asaihost-nodejs 0.0.1

package/dist/chunk-E7V3EBDB.es.js

@@ -0,0 +1,435 @@
+import {
+  dbAddSession,
+  dbCreateUser,
+  dbDeleteUser,
+  dbFindUser,
+  dbListSessions,
+  dbListUsers,
+  dbRemoveSession,
+  dbRemoveSessionsByUser,
+  dbUpdateUser,
+  dbWriteSessions,
+  resolveRoleForLevel
+} from "./chunk-EOGZPRML.es.js";
+import {
+  __name
+} from "./chunk-6U2I5EON.es.js";
+
+// src/sysserver/api/login/store/user-store.ts
+import { randomUUID } from "crypto";
+
+// src/config/secrets.ts
+import fs from "fs/promises";
+import path from "path";
+var ENV_MAP = {
+  password: "ASAI_HOST_PASSWORD",
+  asaisn: "ASAI_ASAISN",
+  aesKeyBase64: "ASAI_AES_KEYBASE64",
+  sessionSecret: "ASAI_SESSION_SECRET",
+  httpsKey: "ASAI_HTTPS_KEY",
+  httpsCert: "ASAI_HTTPS_CERT",
+  httpsKeyPath: "ASAI_HTTPS_KEY_PATH",
+  httpsCertPath: "ASAI_HTTPS_CERT_PATH",
+  wssecToken: "ASAI_WSSEC_TOKEN",
+  siemToken: "ASAI_SIEM_TOKEN"
+};
+function isNonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+__name(isNonEmptyString, "isNonEmptyString");
+async function loadDotEnvFile(envPath) {
+  const out = {};
+  try {
+    const raw = await fs.readFile(envPath, "utf8");
+    for (const line of raw.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq <= 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      let val = trimmed.slice(eq + 1).trim();
+      if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+        val = val.slice(1, -1);
+      }
+      if (key) out[key] = val;
+    }
+  } catch {
+  }
+  return out;
+}
+__name(loadDotEnvFile, "loadDotEnvFile");
+function envGet(name, dotenv) {
+  const fromProcess = process.env[name];
+  if (isNonEmptyString(fromProcess)) return fromProcess.trim();
+  const fromFile = dotenv[name];
+  if (isNonEmptyString(fromFile)) return fromFile.trim();
+  return void 0;
+}
+__name(envGet, "envGet");
+async function readJsonFile(filePath) {
+  try {
+    const raw = await fs.readFile(filePath, "utf8");
+    const data = JSON.parse(raw);
+    return data && typeof data === "object" && !Array.isArray(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+__name(readJsonFile, "readJsonFile");
+async function readPemFile(serverRoot, filePath) {
+  const abs = path.isAbsolute(filePath) ? filePath : path.join(serverRoot, filePath);
+  try {
+    return (await fs.readFile(abs, "utf8")).trim();
+  } catch {
+    return void 0;
+  }
+}
+__name(readPemFile, "readPemFile");
+function stripForbiddenSecretsFromHostConfig(cfg) {
+  const stripped = [];
+  if (isNonEmptyString(cfg.password)) {
+    stripped.push("password");
+    delete cfg.password;
+  }
+  if (isNonEmptyString(cfg.asaisn)) {
+    stripped.push("asaisn");
+    delete cfg.asaisn;
+  }
+  if (cfg.aes && typeof cfg.aes === "object" && isNonEmptyString(cfg.aes.keybase64)) {
+    stripped.push("aes.keybase64");
+    delete cfg.aes.keybase64;
+  }
+  if (cfg.security && typeof cfg.security === "object" && isNonEmptyString(cfg.security.sessionSecret)) {
+    stripped.push("security.sessionSecret");
+    delete cfg.security.sessionSecret;
+  }
+  if (cfg.httpscert && typeof cfg.httpscert === "object") {
+    if (isNonEmptyString(cfg.httpscert.key)) {
+      stripped.push("httpscert.key");
+      delete cfg.httpscert.key;
+    }
+    if (isNonEmptyString(cfg.httpscert.cert)) {
+      stripped.push("httpscert.cert");
+      delete cfg.httpscert.cert;
+    }
+  }
+  if (Array.isArray(cfg.wssec) && isNonEmptyString(cfg.wssec[0])) {
+    stripped.push("wssec[0]");
+    cfg.wssec = [cfg.wssec[0] ? "" : cfg.wssec[0], cfg.wssec[1] ?? "", cfg.wssec[2] ?? "-"];
+    cfg.wssec[0] = "";
+  }
+  return stripped;
+}
+__name(stripForbiddenSecretsFromHostConfig, "stripForbiddenSecretsFromHostConfig");
+function pickFromLocalJson(local) {
+  if (!local) return {};
+  return {
+    password: isNonEmptyString(local.password) ? local.password : void 0,
+    asaisn: isNonEmptyString(local.asaisn) ? local.asaisn : void 0,
+    aesKeyBase64: isNonEmptyString(local.aesKeyBase64) ? local.aesKeyBase64 : isNonEmptyString(local.aes?.keybase64) ? local.aes.keybase64 : void 0,
+    sessionSecret: isNonEmptyString(local.sessionSecret) ? local.sessionSecret : void 0,
+    httpsKey: isNonEmptyString(local.httpsKey) ? local.httpsKey : void 0,
+    httpsCert: isNonEmptyString(local.httpsCert) ? local.httpsCert : void 0,
+    wssecToken: isNonEmptyString(local.wssecToken) ? local.wssecToken : void 0
+  };
+}
+__name(pickFromLocalJson, "pickFromLocalJson");
+async function loadAsaiSecrets(serverRoot) {
+  const sources = [];
+  const dotenv = await loadDotEnvFile(path.join(serverRoot, ".env"));
+  if (Object.keys(dotenv).length) sources.push("webserver/.env");
+  const localPath = path.join(serverRoot, "websys/sys/asaihost.secrets.local.json");
+  const localJson = await readJsonFile(localPath);
+  if (localJson) sources.push("websys/sys/asaihost.secrets.local.json");
+  const fromLocal = pickFromLocalJson(localJson);
+  const password = envGet(ENV_MAP.password, dotenv) ?? fromLocal.password;
+  const asaisn = envGet(ENV_MAP.asaisn, dotenv) ?? fromLocal.asaisn;
+  const aesKeyBase64 = envGet(ENV_MAP.aesKeyBase64, dotenv) ?? fromLocal.aesKeyBase64;
+  let sessionSecret = envGet(ENV_MAP.sessionSecret, dotenv) ?? fromLocal.sessionSecret;
+  let httpsKey = envGet(ENV_MAP.httpsKey, dotenv) ?? fromLocal.httpsKey;
+  let httpsCert = envGet(ENV_MAP.httpsCert, dotenv) ?? fromLocal.httpsCert;
+  const wssecToken = envGet(ENV_MAP.wssecToken, dotenv) ?? fromLocal.wssecToken;
+  const siemToken = envGet(ENV_MAP.siemToken, dotenv) ?? fromLocal.siemToken;
+  if (envGet(ENV_MAP.password, dotenv)) sources.push("env:ASAI_HOST_PASSWORD");
+  if (envGet(ENV_MAP.asaisn, dotenv)) sources.push("env:ASAI_ASAISN");
+  if (envGet(ENV_MAP.aesKeyBase64, dotenv)) sources.push("env:ASAI_AES_KEYBASE64");
+  if (envGet(ENV_MAP.sessionSecret, dotenv)) sources.push("env:ASAI_SESSION_SECRET");
+  const keyPath = envGet(ENV_MAP.httpsKeyPath, dotenv);
+  const certPath = envGet(ENV_MAP.httpsCertPath, dotenv);
+  if (!httpsKey && keyPath) {
+    httpsKey = await readPemFile(serverRoot, keyPath);
+    if (httpsKey) sources.push("env:ASAI_HTTPS_KEY_PATH");
+  }
+  if (!httpsCert && certPath) {
+    httpsCert = await readPemFile(serverRoot, certPath);
+    if (httpsCert) sources.push("env:ASAI_HTTPS_CERT_PATH");
+  }
+  if (!sessionSecret && asaisn) {
+    sessionSecret = asaisn;
+    sources.push("derived:sessionSecret<=asaisn");
+  }
+  return {
+    secrets: {
+      password: password ?? "",
+      asaisn: asaisn ?? "",
+      aesKeyBase64: aesKeyBase64 ?? "",
+      sessionSecret: sessionSecret ?? "",
+      httpsKey,
+      httpsCert,
+      wssecToken,
+      siemToken
+    },
+    strippedFromJson: [],
+    sources: [...new Set(sources)]
+  };
+}
+__name(loadAsaiSecrets, "loadAsaiSecrets");
+function applySecretsToHostConfig(cfg, secrets) {
+  if (secrets.password) cfg.password = secrets.password;
+  if (secrets.asaisn) cfg.asaisn = secrets.asaisn;
+  if (secrets.aesKeyBase64) {
+    if (!cfg.aes || typeof cfg.aes !== "object") cfg.aes = {};
+    cfg.aes.keybase64 = secrets.aesKeyBase64;
+  }
+  if (secrets.sessionSecret) {
+    if (!cfg.security || typeof cfg.security !== "object") cfg.security = {};
+    cfg.security.sessionSecret = secrets.sessionSecret;
+  }
+  if (secrets.httpsKey && secrets.httpsCert) {
+    if (!cfg.httpscert || typeof cfg.httpscert !== "object") cfg.httpscert = {};
+    cfg.httpscert.key = secrets.httpsKey;
+    cfg.httpscert.cert = secrets.httpsCert;
+  } else if (cfg.httpscert && typeof cfg.httpscert === "object") {
+    const hc = cfg.httpscert;
+    if (!secrets.httpsKey && isNonEmptyString(hc.keyPath)) {
+    }
+  }
+  if (secrets.wssecToken) {
+    cfg.wssec = [secrets.wssecToken, "", "-"];
+  }
+  if (secrets.siemToken) {
+    if (!cfg.logger || typeof cfg.logger !== "object") cfg.logger = {};
+    if (!cfg.logger.siem || typeof cfg.logger.siem !== "object") cfg.logger.siem = {};
+    cfg.logger.siem.token = secrets.siemToken;
+    cfg.logger.siem.enabled = 1;
+  }
+}
+__name(applySecretsToHostConfig, "applySecretsToHostConfig");
+async function resolveHttpsCertFromPaths(serverRoot, cfg) {
+  const hc = cfg?.httpscert;
+  if (!hc || typeof hc !== "object") return;
+  if (hc.key && hc.cert) return;
+  const keyPath = hc.keyPath;
+  const certPath = hc.certPath;
+  if (!isNonEmptyString(keyPath) || !isNonEmptyString(certPath)) return;
+  const key = await readPemFile(serverRoot, keyPath);
+  const cert = await readPemFile(serverRoot, certPath);
+  if (key && cert) {
+    hc.key = key;
+    hc.cert = cert;
+  }
+}
+__name(resolveHttpsCertFromPaths, "resolveHttpsCertFromPaths");
+function validateAsaiSecrets(secrets, opts) {
+  const errors = [];
+  const prod = opts?.isProduction ?? process.env.NODE_ENV === "production";
+  if (!isNonEmptyString(secrets.password)) {
+    errors.push("\u7F3A\u5C11 ASAI_HOST_PASSWORD\uFF08\u6216 websys/sys/asaihost.secrets.local.json \u4E2D\u7684 password\uFF09");
+  }
+  if (!isNonEmptyString(secrets.asaisn)) {
+    errors.push("\u7F3A\u5C11 ASAI_ASAISN\uFF08Userinfo \u7F16\u89E3\u7801\u76D0\uFF0C\u7981\u6B62\u5199\u5165 asaihost.json\uFF09");
+  }
+  if (!isNonEmptyString(secrets.aesKeyBase64)) {
+    errors.push("\u7F3A\u5C11 ASAI_AES_KEYBASE64\uFF08AES \u5BC6\u94A5\uFF0C\u7981\u6B62\u5199\u5165 asaihost.json\uFF09");
+  }
+  if (!isNonEmptyString(secrets.sessionSecret)) {
+    errors.push("\u7F3A\u5C11 ASAI_SESSION_SECRET\uFF08\u6216 ASAI_ASAISN \u4F5C\u4E3A\u6D3E\u751F\u6E90\uFF09");
+  }
+  if (prod) {
+    const weak = ["asai", "password", "123456", "admin", "changeme"];
+    if (weak.includes(secrets.password.toLowerCase())) {
+      errors.push("\u751F\u4EA7\u73AF\u5883\u7981\u6B62\u4F7F\u7528\u5F31\u9ED8\u8BA4\u5BC6\u7801\uFF08IEC 62443-4-2 CR 1.7\uFF09");
+    }
+    if (secrets.password.length < 12) {
+      errors.push("\u751F\u4EA7\u73AF\u5883 ASAI_HOST_PASSWORD \u957F\u5EA6\u5E94 \u2265 12");
+    }
+  }
+  return errors;
+}
+__name(validateAsaiSecrets, "validateAsaiSecrets");
+function isDevDefaultPassword(password) {
+  return password === "asai" || password === "AsaiDevOnly1";
+}
+__name(isDevDefaultPassword, "isDevDefaultPassword");
+
+// src/sysserver/api/login/service/user-levels.ts
+var USER_LV = {
+  OPERATOR: 3,
+  ENGINEER: 5,
+  ADMIN: 7,
+  DEVELOPER: 9,
+  SUPER: 99
+};
+
+// src/sysserver/api/login/store/user-store.ts
+function toUserRecord(row) {
+  return {
+    id: String(row.id),
+    us: String(row.us),
+    email: row.email ? String(row.email) : void 0,
+    passHash: String(row.passHash),
+    passSalt: String(row.passSalt),
+    lv: Number(row.lv ?? 0),
+    role: row.role ? String(row.role) : void 0,
+    status: row.status || "active",
+    failCount: Number(row.failCount ?? 0),
+    lockedUntil: row.lockedUntil != null ? Number(row.lockedUntil) : void 0,
+    mustChangePassword: row.mustChangePassword != null ? Number(row.mustChangePassword) : void 0,
+    passwordChangedAt: row.passwordChangedAt != null ? Number(row.passwordChangedAt) : void 0,
+    passHistory: row.passHistory ? String(row.passHistory) : void 0,
+    createdAt: Number(row.createdAt),
+    updatedAt: Number(row.updatedAt)
+  };
+}
+__name(toUserRecord, "toUserRecord");
+function toSessionRecord(row) {
+  return {
+    id: String(row.id),
+    us: String(row.us),
+    ip: String(row.ip),
+    createdAt: Number(row.createdAt),
+    expiresAt: Number(row.expiresAt),
+    lastActivityAt: row.lastActivityAt != null ? Number(row.lastActivityAt) : void 0,
+    pri: String(row.pri),
+    pub: String(row.pub)
+  };
+}
+__name(toSessionRecord, "toSessionRecord");
+async function ensureBootstrapAdmin($asai) {
+  const users = await dbListUsers($asai);
+  if (users.length > 0) return;
+  const { hashPassword } = await import("./password-63OY27RX.es.js");
+  const pwd = $asai?.hostconfig?.password;
+  if (!pwd) throw new Error("[user-store] ASAI_HOST_PASSWORD \u672A\u914D\u7F6E\uFF0C\u65E0\u6CD5\u521B\u5EFA bootstrap admin");
+  const { passHash, passSalt } = hashPassword(pwd);
+  const now = Date.now();
+  const role = resolveRoleForLevel($asai, USER_LV.SUPER).name;
+  await dbCreateUser($asai, {
+    id: randomUUID(),
+    us: "admin",
+    email: "",
+    passHash,
+    passSalt,
+    lv: USER_LV.SUPER,
+    role,
+    status: "active",
+    failCount: 0,
+    lockedUntil: "",
+    mustChangePassword: isDevDefaultPassword(pwd) ? 1 : 0,
+    passwordChangedAt: now,
+    passHistory: "[]",
+    createdAt: now,
+    updatedAt: now
+  });
+}
+__name(ensureBootstrapAdmin, "ensureBootstrapAdmin");
+function createUserStore($asai) {
+  return {
+    async findByUsername(us) {
+      const row = await dbFindUser($asai, "us", us);
+      return row ? toUserRecord(row) : null;
+    },
+    async findById(id) {
+      const row = await dbFindUser($asai, "id", id);
+      return row ? toUserRecord(row) : null;
+    },
+    async listUsers() {
+      const rows = await dbListUsers($asai);
+      return rows.map(toUserRecord);
+    },
+    async createUser(data) {
+      const existing = await dbFindUser($asai, "us", data.us);
+      if (existing) throw new Error("Username already exists");
+      const now = Date.now();
+      const user = {
+        id: randomUUID(),
+        us: data.us,
+        email: data.email,
+        passHash: data.passHash,
+        passSalt: data.passSalt,
+        lv: data.lv ?? 0,
+        role: data.role || resolveRoleForLevel($asai, data.lv ?? 0).name,
+        status: data.status ?? "active",
+        failCount: 0,
+        mustChangePassword: data.mustChangePassword,
+        passwordChangedAt: data.passwordChangedAt ?? Date.now(),
+        passHistory: data.passHistory || "[]",
+        createdAt: now,
+        updatedAt: now
+      };
+      await dbCreateUser($asai, {
+        ...user,
+        email: user.email || "",
+        lockedUntil: user.lockedUntil ?? "",
+        mustChangePassword: user.mustChangePassword ?? 0,
+        passwordChangedAt: user.passwordChangedAt ?? now,
+        passHistory: user.passHistory || "[]",
+        role: user.role || ""
+      });
+      return user;
+    },
+    async updateUser(us, patch) {
+      const dbPatch = { ...patch };
+      if (patch.lockedUntil === void 0 && "lockedUntil" in patch) {
+        dbPatch.lockedUntil = "";
+      }
+      const row = await dbUpdateUser($asai, us, dbPatch);
+      return row ? toUserRecord(row) : null;
+    },
+    async getSessions() {
+      const sessions = (await dbListSessions($asai)).map(toSessionRecord);
+      const now = Date.now();
+      const valid = sessions.filter((s) => s.expiresAt > now);
+      if (valid.length !== sessions.length) {
+        await dbWriteSessions(
+          $asai,
+          valid.map((s) => ({ ...s }))
+        );
+      }
+      return valid;
+    },
+    async addSession(session) {
+      await dbAddSession($asai, { ...session });
+    },
+    async removeSession(sessionId) {
+      await dbRemoveSession($asai, sessionId);
+    },
+    async removeSessionsByUser(us) {
+      await dbRemoveSessionsByUser($asai, us);
+    },
+    async countSessions() {
+      return (await this.getSessions()).length;
+    },
+    async countSessionsByUser(us) {
+      return (await this.getSessions()).filter((s) => s.us === us).length;
+    },
+    async deleteUser(us) {
+      return dbDeleteUser($asai, us);
+    }
+  };
+}
+__name(createUserStore, "createUserStore");
+
+export {
+  loadDotEnvFile,
+  stripForbiddenSecretsFromHostConfig,
+  loadAsaiSecrets,
+  applySecretsToHostConfig,
+  resolveHttpsCertFromPaths,
+  validateAsaiSecrets,
+  isDevDefaultPassword,
+  USER_LV,
+  ensureBootstrapAdmin,
+  createUserStore
+};
+//# sourceMappingURL=chunk-E7V3EBDB.es.js.map

package/dist/chunk-E7V3EBDB.es.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sysserver/api/login/store/user-store.ts","../src/config/secrets.ts","../src/sysserver/api/login/service/user-levels.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\r\nimport type { IUserStore, SessionRecord, UserRecord } from './types';\r\nimport { isDevDefaultPassword } from '../../../../config/secrets';\r\nimport { resolveRoleForLevel } from '../../../../infra/security-policy';\r\nimport { USER_LV } from '../service/user-levels';\r\nimport {\r\n\tdbAddSession,\r\n\tdbCreateUser,\r\n\tdbFindUser,\r\n\tdbDeleteUser,\r\n\tdbListSessions,\r\n\tdbListUsers,\r\n\tdbRemoveSession,\r\n\tdbRemoveSessionsByUser,\r\n\tdbUpdateUser,\r\n\tdbWriteSessions,\r\n} from './user-db';\r\n\r\nfunction toUserRecord(row: Record<string, unknown>): UserRecord {\r\n\treturn {\r\n\t\tid: String(row.id),\r\n\t\tus: String(row.us),\r\n\t\temail: row.email ? String(row.email) : undefined,\r\n\t\tpassHash: String(row.passHash),\r\n\t\tpassSalt: String(row.passSalt),\r\n\t\tlv: Number(row.lv ?? 0),\r\n\t\trole: row.role ? String(row.role) : undefined,\r\n\t\tstatus: (row.status as UserRecord['status']) || 'active',\r\n\t\tfailCount: Number(row.failCount ?? 0),\r\n\t\tlockedUntil: row.lockedUntil != null ? Number(row.lockedUntil) : undefined,\r\n\t\tmustChangePassword: row.mustChangePassword != null ? Number(row.mustChangePassword) : undefined,\r\n\t\tpasswordChangedAt: row.passwordChangedAt != null ? Number(row.passwordChangedAt) : undefined,\r\n\t\tpassHistory: row.passHistory ? String(row.passHistory) : undefined,\r\n\t\tcreatedAt: Number(row.createdAt),\r\n\t\tupdatedAt: Number(row.updatedAt),\r\n\t};\r\n}\r\n\r\nfunction toSessionRecord(row: Record<string, unknown>): SessionRecord {\r\n\treturn {\r\n\t\tid: String(row.id),\r\n\t\tus: String(row.us),\r\n\t\tip: String(row.ip),\r\n\t\tcreatedAt: Number(row.createdAt),\r\n\t\texpiresAt: Number(row.expiresAt),\r\n\t\tlastActivityAt: row.lastActivityAt != null ? Number(row.lastActivityAt) : undefined,\r\n\t\tpri: String(row.pri),\r\n\t\tpub: String(row.pub),\r\n\t};\r\n}\r\n\r\nexport async function ensureBootstrapAdmin($asai: any): Promise<void> {\r\n\tconst users = await dbListUsers($asai);\r\n\tif (users.length > 0) return;\r\n\tconst { hashPassword } = await import('../service/password');\r\n\tconst pwd = $asai?.hostconfig?.password;\r\n\tif (!pwd) throw new Error('[user-store] ASAI_HOST_PASSWORD 未配置，无法创建 bootstrap admin');\r\n\tconst { passHash, passSalt } = hashPassword(pwd);\r\n\tconst now = Date.now();\r\n\tconst role = resolveRoleForLevel($asai, USER_LV.SUPER).name;\r\n\tawait dbCreateUser($asai, {\r\n\t\tid: randomUUID(),\r\n\t\tus: 'admin',\r\n\t\temail: '',\r\n\t\tpassHash,\r\n\t\tpassSalt,\r\n\t\tlv: USER_LV.SUPER,\r\n\t\trole,\r\n\t\tstatus: 'active',\r\n\t\tfailCount: 0,\r\n\t\tlockedUntil: '',\r\n\t\tmustChangePassword: isDevDefaultPassword(pwd) ? 1 : 0,\r\n\t\tpasswordChangedAt: now,\r\n\t\tpassHistory: '[]',\r\n\t\tcreatedAt: now,\r\n\t\tupdatedAt: now,\r\n\t});\r\n}\r\n\r\nexport function createUserStore($asai: any): IUserStore {\r\n\treturn {\r\n\t\tasync findByUsername(us) {\r\n\t\t\tconst row = await dbFindUser($asai, 'us', us);\r\n\t\t\treturn row ? toUserRecord(row) : null;\r\n\t\t},\r\n\t\tasync findById(id) {\r\n\t\t\tconst row = await dbFindUser($asai, 'id', id);\r\n\t\t\treturn row ? toUserRecord(row) : null;\r\n\t\t},\r\n\t\tasync listUsers() {\r\n\t\t\tconst rows = await dbListUsers($asai);\r\n\t\t\treturn rows.map(toUserRecord);\r\n\t\t},\r\n\t\tasync createUser(data) {\r\n\t\t\tconst existing = await dbFindUser($asai, 'us', data.us);\r\n\t\t\tif (existing) throw new Error('Username already exists');\r\n\t\t\tconst now = Date.now();\r\n\t\t\tconst user: UserRecord = {\r\n\t\t\t\tid: randomUUID(),\r\n\t\t\t\tus: data.us,\r\n\t\t\t\temail: data.email,\r\n\t\t\t\tpassHash: data.passHash,\r\n\t\t\t\tpassSalt: data.passSalt,\r\n\t\t\t\tlv: data.lv ?? 0,\r\n\t\t\t\trole: data.role || resolveRoleForLevel($asai, data.lv ?? 0).name,\r\n\t\t\t\tstatus: data.status ?? 'active',\r\n\t\t\t\tfailCount: 0,\r\n\t\t\t\tmustChangePassword: data.mustChangePassword,\r\n\t\t\t\tpasswordChangedAt: data.passwordChangedAt ?? Date.now(),\r\n\t\t\t\tpassHistory: data.passHistory || '[]',\r\n\t\t\t\tcreatedAt: now,\r\n\t\t\t\tupdatedAt: now,\r\n\t\t\t};\r\n\t\t\tawait dbCreateUser($asai, {\r\n\t\t\t\t...user,\r\n\t\t\t\temail: user.email || '',\r\n\t\t\t\tlockedUntil: user.lockedUntil ?? '',\r\n\t\t\t\tmustChangePassword: user.mustChangePassword ?? 0,\r\n\t\t\t\tpasswordChangedAt: user.passwordChangedAt ?? now,\r\n\t\t\t\tpassHistory: user.passHistory || '[]',\r\n\t\t\t\trole: user.role || '',\r\n\t\t\t});\r\n\t\t\treturn user;\r\n\t\t},\r\n\t\tasync updateUser(us, patch) {\r\n\t\t\tconst dbPatch: Record<string, unknown> = { ...patch };\r\n\t\t\tif (patch.lockedUntil === undefined && 'lockedUntil' in patch) {\r\n\t\t\t\tdbPatch.lockedUntil = '';\r\n\t\t\t}\r\n\t\t\tconst row = await dbUpdateUser($asai, us, dbPatch);\r\n\t\t\treturn row ? toUserRecord(row) : null;\r\n\t\t},\r\n\t\tasync getSessions() {\r\n\t\t\tconst sessions = (await dbListSessions($asai)).map(toSessionRecord);\r\n\t\t\tconst now = Date.now();\r\n\t\t\tconst valid = sessions.filter((s) => s.expiresAt > now);\r\n\t\t\tif (valid.length !== sessions.length) {\r\n\t\t\t\tawait dbWriteSessions(\r\n\t\t\t\t\t$asai,\r\n\t\t\t\t\tvalid.map((s) => ({ ...s })),\r\n\t\t\t\t);\r\n\t\t\t}\r\n\t\t\treturn valid;\r\n\t\t},\r\n\t\tasync addSession(session) {\r\n\t\t\tawait dbAddSession($asai, { ...session });\r\n\t\t},\r\n\t\tasync removeSession(sessionId) {\r\n\t\t\tawait dbRemoveSession($asai, sessionId);\r\n\t\t},\r\n\t\tasync removeSessionsByUser(us) {\r\n\t\t\tawait dbRemoveSessionsByUser($asai, us);\r\n\t\t},\r\n\t\tasync countSessions() {\r\n\t\t\treturn (await this.getSessions()).length;\r\n\t\t},\r\n\t\tasync countSessionsByUser(us) {\r\n\t\t\treturn (await this.getSessions()).filter((s) => s.us === us).length;\r\n\t\t},\r\n\t\tasync deleteUser(us) {\r\n\t\t\treturn dbDeleteUser($asai, us);\r\n\t\t},\r\n\t};\r\n}\r\n","/**\r\n * IEC 62443-4-2 CR 4.1 / CR 1.7 — 密钥与凭据不得写入版本库内的 asaihost.json。\r\n * 加载顺序：process.env > webserver/.env > asaihost.secrets.local.json\r\n */\r\nimport fs from 'node:fs/promises';\r\nimport path from 'node:path';\r\n\r\n/** 禁止出现在 asaihost.json 中的敏感字段（检测到则剥离并审计） */\r\nexport const FORBIDDEN_HOSTCONFIG_KEYS = [\r\n\t'password',\r\n\t'asaisn',\r\n] as const;\r\n\r\nexport interface AsaiSecrets {\r\n\tpassword: string;\r\n\tasaisn: string;\r\n\taesKeyBase64: string;\r\n\tsessionSecret: string;\r\n\thttpsKey?: string;\r\n\thttpsCert?: string;\r\n\twssecToken?: string;\r\n\tsiemToken?: string;\r\n}\r\n\r\nexport interface SecretsLoadResult {\r\n\tsecrets: AsaiSecrets;\r\n\tstrippedFromJson: string[];\r\n\tsources: string[];\r\n}\r\n\r\nconst ENV_MAP = {\r\n\tpassword: 'ASAI_HOST_PASSWORD',\r\n\tasaisn: 'ASAI_ASAISN',\r\n\taesKeyBase64: 'ASAI_AES_KEYBASE64',\r\n\tsessionSecret: 'ASAI_SESSION_SECRET',\r\n\thttpsKey: 'ASAI_HTTPS_KEY',\r\n\thttpsCert: 'ASAI_HTTPS_CERT',\r\n\thttpsKeyPath: 'ASAI_HTTPS_KEY_PATH',\r\n\thttpsCertPath: 'ASAI_HTTPS_CERT_PATH',\r\n\twssecToken: 'ASAI_WSSEC_TOKEN',\r\n\tsiemToken: 'ASAI_SIEM_TOKEN',\r\n} as const;\r\n\r\nfunction isNonEmptyString(v: unknown): v is string {\r\n\treturn typeof v === 'string' && v.trim().length > 0;\r\n}\r\n\r\n/** 轻量 .env 解析（不引入 dotenv 依赖） */\r\nexport async function loadDotEnvFile(envPath: string): Promise<Record<string, string>> {\r\n\tconst out: Record<string, string> = {};\r\n\ttry {\r\n\t\tconst raw = await fs.readFile(envPath, 'utf8');\r\n\t\tfor (const line of raw.split(/\\r?\\n/)) {\r\n\t\t\tconst trimmed = line.trim();\r\n\t\t\tif (!trimmed || trimmed.startsWith('#')) continue;\r\n\t\t\tconst eq = trimmed.indexOf('=');\r\n\t\t\tif (eq <= 0) continue;\r\n\t\t\tconst key = trimmed.slice(0, eq).trim();\r\n\t\t\tlet val = trimmed.slice(eq + 1).trim();\r\n\t\t\tif ((val.startsWith('\"') && val.endsWith('\"')) || (val.startsWith(\"'\") && val.endsWith(\"'\"))) {\r\n\t\t\t\tval = val.slice(1, -1);\r\n\t\t\t}\r\n\t\t\tif (key) out[key] = val;\r\n\t\t}\r\n\t} catch {\r\n\t\t/* optional file */\r\n\t}\r\n\treturn out;\r\n}\r\n\r\nfunction envGet(name: string, dotenv: Record<string, string>): string | undefined {\r\n\tconst fromProcess = process.env[name];\r\n\tif (isNonEmptyString(fromProcess)) return fromProcess.trim();\r\n\tconst fromFile = dotenv[name];\r\n\tif (isNonEmptyString(fromFile)) return fromFile.trim();\r\n\treturn undefined;\r\n}\r\n\r\nasync function readJsonFile(filePath: string): Promise<Record<string, unknown> | null> {\r\n\ttry {\r\n\t\tconst raw = await fs.readFile(filePath, 'utf8');\r\n\t\tconst data = JSON.parse(raw);\r\n\t\treturn data && typeof data === 'object' && !Array.isArray(data) ? (data as Record<string, unknown>) : null;\r\n\t} catch {\r\n\t\treturn null;\r\n\t}\r\n}\r\n\r\nasync function readPemFile(serverRoot: string, filePath: string): Promise<string | undefined> {\r\n\tconst abs = path.isAbsolute(filePath) ? filePath : path.join(serverRoot, filePath);\r\n\ttry {\r\n\t\treturn (await fs.readFile(abs, 'utf8')).trim();\r\n\t} catch {\r\n\t\treturn undefined;\r\n\t}\r\n}\r\n\r\n/**\r\n * 从 asaihost.json 剥离敏感字段（禁止落盘/进仓库）。\r\n * 返回被剥离的字段路径列表，供安全审计。\r\n */\r\nexport function stripForbiddenSecretsFromHostConfig(cfg: Record<string, any>): string[] {\r\n\tconst stripped: string[] = [];\r\n\r\n\tif (isNonEmptyString(cfg.password)) {\r\n\t\tstripped.push('password');\r\n\t\tdelete cfg.password;\r\n\t}\r\n\tif (isNonEmptyString(cfg.asaisn)) {\r\n\t\tstripped.push('asaisn');\r\n\t\tdelete cfg.asaisn;\r\n\t}\r\n\tif (cfg.aes && typeof cfg.aes === 'object' && isNonEmptyString(cfg.aes.keybase64)) {\r\n\t\tstripped.push('aes.keybase64');\r\n\t\tdelete cfg.aes.keybase64;\r\n\t}\r\n\tif (cfg.security && typeof cfg.security === 'object' && isNonEmptyString(cfg.security.sessionSecret)) {\r\n\t\tstripped.push('security.sessionSecret');\r\n\t\tdelete cfg.security.sessionSecret;\r\n\t}\r\n\tif (cfg.httpscert && typeof cfg.httpscert === 'object') {\r\n\t\tif (isNonEmptyString(cfg.httpscert.key)) {\r\n\t\t\tstripped.push('httpscert.key');\r\n\t\t\tdelete cfg.httpscert.key;\r\n\t\t}\r\n\t\tif (isNonEmptyString(cfg.httpscert.cert)) {\r\n\t\t\tstripped.push('httpscert.cert');\r\n\t\t\tdelete cfg.httpscert.cert;\r\n\t\t}\r\n\t}\r\n\tif (Array.isArray(cfg.wssec) && isNonEmptyString(cfg.wssec[0])) {\r\n\t\tstripped.push('wssec[0]');\r\n\t\tcfg.wssec = [cfg.wssec[0] ? '' : cfg.wssec[0], cfg.wssec[1] ?? '', cfg.wssec[2] ?? '-'];\r\n\t\tcfg.wssec[0] = '';\r\n\t}\r\n\r\n\treturn stripped;\r\n}\r\n\r\nfunction pickFromLocalJson(local: Record<string, unknown> | null): Partial<AsaiSecrets> {\r\n\tif (!local) return {};\r\n\treturn {\r\n\t\tpassword: isNonEmptyString(local.password) ? local.password : undefined,\r\n\t\tasaisn: isNonEmptyString(local.asaisn) ? local.asaisn : undefined,\r\n\t\taesKeyBase64: isNonEmptyString(local.aesKeyBase64)\r\n\t\t\t? local.aesKeyBase64\r\n\t\t\t: isNonEmptyString((local.aes as any)?.keybase64)\r\n\t\t\t\t? (local.aes as any).keybase64\r\n\t\t\t\t: undefined,\r\n\t\tsessionSecret: isNonEmptyString(local.sessionSecret) ? local.sessionSecret : undefined,\r\n\t\thttpsKey: isNonEmptyString(local.httpsKey) ? local.httpsKey : undefined,\r\n\t\thttpsCert: isNonEmptyString(local.httpsCert) ? local.httpsCert : undefined,\r\n\t\twssecToken: isNonEmptyString(local.wssecToken) ? local.wssecToken : undefined,\r\n\t};\r\n}\r\n\r\nexport async function loadAsaiSecrets(serverRoot: string): Promise<SecretsLoadResult> {\r\n\tconst sources: string[] = [];\r\n\tconst dotenv = await loadDotEnvFile(path.join(serverRoot, '.env'));\r\n\tif (Object.keys(dotenv).length) sources.push('webserver/.env');\r\n\r\n\tconst localPath = path.join(serverRoot, 'websys/sys/asaihost.secrets.local.json');\r\n\tconst localJson = await readJsonFile(localPath);\r\n\tif (localJson) sources.push('websys/sys/asaihost.secrets.local.json');\r\n\r\n\tconst fromLocal = pickFromLocalJson(localJson);\r\n\r\n\tconst password =\r\n\t\tenvGet(ENV_MAP.password, dotenv) ?? fromLocal.password;\r\n\tconst asaisn =\r\n\t\tenvGet(ENV_MAP.asaisn, dotenv) ?? fromLocal.asaisn;\r\n\tconst aesKeyBase64 =\r\n\t\tenvGet(ENV_MAP.aesKeyBase64, dotenv) ?? fromLocal.aesKeyBase64;\r\n\tlet sessionSecret =\r\n\t\tenvGet(ENV_MAP.sessionSecret, dotenv) ?? fromLocal.sessionSecret;\r\n\tlet httpsKey =\r\n\t\tenvGet(ENV_MAP.httpsKey, dotenv) ?? fromLocal.httpsKey;\r\n\tlet httpsCert =\r\n\t\tenvGet(ENV_MAP.httpsCert, dotenv) ?? fromLocal.httpsCert;\r\n\tconst wssecToken =\r\n\t\tenvGet(ENV_MAP.wssecToken, dotenv) ?? fromLocal.wssecToken;\r\n\tconst siemToken =\r\n\t\tenvGet(ENV_MAP.siemToken, dotenv) ?? (fromLocal as any).siemToken;\r\n\r\n\tif (envGet(ENV_MAP.password, dotenv)) sources.push('env:ASAI_HOST_PASSWORD');\r\n\tif (envGet(ENV_MAP.asaisn, dotenv)) sources.push('env:ASAI_ASAISN');\r\n\tif (envGet(ENV_MAP.aesKeyBase64, dotenv)) sources.push('env:ASAI_AES_KEYBASE64');\r\n\tif (envGet(ENV_MAP.sessionSecret, dotenv)) sources.push('env:ASAI_SESSION_SECRET');\r\n\r\n\tconst keyPath = envGet(ENV_MAP.httpsKeyPath, dotenv);\r\n\tconst certPath = envGet(ENV_MAP.httpsCertPath, dotenv);\r\n\tif (!httpsKey && keyPath) {\r\n\t\thttpsKey = await readPemFile(serverRoot, keyPath);\r\n\t\tif (httpsKey) sources.push('env:ASAI_HTTPS_KEY_PATH');\r\n\t}\r\n\tif (!httpsCert && certPath) {\r\n\t\thttpsCert = await readPemFile(serverRoot, certPath);\r\n\t\tif (httpsCert) sources.push('env:ASAI_HTTPS_CERT_PATH');\r\n\t}\r\n\r\n\tif (!sessionSecret && asaisn) {\r\n\t\tsessionSecret = asaisn;\r\n\t\tsources.push('derived:sessionSecret<=asaisn');\r\n\t}\r\n\r\n\treturn {\r\n\t\tsecrets: {\r\n\t\t\tpassword: password ?? '',\r\n\t\t\tasaisn: asaisn ?? '',\r\n\t\t\taesKeyBase64: aesKeyBase64 ?? '',\r\n\t\t\tsessionSecret: sessionSecret ?? '',\r\n\t\t\thttpsKey,\r\n\t\t\thttpsCert,\r\n\t\t\twssecToken,\r\n\t\t\tsiemToken,\r\n\t\t},\r\n\t\tstrippedFromJson: [],\r\n\t\tsources: [...new Set(sources)],\r\n\t};\r\n}\r\n\r\n/** 将已加载的密钥合并进运行时 hostconfig（仅内存，不写回 JSON） */\r\nexport function applySecretsToHostConfig(cfg: Record<string, any>, secrets: AsaiSecrets): void {\r\n\tif (secrets.password) cfg.password = secrets.password;\r\n\tif (secrets.asaisn) cfg.asaisn = secrets.asaisn;\r\n\tif (secrets.aesKeyBase64) {\r\n\t\tif (!cfg.aes || typeof cfg.aes !== 'object') cfg.aes = {};\r\n\t\tcfg.aes.keybase64 = secrets.aesKeyBase64;\r\n\t}\r\n\tif (secrets.sessionSecret) {\r\n\t\tif (!cfg.security || typeof cfg.security !== 'object') cfg.security = {};\r\n\t\tcfg.security.sessionSecret = secrets.sessionSecret;\r\n\t}\r\n\tif (secrets.httpsKey && secrets.httpsCert) {\r\n\t\tif (!cfg.httpscert || typeof cfg.httpscert !== 'object') cfg.httpscert = {};\r\n\t\tcfg.httpscert.key = secrets.httpsKey;\r\n\t\tcfg.httpscert.cert = secrets.httpsCert;\r\n\t} else if (cfg.httpscert && typeof cfg.httpscert === 'object') {\r\n\t\tconst hc = cfg.httpscert;\r\n\t\tif (!secrets.httpsKey && isNonEmptyString(hc.keyPath)) {\r\n\t\t\t/* keyPath resolved at apply time by caller if needed */\r\n\t\t}\r\n\t}\r\n\tif (secrets.wssecToken) {\r\n\t\tcfg.wssec = [secrets.wssecToken, '', '-'];\r\n\t}\r\n\tif (secrets.siemToken) {\r\n\t\tif (!cfg.logger || typeof cfg.logger !== 'object') cfg.logger = {};\r\n\t\tif (!cfg.logger.siem || typeof cfg.logger.siem !== 'object') cfg.logger.siem = {};\r\n\t\tcfg.logger.siem.token = secrets.siemToken;\r\n\t\tcfg.logger.siem.enabled = 1;\r\n\t}\r\n}\r\n\r\nexport async function resolveHttpsCertFromPaths(serverRoot: string, cfg: Record<string, any>): Promise<void> {\r\n\tconst hc = cfg?.httpscert;\r\n\tif (!hc || typeof hc !== 'object') return;\r\n\tif (hc.key && hc.cert) return;\r\n\tconst keyPath = hc.keyPath;\r\n\tconst certPath = hc.certPath;\r\n\tif (!isNonEmptyString(keyPath) || !isNonEmptyString(certPath)) return;\r\n\tconst key = await readPemFile(serverRoot, keyPath);\r\n\tconst cert = await readPemFile(serverRoot, certPath);\r\n\tif (key && cert) {\r\n\t\thc.key = key;\r\n\t\thc.cert = cert;\r\n\t}\r\n}\r\n\r\nexport function validateAsaiSecrets(secrets: AsaiSecrets, opts?: { isProduction?: boolean }): string[] {\r\n\tconst errors: string[] = [];\r\n\tconst prod = opts?.isProduction ?? process.env.NODE_ENV === 'production';\r\n\r\n\tif (!isNonEmptyString(secrets.password)) {\r\n\t\terrors.push('缺少 ASAI_HOST_PASSWORD（或 websys/sys/asaihost.secrets.local.json 中的 password）');\r\n\t}\r\n\tif (!isNonEmptyString(secrets.asaisn)) {\r\n\t\terrors.push('缺少 ASAI_ASAISN（Userinfo 编解码盐，禁止写入 asaihost.json）');\r\n\t}\r\n\tif (!isNonEmptyString(secrets.aesKeyBase64)) {\r\n\t\terrors.push('缺少 ASAI_AES_KEYBASE64（AES 密钥，禁止写入 asaihost.json）');\r\n\t}\r\n\tif (!isNonEmptyString(secrets.sessionSecret)) {\r\n\t\terrors.push('缺少 ASAI_SESSION_SECRET（或 ASAI_ASAISN 作为派生源）');\r\n\t}\r\n\r\n\tif (prod) {\r\n\t\tconst weak = ['asai', 'password', '123456', 'admin', 'changeme'];\r\n\t\tif (weak.includes(secrets.password.toLowerCase())) {\r\n\t\t\terrors.push('生产环境禁止使用弱默认密码（IEC 62443-4-2 CR 1.7）');\r\n\t\t}\r\n\t\tif (secrets.password.length < 12) {\r\n\t\t\terrors.push('生产环境 ASAI_HOST_PASSWORD 长度应 ≥ 12');\r\n\t\t}\r\n\t}\r\n\r\n\treturn errors;\r\n}\r\n\r\nexport function isDevDefaultPassword(password: string): boolean {\r\n\treturn password === 'asai' || password === 'AsaiDevOnly1';\r\n}\r\n","/** 内置等级常量（默认阈值；运行时应优先读 user-level-config） */\r\nexport const USER_LV = {\r\n\tOPERATOR: 3,\r\n\tENGINEER: 5,\r\n\tADMIN: 7,\r\n\tDEVELOPER: 9,\r\n\tSUPER: 99,\r\n} as const;\r\n\r\nexport { getPermissionThreshold, getLvSteps, getLevelLabel, isValidUserLv } from './user-level-config';\r\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;;;ACI3B,OAAO,QAAQ;AACf,OAAO,UAAU;AAyBjB,IAAM,UAAU;AAAA,EACf,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,eAAe;AAAA,EACf,UAAU;AAAA,EACV,WAAW;AAAA,EACX,cAAc;AAAA,EACd,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,WAAW;AACZ;AAEA,SAAS,iBAAiB,GAAyB;AAClD,SAAO,OAAO,MAAM,YAAY,EAAE,KAAK,EAAE,SAAS;AACnD;AAFS;AAKT,eAAsB,eAAe,SAAkD;AACtF,QAAM,MAA8B,CAAC;AACrC,MAAI;AACH,UAAM,MAAM,MAAM,GAAG,SAAS,SAAS,MAAM;AAC7C,eAAW,QAAQ,IAAI,MAAM,OAAO,GAAG;AACtC,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,YAAM,KAAK,QAAQ,QAAQ,GAAG;AAC9B,UAAI,MAAM,EAAG;AACb,YAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AACtC,UAAI,MAAM,QAAQ,MAAM,KAAK,CAAC,EAAE,KAAK;AACrC,UAAK,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,KAAO,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,GAAI;AAC7F,cAAM,IAAI,MAAM,GAAG,EAAE;AAAA,MACtB;AACA,UAAI,IAAK,KAAI,GAAG,IAAI;AAAA,IACrB;AAAA,EACD,QAAQ;AAAA,EAER;AACA,SAAO;AACR;AApBsB;AAsBtB,SAAS,OAAO,MAAc,QAAoD;AACjF,QAAM,cAAc,QAAQ,IAAI,IAAI;AACpC,MAAI,iBAAiB,WAAW,EAAG,QAAO,YAAY,KAAK;AAC3D,QAAM,WAAW,OAAO,IAAI;AAC5B,MAAI,iBAAiB,QAAQ,EAAG,QAAO,SAAS,KAAK;AACrD,SAAO;AACR;AANS;AAQT,eAAe,aAAa,UAA2D;AACtF,MAAI;AACH,UAAM,MAAM,MAAM,GAAG,SAAS,UAAU,MAAM;AAC9C,UAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,WAAO,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,IAAK,OAAmC;AAAA,EACvG,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AARe;AAUf,eAAe,YAAY,YAAoB,UAA+C;AAC7F,QAAM,MAAM,KAAK,WAAW,QAAQ,IAAI,WAAW,KAAK,KAAK,YAAY,QAAQ;AACjF,MAAI;AACH,YAAQ,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,KAAK;AAAA,EAC9C,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAPe;AAaR,SAAS,oCAAoC,KAAoC;AACvF,QAAM,WAAqB,CAAC;AAE5B,MAAI,iBAAiB,IAAI,QAAQ,GAAG;AACnC,aAAS,KAAK,UAAU;AACxB,WAAO,IAAI;AAAA,EACZ;AACA,MAAI,iBAAiB,IAAI,MAAM,GAAG;AACjC,aAAS,KAAK,QAAQ;AACtB,WAAO,IAAI;AAAA,EACZ;AACA,MAAI,IAAI,OAAO,OAAO,IAAI,QAAQ,YAAY,iBAAiB,IAAI,IAAI,SAAS,GAAG;AAClF,aAAS,KAAK,eAAe;AAC7B,WAAO,IAAI,IAAI;AAAA,EAChB;AACA,MAAI,IAAI,YAAY,OAAO,IAAI,aAAa,YAAY,iBAAiB,IAAI,SAAS,aAAa,GAAG;AACrG,aAAS,KAAK,wBAAwB;AACtC,WAAO,IAAI,SAAS;AAAA,EACrB;AACA,MAAI,IAAI,aAAa,OAAO,IAAI,cAAc,UAAU;AACvD,QAAI,iBAAiB,IAAI,UAAU,GAAG,GAAG;AACxC,eAAS,KAAK,eAAe;AAC7B,aAAO,IAAI,UAAU;AAAA,IACtB;AACA,QAAI,iBAAiB,IAAI,UAAU,IAAI,GAAG;AACzC,eAAS,KAAK,gBAAgB;AAC9B,aAAO,IAAI,UAAU;AAAA,IACtB;AAAA,EACD;AACA,MAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,iBAAiB,IAAI,MAAM,CAAC,CAAC,GAAG;AAC/D,aAAS,KAAK,UAAU;AACxB,QAAI,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,GAAG;AACtF,QAAI,MAAM,CAAC,IAAI;AAAA,EAChB;AAEA,SAAO;AACR;AApCgB;AAsChB,SAAS,kBAAkB,OAA6D;AACvF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO;AAAA,IACN,UAAU,iBAAiB,MAAM,QAAQ,IAAI,MAAM,WAAW;AAAA,IAC9D,QAAQ,iBAAiB,MAAM,MAAM,IAAI,MAAM,SAAS;AAAA,IACxD,cAAc,iBAAiB,MAAM,YAAY,IAC9C,MAAM,eACN,iBAAkB,MAAM,KAAa,SAAS,IAC5C,MAAM,IAAY,YACnB;AAAA,IACJ,eAAe,iBAAiB,MAAM,aAAa,IAAI,MAAM,gBAAgB;AAAA,IAC7E,UAAU,iBAAiB,MAAM,QAAQ,IAAI,MAAM,WAAW;AAAA,IAC9D,WAAW,iBAAiB,MAAM,SAAS,IAAI,MAAM,YAAY;AAAA,IACjE,YAAY,iBAAiB,MAAM,UAAU,IAAI,MAAM,aAAa;AAAA,EACrE;AACD;AAfS;AAiBT,eAAsB,gBAAgB,YAAgD;AACrF,QAAM,UAAoB,CAAC;AAC3B,QAAM,SAAS,MAAM,eAAe,KAAK,KAAK,YAAY,MAAM,CAAC;AACjE,MAAI,OAAO,KAAK,MAAM,EAAE,OAAQ,SAAQ,KAAK,gBAAgB;AAE7D,QAAM,YAAY,KAAK,KAAK,YAAY,wCAAwC;AAChF,QAAM,YAAY,MAAM,aAAa,SAAS;AAC9C,MAAI,UAAW,SAAQ,KAAK,wCAAwC;AAEpE,QAAM,YAAY,kBAAkB,SAAS;AAE7C,QAAM,WACL,OAAO,QAAQ,UAAU,MAAM,KAAK,UAAU;AAC/C,QAAM,SACL,OAAO,QAAQ,QAAQ,MAAM,KAAK,UAAU;AAC7C,QAAM,eACL,OAAO,QAAQ,cAAc,MAAM,KAAK,UAAU;AACnD,MAAI,gBACH,OAAO,QAAQ,eAAe,MAAM,KAAK,UAAU;AACpD,MAAI,WACH,OAAO,QAAQ,UAAU,MAAM,KAAK,UAAU;AAC/C,MAAI,YACH,OAAO,QAAQ,WAAW,MAAM,KAAK,UAAU;AAChD,QAAM,aACL,OAAO,QAAQ,YAAY,MAAM,KAAK,UAAU;AACjD,QAAM,YACL,OAAO,QAAQ,WAAW,MAAM,KAAM,UAAkB;AAEzD,MAAI,OAAO,QAAQ,UAAU,MAAM,EAAG,SAAQ,KAAK,wBAAwB;AAC3E,MAAI,OAAO,QAAQ,QAAQ,MAAM,EAAG,SAAQ,KAAK,iBAAiB;AAClE,MAAI,OAAO,QAAQ,cAAc,MAAM,EAAG,SAAQ,KAAK,wBAAwB;AAC/E,MAAI,OAAO,QAAQ,eAAe,MAAM,EAAG,SAAQ,KAAK,yBAAyB;AAEjF,QAAM,UAAU,OAAO,QAAQ,cAAc,MAAM;AACnD,QAAM,WAAW,OAAO,QAAQ,eAAe,MAAM;AACrD,MAAI,CAAC,YAAY,SAAS;AACzB,eAAW,MAAM,YAAY,YAAY,OAAO;AAChD,QAAI,SAAU,SAAQ,KAAK,yBAAyB;AAAA,EACrD;AACA,MAAI,CAAC,aAAa,UAAU;AAC3B,gBAAY,MAAM,YAAY,YAAY,QAAQ;AAClD,QAAI,UAAW,SAAQ,KAAK,0BAA0B;AAAA,EACvD;AAEA,MAAI,CAAC,iBAAiB,QAAQ;AAC7B,oBAAgB;AAChB,YAAQ,KAAK,+BAA+B;AAAA,EAC7C;AAEA,SAAO;AAAA,IACN,SAAS;AAAA,MACR,UAAU,YAAY;AAAA,MACtB,QAAQ,UAAU;AAAA,MAClB,cAAc,gBAAgB;AAAA,MAC9B,eAAe,iBAAiB;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;AAAA,EAC9B;AACD;AA/DsB;AAkEf,SAAS,yBAAyB,KAA0B,SAA4B;AAC9F,MAAI,QAAQ,SAAU,KAAI,WAAW,QAAQ;AAC7C,MAAI,QAAQ,OAAQ,KAAI,SAAS,QAAQ;AACzC,MAAI,QAAQ,cAAc;AACzB,QAAI,CAAC,IAAI,OAAO,OAAO,IAAI,QAAQ,SAAU,KAAI,MAAM,CAAC;AACxD,QAAI,IAAI,YAAY,QAAQ;AAAA,EAC7B;AACA,MAAI,QAAQ,eAAe;AAC1B,QAAI,CAAC,IAAI,YAAY,OAAO,IAAI,aAAa,SAAU,KAAI,WAAW,CAAC;AACvE,QAAI,SAAS,gBAAgB,QAAQ;AAAA,EACtC;AACA,MAAI,QAAQ,YAAY,QAAQ,WAAW;AAC1C,QAAI,CAAC,IAAI,aAAa,OAAO,IAAI,cAAc,SAAU,KAAI,YAAY,CAAC;AAC1E,QAAI,UAAU,MAAM,QAAQ;AAC5B,QAAI,UAAU,OAAO,QAAQ;AAAA,EAC9B,WAAW,IAAI,aAAa,OAAO,IAAI,cAAc,UAAU;AAC9D,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,QAAQ,YAAY,iBAAiB,GAAG,OAAO,GAAG;AAAA,IAEvD;AAAA,EACD;AACA,MAAI,QAAQ,YAAY;AACvB,QAAI,QAAQ,CAAC,QAAQ,YAAY,IAAI,GAAG;AAAA,EACzC;AACA,MAAI,QAAQ,WAAW;AACtB,QAAI,CAAC,IAAI,UAAU,OAAO,IAAI,WAAW,SAAU,KAAI,SAAS,CAAC;AACjE,QAAI,CAAC,IAAI,OAAO,QAAQ,OAAO,IAAI,OAAO,SAAS,SAAU,KAAI,OAAO,OAAO,CAAC;AAChF,QAAI,OAAO,KAAK,QAAQ,QAAQ;AAChC,QAAI,OAAO,KAAK,UAAU;AAAA,EAC3B;AACD;AA9BgB;AAgChB,eAAsB,0BAA0B,YAAoB,KAAyC;AAC5G,QAAM,KAAK,KAAK;AAChB,MAAI,CAAC,MAAM,OAAO,OAAO,SAAU;AACnC,MAAI,GAAG,OAAO,GAAG,KAAM;AACvB,QAAM,UAAU,GAAG;AACnB,QAAM,WAAW,GAAG;AACpB,MAAI,CAAC,iBAAiB,OAAO,KAAK,CAAC,iBAAiB,QAAQ,EAAG;AAC/D,QAAM,MAAM,MAAM,YAAY,YAAY,OAAO;AACjD,QAAM,OAAO,MAAM,YAAY,YAAY,QAAQ;AACnD,MAAI,OAAO,MAAM;AAChB,OAAG,MAAM;AACT,OAAG,OAAO;AAAA,EACX;AACD;AAbsB;AAef,SAAS,oBAAoB,SAAsB,MAA6C;AACtG,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,MAAM,gBAAgB,QAAQ,IAAI,aAAa;AAE5D,MAAI,CAAC,iBAAiB,QAAQ,QAAQ,GAAG;AACxC,WAAO,KAAK,gHAA6E;AAAA,EAC1F;AACA,MAAI,CAAC,iBAAiB,QAAQ,MAAM,GAAG;AACtC,WAAO,KAAK,mHAAkD;AAAA,EAC/D;AACA,MAAI,CAAC,iBAAiB,QAAQ,YAAY,GAAG;AAC5C,WAAO,KAAK,yGAAkD;AAAA,EAC/D;AACA,MAAI,CAAC,iBAAiB,QAAQ,aAAa,GAAG;AAC7C,WAAO,KAAK,+FAA6C;AAAA,EAC1D;AAEA,MAAI,MAAM;AACT,UAAM,OAAO,CAAC,QAAQ,YAAY,UAAU,SAAS,UAAU;AAC/D,QAAI,KAAK,SAAS,QAAQ,SAAS,YAAY,CAAC,GAAG;AAClD,aAAO,KAAK,gHAAqC;AAAA,IAClD;AACA,QAAI,QAAQ,SAAS,SAAS,IAAI;AACjC,aAAO,KAAK,0EAAkC;AAAA,IAC/C;AAAA,EACD;AAEA,SAAO;AACR;AA5BgB;AA8BT,SAAS,qBAAqB,UAA2B;AAC/D,SAAO,aAAa,UAAU,aAAa;AAC5C;AAFgB;;;AC1ST,IAAM,UAAU;AAAA,EACtB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,OAAO;AAAA,EACP,WAAW;AAAA,EACX,OAAO;AACR;;;AFWA,SAAS,aAAa,KAA0C;AAC/D,SAAO;AAAA,IACN,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,OAAO,IAAI,QAAQ,OAAO,IAAI,KAAK,IAAI;AAAA,IACvC,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,IAAI,OAAO,IAAI,MAAM,CAAC;AAAA,IACtB,MAAM,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI;AAAA,IACpC,QAAS,IAAI,UAAmC;AAAA,IAChD,WAAW,OAAO,IAAI,aAAa,CAAC;AAAA,IACpC,aAAa,IAAI,eAAe,OAAO,OAAO,IAAI,WAAW,IAAI;AAAA,IACjE,oBAAoB,IAAI,sBAAsB,OAAO,OAAO,IAAI,kBAAkB,IAAI;AAAA,IACtF,mBAAmB,IAAI,qBAAqB,OAAO,OAAO,IAAI,iBAAiB,IAAI;AAAA,IACnF,aAAa,IAAI,cAAc,OAAO,IAAI,WAAW,IAAI;AAAA,IACzD,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,WAAW,OAAO,IAAI,SAAS;AAAA,EAChC;AACD;AAlBS;AAoBT,SAAS,gBAAgB,KAA6C;AACrE,SAAO;AAAA,IACN,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,WAAW,OAAO,IAAI,SAAS;AAAA,IAC/B,gBAAgB,IAAI,kBAAkB,OAAO,OAAO,IAAI,cAAc,IAAI;AAAA,IAC1E,KAAK,OAAO,IAAI,GAAG;AAAA,IACnB,KAAK,OAAO,IAAI,GAAG;AAAA,EACpB;AACD;AAXS;AAaT,eAAsB,qBAAqB,OAA2B;AACrE,QAAM,QAAQ,MAAM,YAAY,KAAK;AACrC,MAAI,MAAM,SAAS,EAAG;AACtB,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,2BAAqB;AAC3D,QAAM,MAAM,OAAO,YAAY;AAC/B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,kGAA0D;AACpF,QAAM,EAAE,UAAU,SAAS,IAAI,aAAa,GAAG;AAC/C,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAO,oBAAoB,OAAO,QAAQ,KAAK,EAAE;AACvD,QAAM,aAAa,OAAO;AAAA,IACzB,IAAI,WAAW;AAAA,IACf,IAAI;AAAA,IACJ,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,IAAI,QAAQ;AAAA,IACZ;AAAA,IACA,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,aAAa;AAAA,IACb,oBAAoB,qBAAqB,GAAG,IAAI,IAAI;AAAA,IACpD,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW;AAAA,EACZ,CAAC;AACF;AA1BsB;AA4Bf,SAAS,gBAAgB,OAAwB;AACvD,SAAO;AAAA,IACN,MAAM,eAAe,IAAI;AACxB,YAAM,MAAM,MAAM,WAAW,OAAO,MAAM,EAAE;AAC5C,aAAO,MAAM,aAAa,GAAG,IAAI;AAAA,IAClC;AAAA,IACA,MAAM,SAAS,IAAI;AAClB,YAAM,MAAM,MAAM,WAAW,OAAO,MAAM,EAAE;AAC5C,aAAO,MAAM,aAAa,GAAG,IAAI;AAAA,IAClC;AAAA,IACA,MAAM,YAAY;AACjB,YAAM,OAAO,MAAM,YAAY,KAAK;AACpC,aAAO,KAAK,IAAI,YAAY;AAAA,IAC7B;AAAA,IACA,MAAM,WAAW,MAAM;AACtB,YAAM,WAAW,MAAM,WAAW,OAAO,MAAM,KAAK,EAAE;AACtD,UAAI,SAAU,OAAM,IAAI,MAAM,yBAAyB;AACvD,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,OAAmB;AAAA,QACxB,IAAI,WAAW;AAAA,QACf,IAAI,KAAK;AAAA,QACT,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,UAAU,KAAK;AAAA,QACf,IAAI,KAAK,MAAM;AAAA,QACf,MAAM,KAAK,QAAQ,oBAAoB,OAAO,KAAK,MAAM,CAAC,EAAE;AAAA,QAC5D,QAAQ,KAAK,UAAU;AAAA,QACvB,WAAW;AAAA,QACX,oBAAoB,KAAK;AAAA,QACzB,mBAAmB,KAAK,qBAAqB,KAAK,IAAI;AAAA,QACtD,aAAa,KAAK,eAAe;AAAA,QACjC,WAAW;AAAA,QACX,WAAW;AAAA,MACZ;AACA,YAAM,aAAa,OAAO;AAAA,QACzB,GAAG;AAAA,QACH,OAAO,KAAK,SAAS;AAAA,QACrB,aAAa,KAAK,eAAe;AAAA,QACjC,oBAAoB,KAAK,sBAAsB;AAAA,QAC/C,mBAAmB,KAAK,qBAAqB;AAAA,QAC7C,aAAa,KAAK,eAAe;AAAA,QACjC,MAAM,KAAK,QAAQ;AAAA,MACpB,CAAC;AACD,aAAO;AAAA,IACR;AAAA,IACA,MAAM,WAAW,IAAI,OAAO;AAC3B,YAAM,UAAmC,EAAE,GAAG,MAAM;AACpD,UAAI,MAAM,gBAAgB,UAAa,iBAAiB,OAAO;AAC9D,gBAAQ,cAAc;AAAA,MACvB;AACA,YAAM,MAAM,MAAM,aAAa,OAAO,IAAI,OAAO;AACjD,aAAO,MAAM,aAAa,GAAG,IAAI;AAAA,IAClC;AAAA,IACA,MAAM,cAAc;AACnB,YAAM,YAAY,MAAM,eAAe,KAAK,GAAG,IAAI,eAAe;AAClE,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,QAAQ,SAAS,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG;AACtD,UAAI,MAAM,WAAW,SAAS,QAAQ;AACrC,cAAM;AAAA,UACL;AAAA,UACA,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,QAC5B;AAAA,MACD;AACA,aAAO;AAAA,IACR;AAAA,IACA,MAAM,WAAW,SAAS;AACzB,YAAM,aAAa,OAAO,EAAE,GAAG,QAAQ,CAAC;AAAA,IACzC;AAAA,IACA,MAAM,cAAc,WAAW;AAC9B,YAAM,gBAAgB,OAAO,SAAS;AAAA,IACvC;AAAA,IACA,MAAM,qBAAqB,IAAI;AAC9B,YAAM,uBAAuB,OAAO,EAAE;AAAA,IACvC;AAAA,IACA,MAAM,gBAAgB;AACrB,cAAQ,MAAM,KAAK,YAAY,GAAG;AAAA,IACnC;AAAA,IACA,MAAM,oBAAoB,IAAI;AAC7B,cAAQ,MAAM,KAAK,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;AAAA,IAC9D;AAAA,IACA,MAAM,WAAW,IAAI;AACpB,aAAO,aAAa,OAAO,EAAE;AAAA,IAC9B;AAAA,EACD;AACD;AApFgB;","names":[]}