@yadsh/dsh-qa-surface 0.1.1 → 0.3.0

package/lib/accounts/index.js

@@ -0,0 +1,2 @@
+export { QaAccounts, QaAccountsError, defaultAccountsFilePath, } from "./store.js";
+//# sourceMappingURL=index.js.map

package/lib/accounts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accounts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,eAAe,EACf,uBAAuB,GAGxB,MAAM,YAAY,CAAC"}

package/lib/accounts/store.js

@@ -0,0 +1,478 @@
+import { createHmac, randomBytes, randomUUID, scryptSync, timingSafeEqual, } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+export class QaAccountsError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "QaAccountsError";
+    }
+}
+const SCRYPT_KEY_LENGTH = 32;
+const SECRET_BYTES = 32;
+const MIN_PASSWORD_LENGTH = 8;
+const MAX_DISPLAY_NAME_LENGTH = 100;
+const MAX_CLAIM_BATCH = 50;
+const MAX_SESSION_ID_LENGTH = 200;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+/** The accounts file lives next to the DSH home the launcher exports. */
+export function defaultAccountsFilePath() {
+    const home = process.env.DSH_HOME?.trim();
+    return path.join(home !== undefined && home !== "" ? home : process.cwd(), "qa-accounts.json");
+}
+function toPublic(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        displayName: user.displayName,
+        role: user.role,
+        createdAt: user.createdAt,
+        lastLoginAt: user.lastLoginAt,
+        disabled: user.disabled === true,
+    };
+}
+function hashPassword(password) {
+    const salt = randomBytes(16);
+    const hash = scryptSync(password, salt, SCRYPT_KEY_LENGTH);
+    return { salt: salt.toString("hex"), hash: hash.toString("hex") };
+}
+function passwordMatches(password, stored) {
+    const expected = Buffer.from(stored.hash, "hex");
+    const actual = scryptSync(password, Buffer.from(stored.salt, "hex"), expected.length);
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+function base64Url(value) {
+    return Buffer.from(value).toString("base64url");
+}
+function stampOf(stat) {
+    return { mtimeMs: stat.mtimeMs, size: stat.size };
+}
+/**
+ * Host authority for QA accounts: the file-backed user list, the session
+ * ownership map and the HMAC account tokens. All mutations are synchronous
+ * and persisted atomically (temp file + rename); LAN scale keeps this trivial.
+ */
+export class QaAccounts {
+    filePath;
+    file;
+    authAttempts = [];
+    maxAuthAttemptsPerMinute;
+    sessionTtlDays;
+    allowRegistration;
+    /** mtime+size of the file as of the last load; the external-change probe. */
+    lastLoadStamp = { mtimeMs: Number.NEGATIVE_INFINITY, size: -1 };
+    constructor(filePath = defaultAccountsFilePath(), options) {
+        this.filePath = filePath;
+        this.sessionTtlDays = options.sessionTtlDays;
+        this.allowRegistration = options.allowRegistration;
+        this.maxAuthAttemptsPerMinute = options.maxAuthAttemptsPerMinute ?? 30;
+        this.file = this.load();
+    }
+    /**
+     * The qa-accounts CLI runs in its own process against the same file. Re-read
+     * it whenever it changed on disk, before every read or read-modify-write:
+     * without this a running Host would keep honoring tokens the CLI revoked
+     * and its next save would resurrect the CLI's change from a stale snapshot.
+     * One file, one writer at a time remains the deployment's discipline; LAN
+     * scale keeps the stat per operation trivial.
+     */
+    reloadIfChanged() {
+        let stat;
+        try {
+            stat = statSync(this.filePath);
+        }
+        catch {
+            // The file vanished between operations (never by our hand): keep
+            // serving the in-memory state instead of resetting every account.
+            return;
+        }
+        if (stat.mtimeMs === this.lastLoadStamp.mtimeMs &&
+            stat.size === this.lastLoadStamp.size) {
+            return;
+        }
+        this.file = this.load();
+    }
+    load() {
+        let raw;
+        let stat;
+        try {
+            raw = readFileSync(this.filePath, "utf8");
+            stat = statSync(this.filePath);
+        }
+        catch (error) {
+            // Only a missing file means "first run": anything else (permissions,
+            // a directory in the way, I/O failure) must surface, or the store
+            // would silently reset every account it cannot read.
+            if (error.code !== "ENOENT")
+                throw error;
+            const created = {
+                version: 1,
+                secret: base64Url(randomBytes(SECRET_BYTES)),
+                users: [],
+                ownership: {},
+            };
+            this.persist(created);
+            return created;
+        }
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            parsed.version !== 1 ||
+            typeof parsed.secret !== "string" ||
+            !Array.isArray(parsed.users)) {
+            throw new Error(`qa-accounts: ${this.filePath} is not a recognizable accounts file; refusing to overwrite it`);
+        }
+        const file = parsed;
+        if (stat !== undefined)
+            this.lastLoadStamp = stampOf(stat);
+        return {
+            version: 1,
+            secret: file.secret,
+            users: file.users,
+            ownership: file.ownership ?? {},
+        };
+    }
+    persist(file) {
+        mkdirSync(path.dirname(this.filePath), { recursive: true });
+        // A per-process temp name: the Host and the CLI never race on one file.
+        const temp = `${this.filePath}.${process.pid}.tmp`;
+        writeFileSync(temp, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+        renameSync(temp, this.filePath);
+        this.lastLoadStamp = stampOf(statSync(this.filePath));
+    }
+    save() {
+        this.persist(this.file);
+    }
+    pruneAuthAttempts() {
+        const cutoff = Date.now() - 60_000;
+        let stale = 0;
+        for (const at of this.authAttempts) {
+            if (at >= cutoff)
+                break;
+            stale += 1;
+        }
+        if (stale > 0)
+            this.authAttempts.splice(0, stale);
+    }
+    assertAuthBudget() {
+        this.pruneAuthAttempts();
+        if (this.authAttempts.length >= this.maxAuthAttemptsPerMinute) {
+            throw new QaAccountsError("rate-limited", "too many authentication attempts; retry in a minute");
+        }
+        this.authAttempts.push(Date.now());
+    }
+    userByEmail(email) {
+        return this.file.users.find((user) => user.email === email);
+    }
+    register(email, password, displayName) {
+        this.reloadIfChanged();
+        this.assertAuthBudget();
+        if (!this.allowRegistration) {
+            throw new QaAccountsError("registration-disabled", "self-registration is disabled on this deployment");
+        }
+        const normalized = email.trim().toLowerCase();
+        if (!EMAIL_PATTERN.test(normalized) || normalized.length > 254) {
+            throw new QaAccountsError("invalid-email", "email is not a usable address");
+        }
+        if (password.length < MIN_PASSWORD_LENGTH || password.length > 200) {
+            throw new QaAccountsError("weak-password", `password must be ${MIN_PASSWORD_LENGTH} to 200 characters`);
+        }
+        const name = (displayName ?? "").trim();
+        if (name.length > MAX_DISPLAY_NAME_LENGTH) {
+            throw new QaAccountsError("invalid-display-name", `display name must be at most ${MAX_DISPLAY_NAME_LENGTH} characters`);
+        }
+        if (this.userByEmail(normalized) !== undefined) {
+            throw new QaAccountsError("email-taken", "this email is already registered");
+        }
+        // The first account boots the deployment's admin; later ones are users.
+        const role = this.file.users.length === 0 ? "admin" : "user";
+        const user = {
+            id: randomUUID(),
+            email: normalized,
+            displayName: name === "" ? (normalized.split("@")[0] ?? normalized) : name,
+            role,
+            passwordHash: hashPassword(password),
+            createdAt: new Date().toISOString(),
+            lastLoginAt: new Date().toISOString(),
+            tokenVersion: 0,
+        };
+        this.file = { ...this.file, users: [...this.file.users, user] };
+        this.save();
+        return { token: this.mintToken(user.id), user: toPublic(user) };
+    }
+    login(email, password) {
+        this.reloadIfChanged();
+        this.assertAuthBudget();
+        const user = this.userByEmail(email.trim().toLowerCase());
+        // One message for unknown email and wrong password, both scrypt-checked
+        // in the known-user path so the timing does not enumerate addresses.
+        if (user === undefined) {
+            passwordMatches(password, hashPassword(password));
+            throw new QaAccountsError("invalid-credentials", "email or password is incorrect");
+        }
+        if (!passwordMatches(password, user.passwordHash)) {
+            throw new QaAccountsError("invalid-credentials", "email or password is incorrect");
+        }
+        if (user.disabled === true) {
+            throw new QaAccountsError("account-disabled", "this account has been disabled by the operator");
+        }
+        user.lastLoginAt = new Date().toISOString();
+        this.save();
+        return { token: this.mintToken(user.id), user: toPublic(user) };
+    }
+    whoami(token) {
+        this.reloadIfChanged();
+        const userId = this.verifyToken(token);
+        if (userId === null)
+            return { authenticated: false };
+        const user = this.file.users.find((candidate) => candidate.id === userId);
+        return user === undefined || user.disabled === true
+            ? { authenticated: false }
+            : { authenticated: true, user: toPublic(user) };
+    }
+    /** Resolve a token to its user, or null for absent/invalid/expired ones. */
+    verifyToken(token) {
+        if (typeof token !== "string")
+            return null;
+        const parts = token.split(".");
+        if (parts.length !== 3 || parts[0] !== "v1")
+            return null;
+        const payload = parts[1];
+        const signature = parts[2];
+        if (payload === undefined || signature === undefined)
+            return null;
+        let expected;
+        let decoded;
+        try {
+            expected = createHmac("sha256", this.file.secret)
+                .update(payload)
+                .digest();
+            const expectedSignature = base64Url(expected);
+            if (signature.length !== expectedSignature.length ||
+                !timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
+                return null;
+            }
+            decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        }
+        catch {
+            return null;
+        }
+        if (typeof decoded.uid !== "string" ||
+            typeof decoded.exp !== "number" ||
+            decoded.exp < Date.now()) {
+            return null;
+        }
+        // The account's current token version must match the one burned into the
+        // token: bumping it (disable/revoke) invalidates every issued token.
+        const user = this.file.users.find((candidate) => candidate.id === decoded.uid);
+        const version = typeof decoded.ver === "number" ? decoded.ver : undefined;
+        if (user === undefined || version !== (user.tokenVersion ?? 0)) {
+            return null;
+        }
+        return decoded.uid;
+    }
+    mintToken(userId) {
+        const user = this.file.users.find((candidate) => candidate.id === userId);
+        const payload = base64Url(JSON.stringify({
+            uid: userId,
+            exp: Date.now() + this.sessionTtlDays * 86_400_000,
+            ver: user?.tokenVersion ?? 0,
+        }));
+        const signature = base64Url(createHmac("sha256", this.file.secret).update(payload).digest());
+        return `v1.${payload}.${signature}`;
+    }
+    /** The account behind a token, or an auth-required refusal. */
+    requireUser(token) {
+        const userId = this.verifyToken(token);
+        const user = userId === null
+            ? undefined
+            : this.file.users.find((candidate) => candidate.id === userId);
+        if (user === undefined || user.disabled === true) {
+            throw new QaAccountsError("auth-required", "a valid QA account token is required");
+        }
+        return user;
+    }
+    /**
+     * Ownership gate for one session: claim unowned sessions for the requesting
+     * user (first come, first served — the pre-accounts migration path), refuse
+     * foreign sessions unless the caller administers the deployment.
+     */
+    ensureSessionAccess(token, sessionId) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        const owner = this.file.ownership[sessionId];
+        if (owner === undefined) {
+            this.file = {
+                ...this.file,
+                ownership: {
+                    ...this.file.ownership,
+                    [sessionId]: { userId: user.id, claimedAt: new Date().toISOString() },
+                },
+            };
+            this.save();
+            return toPublic(user);
+        }
+        if (owner.userId !== user.id && user.role !== "admin") {
+            throw new QaAccountsError("session-owned-elsewhere", "this session belongs to another QA user");
+        }
+        return toPublic(user);
+    }
+    /** Bulk-claim a browser's local chat index; foreign ids come back as conflicts. */
+    claimSessions(token, sessionIds) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        if (sessionIds.length > MAX_CLAIM_BATCH) {
+            throw new QaAccountsError("auth-required", "claim batch is too large");
+        }
+        let claimed = 0;
+        const conflicts = [];
+        const ownership = { ...this.file.ownership };
+        for (const raw of sessionIds) {
+            const sessionId = typeof raw === "string" ? raw.trim() : "";
+            if (sessionId === "" || sessionId.length > MAX_SESSION_ID_LENGTH)
+                continue;
+            const owner = ownership[sessionId];
+            if (owner === undefined) {
+                ownership[sessionId] = {
+                    userId: user.id,
+                    claimedAt: new Date().toISOString(),
+                };
+                claimed += 1;
+            }
+            else if (owner.userId !== user.id) {
+                conflicts.push(sessionId);
+            }
+        }
+        if (claimed > 0) {
+            this.file = { ...this.file, ownership };
+            this.save();
+        }
+        return { claimed, conflicts };
+    }
+    /** Session ids owned by the token's user, most recently claimed first. */
+    ownedSessionIds(token) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        return Object.entries(this.file.ownership)
+            .filter(([, owner]) => owner.userId === user.id)
+            .sort((left, right) => right[1].claimedAt.localeCompare(left[1].claimedAt))
+            .map(([sessionId]) => sessionId);
+    }
+    /**
+     * Every ownership entry with the owner's display name resolved at read
+     * time, oldest claim first. Admin-only: this is the cross-user view the
+     * admin sidebar groups chats by; ordinary accounts get a dedicated refusal.
+     */
+    listOwnership(token) {
+        const user = this.requireUser(token);
+        if (user.role !== "admin") {
+            throw new QaAccountsError("admin-required", "listing chat ownership requires an admin account");
+        }
+        const names = new Map(this.file.users.map((candidate) => [candidate.id, candidate.displayName]));
+        return Object.entries(this.file.ownership)
+            .map(([sessionId, owner]) => ({
+            sessionId,
+            userId: owner.userId,
+            displayName: names.get(owner.userId) ?? owner.userId,
+            claimedAt: owner.claimedAt,
+        }))
+            .sort((left, right) => left.claimedAt.localeCompare(right.claimedAt));
+    }
+    // ---------------------------------------------------------------------------
+    // Operator management surface (the qa-accounts CLI; never browser-callable).
+    // ---------------------------------------------------------------------------
+    /** Every account, file order; for `qa-accounts list`. */
+    listUsers() {
+        this.reloadIfChanged();
+        return this.file.users.map((user) => ({
+            email: user.email,
+            displayName: user.displayName,
+            role: user.role,
+            disabled: user.disabled === true,
+            createdAt: user.createdAt,
+            lastLoginAt: user.lastLoginAt,
+        }));
+    }
+    /** Create an account outside the self-registration gate. */
+    addUser(email, password, options = {}) {
+        this.reloadIfChanged();
+        this.assertAuthBudget();
+        const normalized = email.trim().toLowerCase();
+        if (!EMAIL_PATTERN.test(normalized) || normalized.length > 254) {
+            throw new QaAccountsError("invalid-email", "email is not a usable address");
+        }
+        if (password.length < MIN_PASSWORD_LENGTH || password.length > 200) {
+            throw new QaAccountsError("weak-password", `password must be ${MIN_PASSWORD_LENGTH} to 200 characters`);
+        }
+        const name = (options.displayName ?? "").trim();
+        if (name.length > MAX_DISPLAY_NAME_LENGTH) {
+            throw new QaAccountsError("invalid-display-name", `display name must be at most ${MAX_DISPLAY_NAME_LENGTH} characters`);
+        }
+        if (options.role !== undefined &&
+            options.role !== "admin" &&
+            options.role !== "user") {
+            throw new QaAccountsError("invalid-role", "role must be admin or user");
+        }
+        if (this.userByEmail(normalized) !== undefined) {
+            throw new QaAccountsError("email-taken", "this email is already registered");
+        }
+        const user = {
+            id: randomUUID(),
+            email: normalized,
+            displayName: name === "" ? (normalized.split("@")[0] ?? normalized) : name,
+            role: options.role ?? (this.file.users.length === 0 ? "admin" : "user"),
+            passwordHash: hashPassword(password),
+            createdAt: new Date().toISOString(),
+            lastLoginAt: null,
+            tokenVersion: 0,
+        };
+        this.file = { ...this.file, users: [...this.file.users, user] };
+        this.save();
+        return toPublic(user);
+    }
+    editUser(email, edit) {
+        this.reloadIfChanged();
+        const normalized = email.trim().toLowerCase();
+        const index = this.file.users.findIndex((user) => user.email === normalized);
+        if (index === -1) {
+            throw new QaAccountsError("invalid-credentials", "no such account");
+        }
+        const updated = edit(this.file.users[index]);
+        const users = [...this.file.users];
+        users[index] = updated;
+        this.file = { ...this.file, users };
+        this.save();
+        return updated;
+    }
+    /** Grant or revoke the admin role. */
+    setUserRole(email, role) {
+        return toPublic(this.editUser(email, (user) => ({ ...user, role })));
+    }
+    /**
+     * Disable an account: future logins are refused and every live token is
+     * invalidated (the token version bumps). `enable` does not resurrect old
+     * tokens — the account signs in again.
+     */
+    setUserDisabled(email, disabled) {
+        return toPublic(this.editUser(email, (user) => {
+            const next = user;
+            if (disabled) {
+                next.disabled = true;
+                next.tokenVersion = (next.tokenVersion ?? 0) + 1;
+            }
+            else {
+                delete next.disabled;
+            }
+            return next;
+        }));
+    }
+    /** Invalidate every token of the account (password-leak response). */
+    revokeTokens(email) {
+        return toPublic(this.editUser(email, (user) => ({
+            ...user,
+            tokenVersion: (user.tokenVersion ?? 0) + 1,
+        })));
+    }
+}
+//# sourceMappingURL=store.js.map

package/lib/accounts/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/accounts/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AAEjB,OAAO,IAAI,MAAM,WAAW,CAAC;AA6B7B,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAA6B,EACtC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAsCD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAEpD,yEAAyE;AACzE,MAAM,UAAU,uBAAuB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EACxD,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB;IAChC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,MAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CACvB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAC/B,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,IAAW;IAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAUV,QAAQ;IATX,IAAI,CAAe;IACV,YAAY,GAAa,EAAE,CAAC;IAC5B,wBAAwB,CAAS;IACjC,cAAc,CAAS;IACvB,iBAAiB,CAAU;IAC5C,6EAA6E;IACrE,aAAa,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAExE,YACW,QAAQ,GAAW,uBAAuB,EAAE,EACrD,OAA0B;wBADjB,QAAQ;QAGjB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACK,eAAe;QACrB,IAAI,IAAW,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,OAAO;QACT,CAAC;QACD,IACE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,aAAa,CAAC,OAAO;YAC3C,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,EACrC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,IAAI;QACV,IAAI,GAAW,CAAC;QAChB,IAAI,IAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,kEAAkE;YAClE,qDAAqD;YACrD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,OAAO,GAAiB;gBAC5B,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAC5C,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,EAAE;aACd,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAAuB,CAAC,OAAO,KAAK,CAAC;YACtC,OAAQ,MAAuB,CAAC,MAAM,KAAK,QAAQ;YACnD,CAAC,KAAK,CAAC,OAAO,CAAE,MAAuB,CAAC,KAAK,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,QAAQ,gEAAgE,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAsB,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;SAChC,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,IAAkB;QAChC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACnD,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAEO,iBAAiB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,EAAE,IAAI,MAAM;gBAAE,MAAM;YACxB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9D,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CACN,KAAa,EACb,QAAgB,EAChB,WAAoB;QAEpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CACvB,uBAAuB,EACvB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC/D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACnE,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,oBAAoB,mBAAmB,oBAAoB,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,gCAAgC,uBAAuB,aAAa,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,MAAM,IAAI,GAAkB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5E,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,KAAK,EAAE,UAAU;YACjB,WAAW,EACT,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/D,IAAI;YACJ,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,KAAa,EAAE,QAAgB;QACnC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC1E,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YACjD,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE;YAC1B,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,WAAW,CAAC,KAAa;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,QAAgB,CAAC;QACrB,IAAI,OAAwD,CAAC;QAC7D,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;iBAC9C,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,EAAE,CAAC;YACZ,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC9C,IACE,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;gBAC7C,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EACxE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EACxB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,GAAG,CAC5C,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IAEO,SAAS,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,SAAS,CACvB,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,UAAU;YAClD,GAAG,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC;SAC7B,CAAC,CACH,CAAC;QACF,MAAM,SAAS,GAAG,SAAS,CACzB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAChE,CAAC;QACF,OAAO,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;IACtC,CAAC;IAED,+DAA+D;IAC/D,WAAW,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GACR,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,KAAa,EAAE,SAAiB;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,GAAG;gBACV,GAAG,IAAI,CAAC,IAAI;gBACZ,SAAS,EAAE;oBACT,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS;oBACtB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;iBACtE;aACF,CAAC;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,mFAAmF;IACnF,aAAa,CAAC,KAAa,EAAE,UAA6B;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB;gBAC9D,SAAS;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS,CAAC,SAAS,CAAC,GAAG;oBACrB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACpC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;aAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CACpD;aACA,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAC1E,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM;YACpD,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAE9E,yDAAyD;IACzD,SAAS;QAQP,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,OAAO,CACL,KAAa,EACb,QAAgB,EAChB,OAAO,GAAmD,EAAE;QAE5D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC/D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACnE,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,oBAAoB,mBAAmB,oBAAoB,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,gCAAgC,uBAAuB,aAAa,CACrE,CAAC;QACJ,CAAC;QACD,IACE,OAAO,CAAC,IAAI,KAAK,SAAS;YAC1B,OAAO,CAAC,IAAI,KAAK,OAAO;YACxB,OAAO,CAAC,IAAI,KAAK,MAAM,EACvB,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,KAAK,EAAE,UAAU;YACjB,WAAW,EACT,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAEO,QAAQ,CACd,KAAa,EACb,IAAsC;QAEtC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CACpC,CAAC;QACF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAe,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sCAAsC;IACtC,WAAW,CAAC,KAAa,EAAE,IAAmB;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAa,EAAE,QAAiB;QAC9C,OAAO,QAAQ,CACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC;YAClB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,YAAY,CAAC,KAAa;QACxB,OAAO,QAAQ,CACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,IAAI;YACP,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;SAC3C,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;CACF"}

package/lib/attestation.js

@@ -0,0 +1,10 @@
+/** Host rejection whose wire message carries the coarse reason marker. */
+export class QaAttestationError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "QaAttestationError";
+    }
+}
+//# sourceMappingURL=attestation.js.map

package/lib/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAqBA,0EAA0E;AAC1E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC,MAAM;IADjB,YACW,MAA2B,EACpC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/lib/cli.js

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { QaAccounts, QaAccountsError, defaultAccountsFilePath, } from "./accounts/store.js";
+const defaultIo = {
+    out: (line) => process.stdout.write(`${line}\n`),
+    err: (line) => process.stderr.write(`${line}\n`),
+};
+const USAGE = `Usage:
+  qa-accounts [--file <path>] list
+  qa-accounts [--file <path>] add <email> --password-stdin [--name <name>] [--role admin|user]
+  qa-accounts [--file <path>] set-role <email> <admin|user>
+  qa-accounts [--file <path>] disable <email>     # blocks logins and revokes live tokens
+  qa-accounts [--file <path>] enable <email>
+  qa-accounts [--file <path>] revoke <email>      # invalidates every issued token
+
+The accounts file defaults to \\$DSH_HOME/qa-accounts.json. Passwords are read
+from stdin (one line) so they never land in shell history.`;
+function readPasswordStdin() {
+    let password;
+    try {
+        password = readFileSync(0, "utf8");
+    }
+    catch (error) {
+        throw new Error(`could not read the password from stdin: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    return password.replace(/\r?\n$/u, "");
+}
+/** Execute one management command; returns the process exit code. */
+export function run(argv, io, readPassword = readPasswordStdin) {
+    const positional = [];
+    const options = new Map();
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === "--password-stdin") {
+            options.set("password-stdin", "true");
+            continue;
+        }
+        if (arg === "--file" || arg === "--name" || arg === "--role") {
+            const value = argv[index + 1];
+            if (value === undefined || value.startsWith("--")) {
+                throw new Error(`${arg} requires a value`);
+            }
+            options.set(arg.slice(2), value);
+            index += 1;
+            continue;
+        }
+        positional.push(arg);
+    }
+    const file = options.get("file") ?? defaultAccountsFilePath();
+    const [command, first, second] = positional;
+    if (command === undefined || command === "help" || command === "--help") {
+        io.out(USAGE);
+        return command === undefined ? 1 : 0;
+    }
+    // Management options that only shape minting behavior; the CLI never mints.
+    const accounts = new QaAccounts(file, {
+        sessionTtlDays: 30,
+        allowRegistration: false,
+    });
+    const requireArgs = (count) => {
+        const given = [first, second].filter((value) => value !== undefined).length;
+        if (given < count) {
+            throw new Error(`the ${command} command requires ${count} argument(s)`);
+        }
+    };
+    switch (command) {
+        case "list": {
+            const users = accounts.listUsers();
+            if (users.length === 0) {
+                io.out("no accounts yet");
+                return 0;
+            }
+            for (const user of users) {
+                io.out(`${user.email}\t${user.displayName}\t${user.role}` +
+                    `${user.disabled ? "\tdisabled" : ""}` +
+                    `${user.lastLoginAt === null ? "" : `\tlast login ${user.lastLoginAt}`}`);
+            }
+            return 0;
+        }
+        case "add": {
+            requireArgs(1);
+            if (!options.has("password-stdin")) {
+                throw new Error("the add command requires --password-stdin");
+            }
+            const role = options.get("role");
+            if (role !== undefined && role !== "admin" && role !== "user") {
+                throw new Error("--role must be admin or user");
+            }
+            const name = options.get("name");
+            const user = accounts.addUser(first, readPassword(), {
+                ...(name === undefined ? {} : { displayName: name }),
+                ...(role === undefined ? {} : { role: role }),
+            });
+            io.out(`added ${user.email} (${user.role})`);
+            return 0;
+        }
+        case "set-role": {
+            requireArgs(2);
+            if (second !== "admin" && second !== "user") {
+                throw new Error("role must be admin or user");
+            }
+            const user = accounts.setUserRole(first, second);
+            io.out(`${user.email} is now ${user.role}`);
+            return 0;
+        }
+        case "disable": {
+            requireArgs(1);
+            const user = accounts.setUserDisabled(first, true);
+            io.out(`${user.email} disabled; live tokens revoked`);
+            return 0;
+        }
+        case "enable": {
+            requireArgs(1);
+            const user = accounts.setUserDisabled(first, false);
+            io.out(`${user.email} enabled`);
+            return 0;
+        }
+        case "revoke": {
+            requireArgs(1);
+            const user = accounts.revokeTokens(first);
+            io.out(`${user.email} tokens revoked`);
+            return 0;
+        }
+        default:
+            throw new Error(`unknown command ${JSON.stringify(command)}`);
+    }
+}
+export function main(argv, io = defaultIo, readPassword = readPasswordStdin) {
+    try {
+        return run(argv, io, readPassword);
+    }
+    catch (error) {
+        io.err(`qa-accounts: ${error instanceof QaAccountsError ? `${error.message} (reason: ${error.reason})` : error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+}
+/* v8 ignore next */
+if (process.argv[1] !== undefined &&
+    import.meta.url === pathToFileURL(process.argv[1]).href) {
+    process.exitCode = main(process.argv.slice(2));
+}
+//# sourceMappingURL=cli.js.map