mindoodb 0.0.84 → 0.0.86

package/dist/server/ServerDataStore.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * Where the server keeps its own small state: the server identity, trusted
+ * servers, the server key bag, tenant configs and per-tenant registries.
+ *
+ * Keys are `/`-separated relative paths, and on Node they are exactly the
+ * file paths below the data directory (`server.identity.json`,
+ * `trusted-servers.json`, `server.keybag`, `<tenantId>/config.json`,
+ * `<tenantId>/purged-docs.json`), so existing servers keep reading their data.
+ * Other hosts map the same keys onto their own storage, e.g. a Durable
+ * Object's SQLite.
+ *
+ * The interface is synchronous on purpose: the server code that reads this
+ * state (tenant lookup, purge denylist) is synchronous today, and both hosts
+ * have synchronous storage (Node `fs`, Durable Object SQLite).
+ *
+ * Entry payloads never go through here; they live in the content-addressed
+ * stores (see {@link ServerStoreProvider}).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryServerDataStore = void 0;
+function normalizeKey(key) {
+    return key.split("/").filter((part) => part.length > 0).join("/");
+}
+/**
+ * Volatile {@link ServerDataStore}: tests, and hosts that seed their state at
+ * startup.
+ */
+class MemoryServerDataStore {
+    constructor() {
+        this.values = new Map();
+    }
+    exists(key) {
+        const normalized = normalizeKey(key);
+        if (normalized === "")
+            return true;
+        if (this.values.has(normalized))
+            return true;
+        const prefix = `${normalized}/`;
+        for (const existing of this.values.keys()) {
+            if (existing.startsWith(prefix))
+                return true;
+        }
+        return false;
+    }
+    readText(key) {
+        const value = this.values.get(normalizeKey(key));
+        if (value === undefined)
+            return null;
+        return typeof value === "string" ? value : new TextDecoder().decode(value);
+    }
+    writeText(key, value) {
+        this.values.set(normalizeKey(key), value);
+    }
+    readBytes(key) {
+        const value = this.values.get(normalizeKey(key));
+        if (value === undefined)
+            return null;
+        return typeof value === "string" ? new TextEncoder().encode(value) : value.slice();
+    }
+    writeBytes(key, value) {
+        this.values.set(normalizeKey(key), value.slice());
+    }
+    listDirectories(prefix) {
+        const normalized = normalizeKey(prefix);
+        const base = normalized === "" ? "" : `${normalized}/`;
+        const names = new Set();
+        for (const key of this.values.keys()) {
+            if (!key.startsWith(base))
+                continue;
+            const rest = key.substring(base.length);
+            const slash = rest.indexOf("/");
+            if (slash > 0)
+                names.add(rest.substring(0, slash));
+        }
+        return [...names];
+    }
+    deleteTree(prefix) {
+        const normalized = normalizeKey(prefix);
+        for (const key of [...this.values.keys()]) {
+            if (normalized === "" || key === normalized || key.startsWith(`${normalized}/`)) {
+                this.values.delete(key);
+            }
+        }
+    }
+}
+exports.MemoryServerDataStore = MemoryServerDataStore;
+//# sourceMappingURL=ServerDataStore.js.map

package/dist/server/ServerDataStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerDataStore.js","sourceRoot":"","sources":["../../src/server/ServerDataStore.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAwCH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAa,qBAAqB;IAAlC;QACmB,WAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAsDnE,CAAC;IApDC,MAAM,CAAC,GAAW;QAChB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;QAChC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrF,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,KAAiB;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,UAAU,KAAK,EAAE,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAvDD,sDAuDC"}

package/dist/server/SyncEventBus.d.ts

@@ -0,0 +1,39 @@
+/**
+ * In-process pub/sub for sync change events (sync-v5, phase 5).
+ *
+ * The `putEntries` paths publish a small descriptor after each accepted
+ * write; SSE subscribers on `GET /sync/:storeKind/events` forward it to
+ * connected clients so they can trigger a pull instead of polling.
+ *
+ * Deliberately minimal: no history, no replay — a client that reconnects
+ * simply runs one normal (cheap, cursor-skipped) sync to catch up.
+ */
+/** Payload published for every accepted `putEntries` write. */
+export interface SyncChangeEvent {
+    tenantId: string;
+    dbId: string;
+    /** "docs" | "attachments" */
+    storeKind: string;
+    /** Store head after the write, when the store supports getStoreHead. */
+    epoch?: string;
+    maxReceiptOrder?: number;
+    /**
+     * Name of the trusted peer whose push produced this write, when it came from
+     * server-to-server replication rather than a client.
+     *
+     * The peer replicator uses it to suppress the obvious loop: entries that
+     * arrived from peer X must not immediately be pushed back to peer X. They
+     * still fan out to every *other* peer, which is how a spoke's write reaches
+     * the rest of the mesh through its hub.
+     */
+    originPeer?: string;
+}
+export type SyncChangeListener = (event: SyncChangeEvent) => void;
+export declare class SyncEventBus {
+    private listeners;
+    /** Register a listener; returns an unsubscribe function. */
+    subscribe(listener: SyncChangeListener): () => void;
+    publish(event: SyncChangeEvent): void;
+    get listenerCount(): number;
+}
+//# sourceMappingURL=SyncEventBus.d.ts.map

package/dist/server/SyncEventBus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncEventBus.d.ts","sourceRoot":"","sources":["../../src/server/SyncEventBus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAElE,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAiC;IAElD,4DAA4D;IAC5D,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAOnD,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAWrC,IAAI,aAAa,IAAI,MAAM,CAE1B;CACF"}

package/dist/server/SyncEventBus.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * In-process pub/sub for sync change events (sync-v5, phase 5).
+ *
+ * The `putEntries` paths publish a small descriptor after each accepted
+ * write; SSE subscribers on `GET /sync/:storeKind/events` forward it to
+ * connected clients so they can trigger a pull instead of polling.
+ *
+ * Deliberately minimal: no history, no replay — a client that reconnects
+ * simply runs one normal (cheap, cursor-skipped) sync to catch up.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SyncEventBus = void 0;
+class SyncEventBus {
+    constructor() {
+        this.listeners = new Set();
+    }
+    /** Register a listener; returns an unsubscribe function. */
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    publish(event) {
+        for (const listener of this.listeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                // A broken subscriber (e.g. a socket torn down mid-write) must never
+                // affect the publisher or other subscribers.
+            }
+        }
+    }
+    get listenerCount() {
+        return this.listeners.size;
+    }
+}
+exports.SyncEventBus = SyncEventBus;
+//# sourceMappingURL=SyncEventBus.js.map

package/dist/server/SyncEventBus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncEventBus.js","sourceRoot":"","sources":["../../src/server/SyncEventBus.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAyBH,MAAa,YAAY;IAAzB;QACU,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAwBpD,CAAC;IAtBC,4DAA4D;IAC5D,SAAS,CAAC,QAA4B;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAsB;QAC5B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,6CAA6C;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF;AAzBD,oCAyBC"}

package/dist/server/SystemAdminAuth.d.ts

@@ -0,0 +1,82 @@
+/**
+ * System admin authentication service.
+ *
+ * Reuses the existing `AuthenticationService` by providing a
+ * `SystemAdminDirectory` adapter that derives user lookup data from
+ * the capabilities section of `config.json` rather than a tenant
+ * directory.  Challenges require both username and publicsignkey so
+ * the issued JWT can carry both fields for capability matching.
+ */
+import type { CryptoAdapter } from "../core/crypto/CryptoAdapter";
+import type { ServerConfig } from "./types";
+export interface SystemAdminTokenPayload {
+    sub: string;
+    publicsignkey: string;
+    iat: number;
+    exp: number;
+}
+export declare class SystemAdminAuthService {
+    private challenges;
+    /**
+     * Hard cap on outstanding challenges (DoS guard). Challenge creation is
+     * unauthenticated, so bound the map and evict oldest-first on overflow.
+     */
+    private static readonly MAX_CHALLENGES;
+    private jwtSecret;
+    private challengeExpirationMs;
+    private tokenExpirationMs;
+    private principals;
+    private allowTenantCreationWildcardPrincipal;
+    private cryptoAdapter;
+    /**
+     * Optional live lookup: a signing key that is a registered tenant's
+     * `adminSigningPublicKey` may obtain a system JWT so it can DELETE that
+     * tenant. Capability checks still deny every other `/system/*` route.
+     */
+    private isTenantAdminSigningKey?;
+    constructor(cryptoAdapter: CryptoAdapter, config: ServerConfig, options?: {
+        jwtSecret?: Uint8Array;
+        challengeExpirationMs?: number;
+        tokenExpirationMs?: number;
+        isTenantAdminSigningKey?: (publicsignkey: string) => boolean;
+    });
+    /**
+     * Hot-swap the principal list from a new config.
+     * In-flight challenges and existing JWTs remain valid (same HMAC secret);
+     * removed principals will fail the CapabilityMatcher check on their next request.
+     */
+    reloadPrincipals(config: ServerConfig): void;
+    /**
+     * Generate a challenge for a system admin.
+     * Both `username` and `publicsignkey` are required so we can bind
+     * the issued JWT to a specific keypair.
+     */
+    generateChallenge(username: string, publicsignkey: string): Promise<string>;
+    /**
+     * Verify a signed challenge and return a JWT containing both
+     * `sub` (username) and `publicsignkey`.
+     */
+    authenticate(challenge: string, signature: Uint8Array): Promise<{
+        success: boolean;
+        token?: string;
+        error?: string;
+    }>;
+    /**
+     * Validate and decode a system admin JWT.
+     */
+    validateToken(token: string): Promise<SystemAdminTokenPayload | null>;
+    private verifySignature;
+    private generateToken;
+    private cleanupExpiredChallenges;
+    /**
+     * Bound the challenge map (DoS guard): if still over the cap after expiry
+     * cleanup, drop the oldest entries (Map preserves insertion order).
+     */
+    private evictChallengesOverCap;
+    private base64UrlEncode;
+    private base64UrlDecode;
+    private uint8ArrayToBase64Url;
+    private base64UrlToUint8Array;
+    private base64ToUint8Array;
+}
+//# sourceMappingURL=SystemAdminAuth.d.ts.map

package/dist/server/SystemAdminAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemAdminAuth.d.ts","sourceRoot":"","sources":["../../src/server/SystemAdminAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,SAAS,CAAC;AAUlE,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAeD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,UAAU,CAA2C;IAC7D;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAU;IAChD,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,oCAAoC,CAAU;IACtD,OAAO,CAAC,aAAa,CAAgB;IACrC;;;;OAIG;IACH,OAAO,CAAC,uBAAuB,CAAC,CAAqC;gBAGnE,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,UAAU,CAAC;QACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,uBAAuB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC;KAC9D;IAaH;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAM5C;;;;OAIG;IACG,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAiClB;;;OAGG;IACG,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BhE;;OAEG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;YAuD5B,eAAe;YAsCf,aAAa;IAuC3B,OAAO,CAAC,wBAAwB;IAShC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/server/SystemAdminAuth.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * System admin authentication service.
+ *
+ * Reuses the existing `AuthenticationService` by providing a
+ * `SystemAdminDirectory` adapter that derives user lookup data from
+ * the capabilities section of `config.json` rather than a tenant
+ * directory.  Challenges require both username and publicsignkey so
+ * the issued JWT can carry both fields for capability matching.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SystemAdminAuthService = void 0;
+const idGeneration_1 = require("../core/utils/idGeneration");
+const serverConfig_1 = require("./serverConfig");
+// ---------------------------------------------------------------------------
+// SystemAdminAuthService
+// ---------------------------------------------------------------------------
+class SystemAdminAuthService {
+    constructor(cryptoAdapter, config, options) {
+        this.challenges = new Map();
+        this.cryptoAdapter = cryptoAdapter;
+        this.principals = (0, serverConfig_1.extractAllPrincipals)(config);
+        this.allowTenantCreationWildcardPrincipal =
+            (0, serverConfig_1.hasTenantCreationWildcardPrincipal)(config);
+        this.isTenantAdminSigningKey = options?.isTenantAdminSigningKey;
+        this.jwtSecret =
+            options?.jwtSecret ?? cryptoAdapter.getRandomValues(new Uint8Array(32));
+        this.challengeExpirationMs = options?.challengeExpirationMs ?? 5 * 60 * 1000;
+        this.tokenExpirationMs = options?.tokenExpirationMs ?? 60 * 60 * 1000;
+    }
+    /**
+     * Hot-swap the principal list from a new config.
+     * In-flight challenges and existing JWTs remain valid (same HMAC secret);
+     * removed principals will fail the CapabilityMatcher check on their next request.
+     */
+    reloadPrincipals(config) {
+        this.principals = (0, serverConfig_1.extractAllPrincipals)(config);
+        this.allowTenantCreationWildcardPrincipal =
+            (0, serverConfig_1.hasTenantCreationWildcardPrincipal)(config);
+    }
+    /**
+     * Generate a challenge for a system admin.
+     * Both `username` and `publicsignkey` are required so we can bind
+     * the issued JWT to a specific keypair.
+     */
+    async generateChallenge(username, publicsignkey) {
+        const normalizedUsername = username.toLowerCase();
+        const found = this.principals.some((p) => p.username.toLowerCase() === normalizedUsername &&
+            p.publicsignkey === publicsignkey);
+        if (!found &&
+            !this.allowTenantCreationWildcardPrincipal &&
+            !this.isTenantAdminSigningKey?.(publicsignkey)) {
+            throw new Error("Unknown system admin principal");
+        }
+        const challenge = (0, idGeneration_1.generateRandomUuid)();
+        const now = Date.now();
+        this.challenges.set(challenge, {
+            challenge,
+            username,
+            publicsignkey,
+            createdAt: now,
+            expiresAt: now + this.challengeExpirationMs,
+            used: false,
+        });
+        this.cleanupExpiredChallenges();
+        this.evictChallengesOverCap();
+        return challenge;
+    }
+    /**
+     * Verify a signed challenge and return a JWT containing both
+     * `sub` (username) and `publicsignkey`.
+     */
+    async authenticate(challenge, signature) {
+        const stored = this.challenges.get(challenge);
+        if (!stored) {
+            return { success: false, error: "Challenge not found or expired" };
+        }
+        if (Date.now() > stored.expiresAt) {
+            this.challenges.delete(challenge);
+            return { success: false, error: "Challenge expired" };
+        }
+        if (stored.used) {
+            return { success: false, error: "Challenge already used" };
+        }
+        stored.used = true;
+        const isValid = await this.verifySignature(challenge, signature, stored.publicsignkey);
+        if (!isValid) {
+            return { success: false, error: "Invalid signature" };
+        }
+        const token = await this.generateToken(stored.username, stored.publicsignkey);
+        return { success: true, token };
+    }
+    /**
+     * Validate and decode a system admin JWT.
+     */
+    async validateToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const [headerB64, payloadB64, signatureB64] = parts;
+        try {
+            // Pin the JWT algorithm to HS256 (audit, Low: alg pinning): reject any
+            // other declared `alg` to block algorithm-confusion attacks.
+            const header = JSON.parse(this.base64UrlDecode(headerB64));
+            if (header.alg !== "HS256")
+                return null;
+            const subtle = this.cryptoAdapter.getSubtle();
+            const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+            const dataToVerify = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+            const sig = this.base64UrlToUint8Array(signatureB64);
+            const isValid = await subtle.verify("HMAC", signingKey, sig.buffer.slice(sig.byteOffset, sig.byteOffset + sig.byteLength), dataToVerify.buffer);
+            if (!isValid)
+                return null;
+            const payload = JSON.parse(this.base64UrlDecode(payloadB64));
+            const now = Math.floor(Date.now() / 1000);
+            if (payload.exp < now)
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Private helpers
+    // -----------------------------------------------------------------------
+    async verifySignature(message, signature, publicKeyPem) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        try {
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const keyData = this.base64ToUint8Array(pemContents);
+            const publicKey = await subtle.importKey("spki", keyData.buffer, { name: "Ed25519" }, false, ["verify"]);
+            const messageBytes = new TextEncoder().encode(message);
+            return await subtle.verify({ name: "Ed25519" }, publicKey, signature.buffer.slice(signature.byteOffset, signature.byteOffset + signature.byteLength), messageBytes.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    async generateToken(username, publicsignkey) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            sub: username,
+            publicsignkey,
+            iat: now,
+            exp: now + Math.floor(this.tokenExpirationMs / 1000),
+        };
+        const header = { alg: "HS256", typ: "JWT" };
+        const headerB64 = this.base64UrlEncode(JSON.stringify(header));
+        const payloadB64 = this.base64UrlEncode(JSON.stringify(payload));
+        const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const dataToSign = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = await subtle.sign("HMAC", signingKey, dataToSign.buffer);
+        const signatureB64 = this.uint8ArrayToBase64Url(new Uint8Array(signature));
+        return `${headerB64}.${payloadB64}.${signatureB64}`;
+    }
+    cleanupExpiredChallenges() {
+        const now = Date.now();
+        for (const [key, ch] of this.challenges) {
+            if (ch.expiresAt < now) {
+                this.challenges.delete(key);
+            }
+        }
+    }
+    /**
+     * Bound the challenge map (DoS guard): if still over the cap after expiry
+     * cleanup, drop the oldest entries (Map preserves insertion order).
+     */
+    evictChallengesOverCap() {
+        let overflow = this.challenges.size - SystemAdminAuthService.MAX_CHALLENGES;
+        if (overflow <= 0)
+            return;
+        for (const key of this.challenges.keys()) {
+            if (overflow-- <= 0)
+                break;
+            this.challenges.delete(key);
+        }
+    }
+    // Base64 utilities
+    base64UrlEncode(str) {
+        const base64 = btoa(str);
+        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlDecode(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        return atob(base64);
+    }
+    uint8ArrayToBase64Url(bytes) {
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        const base64 = btoa(binary);
+        return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlToUint8Array(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    base64ToUint8Array(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+exports.SystemAdminAuthService = SystemAdminAuthService;
+/**
+ * Hard cap on outstanding challenges (DoS guard). Challenge creation is
+ * unauthenticated, so bound the map and evict oldest-first on overflow.
+ */
+SystemAdminAuthService.MAX_CHALLENGES = 10000;
+//# sourceMappingURL=SystemAdminAuth.js.map

package/dist/server/SystemAdminAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SystemAdminAuth.js","sourceRoot":"","sources":["../../src/server/SystemAdminAuth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,6DAAgE;AAGhE,iDAGwB;AAsBxB,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAa,sBAAsB;IAoBjC,YACE,aAA4B,EAC5B,MAAoB,EACpB,OAKC;QA3BK,eAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;QA6B3D,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,iDAAkC,EAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,uBAAuB,GAAG,OAAO,EAAE,uBAAuB,CAAC;QAChE,IAAI,CAAC,SAAS;YACZ,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,MAAoB;QACnC,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAoB,EAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,oCAAoC;YACvC,IAAA,iDAAkC,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,aAAqB;QAErB,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YAC/C,CAAC,CAAC,aAAa,KAAK,aAAa,CACpC,CAAC;QACF,IACE,CAAC,KAAK;YACN,CAAC,IAAI,CAAC,oCAAoC;YAC1C,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,aAAa,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,iCAAkB,GAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,QAAQ;YACR,aAAa;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,qBAAqB;YAC3C,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,SAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CACxC,SAAS,EACT,SAAS,EACT,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa;QAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,CAAC;YACH,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAqB,CAAC;YAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3C,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAErD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,MAAM,EACN,UAAU,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CACjB,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;YAEF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CACN,CAAC;YAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAEnC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;IAClB,0EAA0E;IAElE,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAqB,EACrB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAE9C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAErD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,OAAO,CAAC,MAAqB,EAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YAEF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,MAAM,CAAC,MAAM,CACxB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,SAAS,CAAC,MAAM,CAAC,KAAK,CACpB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAC7B,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ;YACb,aAAa;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACzC,GAAG,SAAS,IAAI,UAAU,EAAE,CAC7B,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,MAAM,EACN,UAAU,EACV,UAAU,CAAC,MAAqB,CACjC,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;IACtD,CAAC;IAEO,wBAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,EAAE,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,sBAAsB;QAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,sBAAsB,CAAC,cAAc,CAAC;QAC5E,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,IAAI,CAAC;gBAAE,MAAM;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,mBAAmB;IAEX,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,qBAAqB,CAAC,KAAiB;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,qBAAqB,CAAC,GAAW;QACvC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AA1UH,wDA2UC;AAzUC;;;GAGG;AACqB,qCAAc,GAAG,KAAM,AAAT,CAAU"}