mindoodb 0.0.84 → 0.0.86

package/dist/server/timestampProxy.js

@@ -0,0 +1,361 @@
+"use strict";
+/**
+ * RFC 3161 timestamp proxy.
+ *
+ * Sealing a document (see the TeamSketchbook seal feature) needs a third-party
+ * attested time: the client hashes its own signature and asks a Time-Stamping
+ * Authority to sign that hash together with the TSA's clock reading.
+ *
+ * Most public TSAs cannot be called from a browser — they are http-only or send
+ * no CORS headers — so the server offers an authenticated proxy. It forwards
+ * opaque DER bytes and never parses them; the *client* verifies the returned
+ * token (messageImprint equality and chain to a trusted root), which is what
+ * makes a hostile or buggy proxy a denial-of-service risk rather than a forgery
+ * risk.
+ *
+ * SSRF is the hazard a forwarding endpoint always carries, so target URLs come
+ * only from server-side env config. A client may name a provider `id`; it can
+ * never supply a URL.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TimestampProxyError = exports.BUILT_IN_TSA_PROVIDERS = exports.DEFAULT_TIMESTAMP_TIMEOUT_MS = exports.MAX_TIMESTAMP_RESPONSE_BYTES = exports.MAX_TIMESTAMP_REQUEST_BYTES = exports.TIMESTAMP_REPLY_CONTENT_TYPE = exports.TIMESTAMP_QUERY_CONTENT_TYPE = void 0;
+exports.parseTsaProviders = parseTsaProviders;
+exports.toPublicTsaProviders = toPublicTsaProviders;
+exports.requestTimestampToken = requestTimestampToken;
+const urlSafety_js_1 = require("../core/utils/urlSafety.js");
+/** Content type mandated by RFC 3161 §3.4 for a request. */
+exports.TIMESTAMP_QUERY_CONTENT_TYPE = "application/timestamp-query";
+/** Content type mandated by RFC 3161 §3.4 for a response. */
+exports.TIMESTAMP_REPLY_CONTENT_TYPE = "application/timestamp-reply";
+/**
+ * A TimeStampReq is a hash plus a little ASN.1 framing — a few hundred bytes at
+ * most. Anything larger is either a bug or an attempt to use us as an upload
+ * relay.
+ */
+exports.MAX_TIMESTAMP_REQUEST_BYTES = 8 * 1024;
+/**
+ * A TimeStampResp carries the token and the TSA certificate chain. Real tokens
+ * run 2–8 KB; the cap bounds memory when an upstream misbehaves.
+ */
+exports.MAX_TIMESTAMP_RESPONSE_BYTES = 128 * 1024;
+/** Per-provider timeout. Failover to the next provider is preferable to waiting. */
+exports.DEFAULT_TIMESTAMP_TIMEOUT_MS = 10000;
+/**
+ * Providers a client can name by id without the operator writing a URL.
+ *
+ * Terms of use differ and are the operator's call, which is why nothing here is
+ * enabled by default:
+ * - `aimoda` and `opentsa` state that general production use is fine;
+ * - `freetsa` is a community service with no usage restriction;
+ * - the DigiCert/Sectigo endpoints are provided for their own certificate
+ *   customers' code signing, so using them as general infrastructure is not
+ *   clearly permitted — they are listed for completeness, not recommended.
+ */
+exports.BUILT_IN_TSA_PROVIDERS = Object.freeze({
+    aimoda: {
+        id: "aimoda",
+        name: "ai.moda RFC 3161 proxy",
+        url: "https://rfc3161.ai.moda",
+        qualified: false,
+        rootInPublicTrustStores: true,
+    },
+    opentsa: {
+        id: "opentsa",
+        name: "Open TSA (open-tsa.eu)",
+        url: "https://tsr.open-tsa.eu",
+        qualified: false,
+        rootInPublicTrustStores: false,
+    },
+    freetsa: {
+        id: "freetsa",
+        name: "FreeTSA",
+        url: "https://freetsa.org/tsr",
+        qualified: false,
+        rootInPublicTrustStores: false,
+    },
+    digicert: {
+        id: "digicert",
+        name: "DigiCert",
+        url: "http://timestamp.digicert.com",
+        qualified: false,
+        rootInPublicTrustStores: true,
+    },
+    sectigo: {
+        id: "sectigo",
+        name: "Sectigo",
+        url: "http://timestamp.sectigo.com",
+        qualified: false,
+        rootInPublicTrustStores: true,
+    },
+    "sectigo-qualified": {
+        id: "sectigo-qualified",
+        name: "Sectigo Qualified",
+        url: "http://timestamp.sectigo.com/qualified",
+        qualified: true,
+        rootInPublicTrustStores: true,
+    },
+});
+/** Provider ids are used in URLs, filenames and manifests — keep them boring. */
+const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+/**
+ * Parse `MINDOODB_TSA_PROVIDERS`.
+ *
+ * Comma-separated entries, each either a built-in id (`aimoda`) or a custom
+ * `id=url` pair (`inhouse=https://tsa.corp.example/tsr`). A trailing `!` on an
+ * entry marks it qualified, and `+` marks its root as publicly trusted:
+ *
+ *   MINDOODB_TSA_PROVIDERS="aimoda,opentsa,belgium=http://tsa.belgium.be/connect!+"
+ *
+ * Unset or empty disables the proxy entirely. That is the safe default: a
+ * forwarding endpoint is outbound network access the operator should opt into,
+ * and Haven can still reach the browser-callable TSA directly without it.
+ */
+function parseTsaProviders(raw, options = {}) {
+    const warn = options.warn ?? ((message) => console.warn(message));
+    const allowInsecure = options.allowInsecureUrls ?? false;
+    const entries = (raw ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    const providers = [];
+    const seen = new Set();
+    for (const entry of entries) {
+        let spec = entry;
+        let qualified = false;
+        let publiclyTrusted;
+        // Flags are suffixes so a URL containing them is still parsed correctly.
+        while (spec.endsWith("!") || spec.endsWith("+")) {
+            if (spec.endsWith("!"))
+                qualified = true;
+            else
+                publiclyTrusted = true;
+            spec = spec.slice(0, -1);
+        }
+        const eq = spec.indexOf("=");
+        const id = (eq === -1 ? spec : spec.slice(0, eq)).trim().toLowerCase();
+        const url = eq === -1 ? undefined : spec.slice(eq + 1).trim();
+        if (!PROVIDER_ID_PATTERN.test(id)) {
+            warn(`[timestampProxy] Ignoring TSA provider "${entry}": invalid id "${id}"`);
+            continue;
+        }
+        if (seen.has(id)) {
+            warn(`[timestampProxy] Ignoring duplicate TSA provider id "${id}"`);
+            continue;
+        }
+        let resolved;
+        if (url === undefined) {
+            const builtIn = exports.BUILT_IN_TSA_PROVIDERS[id];
+            if (!builtIn) {
+                warn(`[timestampProxy] Ignoring TSA provider "${id}": not a built-in id and no URL given (use "${id}=https://...")`);
+                continue;
+            }
+            resolved = { ...builtIn };
+            if (qualified)
+                resolved.qualified = true;
+            if (publiclyTrusted !== undefined)
+                resolved.rootInPublicTrustStores = publiclyTrusted;
+        }
+        else {
+            resolved = {
+                id,
+                name: id,
+                url,
+                qualified,
+                rootInPublicTrustStores: publiclyTrusted ?? false,
+            };
+        }
+        try {
+            // http is deliberately allowed: every eIDAS-qualified TSA we can use is
+            // http-only. The token is signed, so transport confidentiality only hides
+            // an opaque hash. Internal hosts stay blocked — that is the SSRF guard.
+            (0, urlSafety_js_1.assertSafeSyncUrl)(resolved.url, {
+                requireHttps: false,
+                allowPrivate: allowInsecure,
+            });
+        }
+        catch (error) {
+            const reason = error instanceof urlSafety_js_1.UnsafeUrlError ? error.message : String(error);
+            warn(`[timestampProxy] Ignoring TSA provider "${id}": ${reason}`);
+            continue;
+        }
+        seen.add(id);
+        providers.push(resolved);
+    }
+    return providers;
+}
+/** Drop the URL before a provider list is handed to a client. */
+function toPublicTsaProviders(providers) {
+    return providers.map(({ url: _url, ...rest }) => ({ ...rest }));
+}
+class TimestampProxyError extends Error {
+    constructor(message, status, 
+    /** Per-provider failures, for logging and for a client that wants to retry elsewhere. */
+    attempts = []) {
+        super(message);
+        this.status = status;
+        this.attempts = attempts;
+        this.name = "TimestampProxyError";
+    }
+}
+exports.TimestampProxyError = TimestampProxyError;
+/**
+ * Read a response body with a hard byte cap.
+ *
+ * `response.arrayBuffer()` would buffer whatever the upstream sends; a TSA that
+ * answers with a gigabyte (hostile, or simply broken) must not be able to take
+ * the process down with it.
+ */
+async function readCappedBody(response, maxBytes) {
+    const declared = response.headers.get("content-length");
+    if (declared) {
+        const declaredBytes = Number(declared);
+        if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+            throw new Error(`response too large (${declaredBytes} bytes, max ${maxBytes})`);
+        }
+    }
+    const body = response.body;
+    if (!body) {
+        const buffer = new Uint8Array(await response.arrayBuffer());
+        if (buffer.byteLength > maxBytes) {
+            throw new Error(`response too large (${buffer.byteLength} bytes, max ${maxBytes})`);
+        }
+        return buffer;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                throw new Error(`response too large (over ${maxBytes} bytes)`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+        // Abandoning a partially-read body leaks the socket otherwise.
+        void body.cancel().catch(() => undefined);
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+}
+/** Reject an answer that is obviously not DER before it reaches the client. */
+function assertLooksLikeTimestampResponse(bytes, contentType) {
+    if (bytes.byteLength < 2) {
+        throw new Error("empty response");
+    }
+    // Every TimeStampResp is a DER SEQUENCE.
+    if (bytes[0] !== 0x30) {
+        const hint = contentType ? ` (content-type "${contentType}")` : "";
+        throw new Error(`response is not DER${hint}`);
+    }
+    if (contentType) {
+        const normalized = contentType.split(";")[0].trim().toLowerCase();
+        // Some deployments answer `application/octet-stream`; only reject types that
+        // are certainly wrong, such as an HTML error page from a captive proxy.
+        if (normalized.startsWith("text/") || normalized === "application/json") {
+            throw new Error(`unexpected content-type "${normalized}"`);
+        }
+    }
+}
+/**
+ * POST the request to each provider in turn, returning the first DER answer.
+ *
+ * Failover is per-provider and the reason for each failure is preserved: an
+ * operator debugging "sealing stopped working" needs to see that provider A
+ * timed out and provider B answered 403, not a single opaque 502.
+ */
+async function requestTimestampToken(options) {
+    const { providers, request, preferredProviderId, timeoutMs = exports.DEFAULT_TIMESTAMP_TIMEOUT_MS, maxResponseBytes = exports.MAX_TIMESTAMP_RESPONSE_BYTES, fetchImpl = fetch, } = options;
+    if (providers.length === 0) {
+        throw new TimestampProxyError("Timestamping is not enabled on this server", 503);
+    }
+    if (request.byteLength === 0) {
+        throw new TimestampProxyError("Empty timestamp request", 400);
+    }
+    if (request.byteLength > exports.MAX_TIMESTAMP_REQUEST_BYTES) {
+        throw new TimestampProxyError(`Timestamp request too large (${request.byteLength} bytes, max ${exports.MAX_TIMESTAMP_REQUEST_BYTES})`, 413);
+    }
+    if (request[0] !== 0x30) {
+        throw new TimestampProxyError("Timestamp request is not DER-encoded", 400);
+    }
+    let ordered = providers;
+    if (preferredProviderId) {
+        const preferred = providers.find((provider) => provider.id === preferredProviderId);
+        if (!preferred) {
+            throw new TimestampProxyError(`Unknown timestamp provider "${preferredProviderId}"`, 400);
+        }
+        ordered = [preferred, ...providers.filter((provider) => provider.id !== preferred.id)];
+    }
+    const attempts = [];
+    for (const provider of ordered) {
+        const startedAt = Date.now();
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await fetchImpl(provider.url, {
+                method: "POST",
+                headers: {
+                    "content-type": exports.TIMESTAMP_QUERY_CONTENT_TYPE,
+                    accept: exports.TIMESTAMP_REPLY_CONTENT_TYPE,
+                },
+                // A copy, because `fetch` may retain the buffer past this call.
+                body: request.slice().buffer,
+                // Following a redirect would let an upstream re-point us at an internal
+                // host, defeating the URL allowlist.
+                redirect: "error",
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                attempts.push({
+                    providerId: provider.id,
+                    ok: false,
+                    httpStatus: response.status,
+                    error: `HTTP ${response.status}`,
+                    durationMs: Date.now() - startedAt,
+                });
+                continue;
+            }
+            const bytes = await readCappedBody(response, maxResponseBytes);
+            assertLooksLikeTimestampResponse(bytes, response.headers.get("content-type"));
+            attempts.push({
+                providerId: provider.id,
+                ok: true,
+                httpStatus: response.status,
+                durationMs: Date.now() - startedAt,
+            });
+            return {
+                providerId: provider.id,
+                providerName: provider.name,
+                response: bytes,
+                attempts,
+            };
+        }
+        catch (error) {
+            const aborted = error instanceof Error && error.name === "AbortError";
+            attempts.push({
+                providerId: provider.id,
+                ok: false,
+                error: aborted ? `timed out after ${timeoutMs}ms` : String(error instanceof Error ? error.message : error),
+                durationMs: Date.now() - startedAt,
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    throw new TimestampProxyError("No timestamp provider could be reached", 502, attempts);
+}
+//# sourceMappingURL=timestampProxy.js.map

package/dist/server/timestampProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestampProxy.js","sourceRoot":"","sources":["../../src/server/timestampProxy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AA2HH,8CAiFC;AAGD,oDAEC;AA0HD,sDAkGC;AA3aD,6DAA+E;AAE/E,4DAA4D;AAC/C,QAAA,4BAA4B,GAAG,6BAA6B,CAAC;AAC1E,6DAA6D;AAChD,QAAA,4BAA4B,GAAG,6BAA6B,CAAC;AAE1E;;;;GAIG;AACU,QAAA,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC;AACpD;;;GAGG;AACU,QAAA,4BAA4B,GAAG,GAAG,GAAG,IAAI,CAAC;AACvD,oFAAoF;AACvE,QAAA,4BAA4B,GAAG,KAAM,CAAC;AAuBnD;;;;;;;;;;GAUG;AACU,QAAA,sBAAsB,GAAgD,MAAM,CAAC,MAAM,CAAC;IAC/F,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,wBAAwB;QAC9B,GAAG,EAAE,yBAAyB;QAC9B,SAAS,EAAE,KAAK;QAChB,uBAAuB,EAAE,IAAI;KAC9B;IACD,OAAO,EAAE;QACP,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,wBAAwB;QAC9B,GAAG,EAAE,yBAAyB;QAC9B,SAAS,EAAE,KAAK;QAChB,uBAAuB,EAAE,KAAK;KAC/B;IACD,OAAO,EAAE;QACP,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,yBAAyB;QAC9B,SAAS,EAAE,KAAK;QAChB,uBAAuB,EAAE,KAAK;KAC/B;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,+BAA+B;QACpC,SAAS,EAAE,KAAK;QAChB,uBAAuB,EAAE,IAAI;KAC9B;IACD,OAAO,EAAE;QACP,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,8BAA8B;QACnC,SAAS,EAAE,KAAK;QAChB,uBAAuB,EAAE,IAAI;KAC9B;IACD,mBAAmB,EAAE;QACnB,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,wCAAwC;QAC7C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;KAC9B;CACF,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AASxD;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAC/B,GAAuB,EACvB,UAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAEzD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,eAAoC,CAAC;QAEzC,yEAAyE;QACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;;gBACpC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,2CAA2C,KAAK,kBAAkB,EAAE,GAAG,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QAED,IAAI,QAA2B,CAAC;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,8BAAsB,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CACF,2CAA2C,EAAE,+CAA+C,EAAE,gBAAgB,CAC/G,CAAC;gBACF,SAAS;YACX,CAAC;YACD,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;YAC1B,IAAI,SAAS;gBAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;YACzC,IAAI,eAAe,KAAK,SAAS;gBAAE,QAAQ,CAAC,uBAAuB,GAAG,eAAe,CAAC;QACxF,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG;gBACT,EAAE;gBACF,IAAI,EAAE,EAAE;gBACR,GAAG;gBACH,SAAS;gBACT,uBAAuB,EAAE,eAAe,IAAI,KAAK;aAClD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,IAAA,gCAAiB,EAAC,QAAQ,CAAC,GAAG,EAAE;gBAC9B,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,6BAAc,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/E,IAAI,CAAC,2CAA2C,EAAE,MAAM,MAAM,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iEAAiE;AACjE,SAAgB,oBAAoB,CAAC,SAA8B;IACjE,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YACE,OAAe,EACN,MAAc;IACvB,yFAAyF;IAChF,WAA+B,EAAE;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QAEd,aAAQ,GAAR,QAAQ,CAAyB;QAG1C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAVD,kDAUC;AA6BD;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,QAAgB;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,aAAa,eAAe,QAAQ,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,UAAU,eAAe,QAAQ,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,SAAS,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACrB,+DAA+D;QAC/D,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,SAAS,gCAAgC,CAAC,KAAiB,EAAE,WAA0B;IACrF,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IACD,yCAAyC;IACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,mBAAmB,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,6EAA6E;QAC7E,wEAAwE;QACxE,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,OAAgC;IAEhC,MAAM,EACJ,SAAS,EACT,OAAO,EACP,mBAAmB,EACnB,SAAS,GAAG,oCAA4B,EACxC,gBAAgB,GAAG,oCAA4B,EAC/C,SAAS,GAAG,KAAK,GAClB,GAAG,OAAO,CAAC;IAEZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,GAAG,mCAA2B,EAAE,CAAC;QACrD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,OAAO,CAAC,UAAU,eAAe,mCAA2B,GAAG,EAC/F,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,mBAAmB,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,mBAAmB,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,oCAA4B;oBAC5C,MAAM,EAAE,oCAA4B;iBACrC;gBACD,gEAAgE;gBAChE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,MAAqB;gBAC3C,wEAAwE;gBACxE,qCAAqC;gBACrC,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC;oBACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;oBAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC/D,gCAAgC,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YAE9E,QAAQ,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;YACH,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,QAAQ,EAAE,KAAK;gBACf,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC1G,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;AACzF,CAAC"}

package/dist/server/types.d.ts

@@ -0,0 +1,267 @@
+import type { MindooDBServerInfo } from "../core/types";
+import type { PeerSyncDirection, PeerRole, PeerAttachmentMode } from "./peer/types";
+/**
+ * Types for the MindooDB Example Server
+ */
+/**
+ * Store type for content-addressed stores.
+ */
+export type StoreType = "inmemory" | "file";
+/**
+ * Configuration for a user registered in the tenant.
+ * Users can be human clients or other servers (for server-to-server sync).
+ *
+ * The canonical identity of an entry is its `signingPublicKey`: the server
+ * matches and authorizes by key, never by name. `username` is optional and
+ * documentation-only (a human-readable label); it is ignored for matching.
+ * Arbitrary extra fields (e.g. `comment`) are allowed and ignored by the server.
+ */
+export interface UserConfig {
+    /**
+     * Optional, documentation-only label for this key (e.g. "alice" or
+     * "server-eu-west"). Ignored for identity matching — the server identifies
+     * users by `signingPublicKey`. Kept for backward compatibility with
+     * config-based username authentication.
+     */
+    username?: string;
+    /** Ed25519 public key in PEM format for signature verification (the identity). */
+    signingPublicKey: string;
+    /** RSA-OAEP public key in PEM format for encryption */
+    encryptionPublicKey: string;
+    /** Optional free-form note describing this entry (ignored by the server). */
+    comment?: string;
+    /** Arbitrary extra documentation fields are tolerated and ignored. */
+    [key: string]: unknown;
+}
+/**
+ * A remote server trusted for server-to-server sync.
+ * Stored globally in <dataDir>/trusted-servers.json.
+ *
+ * Trust and reachability are one entry: the keys authenticate the peer in both
+ * directions, and `url` says where to reach it. An entry without `url` stays
+ * auth-only — the peer may call us, we never dial it.
+ */
+export interface TrustedServer extends MindooDBServerInfo {
+    /**
+     * Where to reach the peer: an HTTPS origin without a tenant path
+     * (`https://eu-west.example.com`) or an Iroh locator (`iroh:<ticket>` /
+     * raw `endpoint…` ticket). HTTP appends `/{tenantId}`; Iroh uses the
+     * same peer RPC over QUIC. An endpoint-id-only locator (`iroh:<64-hex>`)
+     * is a stable label but cannot be dialled — store a full ticket to pair.
+     */
+    url?: string;
+    /** Which way entries flow. Defaults to `"bidirectional"`. */
+    direction?: PeerSyncDirection;
+    /** Mesh shape. Defaults to `"peer"`. */
+    role?: PeerRole;
+    /** How eagerly attachment blobs follow. Defaults to `"eager"`. */
+    attachments?: PeerAttachmentMode;
+}
+/**
+ * Per-database store configuration.
+ */
+export interface DatabaseStoreConfig {
+    storeType: StoreType;
+}
+/**
+ * Tenant configuration stored in <dataDir>/<tenantId>/config.json
+ *
+ * The tenantId is NOT stored here - it's derived from the directory name.
+ */
+export interface TenantConfig {
+    /** Admin username used for bootstrap authentication (e.g., "cn=admin/o=acme") */
+    adminUsername?: string;
+    /** Ed25519 public key in PEM format for verifying admin signatures */
+    adminSigningPublicKey: string;
+    /** RSA-OAEP public key in PEM format for encrypting admin-only data */
+    adminEncryptionPublicKey: string;
+    /** Default store type for new databases (default: "file") */
+    defaultStoreType?: StoreType;
+    /** Per-database store configuration overrides */
+    databaseStores?: Record<string, DatabaseStoreConfig>;
+    /** Registered users (clients and other servers) kept for bootstrap metadata only */
+    users?: UserConfig[];
+}
+/**
+ * Request body for POST /admin/register-tenant
+ */
+export interface RegisterTenantRequest {
+    /** Tenant identifier (lowercase, becomes directory name) */
+    tenantId: string;
+    /** Admin username used for bootstrap authentication */
+    adminUsername?: string;
+    /** Ed25519 public key in PEM format */
+    adminSigningPublicKey: string;
+    /** RSA-OAEP public key in PEM format */
+    adminEncryptionPublicKey: string;
+    /** Legacy fallback: base64-encoded raw $publicinfos AES-256 key */
+    publicInfosKey?: string;
+    /** Preferred transport: base64-encoded RSA-encrypted $publicinfos AES-256 key */
+    encryptedPublicInfosKey?: string;
+    /** Default store type (default: "file") */
+    defaultStoreType?: StoreType;
+    /** Initial users to register (for testing/bootstrapping only, ignored when publicInfosKey is present) */
+    users?: UserConfig[];
+}
+/**
+ * Response body for POST /admin/register-tenant
+ */
+export interface RegisterTenantResponse {
+    success: boolean;
+    tenantId: string;
+    created?: boolean;
+    message?: string;
+}
+export interface TenantPublicInfosFingerprintsResponse {
+    tenantId: string;
+    fingerprints: string[];
+}
+/**
+ * Response body for GET /admin/tenants
+ */
+export interface ListTenantsResponse {
+    tenants: string[];
+}
+/**
+ * Loaded tenant context used internally by the server.
+ */
+export interface TenantContext {
+    /** Tenant identifier (lowercase) */
+    tenantId: string;
+    /** Loaded tenant configuration */
+    config: TenantConfig;
+}
+/**
+ * A principal entry in a capability rule.
+ * Identifies a system admin by both username and public signing key.
+ *
+ * The special wildcard principal `{ username: "*", publicsignkey: "*" }`
+ * is reserved for demo tenant-creation rules and is rejected for all other
+ * system endpoints.
+ */
+export interface SystemAdminPrincipal {
+    username: string;
+    publicsignkey: string;
+}
+export interface RateLimitConfig {
+    windowMs?: number;
+    max?: number;
+}
+/**
+ * Timestamp proxying additionally carries a daily cap, because the constrained
+ * resource is a third party's allowance rather than this server's CPU.
+ */
+export interface TimestampRateLimitConfig extends RateLimitConfig {
+    dailyMax?: number;
+}
+export interface ServerRateLimitsConfig {
+    auth?: RateLimitConfig;
+    sync?: RateLimitConfig;
+    timestamps?: TimestampRateLimitConfig;
+    /**
+     * Per-IP limit for `/system/*`. Defaults to 30/min, which suits occasional
+     * CRUD but is tight for a cluster console: `GET /system/cluster/status`
+     * polled every few seconds across several nodes will hit it. Raise it on
+     * nodes that a monitoring dashboard watches.
+     *
+     * Does not cover `/system/peer/*`, which is server-to-server traffic with its
+     * own, much higher limit.
+     */
+    system?: RateLimitConfig;
+    /**
+     * Coarse per-IP net applied to every route ahead of the tier limiters.
+     * Defaults to the combined sync and auth budgets plus headroom; setting it
+     * below what a tier allows makes it, not the tier, the effective limit.
+     */
+    global?: RateLimitConfig;
+}
+/**
+ * Server-level configuration loaded from config.json.
+ *
+ * The `capabilities` map controls which system admins can call which
+ * endpoints. Keys are `METHOD:PATHPATTERN` rules (e.g. `ALL:/system/*`,
+ * `POST:/system/tenants/company-*`). Values are arrays of principals
+ * allowed to call matching routes.
+ */
+export interface ServerConfig {
+    capabilities: Record<string, SystemAdminPrincipal[]>;
+    rateLimits?: ServerRateLimitsConfig;
+    cluster?: ServerClusterConfig;
+    /**
+     * Join the Iroh network and accept MindooDB sync on ALPN `mindoodb/sync-v5`.
+     * Off when omitted. HTTP listen stays unchanged.
+     */
+    iroh?: ServerIrohConfig;
+}
+/** Optional Iroh listen settings in config.json. Default is disabled. */
+export interface ServerIrohConfig {
+    enabled: boolean;
+    /**
+     * Path to the 32-byte secret key (hex). Relative paths are resolved against
+     * the server data directory. Created on first start when missing.
+     */
+    secretKeyPath?: string;
+}
+/** Written into new `config.json` files. `--update` does not rewrite existing files. */
+export declare const DEFAULT_SERVER_IROH_CONFIG: ServerIrohConfig;
+/** Node-level cluster settings; per-peer settings live in `trusted-servers.json`. */
+export interface ServerClusterConfig {
+    /**
+     * Start peer replication on boot. Equivalent to the `--auto-sync` CLI flag,
+     * which is the more common way to set it.
+     */
+    autoSync?: boolean;
+    /**
+     * This node's mesh role. `spoke` means it does not dial other spokes (the hub
+     * carries that traffic); `hub` and the default `peer` dial everyone.
+     */
+    role?: PeerRole;
+}
+/**
+ * Environment variables used by the server.
+ */
+export declare const ENV_VARS: {
+    /** Password to decrypt server identity private keys and per-tenant keybags */
+    readonly SERVER_PASSWORD: "MINDOODB_SERVER_PASSWORD";
+    /**
+     * Path to a file whose contents are the server password (trimmed). If set, used
+     * instead of {@link ENV_VARS.SERVER_PASSWORD}. Prefer in Docker so the secret is
+     * not stored in the container environment block.
+     */
+    readonly SERVER_PASSWORD_FILE: "MINDOODB_SERVER_PASSWORD_FILE";
+    /**
+     * Optional comma-separated allowlist for /system/* (system admin HTTP surface).
+     * If unset or `*`, any client IP may call /system/* (JWT + capabilities still required).
+     * Supports exact IPv4/IPv6 addresses plus IPv4/IPv6 CIDRs.
+     * Example: `127.0.0.1,::1,10.0.0.0/8,2001:db8::/32`
+     */
+    readonly ADMIN_ALLOWED_IPS: "MINDOODB_ADMIN_ALLOWED_IPS";
+    /**
+     * Express `trust proxy` setting: a hop count (`1` behind Cloudflare, `2` when
+     * nginx also fronts the origin), a comma-separated list of trusted
+     * addresses/CIDRs, `loopback`, or `true`. Unset means no proxy is trusted.
+     *
+     * Every rate limiter keys on `req.ip`; behind a proxy without this, all
+     * clients share the proxy's address and therefore one budget.
+     */
+    readonly TRUST_PROXY: "MINDOODB_TRUST_PROXY";
+    /**
+     * When `true`/`1`, peer URLs may use plaintext http and target
+     * loopback/private/link-local hosts. Off by default so the server cannot be
+     * pointed at internal services (SSRF). Enable only for local development.
+     */
+    readonly ALLOW_INSECURE_SYNC_URLS: "MINDOODB_ALLOW_INSECURE_SYNC_URLS";
+    /**
+     * Comma-separated RFC 3161 Time-Stamping Authorities the proxy at
+     * `POST /:tenantId/timestamps/rfc3161` may contact. Each entry is a built-in
+     * id (`aimoda`, `opentsa`, `freetsa`, ...) or a custom `id=url` pair; suffix
+     * `!` marks the provider qualified and `+` marks its root publicly trusted.
+     *
+     * Example: `aimoda,opentsa,belgium=http://tsa.belgium.be/connect!+`
+     *
+     * Unset disables the proxy. Clients name a provider by id only — a URL from a
+     * client would turn the endpoint into an SSRF gadget.
+     */
+    readonly TSA_PROVIDERS: "MINDOODB_TSA_PROVIDERS";
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/server/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpF;;GAEG;AAEH;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,wCAAwC;IACxC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,kEAAkE;IAClE,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,wBAAwB,EAAE,MAAM,CAAC;IAEjC,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErD,oFAAoF;IACpF,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wCAAwC;IACxC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,yGAAyG;IACzG,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,MAAM,EAAE,YAAY,CAAC;CACtB;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACrD,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,EAAE,gBAGxC,CAAC;AAEF,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ;IACnB,8EAA8E;;IAE9E;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;IAEH;;;;OAIG;;IAEH;;;;;;;;;;OAUG;;CAEK,CAAC"}