jishushell 0.6.18 → 0.7.3

package/dist/services/files/photos/upload-store.js

@@ -0,0 +1,432 @@
+import { closeSync, createWriteStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { FILES_ROOT, JISHUSHELL_HOME } from "../../../config.js";
+import { DEFAULT_PHOTO_LIBRARY_RELATIVE_PATH } from "../bootstrap.js";
+export const PHOTO_UPLOAD_TTL_MS = 2 * 60 * 60 * 1000;
+export const PHOTO_UPLOAD_FINALIZED_RETENTION_MS = 24 * 60 * 60 * 1000;
+export const PHOTO_UPLOAD_MAX_FILES = 2_000;
+export const PHOTO_UPLOAD_MAX_FILE_BYTES = 500 * 1024 * 1024;
+export const PHOTO_UPLOAD_MAX_TOTAL_BYTES = 50 * 1024 * 1024 * 1024;
+const ALLOWED_MEDIA_EXTENSIONS = new Set([
+    ".3gp",
+    ".arw",
+    ".avi",
+    ".avif",
+    ".bmp",
+    ".cr2",
+    ".cr3",
+    ".dng",
+    ".erf",
+    ".gif",
+    ".heic",
+    ".heif",
+    ".jpeg",
+    ".jpg",
+    ".m2ts",
+    ".m4v",
+    ".mkv",
+    ".mov",
+    ".mp4",
+    ".mts",
+    ".nef",
+    ".orf",
+    ".pef",
+    ".png",
+    ".raf",
+    ".raw",
+    ".rw2",
+    ".srw",
+    ".tif",
+    ".tiff",
+    ".webm",
+    ".webp",
+]);
+export class PhotoUploadStore {
+    filesRoot;
+    sessionRoot;
+    photosRoot;
+    stagingRoot;
+    libraryRoot;
+    constructor(options = {}) {
+        this.filesRoot = options.filesRoot ?? FILES_ROOT;
+        this.sessionRoot = options.sessionRoot
+            ?? join(JISHUSHELL_HOME, "photo-upload-sessions");
+        this.photosRoot = join(this.filesRoot, "photos");
+        this.stagingRoot = join(this.photosRoot, ".staging");
+        this.libraryRoot = join(this.filesRoot, DEFAULT_PHOTO_LIBRARY_RELATIVE_PATH);
+        this.clearInterruptedOperationLocks();
+    }
+    create(input = {}) {
+        const now = input.now ?? new Date();
+        this.deleteExpired({ now });
+        mkdirSync(this.sessionRoot, { recursive: true });
+        mkdirSync(this.stagingRoot, { recursive: true });
+        mkdirSync(this.libraryRoot, { recursive: true });
+        requireRealDirectory(this.sessionRoot);
+        requireRealDirectory(this.stagingRoot);
+        requireRealDirectory(this.libraryRoot);
+        const id = newUploadSessionId(now);
+        const folderName = normalizeFolderName(input.folderName);
+        const destinationRelativePath = buildDestinationRelativePath(now, folderName, id);
+        const session = {
+            id,
+            status: "open",
+            folderName,
+            destinationRelativePath,
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + (input.ttlMs ?? PHOTO_UPLOAD_TTL_MS)).toISOString(),
+            fileCount: 0,
+            totalBytes: 0,
+            uploadedPaths: [],
+            finalizedBatchCount: 0,
+        };
+        mkdirSync(this.sessionDir(id), { recursive: true });
+        mkdirSync(this.stagingDir(id), { recursive: true });
+        this.writeSession(session);
+        return session;
+    }
+    get(sessionId) {
+        if (!isSafeUploadSessionId(sessionId))
+            return null;
+        const dir = this.sessionDir(sessionId);
+        if (!existsSync(dir) || !lstatSync(dir).isDirectory())
+            return null;
+        const path = this.sessionPath(sessionId);
+        if (!existsSync(path))
+            return null;
+        try {
+            return normalizeSession(JSON.parse(readFileSync(path, "utf-8")));
+        }
+        catch {
+            return null;
+        }
+    }
+    async writeFile(sessionId, relativePathInput, source, options = {}) {
+        const session = this.requireOpenSession(sessionId, options.now);
+        const relativePath = normalizeUploadRelativePath(relativePathInput);
+        if (!ALLOWED_MEDIA_EXTENSIONS.has(extname(relativePath).toLowerCase())) {
+            throw new PhotoUploadError("unsupported media file type", 415, "unsupported-file-type");
+        }
+        if (session.fileCount >= PHOTO_UPLOAD_MAX_FILES) {
+            throw new PhotoUploadError("upload session file limit reached", 413, "too-many-files");
+        }
+        return await this.withSessionLock(sessionId, async () => {
+            const current = this.requireOpenSession(sessionId, options.now);
+            if (current.fileCount >= PHOTO_UPLOAD_MAX_FILES) {
+                throw new PhotoUploadError("upload session file limit reached", 413, "too-many-files");
+            }
+            const stagingDir = this.stagingDir(sessionId);
+            requireRealDirectory(stagingDir);
+            const target = resolveContainedPath(stagingDir, relativePath);
+            ensureSafeParentDirectories(stagingDir, dirname(target));
+            if (existsSync(target)) {
+                throw new PhotoUploadError("a file with this path was already uploaded", 409, "file-exists");
+            }
+            let size = 0;
+            const limiter = new Transform({
+                transform(chunk, _encoding, callback) {
+                    size += chunk.length;
+                    if (size > PHOTO_UPLOAD_MAX_FILE_BYTES) {
+                        callback(new PhotoUploadError("file exceeds the 500 MB upload limit", 413, "file-too-large"));
+                        return;
+                    }
+                    callback(null, chunk);
+                },
+            });
+            const output = createWriteStream(target, { flags: "wx", mode: 0o644 });
+            try {
+                await pipeline(source, limiter, output);
+            }
+            catch (error) {
+                rmSync(target, { force: true });
+                throw error;
+            }
+            if (current.totalBytes + size > PHOTO_UPLOAD_MAX_TOTAL_BYTES) {
+                rmSync(target, { force: true });
+                throw new PhotoUploadError("upload session exceeds the 50 GB total limit", 413, "session-too-large");
+            }
+            const updated = {
+                ...current,
+                fileCount: current.fileCount + 1,
+                totalBytes: current.totalBytes + size,
+                uploadedPaths: [...current.uploadedPaths, relativePath],
+            };
+            this.writeSession(updated);
+            return {
+                path: relativePath,
+                size,
+                fileCount: updated.fileCount,
+                totalBytes: updated.totalBytes,
+            };
+        });
+    }
+    async finalize(sessionId, options = {}) {
+        const existing = this.get(sessionId);
+        if (!existing) {
+            throw new PhotoUploadError("upload session not found", 404, "session-not-found");
+        }
+        if (existing.status === "finalized") {
+            return {
+                session: existing,
+                fileCount: existing.fileCount,
+                totalBytes: existing.totalBytes,
+                batchNumber: Math.max(1, existing.finalizedBatchCount),
+                libraryRelativePath: existing.finalLibraryRelativePath ?? existing.destinationRelativePath,
+            };
+        }
+        return await this.withSessionLock(sessionId, async () => {
+            const session = this.requireOpenSession(sessionId, options.now);
+            if (session.fileCount < 1) {
+                throw new PhotoUploadError("upload at least one file before finishing", 400, "empty-upload");
+            }
+            const stagingDir = this.stagingDir(sessionId);
+            if (!existsSync(stagingDir)) {
+                throw new PhotoUploadError("upload staging directory is missing", 409, "staging-missing");
+            }
+            requireRealDirectory(stagingDir);
+            requireRealDirectory(this.libraryRoot);
+            const batchNumber = session.finalizedBatchCount + 1;
+            const batchRelativePath = [session.destinationRelativePath, `batch-${batchNumber}`].join("/");
+            const target = resolveContainedPath(this.libraryRoot, batchRelativePath);
+            ensureSafeParentDirectories(this.libraryRoot, dirname(target));
+            if (existsSync(target)) {
+                throw new PhotoUploadError("upload destination already exists", 409, "destination-exists");
+            }
+            renameSync(stagingDir, target);
+            mkdirSync(stagingDir, { recursive: true });
+            const now = options.now ?? new Date();
+            const libraryRelativePath = relative(this.libraryRoot, target).split(sep).join("/");
+            const updated = {
+                ...session,
+                status: "open",
+                fileCount: 0,
+                totalBytes: 0,
+                uploadedPaths: [],
+                finalizedBatchCount: batchNumber,
+                finalizedAt: now.toISOString(),
+                finalLibraryRelativePath: libraryRelativePath,
+            };
+            this.writeSession(updated);
+            return {
+                session: updated,
+                fileCount: session.fileCount,
+                totalBytes: session.totalBytes,
+                batchNumber,
+                libraryRelativePath,
+            };
+        });
+    }
+    deleteExpired(options = {}) {
+        if (!existsSync(this.sessionRoot))
+            return 0;
+        const nowMs = (options.now ?? new Date()).getTime();
+        let deleted = 0;
+        for (const name of readdirSync(this.sessionRoot)) {
+            if (!isSafeUploadSessionId(name))
+                continue;
+            const session = this.get(name);
+            const finalizedAtMs = Date.parse(session?.finalizedAt ?? session?.createdAt ?? "");
+            const expiredOpen = session?.status === "open" && Date.parse(session.expiresAt) <= nowMs;
+            const expiredFinalized = session?.status === "finalized"
+                && Number.isFinite(finalizedAtMs)
+                && finalizedAtMs + PHOTO_UPLOAD_FINALIZED_RETENTION_MS <= nowMs;
+            if (!session || expiredOpen || expiredFinalized) {
+                rmSync(this.sessionDir(name), { recursive: true, force: true });
+                rmSync(this.stagingDir(name), { recursive: true, force: true });
+                deleted += 1;
+            }
+        }
+        return deleted;
+    }
+    requireOpenSession(sessionId, now = new Date()) {
+        const session = this.get(sessionId);
+        if (!session)
+            throw new PhotoUploadError("upload session not found", 404, "session-not-found");
+        if (session.status !== "open") {
+            throw new PhotoUploadError("upload session is already finalized", 409, "session-finalized");
+        }
+        if (Date.parse(session.expiresAt) <= now.getTime()) {
+            throw new PhotoUploadError("upload session expired", 410, "session-expired");
+        }
+        return session;
+    }
+    async withSessionLock(sessionId, action) {
+        let fd;
+        try {
+            fd = openSync(this.lockPath(sessionId), "wx", 0o600);
+        }
+        catch (error) {
+            if (error?.code === "EEXIST") {
+                throw new PhotoUploadError("another upload operation is in progress", 409, "session-busy");
+            }
+            throw error;
+        }
+        closeSync(fd);
+        try {
+            return await action();
+        }
+        finally {
+            try {
+                unlinkSync(this.lockPath(sessionId));
+            }
+            catch {
+                // Best effort. A stale lock is safer than allowing concurrent writes.
+            }
+        }
+    }
+    writeSession(session) {
+        mkdirSync(this.sessionDir(session.id), { recursive: true });
+        writeFileSync(this.sessionPath(session.id), JSON.stringify(session, null, 2) + "\n", {
+            mode: 0o600,
+        });
+    }
+    sessionDir(sessionId) {
+        return join(this.sessionRoot, sessionId);
+    }
+    sessionPath(sessionId) {
+        return join(this.sessionDir(sessionId), "session.json");
+    }
+    lockPath(sessionId) {
+        return join(this.sessionDir(sessionId), "operation.lock");
+    }
+    stagingDir(sessionId) {
+        return join(this.stagingRoot, sessionId);
+    }
+    clearInterruptedOperationLocks() {
+        if (!existsSync(this.sessionRoot) || !lstatSync(this.sessionRoot).isDirectory())
+            return;
+        for (const name of readdirSync(this.sessionRoot)) {
+            if (!isSafeUploadSessionId(name))
+                continue;
+            rmSync(this.lockPath(name), { force: true });
+        }
+    }
+}
+export class PhotoUploadError extends Error {
+    statusCode;
+    code;
+    constructor(message, statusCode, code) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.name = "PhotoUploadError";
+    }
+}
+function normalizeSession(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return null;
+    const raw = input;
+    const id = typeof raw.id === "string" ? raw.id : "";
+    const status = raw.status === "finalized" ? "finalized" : raw.status === "open" ? "open" : null;
+    if (!isSafeUploadSessionId(id) || !status)
+        return null;
+    return {
+        id,
+        status,
+        folderName: typeof raw.folderName === "string" ? raw.folderName : undefined,
+        destinationRelativePath: typeof raw.destinationRelativePath === "string"
+            ? raw.destinationRelativePath
+            : "",
+        createdAt: typeof raw.createdAt === "string" ? raw.createdAt : new Date(0).toISOString(),
+        expiresAt: typeof raw.expiresAt === "string" ? raw.expiresAt : new Date(0).toISOString(),
+        fileCount: safeNonNegativeInteger(raw.fileCount),
+        totalBytes: safeNonNegativeInteger(raw.totalBytes),
+        uploadedPaths: uniqueStrings(raw.uploadedPaths),
+        finalizedBatchCount: safeNonNegativeInteger(raw.finalizedBatchCount)
+            || (status === "finalized" && typeof raw.finalLibraryRelativePath === "string" ? 1 : 0),
+        finalizedAt: typeof raw.finalizedAt === "string" ? raw.finalizedAt : undefined,
+        finalLibraryRelativePath: typeof raw.finalLibraryRelativePath === "string"
+            ? raw.finalLibraryRelativePath
+            : undefined,
+    };
+}
+function normalizeUploadRelativePath(input) {
+    if (typeof input !== "string") {
+        throw new PhotoUploadError("missing upload path", 400, "invalid-path");
+    }
+    const normalized = input.replaceAll("\\", "/");
+    const segments = normalized.split("/");
+    if (!normalized
+        || normalized.startsWith("/")
+        || /^[A-Za-z]:\//.test(normalized)
+        || normalized.length > 1_024
+        || segments.length > 32
+        || segments.some((segment) => !segment
+            || segment === "."
+            || segment === ".."
+            || segment.length > 255
+            || /[\u0000-\u001f\u007f]/.test(segment))) {
+        throw new PhotoUploadError("invalid upload path", 400, "invalid-path");
+    }
+    return segments.join("/");
+}
+function normalizeFolderName(input) {
+    if (typeof input !== "string")
+        return undefined;
+    const trimmed = input.trim();
+    if (!trimmed)
+        return undefined;
+    const safe = trimmed
+        .normalize("NFKC")
+        .replace(/[^\p{L}\p{N}._ -]+/gu, "-")
+        .replace(/\s+/g, " ")
+        .replace(/^[.\s-]+|[.\s-]+$/g, "")
+        .slice(0, 80);
+    return safe || undefined;
+}
+function buildDestinationRelativePath(now, folderName, id) {
+    const stamp = now.toISOString().replace(/[:T]/g, "-").slice(0, 16);
+    const suffix = id.slice(-8);
+    return ["uploads", `${stamp}-${folderName ?? "photos"}-${suffix}`].join("/");
+}
+function resolveContainedPath(root, relativePath) {
+    const resolvedRoot = resolve(root);
+    const target = resolve(resolvedRoot, relativePath);
+    if (target !== resolvedRoot && !target.startsWith(resolvedRoot + sep)) {
+        throw new PhotoUploadError("upload path escapes its session", 400, "invalid-path");
+    }
+    return target;
+}
+function ensureSafeParentDirectories(root, targetParent) {
+    const resolvedRoot = resolve(root);
+    const relativeParent = relative(resolvedRoot, resolve(targetParent));
+    let current = resolvedRoot;
+    for (const segment of relativeParent.split(sep).filter(Boolean)) {
+        current = join(current, segment);
+        if (existsSync(current)) {
+            if (!lstatSync(current).isDirectory()) {
+                throw new PhotoUploadError("upload path contains a non-directory", 409, "invalid-path");
+            }
+            continue;
+        }
+        mkdirSync(current, { mode: 0o755 });
+    }
+}
+function requireRealDirectory(path) {
+    if (!existsSync(path) || !lstatSync(path).isDirectory()) {
+        throw new PhotoUploadError("photo upload storage path is not a real directory", 409, "unsafe-storage-path");
+    }
+}
+function newUploadSessionId(now) {
+    const stamp = now.toISOString().replace(/[-:T.Z]/g, "").slice(0, 14);
+    return `up_${stamp}_${randomBytes(16).toString("hex")}`;
+}
+function isSafeUploadSessionId(input) {
+    return /^up_[0-9]{14}_[a-f0-9]{32}$/.test(input);
+}
+function safeNonNegativeInteger(input) {
+    const value = typeof input === "number" ? input : 0;
+    return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function uniqueStrings(input) {
+    if (!Array.isArray(input))
+        return [];
+    return [...new Set(input.filter((value) => typeof value === "string" && value.trim().length > 0))];
+}
+export function photoUploadDisplayName(session) {
+    return session.folderName ?? basename(session.destinationRelativePath);
+}
+//# sourceMappingURL=upload-store.js.map

package/dist/services/files/photos/upload-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-store.js","sourceRoot":"","sources":["../../../../src/services/files/photos/upload-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,EACV,MAAM,EACN,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,iBAAiB,CAAC;AAEtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAoCH,MAAM,OAAO,gBAAgB;IACV,SAAS,CAAS;IAClB,WAAW,CAAS;IACpB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,WAAW,CAAS;IAErC,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW;eACjC,IAAI,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAC7E,IAAI,CAAC,8BAA8B,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,QAAuC,EAAE;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvC,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,uBAAuB,GAAG,4BAA4B,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,OAAO,GAAuB;YAClC,EAAE;YACF,MAAM,EAAE,MAAM;YACd,UAAU;YACV,uBAAuB;YACvB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE;YACvF,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,EAAE;YACjB,mBAAmB,EAAE,CAAC;SACvB,CAAC;QACF,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,SAAiB,EACjB,iBAAyB,EACzB,MAAgB,EAChB,UAA0B,EAAE;QAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QACpE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,IAAI,sBAAsB,EAAE,CAAC;YAChD,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,SAAS,IAAI,sBAAsB,EAAE,CAAC;gBAChD,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzF,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC9C,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC9D,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/F,CAAC;YAED,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC;gBAC5B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;oBAC1C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,IAAI,IAAI,GAAG,2BAA2B,EAAE,CAAC;wBACvC,QAAQ,CAAC,IAAI,gBAAgB,CAC3B,sCAAsC,EACtC,GAAG,EACH,gBAAgB,CACjB,CAAC,CAAC;wBACH,OAAO;oBACT,CAAC;oBACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACxB,CAAC;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,GAAG,4BAA4B,EAAE,CAAC;gBAC7D,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,EAC9C,GAAG,EACH,mBAAmB,CACpB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAuB;gBAClC,GAAG,OAAO;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS,GAAG,CAAC;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,IAAI;gBACrC,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC;aACxD,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,IAAI;gBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAiB,EACjB,UAA0B,EAAE;QAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC;gBACtD,mBAAmB,EAAE,QAAQ,CAAC,wBAAwB,IAAI,QAAQ,CAAC,uBAAuB;aAC3F,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,2CAA2C,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC5F,CAAC;YACD,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACjC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,CAAC,CAAC;YACpD,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACzE,2BAA2B,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC7F,CAAC;YACD,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC/B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;YACtC,MAAM,mBAAmB,GAAG,QAAQ,CAClC,IAAI,CAAC,WAAW,EAChB,MAAM,CACP,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,OAAO,GAAuB;gBAClC,GAAG,OAAO;gBACV,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC;gBACb,aAAa,EAAE,EAAE;gBACjB,mBAAmB,EAAE,WAAW;gBAChC,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC9B,wBAAwB,EAAE,mBAAmB;aAC9C,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW;gBACX,mBAAmB;aACpB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,UAA0B,EAAE;QACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;YACnF,MAAM,WAAW,GAAG,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;YACzF,MAAM,gBAAgB,GAAG,OAAO,EAAE,MAAM,KAAK,WAAW;mBACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;mBAC9B,aAAa,GAAG,mCAAmC,IAAI,KAAK,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,WAAW,IAAI,gBAAgB,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,kBAAkB,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAI,SAAiB,EAAE,MAAwB;QAC1E,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,EACzC,GAAG,EACH,cAAc,CACf,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAA2B;QAC9C,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YACnF,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEO,WAAW,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;IAC1D,CAAC;IAEO,QAAQ,CAAC,SAAiB;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO;QACxF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG9B;IACA;IAHX,YACE,OAAe,EACN,UAAkB,EAClB,IAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,eAAU,GAAV,UAAU,CAAQ;QAClB,SAAI,GAAJ,IAAI,CAAQ;QAGrB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO;QACL,EAAE;QACF,MAAM;QACN,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC3E,uBAAuB,EAAE,OAAO,GAAG,CAAC,uBAAuB,KAAK,QAAQ;YACtE,CAAC,CAAC,GAAG,CAAC,uBAAuB;YAC7B,CAAC,CAAC,EAAE;QACN,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACxF,SAAS,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACxF,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC;QAChD,UAAU,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QAClD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QAC/C,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,CAAC,mBAAmB,CAAC;eAC/D,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,GAAG,CAAC,wBAAwB,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC9E,wBAAwB,EAAE,OAAO,GAAG,CAAC,wBAAwB,KAAK,QAAQ;YACxE,CAAC,CAAC,GAAG,CAAC,wBAAwB;YAC9B,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IACE,CAAC,UAAU;WACR,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;WAC1B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;WAC/B,UAAU,CAAC,MAAM,GAAG,KAAK;WACzB,QAAQ,CAAC,MAAM,GAAG,EAAE;WACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3B,CAAC,OAAO;eACL,OAAO,KAAK,GAAG;eACf,OAAO,KAAK,IAAI;eAChB,OAAO,CAAC,MAAM,GAAG,GAAG;eACpB,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CACzC,EACD,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO;SACjB,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC;SACpC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAS,EAAE,UAA8B,EAAE,EAAU;IACzF,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,UAAU,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,YAAoB;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,YAAoB;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,gBAAgB,CAAC,sCAAsC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC1F,CAAC;YACD,SAAS;QACX,CAAC;QACD,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,EACnD,GAAG,EACH,qBAAqB,CACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAS;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,MAAM,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACrD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAA2B;IAChE,OAAO,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;AACzE,CAAC"}

package/dist/services/http/proxy-utils.d.ts

@@ -0,0 +1,7 @@
+export declare const HOP_BY_HOP: Set<string>;
+/**
+ * Strip the panel session cookie (`jishushell_session`) from a cookie header
+ * value, preserving any other cookies for upstream forwarding.
+ */
+export declare function stripPanelSessionCookie(value: string | string[] | undefined): string | undefined;
+export declare function joinUpstreamPath(basePath: string | undefined, suffix: string): string;

package/dist/services/http/proxy-utils.js

@@ -0,0 +1,29 @@
+// Hop-by-hop headers that must not be forwarded by a proxy (RFC 2616 section 13.5.1).
+export const HOP_BY_HOP = new Set([
+    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
+    "te", "trailer", "transfer-encoding", "upgrade",
+]);
+/**
+ * Strip the panel session cookie (`jishushell_session`) from a cookie header
+ * value, preserving any other cookies for upstream forwarding.
+ */
+export function stripPanelSessionCookie(value) {
+    if (value === undefined)
+        return undefined;
+    const cookie = Array.isArray(value) ? value.join("; ") : value;
+    const preserved = cookie
+        .split(";")
+        .map((part) => part.trim())
+        .filter((part) => part && !/^jishushell_session=/i.test(part));
+    return preserved.length ? preserved.join("; ") : undefined;
+}
+export function joinUpstreamPath(basePath, suffix) {
+    const normalizedBase = typeof basePath === "string" && basePath.trim()
+        ? (basePath.startsWith("/") ? basePath : `/${basePath}`)
+        : "/";
+    const normalizedSuffix = suffix.replace(/^\/+/, "");
+    if (!normalizedSuffix)
+        return normalizedBase;
+    return `${normalizedBase.replace(/\/+$/, "")}/${normalizedSuffix}`;
+}
+//# sourceMappingURL=proxy-utils.js.map

package/dist/services/http/proxy-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-utils.js","sourceRoot":"","sources":["../../../src/services/http/proxy-utils.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IAChC,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,qBAAqB;IACvE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS;CAChD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAoC;IAC1E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM;SACrB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA4B,EAAE,MAAc;IAC3E,MAAM,cAAc,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;QACpE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,cAAc,CAAC;IAC7C,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,gBAAgB,EAAE,CAAC;AACrE,CAAC"}

package/dist/services/http/request-utils.d.ts

@@ -0,0 +1,3 @@
+export declare function readHeaderValue(value: unknown): string | null;
+export declare function parseHttpOrigin(value: string | null): string | null;
+export declare function inferRequestOrigin(request: any): string | null;

package/dist/services/http/request-utils.js

@@ -0,0 +1,23 @@
+export function readHeaderValue(value) {
+    const header = Array.isArray(value) ? value[0] : value;
+    return typeof header === "string" && header.trim() ? header.trim() : null;
+}
+export function parseHttpOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function inferRequestOrigin(request) {
+    // Only trust browser-sent Origin/Referer for auto-allowlisting. Host and
+    // X-Forwarded-* are proxy metadata and should not become persisted origin
+    // policy by themselves.
+    return (parseHttpOrigin(readHeaderValue(request?.headers?.origin))
+        ?? parseHttpOrigin(readHeaderValue(request?.headers?.referer)));
+}
+//# sourceMappingURL=request-utils.js.map

package/dist/services/http/request-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-utils.js","sourceRoot":"","sources":["../../../src/services/http/request-utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAoB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAY;IAC7C,yEAAyE;IACzE,0EAA0E;IAC1E,wBAAwB;IACxB,OAAO,CACL,eAAe,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;WACvD,eAAe,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/dist/services/instances/manager.d.ts

@@ -117,11 +117,12 @@ export declare function updateInstance(instanceId: string, name?: string, descri
 export declare function updateInstanceMeta(instanceId: string, patch: Record<string, any>): void;
 /**
  * Toggle the opt-in "privileged" (native-install-like) profile on an
- * OpenClaw instance's docker task. Default (false / absent) keeps the
- * hardened container (cap_drop=ALL, no-new-privileges, read-only rootfs).
- * When enabled, `OpenClawAdapter.buildNomadTask` relaxes those so the agent
- * has native-install-like permissions. Persisted in `instance.json` runtime
- * so it survives restarts and is reapplied on every Nomad job submit.
+ * integration-managed docker task. Default (false / absent) keeps the
+ * hardened container (cap_drop=ALL, no-new-privileges, read-only rootfs when
+ * supported). When enabled, the owning integration's runtime builder relaxes
+ * those settings so the workload has native-install-like permissions.
+ * Persisted in canonical `instance.json.runtime` so it survives restarts and
+ * is reapplied on every Nomad job submit.
  * Returns false when the instance does not exist. Caller must restart the
  * instance for the change to take effect.
  */