codexgpt 1.0.0

package/dist/http/publicApp.js

@@ -0,0 +1,350 @@
+import express from "express";
+import { authorizationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/authorize.js";
+import { parseDynamicClientRegistration } from "../auth/clientStore.js";
+import { AuthConfigurationError, OAuthProtocolError } from "../auth/errors.js";
+import { CORE_OAUTH_RATE_LIMITS, FixedWindowRateLimiter } from "../auth/rateLimits.js";
+import { CodexOAuthProvider, createAuthorizationContinueHandler, createAuthorizationGuard, createAuthorizationStatusHandler, createRevocationEndpointHandler, createTokenEndpointHandler } from "../auth/oauthProvider.js";
+import { AUTHORIZATION_SERVER_METADATA_PATH, PROTECTED_RESOURCE_METADATA_COMPATIBILITY_PATH, PROTECTED_RESOURCE_METADATA_PATH, buildAuthorizationServerMetadata, buildProtectedResourceMetadata, metadataResponse } from "../auth/metadata.js";
+import { createOAuthResourceMiddleware } from "../auth/resourceMiddleware.js";
+import { applyBaseSecurityHeaders, applyNoStore } from "./securityHeaders.js";
+const DEFAULT_ADMISSION_LIMITS = Object.freeze({
+    active: 64,
+    queued: 128,
+    reservedMcpActive: 16,
+    reservedMcpQueued: 32,
+    perMinute: 600,
+    now: Date.now
+});
+function requestHost(req) {
+    const values = [];
+    for (let index = 0; index < req.rawHeaders.length; index += 2) {
+        if (req.rawHeaders[index]?.toLocaleLowerCase("en-US") === "host") {
+            values.push(req.rawHeaders[index + 1] ?? "");
+        }
+    }
+    if (values.length !== 1)
+        return null;
+    const value = values[0].trim().toLocaleLowerCase("en-US");
+    return value.length > 0 && value === req.headers.host?.trim().toLocaleLowerCase("en-US")
+        ? value
+        : null;
+}
+function sendSerialized(res, response) {
+    for (const [name, value] of Object.entries(response.headers))
+        res.setHeader(name, value);
+    res.status(200).send(response.body);
+}
+function rejectBusy(res) {
+    res.setHeader("Retry-After", "1");
+    applyNoStore(res);
+    res.status(429).json({ error: "temporarily_unavailable" });
+}
+export function createPublicAdmissionMiddleware(overrides = {}) {
+    const limits = {
+        ...DEFAULT_ADMISSION_LIMITS,
+        ...overrides,
+        reservedMcpActive: overrides.reservedMcpActive ?? (overrides.active === undefined ? DEFAULT_ADMISSION_LIMITS.reservedMcpActive : 0),
+        reservedMcpQueued: overrides.reservedMcpQueued ?? (overrides.queued === undefined ? DEFAULT_ADMISSION_LIMITS.reservedMcpQueued : 0)
+    };
+    if (!Number.isInteger(limits.active) || limits.active < 1 ||
+        !Number.isInteger(limits.queued) || limits.queued < 0 ||
+        !Number.isInteger(limits.reservedMcpActive) || limits.reservedMcpActive < 0 || limits.reservedMcpActive > limits.active ||
+        !Number.isInteger(limits.reservedMcpQueued) || limits.reservedMcpQueued < 0 || limits.reservedMcpQueued > limits.queued ||
+        !Number.isInteger(limits.perMinute) || limits.perMinute < 1) {
+        throw new Error("Public admission limits are invalid.");
+    }
+    let active = 0;
+    let activeNonMcp = 0;
+    let windowStartedAt = limits.now();
+    let windowCount = 0;
+    const mcpQueue = [];
+    const generalQueue = [];
+    const canAdmit = (entry) => entry.mcp
+        ? active < limits.active
+        : active < limits.active && activeNonMcp < limits.active - limits.reservedMcpActive;
+    const drain = () => {
+        while (mcpQueue.length > 0 && canAdmit(mcpQueue[0]))
+            admit(mcpQueue.shift());
+        while (generalQueue.length > 0 && canAdmit(generalQueue[0]))
+            admit(generalQueue.shift());
+    };
+    const admit = (entry) => {
+        if (entry.res.destroyed || entry.res.writableEnded)
+            return;
+        active += 1;
+        if (!entry.mcp)
+            activeNonMcp += 1;
+        let released = false;
+        const release = () => {
+            if (released)
+                return;
+            released = true;
+            active -= 1;
+            if (!entry.mcp)
+                activeNonMcp -= 1;
+            drain();
+        };
+        entry.res.once("finish", release);
+        entry.res.once("close", release);
+        entry.next();
+    };
+    return (req, res, next) => {
+        const now = limits.now();
+        if (now - windowStartedAt >= 60_000) {
+            windowStartedAt = now;
+            windowCount = 0;
+        }
+        const mcp = req.path === "/mcp";
+        if (!mcp) {
+            windowCount += 1;
+            if (windowCount > limits.perMinute) {
+                rejectBusy(res);
+                return;
+            }
+        }
+        const entry = { req, res, next, mcp };
+        if (canAdmit(entry)) {
+            admit(entry);
+            return;
+        }
+        const totalQueued = mcpQueue.length + generalQueue.length;
+        const generalCapacity = limits.queued - limits.reservedMcpQueued;
+        if (totalQueued >= limits.queued || (!mcp && generalQueue.length >= generalCapacity)) {
+            rejectBusy(res);
+            return;
+        }
+        const queue = mcp ? mcpQueue : generalQueue;
+        queue.push(entry);
+        req.once("aborted", () => {
+            const index = queue.indexOf(entry);
+            if (index >= 0)
+                queue.splice(index, 1);
+        });
+    };
+}
+export function createPublicOAuthApp(options) {
+    const app = express();
+    app.disable("x-powered-by");
+    app.disable("etag");
+    app.enable("case sensitive routing");
+    app.enable("strict routing");
+    app.set("trust proxy", false);
+    app.use(applyBaseSecurityHeaders);
+    app.use((req, res, next) => {
+        if (requestHost(req) !== options.identity.hostname) {
+            res.status(403).send("Forbidden: Host is not allowed");
+            return;
+        }
+        next();
+    });
+    app.use(createPublicAdmissionMiddleware(options.admission));
+    const protectedResource = metadataResponse(buildProtectedResourceMetadata(options.identity, options.enabledScopes));
+    const authorizationServer = metadataResponse(buildAuthorizationServerMetadata(options.identity, options.enabledScopes));
+    const jwks = metadataResponse({ keys: options.publicJwks });
+    const mcpAvailable = Boolean(options.oauthRuntime?.mcp);
+    const rootBody = `<!doctype html><html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CodexGPT OAuth resource</title></head><body><main><h1>CodexGPT OAuth resource</h1><p>This self-hosted endpoint exposes OAuth discovery, constrained public-client registration, owner authorization, token exchange, revocation, and ${mcpAvailable ? "authenticated MCP access" : "no MCP transport"}.</p><h2>Discovery</h2><ul><li><code>/.well-known/oauth-protected-resource/mcp</code></li><li><code>/.well-known/oauth-authorization-server</code></li><li><code>/jwks</code></li></ul><h2>Protocol</h2><p>Authorization Code with PKCE S256 is required. Authorization responses include RFC 9207 issuer binding. Access tokens are accepted only in the Authorization header. Dynamic registration accepts only the supported ChatGPT redirect patterns, ignores unknown extension fields, and never issues a client secret.</p><h2>Public work limits</h2><p>Registration, authorization polling, token, revocation, invalid Bearer, and concurrent request paths are bounded. Established MCP traffic retains reserved admission capacity.</p><h2>Errors</h2><dl><dt><code>invalid_request</code></dt><dd>Malformed method, media type, duplicated parameter, or unsupported request shape.</dd><dt><code>invalid_client</code></dt><dd>Unknown, unapproved, revoked, or mismatched public client.</dd><dt><code>invalid_grant</code></dt><dd>Expired, consumed, replayed, revoked, or mismatched authorization/refresh credential.</dd><dt><code>invalid_scope</code></dt><dd>Unknown, reordered, duplicated, or unavailable scope request.</dd><dt><code>invalid_target</code></dt><dd>Resource does not exactly match this MCP endpoint.</dd><dt><code>temporarily_unavailable</code></dt><dd>Bounded admission, audit, or local owner service is unavailable; retry only after the local operator repairs the reported condition.</dd></dl><p>Owner approval and administration are available only on the separate loopback local-admin listener.</p></main></body></html>`;
+    const healthBody = JSON.stringify({ ok: true, name: "CodexGPT", authMode: "oauth", mcpAvailable });
+    app.get(PROTECTED_RESOURCE_METADATA_PATH, (_req, res) => sendSerialized(res, protectedResource));
+    app.get(PROTECTED_RESOURCE_METADATA_COMPATIBILITY_PATH, (_req, res) => sendSerialized(res, protectedResource));
+    app.get(AUTHORIZATION_SERVER_METADATA_PATH, (_req, res) => sendSerialized(res, authorizationServer));
+    app.get("/jwks", (_req, res) => sendSerialized(res, jwks));
+    app.get("/", (_req, res) => {
+        applyNoStore(res);
+        res.type("html").send(rootBody);
+    });
+    app.get("/healthz", (_req, res) => {
+        applyNoStore(res);
+        res.type("application/json").send(healthBody);
+    });
+    if (options.oauthRuntime) {
+        const registrationLimit = new FixedWindowRateLimiter(CORE_OAUTH_RATE_LIMITS.registration, { now: options.now });
+        const registrationBody = express.raw({ type: "application/json", limit: "16kb" });
+        app.all("/register", (_req, res, next) => {
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            next();
+        });
+        const requireRegistrationContentType = (req, res, next) => {
+            const raw = req.headers["content-type"];
+            if (typeof raw !== "string") {
+                applyNoStore(res);
+                res.status(400).json({ error: "invalid_request", error_description: "Registration requires application/json." });
+                return;
+            }
+            const parts = raw.split(";").map((part) => part.trim().toLocaleLowerCase("en-US"));
+            if (parts[0] !== "application/json" || parts.slice(1).some((part) => part !== "charset=utf-8")) {
+                applyNoStore(res);
+                res.status(400).json({ error: "invalid_request", error_description: "Registration requires application/json with UTF-8." });
+                return;
+            }
+            next();
+        };
+        app.post("/register", requireRegistrationContentType, registrationBody, async (req, res) => {
+            applyNoStore(res);
+            const decision = registrationLimit.consume("deployment");
+            if (!decision.allowed) {
+                res.setHeader("Retry-After", String(decision.retryAfterSeconds));
+                res.status(429).json({ error: "temporarily_unavailable" });
+                return;
+            }
+            try {
+                if (!Buffer.isBuffer(req.body)) {
+                    throw new OAuthProtocolError("invalid_request", "Registration requires application/json.");
+                }
+                const registration = parseDynamicClientRegistration(req.body);
+                const client = await options.oauthRuntime.clients.register(registration);
+                res.status(201).json(client);
+            }
+            catch (error) {
+                if (error instanceof OAuthProtocolError) {
+                    const description = error.localAction ? `${error.message} ${error.localAction}` : error.message;
+                    res.status(error.statusCode).json({ error: error.oauthCode, error_description: description });
+                    return;
+                }
+                if (error instanceof AuthConfigurationError && error.code === "OAUTH_AUDIT_FAILURE") {
+                    res.status(503).json({
+                        error: "temporarily_unavailable",
+                        recovery_action: "Run `codexgpt doctor` locally, repair the audit store, and retry."
+                    });
+                    return;
+                }
+                res.status(503).json({ error: "temporarily_unavailable", error_description: "OAuth registration is unavailable." });
+            }
+        });
+        app.all("/register", (_req, res) => {
+            applyNoStore(res);
+            res.setHeader("Allow", "POST");
+            res.status(405).json({ error: "invalid_request" });
+        });
+        const routeOptions = {
+            identity: options.identity,
+            enabledScopes: options.enabledScopes,
+            clients: options.oauthRuntime.clients,
+            authorizations: options.oauthRuntime.authorizations
+        };
+        const provider = new CodexOAuthProvider(options.identity, options.oauthRuntime.clients, options.oauthRuntime.authorizations, options.oauthRuntime.tokens);
+        const guard = createAuthorizationGuard(routeOptions);
+        app.get("/authorize/status/:pendingId", createAuthorizationStatusHandler(routeOptions));
+        app.get("/authorize/continue/:pendingId", createAuthorizationContinueHandler(routeOptions));
+        app.all("/authorize/", (_req, res) => {
+            applyNoStore(res);
+            res.status(404).json({ error: "authorization_unavailable" });
+        });
+        app.use("/authorize", (req, res, next) => {
+            if (req.path !== "/") {
+                applyNoStore(res);
+                res.status(404).json({ error: "authorization_unavailable" });
+                return;
+            }
+            if (req.method !== "GET" && req.method !== "POST") {
+                applyNoStore(res);
+                res.setHeader("Allow", "GET, POST");
+                res.status(405).json({ error: "invalid_request" });
+                return;
+            }
+            next();
+        });
+        app.post("/authorize", express.raw({ type: "application/x-www-form-urlencoded", limit: "8kb" }), guard);
+        app.get("/authorize", guard);
+        app.use("/authorize", authorizationHandler({ provider, rateLimit: false }));
+        const machineBody = express.raw({ type: "application/x-www-form-urlencoded", limit: "8kb" });
+        app.post("/token", machineBody, createTokenEndpointHandler(options.identity, {
+            provider,
+            now: options.now
+        }));
+        app.all("/token", (_req, res) => {
+            applyNoStore(res);
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Allow", "POST");
+            res.status(405).json({ error: "invalid_request" });
+        });
+        app.post("/revoke", machineBody, createRevocationEndpointHandler({
+            provider,
+            now: options.now
+        }));
+        app.all("/revoke", (_req, res) => {
+            applyNoStore(res);
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.setHeader("Allow", "POST");
+            res.status(405).json({ error: "invalid_request" });
+        });
+        const resource = createOAuthResourceMiddleware({
+            identity: options.identity,
+            enabledScopes: options.enabledScopes,
+            requiredScopes: ["codexgpt:read"],
+            tokens: options.oauthRuntime.tokens,
+            isEstablishedSession: typeof options.oauthRuntime.mcp?.isEstablishedSession === "function"
+                ? (req, tokenFingerprint) => options.oauthRuntime.mcp.isEstablishedSession(req, tokenFingerprint)
+                : undefined
+        });
+        const mcpOriginGuard = (req, res, next) => {
+            const origin = req.headers.origin;
+            if (origin === undefined) {
+                next();
+                return;
+            }
+            if (typeof origin !== "string" || origin.length > 2048) {
+                res.status(403).send("Forbidden: Origin is not allowed");
+                return;
+            }
+            let parsed;
+            try {
+                parsed = new URL(origin);
+            }
+            catch {
+                res.status(403).send("Forbidden: Origin is not allowed");
+                return;
+            }
+            const canonical = parsed.origin === origin;
+            const sameHost = canonical && parsed.protocol === "https:" &&
+                parsed.host.toLocaleLowerCase("en-US") === options.identity.hostname;
+            const configured = canonical && (options.allowedOrigins ?? []).includes(parsed.origin);
+            if (!sameHost && !configured) {
+                res.status(403).send("Forbidden: Origin is not allowed");
+                return;
+            }
+            res.setHeader("Access-Control-Allow-Origin", parsed.origin);
+            res.setHeader("Vary", "Origin");
+            res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+            next();
+        };
+        const unavailableMcp = (_req, res) => {
+            applyNoStore(res);
+            res.status(503).json({ error: "OAUTH_RUNTIME_UNAVAILABLE" });
+        };
+        const postHandler = options.oauthRuntime.mcp
+            ? async (req, res) => {
+                await options.oauthRuntime.mcp.handlePost(req, res, resource.context(res));
+            }
+            : unavailableMcp;
+        const sessionHandler = options.oauthRuntime.mcp
+            ? async (req, res) => {
+                await options.oauthRuntime.mcp.handleSession(req, res, resource.context(res));
+            }
+            : unavailableMcp;
+        app.post("/mcp", mcpOriginGuard, resource.authenticate, express.json({ limit: "20mb" }), resource.rejectBodyCredentials, postHandler);
+        app.get("/mcp", mcpOriginGuard, resource.authenticate, sessionHandler);
+        app.delete("/mcp", mcpOriginGuard, resource.authenticate, sessionHandler);
+        app.all("/mcp", (_req, res) => {
+            applyNoStore(res);
+            res.setHeader("Allow", "GET, POST, DELETE");
+            res.status(405).json({ error: "method_not_allowed" });
+        });
+    }
+    else {
+        app.all("/mcp", (_req, res) => {
+            applyNoStore(res);
+            res.status(503).json({ error: "OAUTH_RUNTIME_UNAVAILABLE" });
+        });
+    }
+    app.use((error, _req, res, _next) => {
+        applyNoStore(res);
+        const code = error.type;
+        if (code === "entity.too.large") {
+            res.status(413).json({ error: "invalid_request" });
+            return;
+        }
+        res.status(400).json({ error: "invalid_request" });
+    });
+    return app;
+}
+//# sourceMappingURL=publicApp.js.map

package/dist/http/publicApp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicApp.js","sourceRoot":"","sources":["../../src/http/publicApp.ts"],"names":[],"mappings":"AAAA,OAAO,OAA2D,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AAEnG,OAAO,EAAoB,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAE1F,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kCAAkC,EAClC,8CAA8C,EAC9C,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,EAC9B,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAG9E,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AA4C9E,MAAM,wBAAwB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACpE,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,GAAG;IACX,iBAAiB,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE;IACrB,SAAS,EAAE,GAAG;IACd,GAAG,EAAE,IAAI,CAAC,GAAG;CACd,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;QACtF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,GAAa,EAAE,QAA6C;IAClF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,GAAa;IAC/B,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAClC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,YAA4C,EAAE;IAE9C,MAAM,MAAM,GAA0B;QACpC,GAAG,wBAAwB;QAC3B,GAAG,SAAS;QACZ,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;KACpI,CAAC;IACF,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,MAAM;QACvH,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,MAAM;QACvH,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAGD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IACnC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,YAAY,GAAqB,EAAE,CAAC;IAE1C,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG;QAC5D,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QACxB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAEtF,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC,CAAC;QAC9E,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,YAAY,CAAC,KAAK,EAAG,CAAC,CAAC;IAC5F,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAqB,EAAQ,EAAE;QAC5C,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa;YAAE,OAAO;QAC3D,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,YAAY,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,IAAI,CAAC,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,YAAY,IAAI,CAAC,CAAC;YAClC,KAAK,EAAE,CAAC;QACV,CAAC,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,GAAG,GAAG,eAAe,IAAI,MAAM,EAAE,CAAC;YACpC,eAAe,GAAG,GAAG,CAAC;YACtB,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,WAAW,IAAI,CAAC,CAAC;YACjB,IAAI,WAAW,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QAC1D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACjE,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,CAAC;YACrF,UAAU,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACvB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACrC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAE5D,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,8BAA8B,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CACxE,CAAC;IACF,MAAM,mBAAmB,GAAG,gBAAgB,CAC1C,gCAAgC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAC1E,CAAC;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,+YAA+Y,YAAY,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,kBAAkB,olDAAolD,CAAC;IACnjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAEnG,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACjG,GAAG,CAAC,GAAG,CAAC,8CAA8C,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/G,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrG,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAE3D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,iBAAiB,GAAG,IAAI,sBAAsB,CAClD,sBAAsB,CAAC,YAAY,EACnC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CACrB,CAAC;QACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACvC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,MAAM,8BAA8B,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;YAC/F,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,yCAAyC,EAAE,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,kBAAkB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;gBAC/F,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oDAAoD,EAAE,CAAC,CAAC;gBAC5H,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACzF,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;gBAC7F,CAAC;gBACD,MAAM,YAAY,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;oBAChG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC9F,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBACpF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,KAAK,EAAE,yBAAyB;wBAChC,eAAe,EAAE,mEAAmE;qBACrF,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACjC,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO;YACrC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,cAAc;SACpD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CACrC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,YAAY,CAAC,OAAO,EAC5B,OAAO,CAAC,YAAY,CAAC,cAAc,EACnC,OAAO,CAAC,YAAY,CAAC,MAAM,CAC5B,CAAC;QACF,MAAM,KAAK,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,YAAY,CAAC,CAAC,CAAC;QACxF,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,kCAAkC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACnC,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACxG,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE5E,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,0BAA0B,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC3E,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC9B,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,+BAA+B,CAAC;YAC/D,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC/B,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,6BAA6B,CAAC;YAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc,EAAE,CAAC,eAAe,CAAC;YACjC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;YACnC,oBAAoB,EAAE,OAAO,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,oBAAoB,KAAK,UAAU;gBACxF,CAAC,CAAC,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,YAAa,CAAC,GAAI,CAAC,oBAAqB,CAAC,GAAG,EAAE,gBAAgB,CAAC;gBACpG,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;YAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;YAC3C,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBACxD,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvE,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;YACjE,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,IAAa,EAAE,GAAa,EAAQ,EAAE;YAC5D,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG;YAC1C,CAAC,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;gBACnD,MAAM,OAAO,CAAC,YAAa,CAAC,GAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,CAAC;YACH,CAAC,CAAC,cAAc,CAAC;QACnB,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG;YAC7C,CAAC,CAAC,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;gBACnD,MAAM,OAAO,CAAC,YAAa,CAAC,GAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClF,CAAC;YACH,CAAC,CAAC,cAAc,CAAC;QACnB,GAAG,CAAC,IAAI,CACN,MAAM,EACN,cAAc,EACd,QAAQ,CAAC,YAAY,EACrB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAC/B,QAAQ,CAAC,qBAAqB,EAC9B,WAAW,CACZ,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC5B,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC5B,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QAC5E,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/securityHeaders.js

@@ -0,0 +1,11 @@
+export function applyBaseSecurityHeaders(_req, res, next) {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+    next();
+}
+export function applyNoStore(res) {
+    res.setHeader("Cache-Control", "no-store");
+}
+//# sourceMappingURL=securityHeaders.js.map

package/dist/http/securityHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityHeaders.js","sourceRoot":"","sources":["../../src/http/securityHeaders.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,wBAAwB,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB;IACvF,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAa;IACxC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC"}