@yadsh/dsh-qa-surface 0.2.0 → 0.4.0

package/lib/accounts/store.js

@@ -0,0 +1,461 @@
+import { randomBytes, randomUUID, scryptSync, timingSafeEqual, } from "node:crypto";
+import { QA_PROFILE_DEFAULT_INSTRUCTIONS_MAX, normalizeProfile, validateProfileWrite, } from "../profile.js";
+import { validateCredentials } from "./credentials.js";
+import { QaAccountsError } from "./errors.js";
+import { createFileStampRef, defaultAccountsFilePath, loadAccountsFile, persistAccountsFile, reloadAccountsFileIfChanged, } from "./file.js";
+import { mintToken, verifyToken } from "./token.js";
+export { QaAccountsError } from "./errors.js";
+export { defaultAccountsFilePath } from "./file.js";
+const SCRYPT_KEY_LENGTH = 32;
+const MAX_CLAIM_BATCH = 50;
+const MAX_SESSION_ID_LENGTH = 200;
+function toPublic(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        displayName: user.displayName,
+        role: user.role,
+        createdAt: user.createdAt,
+        lastLoginAt: user.lastLoginAt,
+        disabled: user.disabled === true,
+        profile: normalizeProfile(user.profile),
+    };
+}
+function hashPassword(password) {
+    const salt = randomBytes(16);
+    const hash = scryptSync(password, salt, SCRYPT_KEY_LENGTH);
+    return { salt: salt.toString("hex"), hash: hash.toString("hex") };
+}
+function passwordMatches(password, stored) {
+    const expected = Buffer.from(stored.hash, "hex");
+    const actual = scryptSync(password, Buffer.from(stored.salt, "hex"), expected.length);
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+/**
+ * Host authority for QA accounts: the file-backed user list, the session
+ * ownership map and the HMAC account tokens. All mutations are synchronous
+ * and persisted atomically (temp file + rename); LAN scale keeps this trivial.
+ *
+ * The class is the facade: token mechanics live in token.ts, the file format
+ * and its atomic persistence plus the external-change probe in file.ts, and
+ * the credential rules shared by registration and the operator CLI in
+ * credentials.ts.
+ */
+export class QaAccounts {
+    filePath;
+    file;
+    authAttempts = [];
+    maxAuthAttemptsPerMinute;
+    sessionTtlDays;
+    allowRegistration;
+    /** Character cap on a stored profile's agent guidance. */
+    instructionsMaxLength;
+    /** Declared handle fields; undefined lets an operator write any shape-valid key. */
+    identityFields;
+    /** mtime+size of the file as of the last load; the external-change probe. */
+    fileStamp = createFileStampRef();
+    constructor(filePath = defaultAccountsFilePath(), options) {
+        this.filePath = filePath;
+        this.sessionTtlDays = options.sessionTtlDays;
+        this.allowRegistration = options.allowRegistration;
+        this.maxAuthAttemptsPerMinute = options.maxAuthAttemptsPerMinute ?? 30;
+        this.instructionsMaxLength =
+            options.instructionsMaxLength ?? QA_PROFILE_DEFAULT_INSTRUCTIONS_MAX;
+        this.identityFields = options.identityFields;
+        this.file = loadAccountsFile(this.filePath, this.fileStamp);
+    }
+    /**
+     * Re-read the accounts file when it changed on disk, before every read or
+     * read-modify-write. The probe itself and its cross-process rationale live
+     * with the file layer (reloadAccountsFileIfChanged).
+     */
+    reloadIfChanged() {
+        const loaded = reloadAccountsFileIfChanged(this.filePath, this.fileStamp);
+        if (loaded !== undefined)
+            this.file = loaded;
+    }
+    save() {
+        persistAccountsFile(this.filePath, this.file, this.fileStamp);
+    }
+    pruneAuthAttempts() {
+        const cutoff = Date.now() - 60_000;
+        let stale = 0;
+        for (const at of this.authAttempts) {
+            if (at >= cutoff)
+                break;
+            stale += 1;
+        }
+        if (stale > 0)
+            this.authAttempts.splice(0, stale);
+    }
+    assertAuthBudget() {
+        this.pruneAuthAttempts();
+        if (this.authAttempts.length >= this.maxAuthAttemptsPerMinute) {
+            throw new QaAccountsError("rate-limited", "too many authentication attempts; retry in a minute");
+        }
+        this.authAttempts.push(Date.now());
+    }
+    userByEmail(email) {
+        return this.file.users.find((user) => user.email === email);
+    }
+    register(email, password, displayName) {
+        this.reloadIfChanged();
+        this.assertAuthBudget();
+        if (!this.allowRegistration) {
+            throw new QaAccountsError("registration-disabled", "self-registration is disabled on this deployment");
+        }
+        const { email: normalized, displayName: name } = validateCredentials(email, password, displayName);
+        if (this.userByEmail(normalized) !== undefined) {
+            throw new QaAccountsError("email-taken", "this email is already registered");
+        }
+        // The first account boots the deployment's admin; later ones are users.
+        const role = this.file.users.length === 0 ? "admin" : "user";
+        const user = {
+            id: randomUUID(),
+            email: normalized,
+            displayName: name === "" ? (normalized.split("@")[0] ?? normalized) : name,
+            role,
+            passwordHash: hashPassword(password),
+            createdAt: new Date().toISOString(),
+            lastLoginAt: new Date().toISOString(),
+            tokenVersion: 0,
+        };
+        this.file = { ...this.file, users: [...this.file.users, user] };
+        this.save();
+        return { token: this.mintToken(user.id), user: toPublic(user) };
+    }
+    login(email, password) {
+        this.reloadIfChanged();
+        this.assertAuthBudget();
+        const user = this.userByEmail(email.trim().toLowerCase());
+        // One message for unknown email and wrong password, both scrypt-checked
+        // in the known-user path so the timing does not enumerate addresses.
+        if (user === undefined) {
+            passwordMatches(password, hashPassword(password));
+            throw new QaAccountsError("invalid-credentials", "email or password is incorrect");
+        }
+        if (!passwordMatches(password, user.passwordHash)) {
+            throw new QaAccountsError("invalid-credentials", "email or password is incorrect");
+        }
+        if (user.disabled === true) {
+            throw new QaAccountsError("account-disabled", "this account has been disabled by the operator");
+        }
+        user.lastLoginAt = new Date().toISOString();
+        this.save();
+        return { token: this.mintToken(user.id), user: toPublic(user) };
+    }
+    whoami(token) {
+        this.reloadIfChanged();
+        const userId = this.verifyToken(token);
+        if (userId === null)
+            return { authenticated: false };
+        const user = this.file.users.find((candidate) => candidate.id === userId);
+        return user === undefined || user.disabled === true
+            ? { authenticated: false }
+            : { authenticated: true, user: toPublic(user) };
+    }
+    /** Resolve a token to its user, or null for absent/invalid/expired ones. */
+    verifyToken(token) {
+        // Signature, expiry and token-version mechanics live in token.ts.
+        return verifyToken(this.file.secret, token, this.file.users);
+    }
+    mintToken(userId) {
+        const user = this.file.users.find((candidate) => candidate.id === userId);
+        return mintToken(this.file.secret, {
+            uid: userId,
+            exp: Date.now() + this.sessionTtlDays * 86_400_000,
+            ver: user?.tokenVersion ?? 0,
+        });
+    }
+    /** The account behind a token, or an auth-required refusal. */
+    requireUser(token) {
+        const userId = this.verifyToken(token);
+        const user = userId === null
+            ? undefined
+            : this.file.users.find((candidate) => candidate.id === userId);
+        if (user === undefined || user.disabled === true) {
+            throw new QaAccountsError("auth-required", "a valid QA account token is required");
+        }
+        return user;
+    }
+    /**
+     * Ownership gate for one session: claim unowned sessions for the requesting
+     * user (first come, first served — the pre-accounts migration path), refuse
+     * foreign sessions unless the caller administers the deployment.
+     */
+    ensureSessionAccess(token, sessionId) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        const owner = this.file.ownership[sessionId];
+        if (owner === undefined) {
+            this.file = {
+                ...this.file,
+                ownership: {
+                    ...this.file.ownership,
+                    [sessionId]: { userId: user.id, claimedAt: new Date().toISOString() },
+                },
+            };
+            this.save();
+            return toPublic(user);
+        }
+        if (owner.userId !== user.id && user.role !== "admin") {
+            throw new QaAccountsError("session-owned-elsewhere", "this session belongs to another QA user");
+        }
+        const ownerUser = this.file.users.find((candidate) => candidate.id === owner.userId);
+        if (ownerUser === undefined) {
+            throw new QaAccountsError("session-owned-elsewhere", "the session owner no longer exists");
+        }
+        return toPublic(ownerUser);
+    }
+    /**
+     * Atomically reserve a Host-generated session id for the token user before
+     * the Session exists. Browser callers therefore never get a race window in
+     * which they can claim another user's newly created chat.
+     */
+    reserveSession(token, sessionId) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        if (sessionId.trim() === "" ||
+            sessionId.length > MAX_SESSION_ID_LENGTH ||
+            this.file.ownership[sessionId] !== undefined) {
+            throw new QaAccountsError("session-owned-elsewhere", "the requested session id is unavailable");
+        }
+        this.file = {
+            ...this.file,
+            ownership: {
+                ...this.file.ownership,
+                [sessionId]: { userId: user.id, claimedAt: new Date().toISOString() },
+            },
+        };
+        this.save();
+        return toPublic(user);
+    }
+    /** Roll back a reservation if Host creation failed before a chat existed. */
+    releaseSessionReservation(userId, sessionId) {
+        this.reloadIfChanged();
+        if (this.file.ownership[sessionId]?.userId !== userId)
+            return;
+        const ownership = { ...this.file.ownership };
+        delete ownership[sessionId];
+        this.file = { ...this.file, ownership };
+        this.save();
+    }
+    /** Bulk-claim a browser's local chat index; foreign ids come back as conflicts. */
+    claimSessions(token, sessionIds) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        if (sessionIds.length > MAX_CLAIM_BATCH) {
+            throw new QaAccountsError("auth-required", "claim batch is too large");
+        }
+        let claimed = 0;
+        const conflicts = [];
+        const ownership = { ...this.file.ownership };
+        for (const raw of sessionIds) {
+            const sessionId = typeof raw === "string" ? raw.trim() : "";
+            if (sessionId === "" || sessionId.length > MAX_SESSION_ID_LENGTH)
+                continue;
+            const owner = ownership[sessionId];
+            if (owner === undefined) {
+                ownership[sessionId] = {
+                    userId: user.id,
+                    claimedAt: new Date().toISOString(),
+                };
+                claimed += 1;
+            }
+            else if (owner.userId !== user.id) {
+                conflicts.push(sessionId);
+            }
+        }
+        if (claimed > 0) {
+            this.file = { ...this.file, ownership };
+            this.save();
+        }
+        return { claimed, conflicts };
+    }
+    /** Session ids owned by the token's user, most recently claimed first. */
+    ownedSessionIds(token) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        return Object.entries(this.file.ownership)
+            .filter(([, owner]) => owner.userId === user.id)
+            .sort((left, right) => right[1].claimedAt.localeCompare(left[1].claimedAt))
+            .map(([sessionId]) => sessionId);
+    }
+    /**
+     * Every ownership entry with the owner's display name resolved at read
+     * time, oldest claim first. Admin-only: this is the cross-user view the
+     * admin sidebar groups chats by; ordinary accounts get a dedicated refusal.
+     */
+    listOwnership(token) {
+        const user = this.requireUser(token);
+        if (user.role !== "admin") {
+            throw new QaAccountsError("admin-required", "listing chat ownership requires an admin account");
+        }
+        const names = new Map(this.file.users.map((candidate) => [candidate.id, candidate.displayName]));
+        return Object.entries(this.file.ownership)
+            .map(([sessionId, owner]) => ({
+            sessionId,
+            userId: owner.userId,
+            displayName: names.get(owner.userId) ?? owner.userId,
+            claimedAt: owner.claimedAt,
+        }))
+            .sort((left, right) => left.claimedAt.localeCompare(right.claimedAt));
+    }
+    // ---------------------------------------------------------------------------
+    // Operator management surface (the qa-accounts CLI; never browser-callable).
+    // ---------------------------------------------------------------------------
+    /** Every account, file order; for `qa-accounts list`. */
+    listUsers() {
+        this.reloadIfChanged();
+        return this.file.users.map((user) => ({
+            email: user.email,
+            displayName: user.displayName,
+            role: user.role,
+            disabled: user.disabled === true,
+            createdAt: user.createdAt,
+            lastLoginAt: user.lastLoginAt,
+        }));
+    }
+    /** Create an account outside the self-registration gate. */
+    addUser(email, password, options = {}) {
+        this.reloadIfChanged();
+        this.assertAuthBudget();
+        const { email: normalized, displayName: name } = validateCredentials(email, password, options.displayName);
+        if (options.role !== undefined &&
+            options.role !== "admin" &&
+            options.role !== "user") {
+            throw new QaAccountsError("invalid-role", "role must be admin or user");
+        }
+        if (this.userByEmail(normalized) !== undefined) {
+            throw new QaAccountsError("email-taken", "this email is already registered");
+        }
+        const user = {
+            id: randomUUID(),
+            email: normalized,
+            displayName: name === "" ? (normalized.split("@")[0] ?? normalized) : name,
+            role: options.role ?? (this.file.users.length === 0 ? "admin" : "user"),
+            passwordHash: hashPassword(password),
+            createdAt: new Date().toISOString(),
+            lastLoginAt: null,
+            tokenVersion: 0,
+        };
+        this.file = { ...this.file, users: [...this.file.users, user] };
+        this.save();
+        return toPublic(user);
+    }
+    editUser(email, edit) {
+        this.reloadIfChanged();
+        const normalized = email.trim().toLowerCase();
+        const index = this.file.users.findIndex((user) => user.email === normalized);
+        if (index === -1) {
+            throw new QaAccountsError("invalid-credentials", "no such account");
+        }
+        const updated = edit(this.file.users[index]);
+        const users = [...this.file.users];
+        users[index] = updated;
+        this.file = { ...this.file, users };
+        this.save();
+        return updated;
+    }
+    /** Grant or revoke the admin role. */
+    setUserRole(email, role) {
+        return toPublic(this.editUser(email, (user) => ({ ...user, role })));
+    }
+    /**
+     * Disable an account: future logins are refused and every live token is
+     * invalidated (the token version bumps). `enable` does not resurrect old
+     * tokens — the account signs in again.
+     */
+    setUserDisabled(email, disabled) {
+        return toPublic(this.editUser(email, (user) => {
+            const next = user;
+            if (disabled) {
+                next.disabled = true;
+                next.tokenVersion = (next.tokenVersion ?? 0) + 1;
+            }
+            else {
+                delete next.disabled;
+            }
+            return next;
+        }));
+    }
+    /** Invalidate every token of the account (password-leak response). */
+    revokeTokens(email) {
+        return toPublic(this.editUser(email, (user) => ({
+            ...user,
+            tokenVersion: (user.tokenVersion ?? 0) + 1,
+        })));
+    }
+    // ---------------------------------------------------------------------------
+    // Self-declared profiles: what the QA prompt says about the current user.
+    // ---------------------------------------------------------------------------
+    /**
+     * The account that owns one session, or undefined while nobody claimed it.
+     * The prompt renderer resolves a chat's owner through this map, so a session
+     * that predates accounts simply carries no identity.
+     */
+    ownerIdOf(sessionId) {
+        this.reloadIfChanged();
+        return this.file.ownership[sessionId]?.userId;
+    }
+    /**
+     * Email plus profile of one account, for the prompt renderer. A disabled
+     * account resolves to nothing: its identity leaves the prompt together with
+     * its access, so a revoked user is no longer addressed by name.
+     */
+    identityOf(userId) {
+        this.reloadIfChanged();
+        const user = this.file.users.find((candidate) => candidate.id === userId);
+        if (user === undefined || user.disabled === true)
+            return undefined;
+        return { email: user.email, profile: normalizeProfile(user.profile) };
+    }
+    /** One account in its public shape; undefined when the address is unknown. */
+    findUser(email) {
+        this.reloadIfChanged();
+        const user = this.userByEmail(email.trim().toLowerCase());
+        return user === undefined ? undefined : toPublic(user);
+    }
+    /**
+     * Operator write: replace one account's profile, addressed by email. The
+     * CLI merges field-level flags into a full profile before calling this.
+     */
+    setProfile(email, input) {
+        return toPublic(this.editUser(email, (user) => this.stampedProfile(user, input)));
+    }
+    /**
+     * Self-service write for the token's own account. The token is verified
+     * first, so a browser can only ever edit the profile it is signed in as.
+     */
+    updateOwnProfile(token, input) {
+        this.reloadIfChanged();
+        const user = this.requireUser(token);
+        return this.setProfile(user.email, input);
+    }
+    /**
+     * Validate one profile write and stamp it onto the account. Throws before
+     * anything is mutated, so a rejected write leaves the stored profile, and
+     * the address it is keyed to, exactly as they were.
+     */
+    stampedProfile(user, input) {
+        const result = validateProfileWrite(input, {
+            instructionsMaxLength: this.instructionsMaxLength,
+            ...(this.identityFields === undefined
+                ? {}
+                : { identities: this.identityFields }),
+        });
+        if (!result.ok) {
+            throw new QaAccountsError("invalid-profile", result.message);
+        }
+        return {
+            ...user,
+            profile: {
+                fullName: result.value.fullName,
+                identities: { ...result.value.identities },
+                instructions: result.value.instructions,
+                updatedAt: new Date().toISOString(),
+            },
+        };
+    }
+}
+//# sourceMappingURL=store.js.map

package/lib/accounts/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/accounts/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AAYrB,OAAO,EACL,mCAAmC,EACnC,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAgBpD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,QAAQ,CAAC,IAAgB;IAChC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;QAChC,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,MAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CACvB,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAC/B,QAAQ,CAAC,MAAM,CAChB,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IAeV,QAAQ;IAdX,IAAI,CAAe;IACV,YAAY,GAAa,EAAE,CAAC;IAC5B,wBAAwB,CAAS;IACjC,cAAc,CAAS;IACvB,iBAAiB,CAAU;IAC5C,0DAA0D;IACzC,qBAAqB,CAAS;IAC/C,oFAAoF;IACnE,cAAc,CACiB;IAChD,6EAA6E;IAC5D,SAAS,GAAG,kBAAkB,EAAE,CAAC;IAElD,YACW,QAAQ,GAAW,uBAAuB,EAAE,EACrD,OAA0B;wBADjB,QAAQ;QAGjB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,qBAAqB;YACxB,OAAO,CAAC,qBAAqB,IAAI,mCAAmC,CAAC;QACvE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACK,eAAe;QACrB,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IAC/C,CAAC;IAEO,IAAI;QACV,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAEO,iBAAiB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,EAAE,IAAI,MAAM;gBAAE,MAAM;YACxB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9D,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CACN,KAAa,EACb,QAAgB,EAChB,WAAoB;QAEpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CACvB,uBAAuB,EACvB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAClE,KAAK,EACL,QAAQ,EACR,WAAW,CACZ,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,MAAM,IAAI,GAAkB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5E,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,KAAK,EAAE,UAAU;YACjB,WAAW,EACT,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/D,IAAI;YACJ,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,KAAa,EAAE,QAAgB;QACnC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC1E,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YACjD,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE;YAC1B,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,WAAW,CAAC,KAAa;QACvB,kEAAkE;QAClE,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAEO,SAAS,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACjC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,UAAU;YAClD,GAAG,EAAE,IAAI,EAAE,YAAY,IAAI,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,WAAW,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GACR,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,KAAa,EAAE,SAAiB;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,GAAG;gBACV,GAAG,IAAI,CAAC,IAAI;gBACZ,SAAS,EAAE;oBACT,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS;oBACtB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;iBACtE;aACF,CAAC;YACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAC7C,CAAC;QACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,oCAAoC,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAa,EAAE,SAAiB;QAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,IACE,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YACvB,SAAS,CAAC,MAAM,GAAG,qBAAqB;YACxC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,EAC5C,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,yBAAyB,EACzB,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG;YACV,GAAG,IAAI,CAAC,IAAI;YACZ,SAAS,EAAE;gBACT,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS;gBACtB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;aACtE;SACF,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,6EAA6E;IAC7E,yBAAyB,CAAC,MAAc,EAAE,SAAiB;QACzD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,MAAM;YAAE,OAAO;QAC9D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,aAAa,CAAC,KAAa,EAAE,UAA6B;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB;gBAC9D,SAAS;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS,CAAC,SAAS,CAAC,GAAG;oBACrB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBACpC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;aAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CACpD;aACA,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAC1E,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM;YACpD,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAE9E,yDAAyD;IACzD,SAAS;QAQP,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,OAAO,CACL,KAAa,EACb,QAAgB,EAChB,OAAO,GAAmD,EAAE;QAE5D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAClE,KAAK,EACL,QAAQ,EACR,OAAO,CAAC,WAAW,CACpB,CAAC;QACF,IACE,OAAO,CAAC,IAAI,KAAK,SAAS;YAC1B,OAAO,CAAC,IAAI,KAAK,OAAO;YACxB,OAAO,CAAC,IAAI,KAAK,MAAM,EACvB,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,kCAAkC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,UAAU,EAAE;YAChB,KAAK,EAAE,UAAU;YACjB,WAAW,EACT,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACvE,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAEO,QAAQ,CACd,KAAa,EACb,IAAsC;QAEtC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CACpC,CAAC;QACF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAe,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sCAAsC;IACtC,WAAW,CAAC,KAAa,EAAE,IAAmB;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAa,EAAE,QAAiB;QAC9C,OAAO,QAAQ,CACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC;YAClB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,QAAQ,CAAC;YACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,YAAY,CAAC,KAAa;QACxB,OAAO,QAAQ,CACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9B,GAAG,IAAI;YACP,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;SAC3C,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAE9E;;;;OAIG;IACH,SAAS,CAAC,SAAiB;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,UAAU,CACR,MAAc;QAGd,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,8EAA8E;IAC9E,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,KAAa,EAAE,KAA4B;QACpD,OAAO,QAAQ,CACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,gBAAgB,CACd,KAAa,EACb,KAA4B;QAE5B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACK,cAAc,CACpB,IAAgB,EAChB,KAA4B;QAE5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE;YACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC1C,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;gBACvC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;SACF,CAAC;IACJ,CAAC;CACF"}

package/lib/accounts/token.js

@@ -0,0 +1,61 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export function base64Url(value) {
+    return Buffer.from(value).toString("base64url");
+}
+/**
+ * Mint a v1 account token: a base64url JSON payload plus an HMAC-SHA256
+ * signature keyed with the accounts file secret.
+ */
+export function mintToken(secret, payload) {
+    const encoded = base64Url(JSON.stringify(payload));
+    const signature = base64Url(createHmac("sha256", secret).update(encoded).digest());
+    return `v1.${encoded}.${signature}`;
+}
+/**
+ * Verify a v1 account token against the current secret and account list and
+ * return its user id, or null for anything malformed, foreign-signed,
+ * expired or superseded. Signature computation, the length check and the
+ * payload decode share one try, so a hostile token can only ever resolve to
+ * null; the comparison is timing-safe (equal length first, then
+ * timingSafeEqual) so a signature guess cannot be accelerated by measuring
+ * HMAC rejection time.
+ */
+export function verifyToken(secret, token, users) {
+    if (typeof token !== "string")
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts[0] !== "v1")
+        return null;
+    const payload = parts[1];
+    const signature = parts[2];
+    if (payload === undefined || signature === undefined)
+        return null;
+    let expected;
+    let decoded;
+    try {
+        expected = createHmac("sha256", secret).update(payload).digest();
+        const expectedSignature = base64Url(expected);
+        if (signature.length !== expectedSignature.length ||
+            !timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature))) {
+            return null;
+        }
+        decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (typeof decoded.uid !== "string" ||
+        typeof decoded.exp !== "number" ||
+        decoded.exp < Date.now()) {
+        return null;
+    }
+    // The account's current token version must match the one burned into the
+    // token: bumping it (disable/revoke) invalidates every issued token.
+    const user = users.find((candidate) => candidate.id === decoded.uid);
+    const version = typeof decoded.ver === "number" ? decoded.ver : undefined;
+    if (user === undefined || version !== (user.tokenVersion ?? 0)) {
+        return null;
+    }
+    return decoded.uid;
+}
+//# sourceMappingURL=token.js.map

package/lib/accounts/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/accounts/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB1D,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAAqB;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CACzB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACtD,CAAC;IACF,OAAO,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,KAAa,EACb,KAA2B;IAE3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM,iBAAiB,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,IACE,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;YAC7C,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EACxE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC"}

package/lib/attachment-rules.js

@@ -0,0 +1,111 @@
+/**
+ * Attachment vocabulary shared by the Host configuration and the browser
+ * composer. The module stays free of Node and DOM imports: the client bundle
+ * imports it directly, and the Host resolver uses it to normalize the
+ * operator's configuration.
+ */
+/**
+ * Text-file extensions the composer accepts out of the box. Compared
+ * lowercase and without the leading dot; an entry is a suffix, not a glob.
+ */
+export const DEFAULT_QA_TEXT_EXTENSIONS = Object.freeze([
+    "md",
+    "markdown",
+    "txt",
+    "text",
+    "log",
+    "json",
+    "jsonl",
+    "yaml",
+    "yml",
+    "toml",
+    "ini",
+    "cfg",
+    "conf",
+    "env",
+    "csv",
+    "tsv",
+    "xml",
+    "html",
+    "htm",
+    "css",
+    "js",
+    "mjs",
+    "cjs",
+    "ts",
+    "tsx",
+    "jsx",
+    "py",
+    "rb",
+    "go",
+    "rs",
+    "java",
+    "kt",
+    "cs",
+    "php",
+    "sh",
+    "bash",
+    "zsh",
+    "ps1",
+    "bat",
+    "cmd",
+    "sql",
+    "patch",
+    "diff",
+]);
+/** Bounds the resolver and the settings card agree on. */
+export const QA_PASTED_TEXT_LINES_MIN = 0;
+export const QA_PASTED_TEXT_LINES_MAX = 10_000;
+export const QA_MAX_FILE_BYTES_MIN = 1024;
+export const QA_MAX_FILE_BYTES_MAX = 52_428_800;
+export const QA_MAX_PENDING_MIN = 1;
+export const QA_MAX_PENDING_MAX = 40;
+/** One accepted extension token: no dot, no separator, bounded length. */
+const EXTENSION_PATTERN = /^[a-z0-9][a-z0-9_-]{0,15}$/u;
+/**
+ * Normalize an operator-authored extension list: lowercase, leading dots
+ * stripped, malformed entries and duplicates dropped, order preserved.
+ * An empty result means no extension is accepted by name — the composer then
+ * still accepts whatever the browser reports as `text/*`.
+ * @param values - raw extension tokens from configuration.
+ * @returns the normalized token list.
+ */
+export function normalizeTextExtensions(values) {
+    const seen = new Set();
+    const normalized = [];
+    for (const value of values) {
+        const token = value.trim().toLowerCase().replace(/^\.+/u, "");
+        if (!EXTENSION_PATTERN.test(token) || seen.has(token))
+            continue;
+        seen.add(token);
+        normalized.push(token);
+    }
+    return normalized;
+}
+/**
+ * Whether one file name carries an accepted text extension. The comparison is
+ * case-insensitive; a name without a dot, or with a hidden-file dot only
+ * (`.gitignore`), is matched against the whole leaf.
+ * @param name - display file name.
+ * @param extensions - normalized accepted extensions.
+ * @returns whether the name matches one accepted extension.
+ */
+export function hasTextExtension(name, extensions) {
+    const leaf = name.trim().toLowerCase();
+    if (leaf === "")
+        return false;
+    const dot = leaf.lastIndexOf(".");
+    const suffix = dot <= 0 ? leaf : leaf.slice(dot + 1);
+    return extensions.includes(suffix);
+}
+/**
+ * Count the lines of a pasted blob the way a reader counts them: a single
+ * trailing newline does not open a new line, and CRLF counts once.
+ * @param text - pasted plain text.
+ * @returns the line count, at least 1 for any non-empty text.
+ */
+export function countTextLines(text) {
+    const normalized = text.replace(/\r\n?/gu, "\n").replace(/\n$/u, "");
+    return normalized === "" ? 0 : normalized.split("\n").length;
+}
+//# sourceMappingURL=attachment-rules.js.map