@songsid/agend 2.1.12 → 2.2.0-alpha.2

package/dist/web-session.d.ts

@@ -0,0 +1,167 @@
+import { renameSync, unlinkSync, writeFileSync } from "node:fs";
+export type SessionSurface = "local" | "gateway";
+/** `admin` may do everything the panel can; `read` is reserved for the read-only tier (design D6). */
+export type SessionTier = "admin" | "read";
+export interface SessionPolicy {
+    /** Hard cap from creation; activity never extends it. */
+    readonly absoluteMs: number;
+    /** Slides with activity, never past the absolute cap. */
+    readonly idleMs: number;
+}
+/** Design D4. The gateway numbers are shorter because a session there is reachable from the internet. */
+export declare const DEFAULT_SESSION_POLICY: Readonly<Record<SessionSurface, SessionPolicy>>;
+/** More than this and the least recently used one is dropped. */
+export declare const MAX_WEB_SESSIONS = 8;
+/** `lastSeen` is only written to disk this often; creation and revocation always write. */
+export declare const SESSION_PERSIST_DEBOUNCE_MS: number;
+export interface SessionRecord {
+    /** Opaque, safe to show and to name in a revoke request. Not the id and not its hash. */
+    readonly handle: string;
+    readonly idHash: string;
+    readonly created: number;
+    lastSeen: number;
+    readonly absoluteExpiry: number;
+    idleExpiry: number;
+    readonly tier: SessionTier;
+    readonly surface: SessionSurface;
+    readonly exposureId?: string;
+    /** What the person sees in the device list. Display only, never an input to a decision. */
+    readonly label: string;
+    /** `sha256(web.token)` when the session was made; a mismatch means the token was rotated. */
+    readonly tokenEpoch: string;
+}
+export interface SessionSummary {
+    readonly handle: string;
+    readonly created: number;
+    readonly lastSeen: number;
+    readonly absoluteExpiry: number;
+    readonly idleExpiry: number;
+    readonly tier: SessionTier;
+    readonly surface: SessionSurface;
+    readonly label: string;
+    readonly current: boolean;
+}
+export declare function sessionIdHash(sessionId: string): string;
+/** Binds a session to the `web.token` it was issued under. */
+export declare function tokenEpoch(webToken: string): string;
+/**
+ * The value a page sends back in `X-Agend-CSRF`.
+ *
+ * Derived from the session id so it needs no storage, and different from the
+ * cookie value so it can be handed to script that must never see the cookie.
+ */
+export declare function csrfTokenFor(sessionId: string): string;
+export declare function isWellFormedSessionId(value: string): boolean;
+/** Printable, bounded, and never empty: a label is drawn in a page by other people's code. */
+export declare function sanitizeLabel(raw: string): string;
+/** "Chrome on macOS" out of a User-Agent, coarse on purpose — it is a hint for a person, not a fingerprint. */
+export declare function labelFromUserAgent(userAgent: string | undefined): string;
+/** The three file operations the store makes, so a test can make one of them fail. */
+export interface SessionFileOps {
+    writeFileSync: typeof writeFileSync;
+    renameSync: typeof renameSync;
+    unlinkSync: typeof unlinkSync;
+}
+export interface WebSessionStoreOptions {
+    /** Where `web-sessions.json` lives. Omit for a memory-only store (tests). */
+    readonly dataDir?: string;
+    /** Override individual file operations (tests only). */
+    readonly fileOps?: Partial<SessionFileOps>;
+    readonly now?: () => number;
+    readonly policy?: Partial<Record<SessionSurface, SessionPolicy>>;
+    readonly maxSessions?: number;
+    readonly onWarn?: (message: string) => void;
+}
+export declare class WebSessionStore {
+    private readonly pending;
+    private readonly byHash;
+    private readonly now;
+    private readonly policy;
+    private readonly maxSessions;
+    private readonly path;
+    private readonly warn;
+    private dirty;
+    private lastPersist;
+    private readonly ops;
+    /** The sessions the file on disk holds right now, as far as this process knows. */
+    private persisted;
+    constructor(opts?: WebSessionStoreOptions);
+    get size(): number;
+    /** How long a session on this surface may sit unused before it ends. For showing people, not for deciding. */
+    idleWindowMs(surface: SessionSurface): number;
+    /**
+     * Make a session. The id is returned once and never stored; the caller puts it
+     * in a cookie and forgets it.
+     */
+    create(input: {
+        tier: SessionTier;
+        surface: SessionSurface;
+        label: string;
+        tokenEpoch: string;
+        exposureId?: string;
+        pending?: boolean;
+    }): {
+        sessionId: string;
+        record: SessionRecord;
+    };
+    /**
+     * The session this id belongs to, if it is still good.
+     *
+     * Expiry and a rotated `web.token` are decided here, on the server, on every
+     * call — nothing is taken on the cookie's word. An expired or stale record is
+     * deleted as it is found so it cannot be revived by a clock or config change.
+     *
+     * `touch: false` is for a stream that re-checks itself on a timer: counting
+     * that as activity would keep an idle session alive for as long as a tab is
+     * open.
+     */
+    authenticate(sessionId: string | undefined, currentEpoch: string, opts?: {
+        touch?: boolean;
+        surface?: SessionSurface;
+        exposureId?: string;
+    }): SessionRecord | null;
+    /** Recheck a retained server record without retaining/replaying its bearer cookie. */
+    isCurrent(record: SessionRecord, currentEpoch: string): boolean;
+    /** A candidate has no usable credential until the public notice and final fence passed. */
+    activate(sessionId: string): boolean;
+    revokeExposure(exposureId: string): {
+        count: number;
+        durable: boolean;
+    };
+    /** Every live session, newest activity first. `currentIdHash` marks the caller's own. */
+    list(currentIdHash?: string): SessionSummary[];
+    revokeByHandle(handle: string): {
+        found: boolean;
+        durable: boolean;
+    };
+    revokeById(sessionId: string): {
+        removed: boolean;
+        durable: boolean;
+    };
+    /** Every session: how many there were, and whether the revocation is durable. */
+    revokeAll(): {
+        count: number;
+        durable: boolean;
+    };
+    /** Write anything pending. Called on shutdown. */
+    flush(): void;
+    private purgeExpired;
+    private evictLeastRecentlyUsed;
+    private persistIfDue;
+    /**
+     * Write the store. Returns whether it is DURABLE: whether a restart is now unable to bring back a
+     * session memory has dropped — true when the file was replaced, when the old file held nothing memory
+     * dropped (it is merely behind), or when it was removed; false only when a stale file is still there.
+     *
+     * The failure path matters more than the success path. Memory forgets a revoked
+     * session at once; if the file cannot be replaced it still holds that session, and a
+     * restart would read it back — a revoked session, alive again. So when a write fails:
+     * the store stays owing the disk a write (`dirty`, retried by the next change, the
+     * next debounce and shutdown), and if the old file holds anything memory has since
+     * dropped, the old file is removed. A restart then finds no sessions and everyone
+     * signs in again, which is the failure that is safe; it says so, loudly, when even
+     * that removal is impossible.
+     */
+    private persistNow;
+    private load;
+}

package/dist/web-session.js

@@ -0,0 +1,389 @@
+/**
+ * Server-side web sessions.
+ *
+ * The cookie is an opaque 256-bit random id and nothing else: it is not derived
+ * from `web.token`, from a login code, or from anything a guess could be
+ * checked against offline. The server keeps only `sha256(id)`, so neither the
+ * process nor the file on disk can be replayed as a cookie.
+ *
+ * What that buys over the old `sha256(web.token)` cookie:
+ * - it expires on the *server* (absolute cap + sliding idle), not only in the
+ *   browser's `Max-Age`;
+ * - one device can be signed out without signing out the rest;
+ * - a stolen one is one session, not a value shared by every device.
+ *
+ * `tokenEpoch` keeps the property the old cookie had for free: `agend web-token
+ * rotate` (a separate process) changes `web.token`, every record made under the
+ * old one stops matching on its next request, and no restart is needed.
+ *
+ * Sessions are persisted (hashes only) because Settings can restart the fleet,
+ * and a session that lived only in memory would sign the operator out at the
+ * moment they pressed the button — with no way back except a new chat code.
+ *
+ * See `docs/design/web-unification-secure-login.zh-TW.md` §3.3.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+const HOUR = 60 * 60 * 1000;
+const MINUTE = 60 * 1000;
+/** Design D4. The gateway numbers are shorter because a session there is reachable from the internet. */
+export const DEFAULT_SESSION_POLICY = {
+    local: { absoluteMs: 12 * HOUR, idleMs: 2 * HOUR },
+    gateway: { absoluteMs: 4 * HOUR, idleMs: 30 * MINUTE },
+};
+/** More than this and the least recently used one is dropped. */
+export const MAX_WEB_SESSIONS = 8;
+/** `lastSeen` is only written to disk this often; creation and revocation always write. */
+export const SESSION_PERSIST_DEBOUNCE_MS = 60 * 1000;
+const SESSION_ID_PATTERN = /^[0-9a-f]{64}$/;
+const HASH_PATTERN = /^[0-9a-f]{64}$/;
+const HANDLE_PATTERN = /^[0-9a-f]{16}$/;
+const LABEL_MAX = 80;
+export function sessionIdHash(sessionId) {
+    return createHash("sha256").update(`agend-web-session-id-v2:${sessionId}`).digest("hex");
+}
+/** Binds a session to the `web.token` it was issued under. */
+export function tokenEpoch(webToken) {
+    return createHash("sha256").update(`agend-web-epoch-v1:${webToken}`).digest("hex");
+}
+/**
+ * The value a page sends back in `X-Agend-CSRF`.
+ *
+ * Derived from the session id so it needs no storage, and different from the
+ * cookie value so it can be handed to script that must never see the cookie.
+ */
+export function csrfTokenFor(sessionId) {
+    return createHash("sha256").update(`agend-web-csrf-v1:${sessionId}`).digest("hex");
+}
+export function isWellFormedSessionId(value) {
+    return SESSION_ID_PATTERN.test(value);
+}
+/** Printable, bounded, and never empty: a label is drawn in a page by other people's code. */
+export function sanitizeLabel(raw) {
+    const cleaned = raw.replace(/[\u0000-\u001f\u007f<>"'`&]/g, "").replace(/\s+/g, " ").trim().slice(0, LABEL_MAX);
+    return cleaned || "unknown device";
+}
+/** "Chrome on macOS" out of a User-Agent, coarse on purpose — it is a hint for a person, not a fingerprint. */
+export function labelFromUserAgent(userAgent) {
+    if (!userAgent)
+        return "unknown device";
+    const ua = userAgent;
+    const browser = /Edg\//.test(ua) ? "Edge"
+        : /OPR\/|Opera/.test(ua) ? "Opera"
+            : /Firefox\//.test(ua) ? "Firefox"
+                : /Chrome\/|CriOS\//.test(ua) ? "Chrome"
+                    : /Safari\//.test(ua) ? "Safari"
+                        : /curl\//.test(ua) ? "curl"
+                            : "browser";
+    const os = /iPhone|iPad|iOS/.test(ua) ? "iOS"
+        : /Android/.test(ua) ? "Android"
+            : /Mac OS X|Macintosh/.test(ua) ? "macOS"
+                : /Windows/.test(ua) ? "Windows"
+                    : /Linux|X11/.test(ua) ? "Linux"
+                        : "";
+    return sanitizeLabel(os ? `${browser} on ${os}` : browser);
+}
+function isRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return typeof v.handle === "string" && HANDLE_PATTERN.test(v.handle)
+        && typeof v.idHash === "string" && HASH_PATTERN.test(v.idHash)
+        && typeof v.created === "number" && Number.isFinite(v.created)
+        && typeof v.lastSeen === "number" && Number.isFinite(v.lastSeen)
+        && typeof v.absoluteExpiry === "number" && Number.isFinite(v.absoluteExpiry)
+        && typeof v.idleExpiry === "number" && Number.isFinite(v.idleExpiry)
+        && (v.tier === "admin" || v.tier === "read")
+        && (v.surface === "local" || v.surface === "gateway")
+        && (v.exposureId === undefined || (typeof v.exposureId === "string" && /^[0-9a-f]{32}$/.test(v.exposureId)))
+        && typeof v.label === "string" && v.label.length <= LABEL_MAX
+        && typeof v.tokenEpoch === "string" && HASH_PATTERN.test(v.tokenEpoch);
+}
+export class WebSessionStore {
+    pending = new Set();
+    byHash = new Map();
+    now;
+    policy;
+    maxSessions;
+    path;
+    warn;
+    dirty = false;
+    lastPersist = 0;
+    ops;
+    /** The sessions the file on disk holds right now, as far as this process knows. */
+    persisted = new Set();
+    constructor(opts = {}) {
+        this.now = opts.now ?? Date.now;
+        this.policy = {
+            local: opts.policy?.local ?? DEFAULT_SESSION_POLICY.local,
+            gateway: opts.policy?.gateway ?? DEFAULT_SESSION_POLICY.gateway,
+        };
+        this.maxSessions = opts.maxSessions ?? MAX_WEB_SESSIONS;
+        this.path = opts.dataDir ? join(opts.dataDir, "web-sessions.json") : null;
+        this.warn = opts.onWarn ?? (() => { });
+        this.ops = { writeFileSync, renameSync, unlinkSync, ...opts.fileOps };
+        this.load();
+    }
+    get size() { return this.byHash.size; }
+    /** How long a session on this surface may sit unused before it ends. For showing people, not for deciding. */
+    idleWindowMs(surface) { return this.policy[surface].idleMs; }
+    /**
+     * Make a session. The id is returned once and never stored; the caller puts it
+     * in a cookie and forgets it.
+     */
+    create(input) {
+        const now = this.now();
+        this.purgeExpired(now);
+        const sessionId = randomBytes(32).toString("hex");
+        const policy = this.policy[input.surface];
+        const absoluteExpiry = now + policy.absoluteMs;
+        const record = {
+            handle: randomBytes(8).toString("hex"),
+            idHash: sessionIdHash(sessionId),
+            created: now,
+            lastSeen: now,
+            absoluteExpiry,
+            idleExpiry: Math.min(now + policy.idleMs, absoluteExpiry),
+            tier: input.tier,
+            surface: input.surface,
+            ...(input.exposureId ? { exposureId: input.exposureId } : {}),
+            label: sanitizeLabel(input.label),
+            tokenEpoch: input.tokenEpoch,
+        };
+        this.byHash.set(record.idHash, record);
+        if (input.pending)
+            this.pending.add(record.idHash);
+        while (this.byHash.size > this.maxSessions)
+            this.evictLeastRecentlyUsed();
+        this.persistNow();
+        return { sessionId, record };
+    }
+    /**
+     * The session this id belongs to, if it is still good.
+     *
+     * Expiry and a rotated `web.token` are decided here, on the server, on every
+     * call — nothing is taken on the cookie's word. An expired or stale record is
+     * deleted as it is found so it cannot be revived by a clock or config change.
+     *
+     * `touch: false` is for a stream that re-checks itself on a timer: counting
+     * that as activity would keep an idle session alive for as long as a tab is
+     * open.
+     */
+    authenticate(sessionId, currentEpoch, opts = {}) {
+        if (!sessionId || !SESSION_ID_PATTERN.test(sessionId))
+            return null;
+        const record = this.byHash.get(sessionIdHash(sessionId));
+        if (!record || this.pending.has(record.idHash))
+            return null;
+        if (record.surface !== (opts.surface ?? "local")
+            || (record.surface === "gateway" && (!opts.exposureId || record.exposureId !== opts.exposureId)))
+            return null;
+        const now = this.now();
+        if (now >= record.absoluteExpiry || now >= record.idleExpiry || record.tokenEpoch !== currentEpoch) {
+            this.byHash.delete(record.idHash);
+            this.persistNow();
+            return null;
+        }
+        if (opts.touch !== false) {
+            record.lastSeen = now;
+            record.idleExpiry = Math.min(now + this.policy[record.surface].idleMs, record.absoluteExpiry);
+            this.dirty = true;
+            this.persistIfDue(now);
+        }
+        return record;
+    }
+    /** Recheck a retained server record without retaining/replaying its bearer cookie. */
+    isCurrent(record, currentEpoch) {
+        return this.byHash.get(record.idHash) === record && !this.pending.has(record.idHash)
+            && record.tokenEpoch === currentEpoch && this.now() < record.absoluteExpiry && this.now() < record.idleExpiry;
+    }
+    /** A candidate has no usable credential until the public notice and final fence passed. */
+    activate(sessionId) {
+        const hash = sessionIdHash(sessionId);
+        if (!this.byHash.has(hash) || !this.pending.delete(hash))
+            return false;
+        this.persistNow();
+        return true;
+    }
+    revokeExposure(exposureId) {
+        let count = 0;
+        for (const [hash, record] of this.byHash) {
+            if (record.surface === "gateway" && record.exposureId === exposureId) {
+                this.byHash.delete(hash);
+                this.pending.delete(hash);
+                count++;
+            }
+        }
+        return { count, durable: this.persistNow() };
+    }
+    /** Every live session, newest activity first. `currentIdHash` marks the caller's own. */
+    list(currentIdHash) {
+        this.purgeExpired(this.now());
+        return [...this.byHash.values()].filter(r => !this.pending.has(r.idHash))
+            .sort((a, b) => b.lastSeen - a.lastSeen)
+            .map(r => ({
+            handle: r.handle,
+            created: r.created,
+            lastSeen: r.lastSeen,
+            absoluteExpiry: r.absoluteExpiry,
+            idleExpiry: r.idleExpiry,
+            tier: r.tier,
+            surface: r.surface,
+            label: r.label,
+            current: r.idHash === currentIdHash,
+        }));
+    }
+    /*
+     * Every revocation says whether it is DURABLE: whether a restart could bring the revoked session back.
+     * Memory forgets it at once; the file may not. A caller that reports "signed out" must not report it
+     * when it is not durable — the operator would believe a session is dead that the next start revives.
+     */
+    revokeByHandle(handle) {
+        if (!HANDLE_PATTERN.test(handle))
+            return { found: false, durable: true };
+        for (const [hash, record] of this.byHash) {
+            if (record.handle === handle) {
+                this.byHash.delete(hash);
+                this.pending.delete(hash);
+                return { found: true, durable: this.persistNow() };
+            }
+        }
+        return { found: false, durable: true };
+    }
+    revokeById(sessionId) {
+        if (!SESSION_ID_PATTERN.test(sessionId))
+            return { removed: false, durable: true };
+        const hash = sessionIdHash(sessionId);
+        this.pending.delete(hash);
+        const removed = this.byHash.delete(hash);
+        return { removed, durable: removed ? this.persistNow() : true };
+    }
+    /** Every session: how many there were, and whether the revocation is durable. */
+    revokeAll() {
+        const count = this.byHash.size;
+        this.byHash.clear();
+        this.pending.clear();
+        return { count, durable: this.persistNow() };
+    }
+    /** Write anything pending. Called on shutdown. */
+    flush() {
+        if (this.dirty)
+            this.persistNow();
+    }
+    purgeExpired(now) {
+        let removed = false;
+        for (const [hash, record] of this.byHash) {
+            if (now >= record.absoluteExpiry || now >= record.idleExpiry) {
+                this.byHash.delete(hash);
+                this.pending.delete(hash);
+                removed = true;
+            }
+        }
+        if (removed)
+            this.dirty = true;
+    }
+    evictLeastRecentlyUsed() {
+        let oldest = null;
+        for (const record of this.byHash.values()) {
+            if (!oldest || record.lastSeen < oldest.lastSeen)
+                oldest = record;
+        }
+        if (oldest) {
+            this.byHash.delete(oldest.idHash);
+            this.pending.delete(oldest.idHash);
+        }
+    }
+    persistIfDue(now) {
+        if (this.dirty && now - this.lastPersist >= SESSION_PERSIST_DEBOUNCE_MS)
+            this.persistNow();
+    }
+    /**
+     * Write the store. Returns whether it is DURABLE: whether a restart is now unable to bring back a
+     * session memory has dropped — true when the file was replaced, when the old file held nothing memory
+     * dropped (it is merely behind), or when it was removed; false only when a stale file is still there.
+     *
+     * The failure path matters more than the success path. Memory forgets a revoked
+     * session at once; if the file cannot be replaced it still holds that session, and a
+     * restart would read it back — a revoked session, alive again. So when a write fails:
+     * the store stays owing the disk a write (`dirty`, retried by the next change, the
+     * next debounce and shutdown), and if the old file holds anything memory has since
+     * dropped, the old file is removed. A restart then finds no sessions and everyone
+     * signs in again, which is the failure that is safe; it says so, loudly, when even
+     * that removal is impossible.
+     */
+    persistNow() {
+        this.lastPersist = this.now();
+        if (!this.path) {
+            this.dirty = false;
+            return true;
+        }
+        const dir = dirname(this.path);
+        const temp = `${this.path}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+        try {
+            mkdirSync(dir, { recursive: true });
+            const body = JSON.stringify({ version: 1, sessions: [...this.byHash.values()].filter(r => !this.pending.has(r.idHash)) });
+            this.ops.writeFileSync(temp, body, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            this.ops.renameSync(temp, this.path);
+            try {
+                chmodSync(this.path, 0o600);
+            }
+            catch { /* best effort */ }
+            this.persisted = new Set([...this.byHash.keys()].filter(hash => !this.pending.has(hash)));
+            this.dirty = false;
+            return true;
+        }
+        catch (err) {
+            try {
+                this.ops.unlinkSync(temp);
+            }
+            catch { /* never created or already moved */ }
+            this.dirty = true;
+            const message = err.message;
+            const staleOnDisk = [...this.persisted].some(hash => !this.byHash.has(hash));
+            if (!staleOnDisk) {
+                // Nothing on disk that memory has dropped: the file is merely behind, and a restart only loses the newest sign-ins.
+                this.warn(`web sessions could not be saved (will retry): ${message}`);
+                return true;
+            }
+            try {
+                this.ops.unlinkSync(this.path);
+                this.persisted = new Set();
+                this.warn(`web sessions could not be saved (${message}); removed the old file so a restart cannot bring back a revoked session — everyone will have to sign in again`);
+                return true;
+            }
+            catch {
+                this.warn(`web sessions could not be saved (${message}) and the old file could not be removed: a restart may restore sessions that were revoked since the last successful save. Fix the permissions on ${this.path}`);
+                return false;
+            }
+        }
+    }
+    load() {
+        if (!this.path)
+            return;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.path, "utf8"));
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                this.warn("web sessions file is unreadable — starting with none");
+            return;
+        }
+        const list = parsed?.sessions;
+        if (!Array.isArray(list))
+            return;
+        const now = this.now();
+        for (const entry of list) {
+            if (!isRecord(entry))
+                continue;
+            if (now >= entry.absoluteExpiry || now >= entry.idleExpiry)
+                continue;
+            this.byHash.set(entry.idHash, { ...entry });
+        }
+        while (this.byHash.size > this.maxSessions)
+            this.evictLeastRecentlyUsed();
+        this.persisted = new Set([...this.byHash.keys()].filter(hash => !this.pending.has(hash)));
+    }
+}
+//# sourceMappingURL=web-session.js.map

package/dist/web-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-session.js","sourceRoot":"","sources":["../src/web-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAa1C,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzB,yGAAyG;AACzG,MAAM,CAAC,MAAM,sBAAsB,GAAoD;IACrF,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE;IAClD,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE;CACvD,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,SAAS,GAAG,EAAE,CAAC;AA+BrB,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChH,OAAO,OAAO,IAAI,gBAAgB,CAAC;AACrC,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,kBAAkB,CAAC,SAA6B;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,gBAAgB,CAAC;IACxC,MAAM,EAAE,GAAG,SAAS,CAAC;IACrB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;QACvC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;YAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;gBAChC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;oBACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;wBAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;4BAC1B,CAAC,CAAC,SAAS,CAAC;IACxB,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;gBACvC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC9B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO;wBAC9B,CAAC,CAAC,EAAE,CAAC;IACf,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAoBD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;WAC/D,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;WAC3D,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;WAC3D,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;WAC7D,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;WACzE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;WACjE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;WACzC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;WAClD,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;WACzG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS;WAC1D,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,GAAG,CAAe;IAClB,MAAM,CAAwC;IAC9C,WAAW,CAAS;IACpB,IAAI,CAAgB;IACpB,IAAI,CAA4B;IACzC,KAAK,GAAG,KAAK,CAAC;IACd,WAAW,GAAG,CAAC,CAAC;IACP,GAAG,CAAiB;IACrC,mFAAmF;IAC3E,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,sBAAsB,CAAC,KAAK;YACzD,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,sBAAsB,CAAC,OAAO;SAChE,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/C,8GAA8G;IAC9G,YAAY,CAAC,OAAuB,IAAY,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAErF;;;OAGG;IACH,MAAM,CAAC,KAAgI;QACrI,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/C,MAAM,MAAM,GAAkB;YAC5B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;YAChC,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,GAAG;YACb,cAAc;YACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;YACzD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;YACjC,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;OAUG;IACH,YAAY,CAAC,SAA6B,EAAE,YAAoB,EAAE,OAA2E,EAAE;QAC7I,IAAI,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;eAC3C,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACnG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YACtB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sFAAsF;IACtF,SAAS,CAAC,MAAqB,EAAE,YAAoB;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;eAC/E,MAAM,CAAC,UAAU,KAAK,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;IAClH,CAAC;IAED,2FAA2F;IAC3F,QAAQ,CAAC,SAAiB;QACxB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvE,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAkB;QAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,KAAK,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,yFAAyF;IACzF,IAAI,CAAC,aAAsB;QACzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACtE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa;SACpC,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;;;OAIG;IAEH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClF,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,iFAAiF;IACjF,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,kDAAkD;IAClD,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACpC,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;QACxI,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACjC,CAAC;IAEO,sBAAsB;QAC5B,IAAI,MAAM,GAAyB,IAAI,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ;gBAAE,MAAM,GAAG,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IACxF,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,2BAA2B;YAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7F,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,UAAU;QAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1H,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAChE,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;YACvC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,oHAAoH;gBACpH,IAAI,CAAC,IAAI,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,oCAAoC,OAAO,gHAAgH,CAAC,CAAC;gBACvK,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,oCAAoC,OAAO,oJAAoJ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtN,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAI,MAAwC,EAAE,QAAQ,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,IAAI,GAAG,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG,IAAI,KAAK,CAAC,UAAU;gBAAE,SAAS;YACrE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;CACF"}

package/dist/web-shell-routes.d.ts

@@ -0,0 +1,59 @@
+/**
+ * #1408 §3: the one classifier for the web app's navigations. Every place that has to know "is this a page of the
+ * app?" asks it, and none keeps a list of its own:
+ * - web-api.ts serves the app shell for exactly these paths, never as a prefix fallback;
+ * - the gate's sign-in fallback answers a signed-out browser navigation with the sign-in page;
+ * - the public link's manifest (public-web-gateway.ts) admits these GETs.
+ *
+ * Client routes take only first segments the server's data routes never use (chat, fleet), so a page and a data
+ * read can never be confused (a test checks both directions). /view and /view/<name> are the View panel (step 2;
+ * view-api.ts serves them, open to anyone when `web.view_access` is open). /settings and /settings/<section> are the
+ * Settings panel (step 3; settings-api.ts serves them, signed in only).
+ */
+export declare const FLEET_TABS: readonly ["tasks", "schedules", "teams", "org", "cache", "config"];
+export type FleetTab = typeof FLEET_TABS[number];
+export declare const SETTINGS_SECTIONS: readonly ["agents", "bots", "classic", "general", "advanced"];
+export type SettingsSection = typeof SETTINGS_SECTIONS[number];
+export type ShellRoute = {
+    panel: "chat";
+    instance: string | null;
+} | {
+    panel: "fleet";
+    tab: FleetTab;
+} | {
+    panel: "view";
+    instance: string | null;
+} | {
+    panel: "settings";
+    section: SettingsSection;
+} | {
+    panel: "needs";
+};
+/** What a path is: the app shell (with its route), a malformed shell path (400), or not the shell at all (null). */
+export type ShellMatch = {
+    kind: "shell";
+    route: ShellRoute;
+} | {
+    kind: "malformed";
+} | null;
+/** Longest instance name a path may carry; real names are far shorter. */
+export declare const MAX_INSTANCE_NAME = 128;
+/**
+ * The same rule instance paths are held to (access-path.ts): not empty, no separator, no control character, no
+ * traversal. A name that passes may still be unknown; that is the panel's "not found" state, never an error page.
+ */
+export declare function isSafeInstanceName(name: string): boolean;
+/** The app shell's routes (#1408 §3). Only GET and HEAD are navigations. */
+export declare function shellRoute(method: string, path: string): ShellMatch;
+/** The Settings panel's pages: what settings-api.ts serves (behind the session gate). */
+export declare function isSettingsPage(path: string): boolean;
+/** The View panel's pages: what view-api.ts serves, and what `web.view_access: open` lets anyone read. */
+export declare function isViewPage(path: string): boolean;
+/**
+ * A browser navigation to a page of the web app: the shell's routes. The gate answers these, signed out, with the
+ * sign-in page instead of a JSON 401.
+ */
+export declare function isWebPageNavigation(path: string): boolean;
+/** The app's client-side paths, for links the server builds (#1386 links, the tour). */
+export declare function chatPath(instance: string): string;
+export declare function viewPath(instance: string): string;