD,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,YAAY;CACJ,CAAC;AAGX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AAElF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAY5F,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAA2C,EAC3C,EAAU,EACV,IAAiB;IAEjB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,GAAG,iBAAiB,CAAC,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAE7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,MAAM,GAAG,CAAA;;cAEG,EAAE,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,MAAM;cACrE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,MAAkB,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,IAAI;cACxE,IAAI,CAAC,SAAS,IAAI,IAAI;GACjC,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAiB,EACjB,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAatB;;;;0BAIuB,MAAM;;GAE7B,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,EAAE;QACf,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAiB,EACjB,OAAe,EACf,MAAqB;IAErB,MAAM,GAAG,CAAA;iEACsD,MAAM;kBACrD,OAAO;GACtB,CAAC;AACJ,CAAC"}

package/dist/routes/owner.js

@@ -0,0 +1,288 @@
+import { Hono } from "hono";
+import { randomUUID, randomBytes, createHash, timingSafeEqual, scryptSync } from "node:crypto";
+import { DASHBOARD_SESSION_COOKIE, DASHBOARD_CSRF_COOKIE, HTTP_HEADER } from "../vendor/types/names.js";
+/** 05 §4.7: 30-day absolute, 7-day idle, rolling refresh on use. */
+const ABSOLUTE_MS = 30 * 24 * 60 * 60 * 1000;
+const IDLE_MS = 7 * 24 * 60 * 60 * 1000;
+const sha256 = (s) => createHash("sha256").update(s, "utf8").digest();
+function fail(c, status, code, message) {
+    return c.json({ error: { code, message, requestId: c.get("requestId") } }, status);
+}
+/**
+ * scrypt, not argon2id, and the deviation is deliberate.
+ *
+ * 05 §4.7's table says argon2id via `node-argon2`. That is a NATIVE module: it
+ * needs a compiler or a prebuilt binary for the exact platform and Node ABI,
+ * and A9's promise is one npm package that `npx` runs with no build step. A
+ * dependency that fails to install on a machine with no toolchain would make
+ * the first-run login unreachable, which is the same failure mode §4.7 rejects
+ * magic-link-only auth for.
+ *
+ * scrypt is memory-hard, in the standard library, and OWASP-parameterised here
+ * (N=2^17, r=8, p=1 — their scrypt baseline). The format carries its
+ * parameters so an argon2 row can be added later without a migration.
+ */
+const SCRYPT = { N: 2 ** 17, r: 8, p: 1, maxmem: 256 * 1024 * 1024 };
+export function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = scryptSync(password, salt, 64, SCRYPT);
+    return `scrypt$${salt.toString("base64url")}$${key.toString("base64url")}`;
+}
+/**
+ * Verify, in constant time, and never leak WHICH part was wrong.
+ *
+ * Returns false for a user with no password (OAuth-only, §4.7) rather than
+ * throwing — but still spends the same work, because an early return on
+ * "this account has no password" is an account-enumeration oracle measurable
+ * over a few hundred requests.
+ */
+export function verifyPassword(password, stored) {
+    const parts = (stored ?? "").split("$");
+    const decoy = parts.length === 3 ? null : "scrypt$AAAAAAAAAAAAAAAAAAAAAA$AAAA";
+    const [, saltB64, keyB64] = (decoy ? decoy.split("$") : parts);
+    const salt = Buffer.from(saltB64, "base64url");
+    const want = Buffer.from(keyB64, "base64url");
+    const got = scryptSync(password, salt, want.length || 64, SCRYPT);
+    if (decoy)
+        return false;
+    return want.length === got.length && timingSafeEqual(want, got);
+}
+/** Both cookies, set together — they are one credential in two halves. */
+function setSessionCookies(c, token, csrf, secure, maxAgeS) {
+    const base = `Path=/; SameSite=Lax; Max-Age=${maxAgeS}${secure ? "; Secure" : ""}`;
+    // HttpOnly: the value is the credential and no script has any reason to read it.
+    c.header("Set-Cookie", `${DASHBOARD_SESSION_COOKIE}=${token}; HttpOnly; ${base}`, { append: true });
+    // NOT HttpOnly, deliberately: double-submit works precisely because the
+    // dashboard's own JS reads this one and echoes it in a header, which a
+    // cross-site page cannot do — it can send the cookie, but it cannot read it.
+    c.header("Set-Cookie", `${DASHBOARD_CSRF_COOKIE}=${csrf}; ${base}`, { append: true });
+}
+function clearSessionCookies(c, secure) {
+    const base = `Path=/; SameSite=Lax; Max-Age=0${secure ? "; Secure" : ""}`;
+    c.header("Set-Cookie", `${DASHBOARD_SESSION_COOKIE}=; HttpOnly; ${base}`, { append: true });
+    c.header("Set-Cookie", `${DASHBOARD_CSRF_COOKIE}=; ${base}`, { append: true });
+}
+function readCookie(c, name) {
+    const raw = c.req.header("Cookie");
+    if (!raw)
+        return null;
+    for (const part of raw.split(";")) {
+        const i = part.indexOf("=");
+        if (i < 0)
+            continue;
+        if (part.slice(0, i).trim() === name)
+            return part.slice(i + 1).trim();
+    }
+    return null;
+}
+/**
+ * The middleware. Attaches `owner` when a session verifies; refuses nothing by
+ * itself — the routes decide, exactly as `bearerAuth` does on the widget side,
+ * so a route that forgot to check is a visible omission rather than an
+ * invisible one.
+ */
+export function ownerAuth(deps) {
+    const { sql } = deps;
+    const now = deps.now ?? (() => new Date());
+    return async (c, next) => {
+        const token = readCookie(c, DASHBOARD_SESSION_COOKIE);
+        if (!token)
+            return next();
+        const at = now();
+        const [row] = await sql `
+      SELECT s.id, s.org_id, s.user_id, u.email, u.name, s.last_seen_at
+      FROM user_sessions s
+      JOIN users u ON u.id = s.user_id AND u.deleted_at IS NULL
+      WHERE s.token_hash = ${sha256(token)}
+        AND s.revoked_at IS NULL
+        AND s.expires_at > ${at}
+        AND s.last_seen_at > ${new Date(at.getTime() - IDLE_MS)}
+    `;
+        if (!row)
+            return next();
+        c.set("owner", {
+            userId: row.user_id,
+            orgId: row.org_id,
+            email: row.email,
+            name: row.name,
+            sessionId: row.id,
+        });
+        // Rolling refresh (§4.7), but not on every request: `last_seen_at` only
+        // needs to be accurate to within the idle window, and a write per request
+        // turns a read-only dashboard page into a write on the hot path.
+        if (at.getTime() - row.last_seen_at.getTime() > 60 * 60 * 1000) {
+            void sql `UPDATE user_sessions SET last_seen_at = ${at} WHERE id = ${row.id}`.catch(() => { });
+        }
+        return next();
+    };
+}
+/**
+ * The double-submit compare itself, exported so a route that cannot mount
+ * `requireOwner()` wholesale — because it also serves a different credential
+ * — can still run the same check inline (`comments.ts`: a reviewer session
+ * posts to the same path an owner cookie does, so the route itself has to
+ * branch on which credential arrived rather than gating the whole path).
+ *
+ * `Origin` is NOT re-checked here — that half of `requireOwner()`'s story is
+ * about login CSRF specifically (§4.7's comment on `/auth/login`) and every
+ * other owner-cookie route relies on `SameSite=Lax` plus this pair.
+ */
+export function csrfOk(c) {
+    const sent = c.req.header(HTTP_HEADER.csrf);
+    const cookie = readCookie(c, DASHBOARD_CSRF_COOKIE);
+    return (!!sent && !!cookie && sent.length === cookie.length && timingSafeEqual(Buffer.from(sent), Buffer.from(cookie)));
+}
+/**
+ * §4.7's CSRF pair, on mutations only.
+ *
+ * TWO checks, and `SameSite=Lax` is explicitly not treated as sufficient by the
+ * spec: `Origin` must equal the server's own, AND `x-snagset-csrf` must equal
+ * the non-HttpOnly cookie. The second is what a cross-site page cannot forge —
+ * it can cause the browser to SEND our cookies, but it cannot READ one to echo
+ * it back in a header.
+ *
+ * A safe method is exempt because a GET must not be a mutation in the first
+ * place; if one ever is, that is the bug to fix rather than the check to add.
+ */
+export function requireOwner() {
+    return async (c, next) => {
+        const owner = c.get("owner");
+        if (!owner) {
+            return c.json({
+                error: {
+                    code: "unauthorized",
+                    message: "Sign in to the dashboard first.",
+                    requestId: c.get("requestId"),
+                },
+            }, 401);
+        }
+        if (!["GET", "HEAD", "OPTIONS"].includes(c.req.method) && !csrfOk(c)) {
+            return c.json({
+                error: {
+                    code: "csrf_failed",
+                    message: "That request could not be verified. Reload the dashboard and try again.",
+                    requestId: c.get("requestId"),
+                },
+            }, 403);
+        }
+        return next();
+    };
+}
+export function ownerRoutes(deps) {
+    const app = new Hono();
+    const { sql } = deps;
+    const now = deps.now ?? (() => new Date());
+    /**
+     * Sign in. ONE error for every failure — unknown email, wrong password,
+     * deleted user — because the difference between them is exactly the
+     * information an account-enumeration attack is after.
+     */
+    app.post("/auth/login", async (c) => {
+        // The origin check applies here too: a cross-site page cannot read the
+        // response, but it CAN log a victim into an account the attacker controls
+        // (login CSRF), and every subsequent action the victim takes lands in the
+        // attacker's org.
+        // The origin must be OURS — but "ours" is not only the configured base URL.
+        //
+        // The first attempt compared against `SNAGSET_BASE_URL` alone, which
+        // defaults to `http://localhost:8080`, and then refused a browser sitting
+        // on `http://127.0.0.1:8080` — the same server, reached by the other name
+        // for it. An operator does not reach a self-hosted instance by the name a
+        // config default guessed; they reach it by an IP, a LAN hostname, or a
+        // tunnel, and being told "this instance does not serve that" by the
+        // instance currently serving it is a dead end with no next step.
+        //
+        // So the request's own Host counts too. That is the standard formulation
+        // of this check and it keeps the property that matters: a cross-site page
+        // cannot set `Origin`, which is the header being tested. Host is
+        // attacker-influenced in principle, but a Host that reaches this process
+        // is one the deployment already routes here, and spoofing it does not
+        // deliver the victim's cookie anywhere new.
+        const origin = c.req.header("Origin");
+        const host = c.req.header("Host");
+        const ours = new Set([deps.origin, host ? `http://${host}` : "", host ? `https://${host}` : ""]);
+        if (origin && !ours.has(origin)) {
+            return fail(c, 403, "forbidden", "That sign-in request came from another site.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        const email = typeof body?.email === "string" ? body.email.trim().toLowerCase() : "";
+        const password = typeof body?.password === "string" ? body.password : "";
+        if (!email || !password) {
+            return fail(c, 400, "validation_failed", "Both an email address and a password are required.");
+        }
+        const [user] = await sql `
+      SELECT id, org_id, email, name, password_hash
+      FROM users WHERE email = ${email} AND deleted_at IS NULL
+    `;
+        // `verifyPassword` spends the same work on a missing row as on a wrong
+        // password, so this branch costs what the real one costs.
+        if (!verifyPassword(password, user?.password_hash ?? null)) {
+            return fail(c, 401, "invalid_credentials", "That email address and password do not match an account.");
+        }
+        const token = randomBytes(32).toString("base64url");
+        const csrf = randomBytes(32).toString("base64url");
+        const expires = new Date(now().getTime() + ABSOLUTE_MS);
+        await sql `
+      INSERT INTO user_sessions (id, org_id, user_id, token_hash, user_agent, expires_at)
+      VALUES (${randomUUID()}, ${user.org_id}, ${user.id}, ${sha256(token)},
+              ${(c.req.header("User-Agent") ?? "").slice(0, 400)}, ${expires})
+    `;
+        setSessionCookies(c, token, csrf, deps.secure, Math.floor(ABSOLUTE_MS / 1000));
+        // No id, for the reason `/api/v1/me` gives: nothing outside the database
+        // needs it, and an internal id put on the wire because it was to hand is
+        // how the first one always gets out.
+        return c.json({ user: { email: user.email, name: user.name }, csrfToken: csrf });
+    });
+    /** Sign out. Revokes the ROW, so the cookie being kept changes nothing. */
+    app.post("/auth/logout", async (c) => {
+        const owner = c.get("owner");
+        if (owner)
+            await sql `UPDATE user_sessions SET revoked_at = now() WHERE id = ${owner.sessionId}`;
+        clearSessionCookies(c, deps.secure);
+        return c.json({ ok: true });
+    });
+    /**
+     * Who am I, and what can I see — the dashboard's first call on every load.
+     *
+     * It returns the projects too, because every dashboard screen needs them and
+     * a separate round trip for a list this size is a round trip for nothing.
+     */
+    app.get("/api/v1/me", async (c) => {
+        const owner = c.get("owner");
+        if (!owner)
+            return fail(c, 401, "unauthorized", "Sign in to the dashboard first.");
+        const [org] = await sql `
+      SELECT name, slug FROM orgs WHERE id = ${owner.orgId}
+    `;
+        const projects = await sql `
+      SELECT p.uid, p.name, p.key_prefix, p.write_mode,
+             count(t.id)::int AS threads,
+             count(t.id) FILTER (WHERE t.status <> 'resolved')::int AS unresolved
+      FROM projects p
+      LEFT JOIN threads t ON t.project_id = p.id AND t.deleted_at IS NULL AND t.private = false
+      WHERE p.org_id = ${owner.orgId} AND p.deleted_at IS NULL
+      GROUP BY p.id, p.uid, p.name, p.key_prefix, p.write_mode
+      ORDER BY p.created_at
+    `;
+        return c.json({
+            // NO id. Foundations §2.10 mints no `usr_` prefix, and the dashboard has
+            // no use for one: it renders a name and an email. AC-1-9 is about
+            // project uuids specifically, but the habit is the point — an internal
+            // id put on the wire because it was to hand is how the first one always
+            // gets out.
+            user: { email: owner.email, name: owner.name },
+            org: { name: org?.name ?? "", slug: org?.slug ?? "" },
+            projects: projects.map((p) => ({
+                uid: p.uid,
+                name: p.name,
+                keyPrefix: p.key_prefix,
+                writeMode: p.write_mode,
+                threads: p.threads,
+                unresolved: p.unresolved,
+            })),
+        });
+    });
+    return app;
+}
+export { setSessionCookies };
+//# sourceMappingURL=owner.js.map

package/dist/routes/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../src/routes/owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAwC,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAkDpG,oEAAoE;AACpE,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7C,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAEtF,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAa,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAW,CAAC;AAE9E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAqB;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC,CAAC;IAC/E,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAA6B,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAM,EAAE,KAAa,EAAE,IAAY,EAAE,MAAe,EAAE,OAAe;IAC9F,MAAM,IAAI,GAAG,iCAAiC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACnF,iFAAiF;IACjF,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,wBAAwB,IAAI,KAAK,eAAe,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,wEAAwE;IACxE,uEAAuE;IACvE,6EAA6E;IAC7E,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,qBAAqB,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAM,EAAE,MAAe;IAClD,MAAM,IAAI,GAAG,kCAAkC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1E,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,wBAAwB,gBAAgB,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,qBAAqB,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,CAAM,EAAE,IAAY;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAQ,EAAE,wBAAwB,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAEtB;;;;6BAIwB,MAAM,CAAC,KAAK,CAAC;;6BAEb,EAAE;+BACA,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC;KAC1D,CAAC;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAExB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC/D,KAAK,GAAG,CAAA,2CAA2C,EAAE,eAAe,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,MAAM,CAAC,CAAM;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACpD,OAAO,CACL,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAC/G,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAQ,CAAS,CAAC,IAAI,CACpB;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;oBAC1C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;iBAC9B;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAQ,CAAC,EAAE,CAAC;YAC5E,OAAQ,CAAS,CAAC,IAAI,CACpB;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,yEAAyE;oBAClF,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;iBAC9B;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAe;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C;;;;OAIG;IACH,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,4EAA4E;QAC5E,EAAE;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,oEAAoE;QACpE,iEAAiE;QACjE,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,yEAAyE;QACzE,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjG,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,8CAA8C,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmD,CAAC;QACtG,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,oDAAoD,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAA6F;;iCAExF,KAAK;KACjC,CAAC;QACF,uEAAuE;QACvE,0DAA0D;QAC1D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;QACxD,MAAM,GAAG,CAAA;;gBAEG,UAAU,EAAE,KAAK,IAAK,CAAC,MAAM,KAAK,IAAK,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC;gBAC5D,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,OAAO;KACvE,CAAC;QACF,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;QAC/E,yEAAyE;QACzE,yEAAyE;QACzE,qCAAqC;QACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,MAAM,GAAG,CAAA,0DAA0D,KAAK,CAAC,SAAS,EAAE,CAAC;QAChG,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,iCAAiC,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAkC;+CACd,KAAK,CAAC,KAAK;KACrD,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAEzB;;;;;;yBAMoB,KAAK,CAAC,KAAK;;;KAG/B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,YAAY;YACZ,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAC9C,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;YACrD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}