agent-embassy 1.0.0

package/dist/src/gateway/live-dashboard-http.js

@@ -0,0 +1,445 @@
+import { isGatewayAlias } from "./control.js";
+import { assertDashboardLocale, getDashboardCopy, } from "./dashboard-copy.js";
+import { equalSecret, LIVE_DASHBOARD_LIMITS, liveDashboardSecurityHeaders, readSingleCookie, sessionCookieHeader, validateLiveDashboardRequest, } from "./live-dashboard-protocol.js";
+const SHELL_CONTENT_SECURITY_POLICY = "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
+function isCanonical256BitBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(value))
+        return false;
+    const decoded = Buffer.from(value, "base64url");
+    return decoded.length === 32 && decoded.toString("base64url") === value;
+}
+function assertOptions(options) {
+    assertDashboardLocale(options.lang);
+    if (!/^\/[A-Za-z0-9_-]{16,128}$/u.test(options.instancePath)) {
+        throw new Error("LIVE_DASHBOARD_INSTANCE_PATH_INVALID");
+    }
+    const hostMatch = /^127\.0\.0\.1:([1-9][0-9]{0,4})$/u.exec(options.expectedHost);
+    const port = Number(hostMatch?.[1]);
+    if (hostMatch === null ||
+        !Number.isInteger(port) ||
+        port > 65_535 ||
+        options.expectedOrigin !== `http://${options.expectedHost}`) {
+        throw new Error("LIVE_DASHBOARD_ORIGIN_INVALID");
+    }
+    if (!isCanonical256BitBase64Url(options.capability)) {
+        throw new Error("LIVE_DASHBOARD_CAPABILITY_INVALID");
+    }
+    if (!isCanonical256BitBase64Url(options.sessionSecret)) {
+        throw new Error("LIVE_DASHBOARD_SESSION_SECRET_INVALID");
+    }
+}
+function routeFor(target, instancePath) {
+    switch (target) {
+        case `${instancePath}/bootstrap`:
+            return { kind: "navigation", name: "bootstrap" };
+        case `${instancePath}/client.js`:
+            return { kind: "navigation", name: "client" };
+        case `${instancePath}/app.css`:
+            return { kind: "navigation", name: "style" };
+        case `${instancePath}/react.js`:
+            return { kind: "navigation", name: "vendorReact" };
+        case `${instancePath}/react-dom.js`:
+            return { kind: "navigation", name: "vendorReactDom" };
+        case `${instancePath}/app.js`:
+            return { kind: "navigation", name: "app" };
+        case `${instancePath}/session`:
+            return { kind: "session", name: "session" };
+        case `${instancePath}/snapshot`:
+            return { kind: "authenticated", name: "snapshot" };
+        case `${instancePath}/stream`:
+            return { kind: "authenticated", name: "stream" };
+        case `${instancePath}/action`:
+            return { kind: "authenticated", name: "action" };
+        default:
+            return undefined;
+    }
+}
+function statusBody(copy, statusCode) {
+    switch (statusCode) {
+        case 400:
+            return `${copy["live.http.badRequest"]}\n`;
+        case 403:
+            return `${copy["live.http.forbidden"]}\n`;
+        case 404:
+            return `${copy["live.http.notFound"]}\n`;
+        case 405:
+            return `${copy["live.http.methodNotAllowed"]}\n`;
+        case 413:
+            return `${copy["live.http.bodyTooLarge"]}\n`;
+        case 414:
+            return `${copy["live.http.targetTooLarge"]}\n`;
+        case 415:
+            return `${copy["live.http.unsupportedMediaType"]}\n`;
+        case 429:
+            return `${copy["live.http.tooManyStreams"]}\n`;
+        case 431:
+            return `${copy["live.http.headersTooLarge"]}\n`;
+        case 503:
+            return `${copy["live.http.snapshotUnavailable"]}\n`;
+        default:
+            return `${copy["live.http.requestFailed"]}\n`;
+    }
+}
+function respond(response, copy, statusCode, body = statusBody(copy, statusCode), contentType = "text/plain; charset=utf-8", additionalHeaders = {}, contentSecurityPolicy) {
+    const encoded = Buffer.from(body, "utf8");
+    response.writeHead(statusCode, {
+        ...liveDashboardSecurityHeaders(contentSecurityPolicy),
+        "Content-Type": contentType,
+        "Content-Length": String(encoded.length),
+        ...additionalHeaders,
+    });
+    response.end(encoded);
+}
+function respondWithoutBody(response, statusCode, additionalHeaders = {}) {
+    response.writeHead(statusCode, {
+        ...liveDashboardSecurityHeaders(),
+        "Content-Length": "0",
+        ...additionalHeaders,
+    });
+    response.end();
+}
+function parseContentLength(value) {
+    if (value === undefined)
+        return undefined;
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(value))
+        return Number.NaN;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : Number.NaN;
+}
+function readBoundedBody(request, declaredLength, maximumBytes) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let received = 0;
+        let tooLarge = false;
+        let settled = false;
+        const cleanup = () => {
+            request.off("data", onData);
+            request.off("end", onEnd);
+            request.off("error", onFailure);
+            request.off("aborted", onFailure);
+        };
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(result);
+        };
+        const onData = (chunk) => {
+            let bytes;
+            if (typeof chunk === "string") {
+                bytes = Buffer.from(chunk, "utf8");
+            }
+            else if (Buffer.isBuffer(chunk) || chunk instanceof Uint8Array) {
+                bytes = Buffer.from(chunk);
+            }
+            else {
+                tooLarge = true;
+                return;
+            }
+            received += bytes.length;
+            if (received > maximumBytes) {
+                tooLarge = true;
+                return;
+            }
+            if (!tooLarge)
+                chunks.push(bytes);
+        };
+        const onEnd = () => {
+            if (tooLarge) {
+                finish({ ok: false, statusCode: 413 });
+                return;
+            }
+            if (received !== declaredLength) {
+                finish({ ok: false, statusCode: 400 });
+                return;
+            }
+            finish({ ok: true, body: Buffer.concat(chunks).toString("utf8") });
+        };
+        const onFailure = () => finish({ ok: false, statusCode: 400 });
+        request.on("data", onData);
+        request.once("end", onEnd);
+        request.once("error", onFailure);
+        request.once("aborted", onFailure);
+    });
+}
+function validateEmptyPostBody(validation) {
+    const contentLength = parseContentLength(validation.headers.get("content-length"));
+    if ((contentLength !== undefined && !Number.isFinite(contentLength)) ||
+        (contentLength !== undefined && contentLength !== 0)) {
+        return 400;
+    }
+    return undefined;
+}
+function authenticated(validation, cookieName, sessionSecret) {
+    const supplied = readSingleCookie(validation.headers.get("cookie"), cookieName);
+    return equalSecret(supplied, sessionSecret);
+}
+function parseAction(body) {
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    const keys = Object.keys(record);
+    if (record.action === "refresh_dashboard" &&
+        keys.length === 1 &&
+        keys[0] === "action") {
+        return { action: "refresh_dashboard" };
+    }
+    if ((record.action === "pair" || record.action === "unpair") &&
+        keys.length === 3 &&
+        keys.includes("action") &&
+        keys.includes("claudeAlias") &&
+        keys.includes("codexAlias") &&
+        typeof record.claudeAlias === "string" &&
+        typeof record.codexAlias === "string" &&
+        record.claudeAlias.length <= 128 &&
+        record.codexAlias.length <= 128 &&
+        isGatewayAlias(record.claudeAlias) &&
+        isGatewayAlias(record.codexAlias) &&
+        record.claudeAlias.startsWith("claude-") &&
+        record.codexAlias.startsWith("codex-") &&
+        record.claudeAlias.slice(record.claudeAlias.lastIndexOf("@") + 1) ===
+            record.codexAlias.slice(record.codexAlias.lastIndexOf("@") + 1)) {
+        return {
+            action: record.action,
+            claudeAlias: record.claudeAlias,
+            codexAlias: record.codexAlias,
+        };
+    }
+    return undefined;
+}
+function isActionResult(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    const validShape = Object.keys(record).length === 2 &&
+        typeof record.ok === "boolean" &&
+        typeof record.code === "string" &&
+        /^(?:ok|not_found|conflict|route_mismatch|busy|unavailable|rejected)$/u.test(record.code);
+    return (validShape &&
+        ((record.ok === true && record.code === "ok") ||
+            (record.ok === false && record.code !== "ok")));
+}
+function actionResponse(response, copy, statusCode, result, additionalHeaders = {}) {
+    respond(response, copy, statusCode, JSON.stringify(result), "application/json; charset=utf-8", additionalHeaders);
+}
+function streamWriter(response) {
+    return {
+        write: (chunk) => response.write(chunk),
+        onDrain: (callback) => {
+            response.on("drain", callback);
+        },
+        onClose: (callback) => {
+            response.once("close", callback);
+            response.once("error", callback);
+        },
+        end: () => {
+            response.end();
+        },
+    };
+}
+export function createLiveDashboardRequestHandler(options) {
+    assertOptions(options);
+    const { actions, assets, cookieName, expectedHost, expectedOrigin, hub, instancePath, lang, sessionSecret, } = options;
+    const now = options.now ?? Date.now;
+    const copy = getDashboardCopy(lang);
+    const cookieHeader = sessionCookieHeader(cookieName, sessionSecret, instancePath);
+    let remainingCapability = options.capability;
+    let actionTokens = LIVE_DASHBOARD_LIMITS.maximumActionsPerMinute;
+    let actionRefilledAt = now();
+    const consumeActionToken = () => {
+        const observedAt = now();
+        const elapsed = Math.max(0, observedAt - actionRefilledAt);
+        actionRefilledAt = Math.max(actionRefilledAt, observedAt);
+        actionTokens = Math.min(LIVE_DASHBOARD_LIMITS.maximumActionsPerMinute, actionTokens +
+            (elapsed * LIVE_DASHBOARD_LIMITS.maximumActionsPerMinute) / 60_000);
+        if (actionTokens >= 1) {
+            actionTokens -= 1;
+            return undefined;
+        }
+        return Math.max(1, Math.ceil(((1 - actionTokens) * 60) /
+            LIVE_DASHBOARD_LIMITS.maximumActionsPerMinute));
+    };
+    return async (request, response) => {
+        try {
+            const route = routeFor(request.url, instancePath);
+            const validation = validateLiveDashboardRequest({
+                method: request.method,
+                target: request.url,
+                rawHeaders: request.rawHeaders,
+            }, {
+                expectedHost,
+                expectedOrigin,
+                kind: route?.kind ??
+                    (request.method === "GET" ? "navigation" : "authenticated"),
+            });
+            if (!validation.ok) {
+                respond(response, copy, validation.statusCode);
+                return;
+            }
+            if (route === undefined) {
+                respond(response, copy, 404);
+                return;
+            }
+            switch (route.name) {
+                case "bootstrap":
+                    respond(response, copy, 200, assets.shellHtml, "text/html; charset=utf-8", {}, SHELL_CONTENT_SECURITY_POLICY);
+                    return;
+                case "client":
+                    respond(response, copy, 200, assets.clientJavaScript, "text/javascript; charset=utf-8");
+                    return;
+                case "style":
+                    respond(response, copy, 200, assets.styleSheet, "text/css; charset=utf-8");
+                    return;
+                case "vendorReact":
+                    respond(response, copy, 200, assets.vendorReactJavaScript, "text/javascript; charset=utf-8");
+                    return;
+                case "vendorReactDom":
+                    respond(response, copy, 200, assets.vendorReactDomJavaScript, "text/javascript; charset=utf-8");
+                    return;
+                case "app":
+                    respond(response, copy, 200, assets.appJavaScript, "text/javascript; charset=utf-8");
+                    return;
+                case "session": {
+                    const contentType = validation.headers.get("content-type");
+                    if (contentType !== "text/plain" &&
+                        contentType !== "text/plain;charset=UTF-8") {
+                        respond(response, copy, 415);
+                        return;
+                    }
+                    const contentLength = parseContentLength(validation.headers.get("content-length"));
+                    if (contentLength === undefined ||
+                        !Number.isFinite(contentLength) ||
+                        contentLength < 0) {
+                        respond(response, copy, 400);
+                        return;
+                    }
+                    if (contentLength > LIVE_DASHBOARD_LIMITS.maximumSessionBodyBytes) {
+                        respond(response, copy, 413);
+                        return;
+                    }
+                    const body = await readBoundedBody(request, contentLength, LIVE_DASHBOARD_LIMITS.maximumSessionBodyBytes);
+                    if (!body.ok) {
+                        respond(response, copy, body.statusCode);
+                        return;
+                    }
+                    if (!equalSecret(body.body, remainingCapability)) {
+                        respond(response, copy, 403);
+                        return;
+                    }
+                    remainingCapability = undefined;
+                    respondWithoutBody(response, 204, { "Set-Cookie": cookieHeader });
+                    return;
+                }
+                case "snapshot": {
+                    const bodyError = validateEmptyPostBody(validation);
+                    if (bodyError !== undefined) {
+                        respond(response, copy, bodyError);
+                        return;
+                    }
+                    if (!authenticated(validation, cookieName, sessionSecret)) {
+                        respond(response, copy, 403);
+                        return;
+                    }
+                    const refreshed = await hub.refresh();
+                    if (refreshed === undefined) {
+                        respond(response, copy, 503);
+                        return;
+                    }
+                    respond(response, copy, 200, JSON.stringify(refreshed), "application/json; charset=utf-8");
+                    return;
+                }
+                case "stream": {
+                    const bodyError = validateEmptyPostBody(validation);
+                    if (bodyError !== undefined) {
+                        respond(response, copy, bodyError);
+                        return;
+                    }
+                    if (!authenticated(validation, cookieName, sessionSecret)) {
+                        respond(response, copy, 403);
+                        return;
+                    }
+                    if (hub.streamCount() >= LIVE_DASHBOARD_LIMITS.maximumStreams) {
+                        respond(response, copy, 429);
+                        return;
+                    }
+                    response.writeHead(200, {
+                        ...liveDashboardSecurityHeaders(),
+                        "Content-Type": "text/event-stream; charset=utf-8",
+                        Connection: "keep-alive",
+                    });
+                    const added = hub.add(streamWriter(response));
+                    if (!added.ok)
+                        response.end();
+                    return;
+                }
+                case "action": {
+                    if (!authenticated(validation, cookieName, sessionSecret)) {
+                        respond(response, copy, 403);
+                        return;
+                    }
+                    if (validation.headers.get("content-type") !== "application/json") {
+                        respond(response, copy, 415);
+                        return;
+                    }
+                    const contentLength = parseContentLength(validation.headers.get("content-length"));
+                    if (contentLength === undefined ||
+                        !Number.isFinite(contentLength) ||
+                        contentLength < 1) {
+                        respond(response, copy, 400);
+                        return;
+                    }
+                    if (contentLength > LIVE_DASHBOARD_LIMITS.maximumActionBodyBytes) {
+                        respond(response, copy, 413);
+                        return;
+                    }
+                    const body = await readBoundedBody(request, contentLength, LIVE_DASHBOARD_LIMITS.maximumActionBodyBytes);
+                    if (!body.ok) {
+                        respond(response, copy, body.statusCode);
+                        return;
+                    }
+                    const action = parseAction(body.body);
+                    if (action === undefined) {
+                        respond(response, copy, 400);
+                        return;
+                    }
+                    const retryAfter = consumeActionToken();
+                    if (retryAfter !== undefined) {
+                        actionResponse(response, copy, 429, { ok: false, code: "rate_limited" }, { "Retry-After": String(retryAfter) });
+                        return;
+                    }
+                    let result;
+                    try {
+                        const executed = await actions.execute(action);
+                        result = isActionResult(executed)
+                            ? executed
+                            : { ok: false, code: "unavailable" };
+                    }
+                    catch {
+                        result = { ok: false, code: "unavailable" };
+                    }
+                    actionResponse(response, copy, result.code === "unavailable" ? 503 : 200, result);
+                    return;
+                }
+            }
+        }
+        catch {
+            if (!response.headersSent) {
+                respond(response, copy, 500);
+            }
+            else if (!response.writableEnded) {
+                response.end();
+            }
+        }
+    };
+}
+//# sourceMappingURL=live-dashboard-http.js.map

package/dist/src/gateway/live-dashboard-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-dashboard-http.js","sourceRoot":"","sources":["../../../src/gateway/live-dashboard-http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAA4B,MAAM,cAAc,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,4BAA4B,EAC5B,gBAAgB,EAChB,mBAAmB,EACnB,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AAsEtC,MAAM,6BAA6B,GACjC,0IAA0I,CAAC;AAE7I,SAAS,0BAA0B,CAAC,KAAa;IAC/C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,OAA2C;IAChE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CACxD,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IACE,SAAS,KAAK,IAAI;QAClB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QACvB,IAAI,GAAG,MAAM;QACb,OAAO,CAAC,cAAc,KAAK,UAAU,OAAO,CAAC,YAAY,EAAE,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAA0B,EAAE,YAAoB;IAChE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,YAAY,YAAY;YAC9B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnD,KAAK,GAAG,YAAY,YAAY;YAC9B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChD,KAAK,GAAG,YAAY,UAAU;YAC5B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/C,KAAK,GAAG,YAAY,WAAW;YAC7B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACrD,KAAK,GAAG,YAAY,eAAe;YACjC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACxD,KAAK,GAAG,YAAY,SAAS;YAC3B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7C,KAAK,GAAG,YAAY,UAAU;YAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC9C,KAAK,GAAG,YAAY,WAAW;YAC7B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACrD,KAAK,GAAG,YAAY,SAAS;YAC3B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnD,KAAK,GAAG,YAAY,SAAS;YAC3B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnD;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB,EAAE,UAAkB;IACzD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAC7C,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC5C,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAC3C,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC;QACnD,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAC/C,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC;QACjD,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC;QACvD,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC;QACjD,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAClD,KAAK,GAAG;YACN,OAAO,GAAG,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC;QACtD;YACE,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,QAAwB,EACxB,IAAmB,EACnB,UAAkB,EAClB,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,EACnC,WAAW,GAAG,2BAA2B,EACzC,oBAAsD,EAAE,EACxD,qBAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE;QAC7B,GAAG,4BAA4B,CAAC,qBAAqB,CAAC;QACtD,cAAc,EAAE,WAAW;QAC3B,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC,GAAG,iBAAiB;KACrB,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAwB,EACxB,UAAkB,EAClB,oBAAsD,EAAE;IAExD,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE;QAC7B,GAAG,4BAA4B,EAAE;QACjC,gBAAgB,EAAE,GAAG;QACrB,GAAG,iBAAiB;KACrB,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CACtB,OAAwB,EACxB,cAAsB,EACtB,YAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAQ,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAmC,EAAQ,EAAE;YAC3D,IAAI,KAAa,CAAC;YAClB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBACjE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;gBAChC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAErE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAAiE;IAEjE,MAAM,aAAa,GAAG,kBAAkB,CACtC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACzC,CAAC;IACF,IACE,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChE,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,CAAC,CAAC,EACpD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,UAAiE,EACjE,UAAkB,EAClB,aAAqB;IAErB,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAChC,UAAU,CACX,CAAC;IACF,OAAO,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAA0C,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IACE,MAAM,CAAC,MAAM,KAAK,mBAAmB;QACrC,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EACpB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IACD,IACE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxD,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG;QAChC,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,GAAG;QAC/B,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;QACjC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACjE,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAA0C,CAAC;IAC1D,MAAM,UAAU,GACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAChC,OAAO,MAAM,CAAC,EAAE,KAAK,SAAS;QAC9B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,uEAAuE,CAAC,IAAI,CAC1E,MAAM,CAAC,IAAI,CACZ,CAAC;IACJ,OAAO,CACL,UAAU;QACV,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;YAC3C,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,QAAwB,EACxB,IAAmB,EACnB,UAA2B,EAC3B,MAAiC,EACjC,oBAAsD,EAAE;IAExD,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,iCAAiC,EACjC,iBAAiB,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB;IAC5C,OAAO;QACL,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YACpB,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,EAAE,GAAG,EAAE;YACR,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;IAE3C,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,EACJ,OAAO,EACP,MAAM,EACN,UAAU,EACV,YAAY,EACZ,cAAc,EACd,GAAG,EACH,YAAY,EACZ,IAAI,EACJ,aAAa,GACd,GAAG,OAAO,CAAC;IACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,mBAAmB,CACtC,UAAU,EACV,aAAa,EACb,YAAY,CACb,CAAC;IACF,IAAI,mBAAmB,GAAuB,OAAO,CAAC,UAAU,CAAC;IACjE,IAAI,YAAY,GAAW,qBAAqB,CAAC,uBAAuB,CAAC;IACzE,IAAI,gBAAgB,GAAG,GAAG,EAAE,CAAC;IAE7B,MAAM,kBAAkB,GAAG,GAAuB,EAAE;QAClD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC,CAAC;QAC3D,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC1D,YAAY,GAAG,IAAI,CAAC,GAAG,CACrB,qBAAqB,CAAC,uBAAuB,EAC7C,YAAY;YACV,CAAC,OAAO,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,MAAM,CACrE,CAAC;QACF,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACtB,YAAY,IAAI,CAAC,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,IAAI,CACP,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACvB,qBAAqB,CAAC,uBAAuB,CAChD,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,4BAA4B,CAC7C;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,EACD;gBACE,YAAY;gBACZ,cAAc;gBACd,IAAI,EACF,KAAK,EAAE,IAAI;oBACX,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;aAC9D,CACF,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,WAAW;oBACd,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,MAAM,CAAC,SAAS,EAChB,0BAA0B,EAC1B,EAAE,EACF,6BAA6B,CAC9B,CAAC;oBACF,OAAO;gBACT,KAAK,QAAQ;oBACX,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,MAAM,CAAC,gBAAgB,EACvB,gCAAgC,CACjC,CAAC;oBACF,OAAO;gBACT,KAAK,OAAO;oBACV,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,MAAM,CAAC,UAAU,EACjB,yBAAyB,CAC1B,CAAC;oBACF,OAAO;gBACT,KAAK,aAAa;oBAChB,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,MAAM,CAAC,qBAAqB,EAC5B,gCAAgC,CACjC,CAAC;oBACF,OAAO;gBACT,KAAK,gBAAgB;oBACnB,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,MAAM,CAAC,wBAAwB,EAC/B,gCAAgC,CACjC,CAAC;oBACF,OAAO;gBACT,KAAK,KAAK;oBACR,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,MAAM,CAAC,aAAa,EACpB,gCAAgC,CACjC,CAAC;oBACF,OAAO;gBACT,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC3D,IACE,WAAW,KAAK,YAAY;wBAC5B,WAAW,KAAK,0BAA0B,EAC1C,CAAC;wBACD,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,MAAM,aAAa,GAAG,kBAAkB,CACtC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACzC,CAAC;oBACF,IACE,aAAa,KAAK,SAAS;wBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAC/B,aAAa,GAAG,CAAC,EACjB,CAAC;wBACD,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,IAAI,aAAa,GAAG,qBAAqB,CAAC,uBAAuB,EAAE,CAAC;wBAClE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,OAAO,EACP,aAAa,EACb,qBAAqB,CAAC,uBAAuB,CAC9C,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;wBACzC,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,CAAC;wBACjD,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,mBAAmB,GAAG,SAAS,CAAC;oBAChC,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;oBACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC1D,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;oBACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,OAAO,CACL,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EACzB,iCAAiC,CAClC,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;oBACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC1D,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,qBAAqB,CAAC,cAAc,EAAE,CAAC;wBAC9D,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;wBACtB,GAAG,4BAA4B,EAAE;wBACjC,cAAc,EAAE,kCAAkC;wBAClD,UAAU,EAAE,YAAY;qBACzB,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC9C,IAAI,CAAC,KAAK,CAAC,EAAE;wBAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC1D,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,kBAAkB,EAAE,CAAC;wBAClE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,MAAM,aAAa,GAAG,kBAAkB,CACtC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACzC,CAAC;oBACF,IACE,aAAa,KAAK,SAAS;wBAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAC/B,aAAa,GAAG,CAAC,EACjB,CAAC;wBACD,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,IAAI,aAAa,GAAG,qBAAqB,CAAC,sBAAsB,EAAE,CAAC;wBACjE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,OAAO,EACP,aAAa,EACb,qBAAqB,CAAC,sBAAsB,CAC7C,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;wBACzC,OAAO;oBACT,CAAC;oBACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBACD,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;oBACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wBAC7B,cAAc,CACZ,QAAQ,EACR,IAAI,EACJ,GAAG,EACH,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,EACnC,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACtC,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,IAAI,MAAiC,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBAC/C,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC;4BAC/B,CAAC,CAAC,QAAQ;4BACV,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;oBACzC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;oBAC9C,CAAC;oBACD,cAAc,CACZ,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACzC,MAAM,CACP,CAAC;oBACF,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/gateway/live-dashboard-protocol.d.ts

@@ -0,0 +1,38 @@
+export declare const LIVE_DASHBOARD_LIMITS: Readonly<{
+    readonly maximumHeaderBytes: number;
+    readonly maximumRequestTargetBytes: number;
+    readonly maximumConnections: 16;
+    readonly maximumStreams: 4;
+    readonly maximumSessionBodyBytes: 256;
+    readonly maximumActionBodyBytes: 1024;
+    readonly maximumActionsPerMinute: 6;
+    readonly pollIntervalMs: 1000;
+    readonly backpressureTimeoutMs: 5000;
+    readonly heartbeatIntervalMs: 15000;
+    readonly headersTimeoutMs: 5000;
+    readonly requestTimeoutMs: 10000;
+    readonly keepAliveTimeoutMs: 5000;
+}>;
+export type LiveDashboardRequestKind = "navigation" | "session" | "authenticated";
+export type LiveDashboardRequestMetadata = Readonly<{
+    method: string | undefined;
+    target: string | undefined;
+    rawHeaders: readonly string[];
+}>;
+export type LiveDashboardRequestValidation = Readonly<{
+    ok: true;
+    headers: ReadonlyMap<string, string>;
+}> | Readonly<{
+    ok: false;
+    statusCode: 400 | 403 | 405 | 414 | 431;
+    safeCode: "BAD_REQUEST" | "CROSS_ORIGIN_REQUEST" | "HEADER_TOO_LARGE" | "METHOD_NOT_ALLOWED" | "TARGET_TOO_LARGE";
+}>;
+export declare function validateLiveDashboardRequest(request: LiveDashboardRequestMetadata, options: Readonly<{
+    expectedHost: string;
+    expectedOrigin: string;
+    kind: LiveDashboardRequestKind;
+}>): LiveDashboardRequestValidation;
+export declare function liveDashboardSecurityHeaders(contentSecurityPolicy?: string): Readonly<Record<string, string>>;
+export declare function readSingleCookie(cookieHeader: string | undefined, cookieName: string): string | undefined;
+export declare function equalSecret(supplied: string | undefined, expected: string | undefined): boolean;
+export declare function sessionCookieHeader(cookieName: string, value: string, instancePath: string): string;

package/dist/src/gateway/live-dashboard-protocol.js

@@ -0,0 +1,156 @@
+import { timingSafeEqual } from "node:crypto";
+export const LIVE_DASHBOARD_LIMITS = Object.freeze({
+    maximumHeaderBytes: 8 * 1024,
+    maximumRequestTargetBytes: 2 * 1024,
+    maximumConnections: 16,
+    maximumStreams: 4,
+    maximumSessionBodyBytes: 256,
+    maximumActionBodyBytes: 1_024,
+    maximumActionsPerMinute: 6,
+    pollIntervalMs: 1_000,
+    backpressureTimeoutMs: 5_000,
+    heartbeatIntervalMs: 15_000,
+    headersTimeoutMs: 5_000,
+    requestTimeoutMs: 10_000,
+    keepAliveTimeoutMs: 5_000,
+});
+const SENSITIVE_SINGLETON_HEADERS = new Set([
+    "host",
+    "origin",
+    "cookie",
+    "x-embassy-request",
+    "content-length",
+    "content-type",
+    "transfer-encoding",
+]);
+const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function rejected(statusCode, safeCode) {
+    return { ok: false, statusCode, safeCode };
+}
+function requestHeaderBytes(rawHeaders) {
+    let bytes = 2;
+    for (let index = 0; index < rawHeaders.length; index += 2) {
+        bytes += Buffer.byteLength(rawHeaders[index] ?? "", "utf8");
+        bytes += 2;
+        bytes += Buffer.byteLength(rawHeaders[index + 1] ?? "", "utf8");
+        bytes += 2;
+    }
+    return bytes;
+}
+function isForwardingHeader(name) {
+    return name === "forwarded" || name.startsWith("x-forwarded-");
+}
+export function validateLiveDashboardRequest(request, options) {
+    if (request.rawHeaders.length % 2 !== 0 ||
+        requestHeaderBytes(request.rawHeaders) >
+            LIVE_DASHBOARD_LIMITS.maximumHeaderBytes) {
+        return rejected(431, "HEADER_TOO_LARGE");
+    }
+    const target = request.target;
+    if (target === undefined ||
+        Buffer.byteLength(target, "utf8") >
+            LIVE_DASHBOARD_LIMITS.maximumRequestTargetBytes) {
+        return rejected(414, "TARGET_TOO_LARGE");
+    }
+    if (!target.startsWith("/") ||
+        target.startsWith("//") ||
+        target.includes("#") ||
+        /[\u0000-\u0020\u007f]/u.test(target)) {
+        return rejected(400, "BAD_REQUEST");
+    }
+    if (request.method === "OPTIONS") {
+        return rejected(405, "METHOD_NOT_ALLOWED");
+    }
+    const requiredMethod = options.kind === "navigation" ? "GET" : "POST";
+    if (request.method !== requiredMethod) {
+        return rejected(405, "METHOD_NOT_ALLOWED");
+    }
+    const headers = new Map();
+    const counts = new Map();
+    for (let index = 0; index < request.rawHeaders.length; index += 2) {
+        const rawName = request.rawHeaders[index] ?? "";
+        const value = request.rawHeaders[index + 1] ?? "";
+        if (!HEADER_NAME_PATTERN.test(rawName) || /[\r\n\u0000]/u.test(value)) {
+            return rejected(400, "BAD_REQUEST");
+        }
+        const name = rawName.toLowerCase();
+        if (isForwardingHeader(name) || name === "transfer-encoding") {
+            return rejected(400, "BAD_REQUEST");
+        }
+        const count = (counts.get(name) ?? 0) + 1;
+        counts.set(name, count);
+        if (count > 1 && SENSITIVE_SINGLETON_HEADERS.has(name)) {
+            return rejected(400, "BAD_REQUEST");
+        }
+        if (count === 1)
+            headers.set(name, value);
+    }
+    if (headers.get("host") !== options.expectedHost) {
+        return rejected(403, "CROSS_ORIGIN_REQUEST");
+    }
+    const origin = headers.get("origin");
+    if (options.kind === "navigation") {
+        if (origin !== undefined && origin !== options.expectedOrigin) {
+            return rejected(403, "CROSS_ORIGIN_REQUEST");
+        }
+    }
+    else if (origin !== options.expectedOrigin ||
+        headers.get("x-embassy-request") !== "1") {
+        return rejected(403, "CROSS_ORIGIN_REQUEST");
+    }
+    return { ok: true, headers };
+}
+export function liveDashboardSecurityHeaders(contentSecurityPolicy = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'") {
+    return Object.freeze({
+        "Cache-Control": "no-store",
+        Pragma: "no-cache",
+        "Content-Security-Policy": contentSecurityPolicy,
+        "Cross-Origin-Opener-Policy": "same-origin",
+        "Cross-Origin-Resource-Policy": "same-origin",
+        "Permissions-Policy": "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff",
+        "X-Frame-Options": "DENY",
+    });
+}
+export function readSingleCookie(cookieHeader, cookieName) {
+    if (cookieHeader === undefined ||
+        cookieHeader.length > LIVE_DASHBOARD_LIMITS.maximumHeaderBytes ||
+        !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u.test(cookieName)) {
+        return undefined;
+    }
+    let found;
+    for (const field of cookieHeader.split(";")) {
+        const separator = field.indexOf("=");
+        if (separator < 1)
+            continue;
+        const name = field.slice(0, separator).trim();
+        if (name !== cookieName)
+            continue;
+        if (found !== undefined)
+            return undefined;
+        const value = field.slice(separator + 1).trim();
+        if (!/^[A-Za-z0-9_-]{1,128}$/u.test(value))
+            return undefined;
+        found = value;
+    }
+    return found;
+}
+export function equalSecret(supplied, expected) {
+    if (supplied === undefined || expected === undefined)
+        return false;
+    const suppliedBytes = Buffer.from(supplied, "utf8");
+    const expectedBytes = Buffer.from(expected, "utf8");
+    if (suppliedBytes.length !== expectedBytes.length)
+        return false;
+    return timingSafeEqual(suppliedBytes, expectedBytes);
+}
+export function sessionCookieHeader(cookieName, value, instancePath) {
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u.test(cookieName) ||
+        !/^[A-Za-z0-9_-]{43,64}$/u.test(value) ||
+        !/^\/[A-Za-z0-9_-]{16,128}$/u.test(instancePath)) {
+        throw new Error("INVALID_LIVE_DASHBOARD_COOKIE");
+    }
+    return `${cookieName}=${value}; Path=${instancePath}/; HttpOnly; SameSite=Strict`;
+}
+//# sourceMappingURL=live-dashboard-protocol.js.map